Every company invests a percentage of its budget towards technology. Security solutions includes tooling for endpoint security, network security, cloud security, data security, and identity access management. Not every solution will be covered in this post, and I will not go into vendor specifics. In no order of priority, every company should have these 10 IT Systems in place.

EDR/AntiVirus

Endpoints are laptops, desktops, servers, and virtual machines. They are often the first to get compromised and all need to be secured from bad actors. This is where AntiVirus and Endpoint Defender Response (EDR) solutions come in. AntiVirus offers real-time malware protection, blocking known threats and alerting analysts of malicious activity. EDR solutions can identify suspicious behavior and enable analysts to respond to a security incident.

How many times a month do you read about computers being compromised and spreading ransomware throughout a company? An antivirus solution could have prevented the malware from running in the first place. EDR software could have detected the suspicious behavior and quarantined the device from communicating with the rest of the network, preventing the malware from spreading.

It cannot be emphasized enough how crucial it is to deploy software on endpoints that can monitor, protect, and prevent attacks.

Although Microsoft has improved its Windows Defender product, it is the first hurdle any attacker is going to clear for creating malware. It is enabled by default on every Windows computer after all.

SIEM – Logging

The Security Information Event Management (SIEM) collects system, application, cloud, and networking logs in a central location. Analysts can investigate alerts, visualize data, and monitor their IT environments.

This provides visibility for the Security Operations Center (SOC) to perform their investigations. For example, an employee downloads a malicious file from a website, the malware elevates its privileges to admin and starts connecting to a botnet. A SIEM can log all this information and correlate these events for an analyst to investigate which websites the employee visited, what the malware is doing on the machine, and where its communicating to.

VPN – Virtual Private Network

No, I am not talking about consumer VPN products you might have heard from your favorite influencer.

With the rise of remote working, employees need a Virtual Private Network to securely connect to the office network to work on their projects. An enterprise VPN is going to be a split tunnel VPN that allows internal routing to go through, and external access through the employee’s own Internet Service Provider. Consumer-based VPNs are full tunnel routing all traffic through the VPN for security and encryption.

VPNs are the best way to access resources remotely without having to expose assets to the public internet. VPN gateways, clients, and infrastructure must be protected heavily, as they could allow anyone access to the corporate network.

Proxy – Internet Traffic Inspection

Another key point is once a device or user is connected, anything can happen on a network. It is important to monitor the traffic ingress and egress; and determine if it is malicious/inappropriate usage. This is the best way to block traffic that is not meant to go out of your corporate environment. NSFW or malicious.

Segmentation & Firewall

Typically home networks are flat, meaning that once a device is connected, it can communicate to every other device on the network. With the spirit of least privilege access, organizations should never have a flat network. If devices do not need it, they should not access different network segments.

The best way to segment networks is by using Virtual LANs (VLANs) and Firewalls. VLANs will separate where on the network a device or application will communicate. Firewalls will allow or block cross-network communication when talking to different parts of the network.

Generally speaking, networks should be separated by intranet, DMZ, extranet, production separated from development, and BYOD/IoT devices to be their own isolated network.

Backups

It’s always good to have backups of systems. Whether it is a system image or an application configuration. Backups should be taken regularly and are essential for dealing with a ransomware incident. Everybody needs a backup, and you will be glad you backed it up before things went wrong.

To minimize the risk of data loss, follow the 3-2-1 backup rule. Keep 3 copies of your data, stored on 2 different types of media, with 1 copy kept off-site.

Multifactor – Authentication

Every month, there is a new article about a leak of billions of passwords hitting the internet. Here’s an article about that happening recently.

As cybersecurity professionals, we get it, passwords alone are no longer secure enough to protect accounts. Multifactor authentication provides security by checking that the user authenticating has their smartphone or biometrics. In today’s threat landscape, MFA should not rely on sending a text message to phone numbers due to attacks like SIM swapping. MFA should be done with a mobile authenticator app or a device like a yubikey.

Email Security

Email is the lifeblood of professional communication over the last 25 years on the Internet. Everyone online has an email address.

Not every emailer has their recipients’ best interests in mind. Any IT security-related exam will tell you all the various Phishing techniques that can be done through email. So it is imperative to have good technologies in place to block suspicious looking emails, including those that contain suspicious attachments.

Technology is not the only solution to this problem. The best way to defend against email based attacks is training. Employees should know the signs of a phishing attack and learn the processes of reporting it to the IT department.

Patch Management

What good are securing servers and workstations if they are not up to date on security patching? New exploits come out all the time. For example, a JavaScript framework React had a critical vulnerability named React2Shell, which allowed attackers to remotely execute code on any affected machine with an HTTP request. Updating software is the best way to avoid being vulnerable.

Microsoft releases a patch for Microsoft Windows machines on every second Tuesday of the month. Linux does not have a fixed timeline for releaseing patches, they are released whenever they become available.

Vulnerability Scanning

Lastly, vulnerability scanners can bring attention to analysts what technologies should be addressed, the priority it should be fixed in, and to catch concerns early before they become an issue. It is too common for organizations to keep old devices around because they run an applciation that stopped receiving updated years ago. Vulnerability scanners can call out these old devices and justify that they reached the end of their lifecycle.

As mentioned before, patch management is a good way to knock out the easy wins. However, some applications or software require a more in depth look to remediate the vulnerabilities.

The post 10 Information Technology Systems Every Company Should Have appeared first on Eric Logan written by eric.

Introduction

TryHackMe: Thompson was first released for the FIT and bsides Guatemala CTF. To get right into it, Thompson’s server is running a default installation of Tomcat, with default administrator credentials. We gain initial access to the web server by uploading a malicious war file. Then misuse file permissions to read protected files.

Information Gathering

In a CTF-like fashion, there is no prior information about this engagement. The goal of this room is to find, get access, and read the user.txt and root.txt flags.

The Nmap scan indicates that there are three ports open. The services running are SSH, Apache Jserver, and Apache Tomcat.

By opening the browser, we navigate the website hosting Tomcat on port 8080. This is a default installation of Apache Tomcat version 8.5.5. Tomcat is an open-source Java web application server.

Have a look around on the Apache Tomcat dashboard. The Server Status displays general server information, system resources, and service status. Manager App provides basic functionality to deploy web apps. The Host Manager’s purpose is to deploy, configure, and manage virtual hosts. You can access these services by using Tomcat’s default credentials, tomcat:s3cret.

Exploitation

Welcome to the Tomcat Web Application Manager for all your web app needs.

The file type we use to deploy a web app is a war file. War stands for Web Application Resource and it is used to package web applications that we can deploy on any Servlet/JSP container.

Using the payload above, we can craft a malicious war file named shell3.war. This is a reverse TCP shell, meaning we can upload the file and have it connect back to our attacking machine. msfvenom is a repository of payloads that can be crafted into many extensible files.

Run Metasploit’s multi-handler module and launch the malicious payload by opening it on your web browser. The shell will connect to our machine, and we now have access to the victim server.

Post Exploitation

Let’s get our bearing now that we are on the machine. We can see that we are the tomcat user of the system and in the root directory. The user.txt file lives in Jack’s home directory, and we have permission to read the file.

Looking at the rest of the contents in Jack’s home directory, we see a file named id.sh. The purpose of this file is to execute the id command and output it into the test.txt file.

Let’s take a look closer at the highlight portion above. We can see that the file’s permissions allow anyone to read, write, and execute this file. Meaning that we can potentially change the contents of the file.

With the following bash command, we can change the contents of the id.sh file without changing any of the permissions or ownership of the file.

echo "cat /root/root.txt > test.txt" > id.sh

Finally, we can cat out the test.txt file and find the root.txt file contents inside of it!

Conclusion

To conclude, TryHackMe: Thompson presented a nice challenge for FIT and bsides Guatemala CTFs. In my experience, gaining initial access to Tomcat’s system was trivial but I enjoyed misusing file permissions to read protected files. Running web applications like Tomcat with default credentials is asking for your system to get owned!

The post TryHackMe: Thompson appeared first on Eric Logan written by eric.

Introduction

Apache Tomcat is an open-source web server that can deploy and run Java-based web applications. In 2020 a vulnerability dubbed GhostCat was discovered, allowing attackers to read or include files from the host system. In this room, TryHackMe tomghost, your goal is to use the GhostCat exploit to read files, gain user access, decrypt PGP files, and escalate to root privileges.

Information Gathering

As always, we use our trusty Nmap tool to scan the ports to see what services are running on this machine.

It looks like port 8080 is running the vulnerable Apache Tomcat version 9.0.30.

Exploitation

Tomcat version 9.0.30 has a vulnerability with Apache JServ Protocol (AJP). CVE-2020-1938 allows attackers the ability to read and include files on the server because “Tomcat treats AJP connections as having higher trust”.

Somebody already wrote an exploit for this vulnerability. After downloading this, we can run the Python script and point it to the web server.

We can see here that there is something hosted on /asdf. It’s an XML file with metadata included. There is also something in the description that looks like login credentials.

Post Exploitation

Returning to our Nmap scan, we can see that SSH is open on this machine. Let’s see if we can log into the skyfuck account.

Changing the directory to Merlin’s home directory we can find the user.txt flag.

Returning to our home directory, we can see a couple of files called credential.pgp and tryhackme.asc. Using a tool like gpg2john we can convert tryhackme.asc into a format that can be interpreted by johntheripper.

Johntheripper, in combination with the rockyou.txt dictionary file, we can dictionary brute-force the password for the .asc file.

Using gpg import the tryhackme.asc file and enter the password alexandru. It looks like it is an OpenPGP secret key for stuxnet@tryhackme.com

We can then decrypt the credential.pgp file and see Merlin’s login information.

After logging into Merlin’s account we still do not have access to the root system. However, after running sudo -l we can see that Merlin can run root permissions on the command zip.

Using gtfobins, we can see the binary allowing us to run superuser and drop escalated privileged access to the system.

Finally, we run the command. Allowing us to be root user.

We can finally navigate to the root directory and read out the root.txt flag.

Conclusion

In conclusion, these exploits only existed because the software inherently trusted these AJP files. Software developers will have to use caution on when to trust anything involving inputs as they may become compromised.

The post TryHackMe: tomghost appeared first on Eric Logan written by eric.

Introduction

TryHackMe: LazyAdmin outlines a story as old as time. Outdated software, exposed MySQL database backups, and easy to crack passwords that spell disaster for our lazy Linux administrator. Learn what could go wrong when these elements are combined below.

Information Gathering

To get started, scan for the open ports and services running on those ports. It looks like SSH and a web server are running on this server. We can use a tool like gobuster, to brute force if there are any open directories.

Going to http://10.10.222.75/content we were met with SweetRice installed webpage. SweetRice is an open-source website management system that creates common blogs or websites.

I could not find what version of SweetRice this website was running by inspecting the website’s source code.

Exploitation

Sometimes it is best to take a shot in the dark when trying to exploit a machine. SweetRice version 1.5.1 has a vulnerability that exposes their MySQL backup file for anyone to come in and download it.

Going to the URL, we can find a MySQL backup file from October 29, 2019.

Going through the MySQL file we can see the users of the website. There is a user manager with a convenient MD5 password hash value. We can run this hash through hashcat and crack the password to enter it into SweetRice’s admin portal.

Easy peasy, the administrator chose a weak password!

There are several ways to find the SweetRice admin portal. I found it on exploit-db when looking at SweetRice’s arbitrary file upload exploit. Alternatively, it could be found by recursively brute-forcing all the directories with dirbuster or looking through SweetRice’s documentation. All in all, the admin login page is located at /as/.

Using the username and password we just cracked, we can log into the SweetRice admin portal. Admins can Post, Change settings, and upload files.

We are interested in uploading files. Instead of using the arbitrary file upload exploit, I decided to use the reverse PHP shell from pentestmonkey. They’ll both get a shell on the web server.

Post Exploitation

After connecting to the web server. Head to the home directory and find a user named itguy and read the user.txt flag.

Finally, to escalate our privileges to the root user run the command sudo -l. It will display which commands can run as a super user that does not need a password.

It looks like we can run Perl as root on the itguy’s backup.pl file.

This is pretty straightforward. According to gtfobins, all we will need to run the superuser do Perl command using the backup.pl file and it will run as root. Unfortunately, we only have read and execute privileges on the backup.pl file. So let’s read the file and see what backup.pl even does.

It looks like backup.pl runs the script of copy.sh. When going over to the /etc/ directory it looks like we have read, write, and execute permissions on the copy.sh file. The plan is to overwrite the file with a reverse shell, run the backup.pl as root, and connect the server to our client as root.

Payload all the things is an open-source resource with hundreds of ways to create a reverse shell. I first tried the netcat traditional commands. However, after running them it said that the version of netcat the server was using was netcat-openbsd package.

Running the command exactly how it is written out in the sudo -l output is the only way for the terminal not to prompt with password input.

Lastly, launching another shell on my attacker machine and running the Perl command, I became root. It’s now as easy as going to the root directory and reading the root.txt flag.

Conclusion

This is a scenario that would most certainly happen in the real world. It doesn’t necessarily have to come down to laziness, projects come and go. IT staff need to be aware when this happens and take the necessary steps to avoid running vulnerable software on their systems.

The post TryHackMe: LazyAdmin appeared first on Eric Logan written by eric.

Introduction

It looks like our bragging brought the attention of Spike Spiegal and his crew, the TryHackMe: Bounty Hacker. They need us to hack and gain root in this system no questions asked. With some enumeration and an anonymous FTP account, we can crack the SSH passphrase to become a user on the system and exploit tar to escalate our privileges to root.

Information Gathering

Like any other challenge, I want to get the lay of the land. We are looking for any open ports and what kind of services they are running.

Nice! It looks like they left an anonymous account enabled on their FTP server.

These files look interesting: locks.txt and task.txt. I will just go ahead and download that onto my system and give them a read.

Score! This file looks like it contains passwords. Not sure which is the right one but let us check out the task.txt for further clues.

Now, if you have never seen the show there is some context to the message. Vicious, the main antagonist in Cowboy Bebop and Red Eye, is an illegal performance-enhancing drug. Lin is one of Vicious’s henchmen and I would be willing to bet that he was the one that set up this server.

Going back to our Nmap scan, we can see that SSH is running on the machine. Using a tool like Hydra, we can use the passwords found in locks.txt and brute force our way into Lin’s account.

And just like that, we have Lin’s login information!

Exploitation

The user.txt flag is found immediately in lin’s home directory. The last thing we need to do is escalate our privileges and read the root.txt flag.

Post Exploitation

Sudo -l allows us to list the allowed commands the user can invoke with root privileges.

The tar command is used to compress a group of files into an archive. Let’s check out GTFObins to see if there are any commands we can leverage to our advantage.

There is a couple of things going on in this command. First, tar is creating an archived file at /dev/null. Since it is running in super user do, spawning a bash shell at checkpoint 1 makes it possible to escalate our privileges to root.

And there you have it! The root.txt flag file is easy to find in the root directory.

Conclusion

In conclusion, this TryHackMe room earns its easy badge. Enumeration and privilege escalation was pretty straightforward and a piece of cake for this braggadocious hacker.

The post TryHackMe: Bounty Hacker appeared first on Eric Logan written by eric.

Introduction

RootMe is a beginner-level capture-the-flag challenge from TryHackMe. The tasks are arranged to help newcomers through the processes of hacking this machine. It starts with enumerating the system by scanning for open ports and directories. Next, we will bypass the website’s upload restrictions and gain a reverse shell on the webserver. Finally, we will abuse SUID permissions to escalate user privileges to root.

Information Gathering

There is not a lot of information to be gathered during the information-gathering phase. Almost all of the reconnaissance task questions can be answered through Nmap.

There are 2 open ports on this machine. This Ubuntu server is using Apache version 2.4.29 and is running SSH on port 22.

The last thing to find is if there are any hidden directories on the Apache webserver.

Gobuster found a couple of directories, but the ones of importance are /panel and /uploads.

Exploitation

Let’s check out the /panel/ directory.

It looks like we can upload any file we want to it. Let’s try uploading a PHP reverse shell. “A reverse shell is a shell session established on a connection that is initiated from a remote machine, not from the attacker’s host.”

It looks like the webserver does not allow PHP files to be uploaded to it. “Developers may blacklist specific file extensions and prevent users from uploading files with extensions that are considered dangerous.”

We can try to bypass the file upload blacklist by changing the extension of the file. For example, I have changed the file from reverse.php to reverse.php.php5.

The file has been successfully uploaded! We can even check out the /uploads/ directory to confirm that the file has been uploaded.

We can use the netcat tool to listen for incoming IP connections to port 4444. After opening the /uploads/reverse.php.php5 file on the web browser it makes the connection.

We can use the find command to search for files on the system. Since we know the file we are searching for is named user.txt we can use the -name flag to search for it. The 2> /dev/null at the end of the command make sure that nothing else is outputted to the command line.

Post Exploitation

Before this challenge, I had no idea what SUID permissions were. “It is special file permission for executable files. This enables other users to run the file with the effective permissions of the file owner.”

The question hint gives the command find / -user root -perm /4000. This command finds files and directories, starting at directory /, displays files owned by root, and with permissions set to 4000. With permissions set to 4000, a user can set the setuid bit and if the file is owned by root, they can escalate their privileges to root. If a user executes that program it will do so as if they are the user root instead of themselves.

One that sticks out to us is the /usr/bin/python file. We might be able to execute python code that will set the SUID bit and escalate our privileges to root.

This python code should spawn an interactive bash shell as root.

Just like that, after changing our directory to the /usr/bin and executing the python code we are root. The root.txt file is found in the root directory.

Conclusion

In conclusion, RootMe was a fun challenge with a lot to learn from. We enumerated the services running on the machine, bypassed file upload restrictions, and escalated our privileges through setting SUID permissions. File permissions can cause unauthorized users to have access to resources that they were not intended to have.

The post TryHackMe: RootMe appeared first on Eric Logan written by eric.

Introduction

Kiba is a beginner-level challenge from TryHackMe. The point of this challenge is to “Identify the critical security flaw in the data visualization dashboard, that allows execute remote code execution.” By identifying the vulnerable service, and their public CVE’s, we can find an exploit that will give us a foothold onto the server and abuse Linux capabilities to escalate privileges to root.

Information Gathering

The first question of this challenge: What is the vulnerability that is specific to programming languages with prototype-based inheritance? I did not know the answer, but I did know where to find it. After a quick Google search, we got the answer. It is Prototype pollution.

To start this challenge, we will use Nmap to scan the server for its open ports.

On Port 5601, we can see that an application named Kibana is running on the server. Kibana provides “search and data visualization capabilities for data indexed in Elasticsearch… It also acts as the user interface for monitoring, managing, and securing an Elastic Stack cluster“.

The answer to the second question can be found hidden within the website’s source code. The version of Kibana they are running is version number 6.5.4.

Now that we know the server is running Kibana version 6.5.4 it’s time to do some research and find if there are any public CVEs related to it.

Published on several large cybersecurity blogs, CVE-2019-7609 is a vulnerability that allows for remote code to be executed on servers running Kibana version 6.5.4. Luckily, one of the articles that posted about it links to a GitHub repository containing an exploit script.

Exploitation

All I had to do was download the GitHub repository, set up a netcat listener on port 4444, and run the script.

Post Exploitation

Finding the user.txt flag was trivial, all I had to do was change my directory to /home/Kiba and use the command cat user.txt.

Questions 5 and 6 give us a direction we can take to gain root privileges. Question 5 does not need to be answered, but it should be noted. Question 6: How would you recursively list all of these capabilities? The getcap -r / command will recursively examine file capabilities within the directory.

When running this command in the Kiba home directory, we can see that python3 = cap_setuid+ep. This means that I manipulate my user identifier to any number used to identify the user to the system and to determine which system resources I have access to.

This snippet from GTFObins allows me to use python to escalate my privileges to root by setting my uid to 0.

Now that we have rooted the box, we can change to the root directory and read the root.txt flag.

Conclusion

In conclusion, this was a really fun and straightforward challenge to complete. The questions were able to guide me in the right direction without giving too much away. Through this, I learned about Linux capabilities and how to exploit its privileges.

The post TryHackMe: Kiba appeared first on Eric Logan written by eric.

TryHackMe: GamingServer is an easy boot2root challenge on TryHackMe. This challenge simulates a “gaming server built by amateurs with no experience in web development.” With an exposed RSA Private Key, we can gain a foothold onto the server and take advantage of lxd, a development system, to escalate privileges to root.

Information Gathering

As always, to start the information gathering phase of this challenge, we will use Nmap to scan all ports at the GamingServer’s IP address.

On this Ubuntu Linux machine, 2 out of the 65535 ports are open. Port 22 is running SSH version OpenSSH 7.6p1 and port 80 is running Apache 2.4.29. By going to this IP address in our browser, we can see that the apache web server is hosting a website called Draagan.

It looks like the gaming server’s website is still under construction.

Going to the browser’s source code, we can see that the developers left a comment for John. We can conclude that John is the user account we should be targeting during this assessment.

The overall functionality of this website is limited and does not give us an ample foothold onto the server. Therefore, another directory will give us the information we need to gain access to this machine.

Using a tool like Gobuster, we can enumerate the directories and files on the webserver. The results above show that the /uploads and /secret directories could hold valuable information.

Unless you want to read the hacker manifesto by The Mentor or look at a picture of a shocked Beaker from the Muppets, there isn’t any particular value from the manifesto.txt or meme.jpg files. However, the file of interest is the dict.lst file a dictionary list that contains common passwords.

The /secret directory only has one file named secretKey. The secretKey refers to an RSA Private Key which can be used to authenticate SSH access.

Exploitation

To start, we will copy the RSA private key into a file called id_rsa and permit it 600. Then will use the tool ssh2john.py to convert the id_rsa file into a format that John the Ripper will be able to crack. Finally, using the dict.lst we copied from the /uploads directory, we can then crack the RSA Private Key passphrase.

After a couple of minutes, the RSA Private Key passphrase has been cracked, and the passphrase is letmein.

Using the private key file, id_rsa, we can then use the id_rsa file to ssh into the machine as John. That’s where we can find the user.txt flag a5c2ff8b9c2e3d4fe9d4ff2f1a5a6e7e.

Post Exploitation

The last thing we need to do to complete this challenge is escalating our privileges to root and find the root.txt flag.

Unlike other privilege escalation challenges, the sudo -l command does not bear much information because we do not have john’s password.

However, we can upload a tool called linpeas.sh onto the server to search for possible paths to escalate privileges on Linux/Unix*/MacOS hosts. LinPEAS, Linux Privilege Escalation Awesome Script, is a great tool to automate the privilege escalation process.

As the legend states, anything with a highlighted RED/YELLOW text indicates it is 95% a Privilege escalation vector. LXD, highlighted above, is an open-source container management extension for Linux Containers (LXC).

The LinPeas README file states that all of LinPeas’ checks are explained in book.hacktricks.xyz. This website has instructions on how to escalate our privileges to root because we are a part of lxd/lxc group.

Run the first block of commands on your host machine and then upload it to the victim server.

After uploading the lxd.tar.xz and rootfs.squashfs file, we add the image, create a container and add root path, and finally execute the container to become root.

The last thing to do is to find the root.txt flag.

It took some time but the root directory was accessible in the /mnt directory. Revealing that the root.txt flag is 2e337b8c9f3aff0c2b3e8d4e6a7c88fc.

Conclusion

In conclusion, this challenge was really fun and seemed more realistic than previous challenges. People upload their RSA private keys in directories they think people won’t find all the time. Like I said above, it took some time to find the root flag but it was better than just rushing over to the /root directory and finding it there.

The post TryHackMe: GamingServer appeared first on Eric Logan written by eric.

Brute It is a beginner-friendly challenge by TryHackMe. It is separated into three tasks reconnaissance, getting a shell, and privilege escalation with questions along the way to guide you throughout the engagement. It is a bit more hand-holding but was a fun challenge nonetheless. This box requires you to brute force, crack hashes, and escalate privileges to root.

Task 2 – Reconnaissance

The reconnaissance phase of this challenge is equivalent to gathering information on an assessment. Information such as how many ports are open, what services they are running, and what operating system it uses is important to determine how to attack this system. Other than discovering the web server’s hidden directories, most of the information can be gathered through Nmap.

To start off the reconnaissance phase, we run Nmap to scan against all the ports, 1-65535. Nmap, short for network mapper, “is used to discover hosts and services on a computer network by sending packets and analyzing the responses.“

The highlighted sections of the scan will be used to answer the questions. This Ubuntu Linux machine has 2 open ports. Port 22 is running SSH version OpenSSH 7.6p1 and port 80 is running HTTP Apache web server version 2.4.29.

All there is left to do is to find the hidden directory running on the server’s website.

Tools like Gobuster and Dirbuster use wordlists to enumerate directories and files. The /admin directory gives us a response status code of 301, meaning it has moved permanently, which will redirect us to another page. As one can guess, by going to this page we are greeted with an admin login panel.

Task 3 – Getting a shell

Now that the necessary information has been gathered, it is time to get a shell on this system. To start, we will need to brute force the username and password of the admin panel. As well as crack John’s RSA Private Key phrase. Finally, we will enumerate the system for the challenge’s Web and user.txt flags.

When going to the /admin/ directory, there is a login screen needing a username and password.

By using a tool like Hydra, we can brute force the login credentials to the admin account. The web browser’s built-in dev tools can analyze the traffic being sent to and from the server. Every time we log in we send a post request to /admin/index.php with the user and pass in the body parameters. We add Username or password invalid at the end of the command to know if a login has been successful.

After going through thousands of common passwords, we can see that the admin uses the password xavier to log in. The /admin/panel directory has the web flag THM{brut3_f0rce_is_e4sy} as well as a link to John’s RSA Private Key.

The admin of this system has set up SSH key-based authentication. Key-based authentication “uses cryptography to ensure secure connections… The private key should be kept secret and is used to connect to machines that have the matching public key“. By cracking the private key’s passphrase, we will be able to SSH into the system as John.

ssh2john.py is a program that will convert the id_rsa file into a format that John the Ripper will be able to crack. With a file like rockyou.txt, filled with millions of common passwords, we can find the password by performing a dictionary attack against the id_rsa.hash file. The password associated with the SSH Private Key is rockinroll.

After changing the id_rsa’s file permissions to 600, we can use SSH’s identity option to log in as John. Found in John’s home directory is the user.txt file containing the flag THM{a_password_is_not_a_barrier}.

Task 4 – Privilege Escalation

The last thing we need to do on this system is to escalate our privileges to root. By becoming root, we have effectively taken over this system and owned it.

Sudo -l lists commands John can use with root privileges without being root. The cat command can read data from files but because John can run it as root “it may be used to do privileged reads or disclose files outside a restricted file system”.

This means that our user John has the ability to read the root.txt flag. All we need to do is navigate to the root directory to read it. The root.txt flag is THM{pr1v1l3g3_3sc4l4t10n}.

Reading any file on the system is nice, but it does not mean we owned this system entirely. I collected the /etc/passwd and /etc/shadow files off the system to get the root’s password. These files are the operating system’s authentication schemes and store the operating system’s login information.

Before we use John the Ripper to find out the root’s password we need to put it in a format that john will understand. To do this we will use the unshadow command. unshadow passwd.txt shadow.txt > pass.txt

Having John the Ripper work its magic for a couple of minutes, we can see that the root’s password is football. We will then be able to switch users and become root.

Conclusion

In conclusion, this is a nice follow-up to the Brooklyn Nine Nine. This box required various types of brute force attacks. The admin panel credentials, the RSA key, and the root password all had to be brute forced to complete this challenge. It just goes to show that passwords are not the end all be all to security.

The post TryHackMe: Brute It appeared first on Eric Logan written by eric.

TryHackMe: Brooklyn Nine Nine is a beginner-level boot2root style challenge. The goal of the challenge is to find and read the contents of the user.txt and root.txt files located on the machine. Brooklyn Nine Nine shows the importance of information gathering and how to use it to gain access to a system. It also highlights the importance of avoiding weak passwords. As noted by the challenge’s author, there are two main intended ways to complete this room. This write-up goes through one of the solutions.

Information Gathering

After booting the machine up, I use Nmap to scan every port at the IP address.

Looking at these results, we see that the ftp port is open and allows anonymous ftp login. Highlighted above, the user anonymous has read write privileges to the file note_to_jake.txt.

Exploitation

Using the command ftp 10.10.207.118 and putting anonymous as our username, any password is valid and can log me in. After logging in, we can see that there is a note_to_jake.txt file waiting for us. The command get note_to_jake.txt will then download the file to our client.

Amy is letting us know that Jake has a weak password. We can then use a tool called Hydra to brute force Jake’s ssh password.

By setting the username and using the rockyou.txt password list we can launch a dictionary attack against the server’s ssh protocol. The results show that Jake’s password is 987654321.

We can ssh to the server by using Jake’s credentials.

Post Exploitation

By knowing which directory we are in on the system, we can start having a look around. By changing to Holt’s directory we can locate and read the user.txt document which hold’s the user flag of this challenge.

Now it is time to use privilege leverage escalation techniques to become root on the system. The sudo -l command lists the allowed (and forbidden) commands for the invoking user.

As we can see, the user Jake can invoke sudo commands by using the less command. Going to gtfobins we can find a section that tells us how we can use this command to become root.

And there you have it. We now have root access over this machine and can change the root directory to read the root.txt flag.

Conclusion

Overall, this was a pretty straightforward challenge. I would recommend it to new hackers as their first challenge on TryHackMe. Doing this challenge has taught me about network mapping, brute force, and Linux privilege escalation.

The post TryHackMe: Brooklyn Nine Nine appeared first on Eric Logan written by eric.