[WALKTHROUGH] Brainpan 1

This is one joyful and also one full of frustration box as it took me quite some times to solve it... but it is very rewarding as well... really thanks to superkojiman on this great challenge that he designed... not sure why he named it as Brainpan, but I will definitely named it as Brainpain, which literally explained everything... :)

This challenge is designed solely based on buffer overflow exploitation and it is a good chance for noobie like me to start off and train on... :)

Kick start with finding the target IP...

Scan for the ports...

Returned only 2 open ports, which are 9999 and 10000...

Let's recon harder and see if we can find something better...

Nothing useful...

Check out their http website...

Scrapped the web page source code but nothing found again...

Let's poke on its 9999 port and see what is going to happen...

Obviously not some easy brute force or dictionary attack can break in...

 Leave it and move on again...

Check if any sub-directory found on the web hosting...

Found a "/bin" directory...

Let's check it out... :)

 Found a "brainpan.exe" file... seems like a Windows executable file...

Grab it down for further probing...

Checked and verified it is a Windows executable file...

Some forensics-fu with 'Strings' command and found the password for port 9999 is "shitstorm"...

Tried log in using the credential found successfully but nothing rewarding so far...

Move the 'brainpan.exe' file over to Windows environment and debug using Immunity Debugger...

At the same end, create a fuzzer script as shown below to fuzz with the "brainpan.exe" file...

Set the target IP address accordingly, here we will set the IP of the windows machine first before we move on back to our Brainpan box...

The script will try feed from 100 bytes and increment of 100 every time until the program crashed... and this is where we begin our buffer overflow exploitation...

Seems like the program crashed after intake of 600 bytes... hence we create a unique 600 bytes to identify the offset of EIP...

Next step is to find the exact offset of EIP using the pattern_offset script in Kali linux...

Since the leftover spaces for shell code is definitely not enough (600-524 = 76 bytes)... We tried to increase it further to 1000 bytes see if the crashed address remained the same...

Well, since the program behave the same if we push in 1000 bytes... so we make changes accordingly...

Push in 524 of  "A" + 4 of "B" to differentiate the memory address + the rest bytes will be filled with "C" temporary...

Tested and everything seems fine...

Next step is to find the memory address for "JMP ESP"...

Finding out the hexcode for instruction "JMP ESP" using the nasm_shell scripts...

Execute the mona scripts in Immunity Debugger...

!mona find -s "\xff\xe4" -m brainpan.exe

Replace the memory address found accordingly...

 At the other hand, create the payload...

 Put the shell code created earlier into our fuzzer scripts...

Padding the shell code with some NOP bytes...

Launch a handler to catch the reverse shell...

Run the exploit and check for the reverse shell...

The attack is successful...

Let's move this back to Linux payload...

Create another new payload using the msfpayload for linux...

Replace the code accordingly... 

Launch the exploit as previous attack and wait for reverse shell...

Now, we got a shell on the target box... apparently this user does not have much privilege on the box... let's see what can this user 'puck' do as sudo with "sudo -l" command...

Only one sudo command which does not require any password... "anansi_util"...
 
This command require at least one argument...

As far as I know, we can launch another shell within the "manual" command...

So here, I try with "manual vi"...

We see a regular manual page for "vi"...

To launch an command within "manual", we pre-pend an "!" in front of it...

Hence, "!/bin/bash" will launch another shell within the "manual"...

Check for the id and we got the root shell instantly... :)

A very nice challenge indeed... sorry as I do not have screenshots from windows machine as I accidentally reverted the machine... :(

[TUTORIAL] Creating Wifi Hotspot in Windows 8.1

So, I heard some people having some difficulties in creating a wifi hotspot in Windows 8.1. Well, let's fire up the very first post for this blog with "How to create a wifi hotspot in Windows 8.1". This tutorial is applicable for Windows 7 and Windows 8 too. *yay!*

Since Windows 7, it is called as the Hosted Network which is a new feature to enable to a single wireless adapter to be able to create a another virtual adapter out of itself and broadcasting the software access point (SoftAP). In another words, a single hardware wireless adapter is having two drivers. One is used for connecting to the cloud, while another one is act as an access point. *Again, yay!*

Before we start our tutorial, let's make sure our wireless adapter's drivers is able to do so. Now, let's fire up our command prompt and get our hands dirty. A great improvement since Windows 8 which I favored a lot is the shortcut key to start our command prompt. *Please be aware that, we will need to do this in Command Prompt as an Administrator.*

By pressing the "Windows + X" button, we will see a menu list as below:

In the shortcut menu list, we can easily access to other utilities in our pc. However, in our case we would like to fire up our Command Prompt with Administrator privilege. So, press the button "A" followed up and we got our command prompt with admin privilege as shown in the picture. You will found this shortcut key very useful once you get used to it.

The next thing is, we want to check whether our wireless adapter able to create a hosted network.

netsh wlan show drivers

So, after confirmed our wireless adapter able to support hosted network feature. Without any further delay, copy and paste the code below and paste into the command prompt.

netsh wlan set hostednetwork mode=allow ssid="SSIDNAME" key="WIFI@KEY" keyUsage=persistent

Replace the SSIDNAME to your desired SSID and WIFI@KEY to your desired wireless key. The wireless key need to be at least 8 characters. The recommended one are the combinations of numbers, alphabets and special symbols with at least 8 characters in overall.

At this stage, we have successfully created our hostednetwork. You will see an extra network adapter appear out of nowhere in your Network Connections place.

Next, let's start the hostednetwork to be visible to the other clients.

netsh wlan start hostednetwork

Connect your client to the SSID created few seconds ago and input the wireless key. But still, we do not have internet connection for this adapter. So, we will be going to use the Internet Connection Sharing feature by Microsoft and share the internet connection from the current adapter which is connecting to the internet.

Right Click (on the adapter with internet connection) > Properties > Sharing Tab > Tick (Allow other network users to connect... ) > Select your virtual adapter created just now.

Voila! Your client should be able to connect to the internet by connecting to your SoftAP with SSID "SSIDNAME" now.

Note: If your client is having difficulty in obtaining IP address, I will suggest to set static IP to your devices by following the configuration as below:

IP Address: 192.168.137.x --- "x" can be any numbers range from 2-254, e.g.: 192.168.137.100
Subnet Mask: 255.255.255.0
Gateway: 192.168.137.1
DNS 1: 8.8.8.8
DNS 2: 8.8.4.4

[WALKTHROUGH] KIOPTRIX Level 5 (2014)

Sorry guys...just noticed I have pending the post for Kioptrix 2014...

So, let's start with Nmap finding out the target host IP and continue with some reconnaissance steps...

Checking out their web page source code...

pChart vulnerable point enable for command execution...

Let's check on the apache config file so find out why we cant access to the webpage with port 8080...

Found the culprit who is controlling the access to the web page at port 8080...

Get the "User Agent Switcher" add-on in Firefox/Iceweasel and change our user agent to be able to access to the web page... :)

Another vulnerable phptax application... for more details, please Google it up... :))

Download the shell payload from our web hosting...

And execute it...

You must set a listener at your attacking host before you launch the payload...and we got a shell on the target host...

Next thing is to escalate our shell to root privilege...

Search for the local exploit and exploit it...

Just another root shell... XD