24Aug 2022 by admin

TryHackMe – VulnNet Roasted

TryHackMe
Greetings, everyone! In today's post, we'll be checking out the room VulnNet Roasted in the TryHackMe platform. So without further ado, let's jump right in! We'll start off with our trusty Nmap scan. We'll use the following flags: -A for scripting-p- for scanning all ports-T4 to speed up the scan-Pn to disable ping Nmap scan of 10.10.81.207 Looks like this system is a Domain Controller! Looking at the open ports, immediately we notice that port 445 is listed, which is SMB. We'll begin here with our enumeration. We'll use a tool called SMBClient to see what shares are listed: smbclient to list out shares Now that we know the shares, our next step is to see if we can connect to any of them without any credentials. The last two…
Read More
28Feb 2022 by admin

TryHackMe – ColddBox

Hacking, privilege escalation, shell, TryHackMe
Greetings everyone! We're back with another box; this one is called ColddBox that is on the TryHackMe platform! So let's jump right into it! We'll start off with an Nmap scan to see what ports we have open and what services are running on them. To do this, we'll use this command: nmap -A -p- -T4 10.10.150.55 Port 80 is open so let's begin by browsing to the website: We know from the data returned in our nmap scan that this is a WordPress site. Let's do some directory busting using a tool called gobuster: Hmm looks like there is a rather interesting directory called "hidden". Let's check it out! We are greeted with a message! Apparently someone named C0ldd is being asked to send Hugo his new password. Looking…
Read More
02Apr 2021 by admin

CyberSecLabs – Secret

Hacking, privilege escalation, smb, vulnerability, Windows
Greetings everyone and happy Friday! Welcome back to another walkthrough of a system hosted on the CyberSecLabs platform! The machine we'll be attacking today is called Secret, so let's jump right in! We'll start off by scanning the host with Nmap: So we have quite a bit of ports open here, and a lot to work with! Right off the bat, we should be focused on port 445 which is SMB. Let's start probing at that port to see if we can find any additional information. We'll start by using a tool called smbclient to enumerate possible shares. We can do this by specifying the "-L" switch: When prompted for a password, we can simply press enter to see if we can list the shares without providing any credentials. For…
Read More
25Mar 2021 by admin

CyberSecLabs – Unattended

Hacking, http, metasploit, meterpreter, privilege escalation, vulnerability, Windows
Greetings everyone! Today, we'll be attacking a machine called Unattended on a platform called CyberSecLabs! So without further ado, let's jump right into it! As always, we'll start off with our trusty nmap scan! So we see a few ports open that we can start probing. We may as well start off by checking port 80 and see what we can find there! Let's plug the IP address into a web browser and see what we're greeted with. Under "Server Information", we see it displays HttpFileServer 2.3 (also noted in our nmap scan!). Let's click on it and see where it brings us. Interesting! Let's see if there are any vulnerabilities we can exploit pertaining to Rejetto. Time to fire up Metasploit! Perfect! We have our exploit selected! But let's…
Read More
14Nov 2020 by admin

TryHackMe – Pokemon

http, pokemon, privilege escalation, ssh, TryHackMe
Greetings everyone! In today's post, we'll be attacking another machine on the great platform TryHackMe. This machine is, you guessed it, Pokemon-themed! The description for this room mentions that there are actually four flags to find! Three of them are based off of Pokemon types (Grass, Water, Fire), and then there is a root flag to find. Well, it actually says 'What is Root's favorite Pokemon?". I'm going to treat that as the root flag as I'm assuming that we'll need root-level access to find that out! Let's jump in to find out! As always, we'll begin with our trusted Nmap scan! Only two ports open, but one of them is port 80. Let's start enumerating that web server! The landing page is the default Apache2 page: While poking around…
Read More
12Oct 2020 by admin

TryHackMe – Bounty Hacker

ftp, privilege escalation, ssh, TryHackMe
Greetings everyone! I have a pretty quick walkthrough today for you! Once again, we'll be using the fantastic platform TryHackMe. The box we'll be tackling is called Bounty Hacker! With our Kali box fired up, we'll start off with our trusted Nmap scan! We can see that we get a few hits back; the main one being FTP! Nmap shows that the box allows for anonymous login, so let's connect that way and grab any files that we can! We can see that two files are listed: locks.txt and task.txt. Time to download them and see what goodies are inside! We'll first cat out the task.txt file: Looks like this task file was created by someone named "lin". This is great because we have a possible username that we may…
Read More
11Oct 2020 by admin

Exploiting ZeroLogon!

privilege escalation, remote access, vulnerability
Greetings everyone! In today's post, we'll be exploring the ZeroLogon vulnerability and demonstrating just how easy it is to exploit! What Is It? The ZeroLogon vulnerability, tracked as CVE-2020-1472, is an authentication bypass vulnerability, which allows for privilege escalation, in the Netlogon Remote Protocol (MS-NRPC), a remote procedure call (RPC) interface that Windows uses to authenticate users and computers on domain-based networks. According to a blog post on Secura's website, Zerologon takes advantage of a weak cryptographic algorithm used in the Netlogon authentication process. This bug allows an attacker to manipulate the Netlogon authentication procedures and: Impersonate the identity of any computer on a network when trying to authenticate against the domain controller Disable security features in the Netlogon authentication processChange a computer's password on the Domain Controller's Active Directory…
Read More
24Aug 2020 by admin

TryHackMe – Agent Sudo

ftp, privilege escalation, ssh, Steganography, TryHackMe
Greetings everyone! I'm back with another machine walkthrough from the hacking platform TryHackMe! This machine is called Agent Sudo! So without any further ado, let's jump into it! We'll start off with our trusty Nmap scan: Alright, well right off the bat we can see that port 80 is open, and that means there is a website to check out! Great, let's browse to it! Hmm! Now there wasn't much, actually nothing, returned from any type of enumeration or vulnerability scanning on this website! That being the case, I went back and re-read the message that was displayed. At the moment, we have no sweet clue what our "codename" is. But what we can do is use cURL to spoof our user-agent. Putting out detective hat on, we notice that…
Read More
09Jun 2020 by admin

TryHackMe – Alfred

meterpreter, msfvenom, Powershell, privilege escalation, Tokens, TryHackMe
Greetings everyone!In today's post, we're going to try something a little different! I've recently signed up for a new hacking training platform called TryHackMe. I've read a few posts regarding TryHackMe, and the reviews have been nothing but outstanding, so I figured let's give it a shot! In today's post, I'll be attacking the box called Alfred. So let's get to it! Alfred has an IP of 10.10.33.30. Knowing that, let's start off with an Nmap scan! Only 3 open ports are returned so we don't have a lot to work with. Let's start by browsing to port 80: RIP Bruce Wayne?? Well that's not a message I wanted to see. Did Bane (the best super-villain) finally end Batman, once and for all? Anyways, back to the mission at hand!…
Read More
30Mar 2020 by admin

Hack The Box – Jerry

apache, hackthebox, msfvenom, shell
Greetings, everyone! After a long, long break, I've decided to return to the wonderful world of blogging my experiences on Hack the Box! I'm currently knees deep in course material for Offensive Security's OSCP certification, so I figured this would be a nice break from it! So without further ado, let's get into it! The box I've decided to attack for this post is called Jerry, and has the IP of 10.10.10.95. Let's start off with an Nmap scan: Only one port open: 8080. Well let's check it out to see what we can find! We're brought to an Apache Tomcat configuration page! After poking around for a bit on the landing page, the tab "Manager App" looks the most promising. Let's click on that tab and see what happens:…
Read More