Hackday: Albania Walkthrough

Here we are for a walkthrough of the Hackday: Albania and after booting it up in VirtualBox, I ran an NMAP scan that listed only port 22 open and a web server on port 8008. So when we browse to the webserver we are greeted with Mr. Robot...

I have no idea which language that is or what is says so throwing it in google translate gives us: "If I am, I know where to go," and it is in Albanian. Cool.

So, I check the source and there is a comment and I throw that into google translate as well, "Ok, Ok, but not here." Ok, the website is trolling me, ass. So I don't see anything useful from the source so I use dirbuster to see if there is anything else on this server. So, something came back a /js/ directory so I navigated to the page and found this...

The translation is loosely, "Is it right or is directory jerk." So, since /js/ is a directory, I decide to recurse on the /js/ directory with dirbuster and I find /js/external, /js/images/. /js/external has a directory /jquery/ which contains jquery.js and seems to be the external version of the jquery.js file if needed. /js/images has a list of icon sets in different colors. Could be something, but i'm not sure at this point. At this point, I'm kind of stuck so I decide to use another scanner, Nikto, and holy crap things appeared! Why? robots.txt. So I pulled it up on the web server...

A bunch of directories have been disallowed by the robots.txt file, however none of them are trivial to manually type, so I want to find a tool to that will scan these for me. I tried dirbuster and ZAP, but none seemed to do searches based off the robots.txt file. So, I google around and found wfuzz which seemed to do the trick. I had never used wfuzz before, so I fumbled through the usage and eventually saw this on the help file...

Which seemed to be exactly what I wanted (side note: I used wget to get a local copy of the robots.txt file and locally named it robots.txt). Then the results were...

This result is weird, so let's look at it. We found a new page!

So I navigated to /uni.../vulnbank and I see there is a client folder in the vulnbank folder. Again, I follow the path and end up at 'Very Secure Bank' client portal. Looks like some SQL injection is next. After trying some naive attempts at SQL injection, I decided that sqlmap would do this faster and better! Soooo here we go...sqlmap didn't give us great results, but username is vulnerable and it did get us the information that the back end database is MySQL. A good thing to know is that MySQL uses '#' as comments instead of '--' like I was using previously. So, I tried some more naive SQL injection attempts. Nothing worked. COME ON!

Since the username is vulnerable, I figured I'd try and brute force the username with "'#" (single quote, poundsign) appended to the end to trigger the SQL injection vulnerability. I searched kali and google for a good list of usernames and tried some to no avail. Finally, I resorted to the ol' faithful rockyou.txt. It worked. It found jeff and hobson as two users. So I tried both of their usernames appended with '# and they worked!

Ok, there is a submission form on the right side, let's submit a test case and see what happens. Once we submit a test case, we see the message "After we got hacked we our allowing only image files to upload such as jpg, jpeg, bmp etc...". I didn't try and upload an image yet, but obviously I need to try! I'm going to see if I can use the php shell in a jpg trick to get RCE.

AAAAnd boom! Meterpreter shell.

 Now that we have a shell, let's do some recon and escalate privs. First, I like to cat /etc/passwd and look for users...

So we found 'taviso', I decided to also check which groups he is in (meterpreter shell is not very stable but easily obtainable just by refreshing the ticket page in the web app) so I copied it to my local machine and I see the following...

He's in the sudo group! Awesome! So, continuing my reconnaissance, I realized I overlooked something about the /etc/passwd file...it's world writable. what.

Well, that makes everything much easier then. I decided to add my own root user.

 First, I created a password....it was 'password' as you can see. Next, I created the new user 'fabio'.

Since the file was editable, I simply said 'fabio' had a UID of 0 and a GID of 0, which means root privs!

Lastly, all I had to do was switch users to fabio...

This included getting TTY using python3 on the system. Now that I have root privs, let's finish this challenge.

There we go. I hope this helped you out! I realize there are many walkthroughs for this challenge and I hope mine gave you something you might not have received elsewhere while you were learning from this challenge. Full Disclosure: I had issues with meterpreter and getting running the 'shell' command inside of meterpreter because the VM had run out of memory. If you find you're running into a similar issue, try restarting the VM and it should fix that issue.

-Hack Responsibly. Hack Professionally.

A Pretty Cewl Post

Hello everyone,

I have been MIA for quite awhile so as a welcome back post, let's talk about a CEWL tool. Cewl is a custom wordlist generator that comes standard with Kali. The idea is to use this tool to create a wordlist from a website that could be used for cracking passwords. In addition, this tool can also grab email addresses to be used as usernames. So, let's walk through this tool!

Before we start, this post is for educational purposes only and I, as the author, do not condone the usage of this tool for any malicious purposes. In addition, this post does not reflect the views of any of the author's past, present, or future employers. 

The basic usage of Cewl looks like this:

Just from typing in www.google.com, cewl produced a list of interesting words that could be used as passwords. So what else can we do? We could rank the most commonly found words.

Let's see what cewl can really do...let's see the counts of words, let's write the results to a file, let's find any emails lying around, and let's parse any metadata for www.sans.org (Google didn't return any interesting results...lame).

As you can see I had to try a couple times to get a good example to show you guys but, from this information we can see some keywords usable for passwords (although not very good in my opinion but, there are better ones further down in the list). We also got some emails; we can use these to seed reconnaissance searches, or use as 'from' addresses for a phishing campaign. Lastly, we know someone named 'Lynn' worked with some of the documents Cewl was able to find.

Reconnaissance is not a sexy part of hacking but, the more information we can gather the better campaign we will have. When gathering information make sure you are professional; some information when gathered and put together can be quite sensitive to people, companies, or other concerned parties.

Password Cracking: Hashcat

For hackers and security analysts that crack passwords, make sure you learn to use hashcat too! I normally use JTR (John the Ripper aka John) but, a friend of mine pointed out that hashcat is also a very viable tool. He insists that it's better than john but, I have not tested them nor am I saying one is better than the other. They are both password cracking tools and any great hacker/security analyst should be able to use either proficiently.

To get a basic understanding of how hashcat works, check out these posts*:

• http://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-passwords-part-3-using-hashcat-0156543/
• http://hashcat.net/wiki/
• https://www.samsclass.info/123/proj10/p12-hashcat.htm

Now, for both my and my readers' benefit, I am going to walk through using this tool to crack passwords.

First, I am going to create a new user so I can crack the password. 

Now, I am going to follow the instructions of the previous articles to crack this password (it's fairly simple to start ;) )

I put my hashcat1 user line from /etc/shadow into the hash.lst file. I checked the hash function and it is SHA512.

Now, I will run the same commands to crack this password.

It worked in THREE seconds. Now, to be fair, it was a dictionary word and I used the rockyou dictionary to crack it. Let's make it a little more difficult for hashcat. I created a password that uses uppercase and lowercase. Let's see how hashcat does.

Hashcat allows for 'masks' which allow you to specify which types of characters will be where in the password. As we can see, I have an upper case letter, followed by 4 lower case letters, an upper case letter, followed by 5 lower case letters. Two words, put together, first letter capitalized. These masks allow for very specific guessing of passwords and drastically reduces the keyspace that hashcat needs to guess. For example, if you knew that I only used upper and lower case and that it was 11 characters long, the keyspace is 52^11 ~ 7.5*10^18. By specifying a mask, we reduce the keyspace to 26^11 ~ 3.6*10^15. The keyspace becomes approximately 2000 times smaller. So if we go by hashcat's output, 10 years would become 20,000 years. This is a great example at how computationally expensive cracking passwords can get just by adding one more letter or one more set of characters (numbers, upper case, lower case, special).

Hashcat allows for masks, dictionary files, combinations of dictionary words from files, permutations of words from a dictionary, hybrid attacks, table-lookups, and rule-based attacks. I recommend looking at hashcat's wiki to understand the more complex attacks but they can get pretty specific and the more you know about the potential password, the easier it will be to crack.  

Lastly, if anyone is looking for unsolicited advice, I always recommend using a passphrase rather than a password. 'ILoveMyCatSoMuch!0906' which could be a true statement (easy to remember), punctuation that emphasizes your true statement, and your cat's birthday (in this case) makes a very secure password that incorporates all four categories of characters, 21 character length, and it's easy to remember because it's a true statement about yourself. Now, like everything else, this is exploitable. Specifically, this is subject to Social Engineering. This password could be guessed however, the attacker would have to know you love your cat, know which letters you capitalized, which order each word goes in, and which order the sentence, punctuation, and birthday go in (for example, !0906ILoveMyCatALot, MyCatFluffyWasBorn0906, 123MyCatIsSoAwesome?!?! are all great passwords that revolve around an important part of your life.

There is no silver bullet to password cracking but hashcat is a very powerful password cracking tool and I'm very happy I decided to add it to my arsenal of hacking tools. Look it up, learn it, be great!



*These posts are not in any particular order, I am not receiving any compensation from anyone to post these sites, and these sites do not necessarily reflect my opinion, my employer's opinion, nor any certification bodies' opinions of which I hold one or more of their certificates.