Archives

All posts by kanishka10

Good morning aspiring hackers. Today we will see how to create a persistent windows backdoor with Metasploit. As soon as we get meterpreter shell on the target system, it is a good practice for a hacker ( pen tester ) to create a backdoor. Coming to that, what exactly is a backdoor? A backdoor is something which gives us continuous access to our target system.

Next question that comes to our mind is why we need to create a backdoor? Most of the methods we used to take control of our target systems are based on the vulnerabilities our target has. So once the vulnerabilities are patched, access to the target is lost. That’ why we need to create a backdoor.

This backdoor also answers a question many people ask like, once we get a meterpreter shell, can we shut down our machine? If we restart, will the connection be gone or still intact? .This backdoor needs only one one condition to be fulfilled. The target system should be out of its safest mode. i.e it shouldn’t  be turned off .
Now let us see how to create a persistent windows backdoor with Metasploit. In the meterpreter session we acquired on the target system, run the command “run persistence -h“. It will show you all the options we can set for our backdoor. All the options are self explanatory.

persistence1

Now I want my backdoor to start as soon as the system starts. So I chose ‘X’ option. After starting, I want it to make connection attempt to my attacker system every three seconds, so I kept the interval(i) as 3. The port on which connection should be made is 443. The option (r) is remote system’s IP address i.e the IP of the system to which the connection should be made.

Remember this script will be installed on the target system. Run the script. As you can see, the file is installed in the autorun.

persistence2

Now it’s time to start a listener on our attacker system. We have done it many times as shown below.

persistence3

Change the options accordingly as we set in the persistence script and start the handler. If the system is live, we will get the meterpreter shell as shown below.

persistence4

 

 

 

Hello aspiring hackers. In many hacking scenarios, we encounter hashes. To those newbies who have no idea what hashes are, they are encrypted text ( literarlly we can’t call it text ). Normally they are used to encrypt passwords for website users, operating system users etc. Today our tutorial is about cracking hashes.

For this howto, we will use NewsP Free News Script 1.4.7 which had a credential disclosure vulnerability as shown below. Imagine we got the username and password hash as shown below. The only thing that stops me from accessing the website is password in encrypted format.

findmyhash1

The first step in cracking hashes is to identify the type of hash we are cracking. Kali Linux has an inbuilt tool to identify the type of hash we are cracking. It’s hash-identifier. Open a terminal and type command hash-identifier.

hash-identifier1

Enter the hash we need to crack as shown above and hit ENTER. It will show the possible hash type as shown below. In our case, it is MD5 or a variant of it.

hash-identifier2

We can also use another tool hashid for similar purpose. It’s syntax is as shown below.

hashid1

We know what the type of hash is. Now, it’s time to crack the hash.We will use a tool called ‘findmyhash’. To use this tool, we need to specify the hash type ( which we already know ) and hash after it as shown below. This tool tries to crack the hash by using various online hash crackers available.

findmyhash2

After successfully cracking the hash, it will display us the corresponding password as shown below. In our case, the password is admin.

findmyhash3

 

 

WARNING: This post is for education purpose only. Misuse this post at your own  risk.

Hello aspiring hackers. Today we will learn how to do Windows hacking with Arcanus Framework. Arcanus is a customized payload generator that can generate payloads which are undetectable by almost all of the antiviruses (till date ). This could be very useful in penetration testing.

Today we will see how to get a shell on a remote Windows system with this tool. Before we do anything, we need to install golang. Install Golang and then clone the Arcanus git as shown below.

arcanus1

Navigate to the ARCANUS directory created and view its contents. We should see a file ARCANUS_x86. We will generate a x_86 payload. First change its permissions as shown below.

arcanus2

Next run this file. You should see an ARCANUS logo as shown below.

arcanus3

You will see five options as shown below. Since we are about to hack windows, we will generate a windows payload by choosing option 2.

arcanus4

It will prompt you for the attacker IP address ( in our case the address of Kali Linux ) and a port on which you to listen for the reverse shell. Enter the values and hit “Enter”.

arcanus5

It will generate the payload and automatically start a listener as shown below.

arcanus6

The payload will be generated with the name “payload.exe” as shown below in the ARCANUS directory.

arcanus7

Next we need to send this payload to the victim. When the victim clicks on the payload we sent, we will get a shell of the victim as shown below. Happy hacking.

arcanus8

Good evening friends. Recently we have seen how to exploit server credential disclosure vulnerability in Webnms framework 5.2. This time around researchers found an arbitrary file upload vulnerability in the Webnms framework 5.2.

The Fileuploadservlet has a directory traversal vulnerability in the “filename” parameter which allows an unauthenticated user to upload a jsp file. We can only upload text files and to achieve RCE , they need to be dropped in ../jsp/ folder with names only as login.jsp or webstartXXX.jsp ( where XXX is string of any length).

Here is the code vulnerable to arbitrary file upload.

webnmsfileupload0Here are the names of the files that are uploaded in the process of exploitation. As you can see, the files are appended with random text.
webnmsfileupload00
Ok. Now let’s see how this exploit works. Start Metasploit and load the exploit as shown below.
webnmsfileupload1
We need to only set the target IP. The “check” command may not give you exact status of vulnerability as shown below.
webnmsfileupload2
 Set the meterpreter payload as shown below.
 webnmsfileupload3
Type “run” command to execute the exploit. You should successfully get meterpreter session as shown below.
webnmsfileupload4
 

 

Hello aspiring hackers. In our previous howtos, we saw about different shells like the infamous c99 shell, web shells in Kali Linux and Weevely. In this howto, we will see about hacking a website by uploading shell made with Metasploit. We will be getting a meterpreter shell on the website.

One of the wonderful features of Metasploit is creating payloads as per requirement. Using msfvenom, we can create binaries for Windows, MAC and Linux.  We can also create shell payloads for websites in different formats like php, asp , javascript and asp. In future howto’s we will definitely learn more about msfvenom but for this howto, we will create a php payload.

As you can see below, I have created a php payload named “shell.php” with the metasploit payload option “php/meterpreter_reverse_tcp”. This gives us a reverse php meterpreter shell. The “lhost” option is our attacker system’s IP address and “lport” the port on which we want php meterpreter shell back.

msfvenomphp1

After the shell is successfully created, let’s start a listener with Metasploit as shown below. Remember to set the same payload we set while creating the payload.

msfvenomphp2

Set the lhost and lport as shown below. They should match with the values in the shell we created. Type command “run” to start the listener.

msfvenomphp3

Now you need to find a site vulnerable to file upload. For this howto, I’m using my own vulnerable webapp “Vulnerawa”. To know more about Vulnerawa go here. Vulnerawa has a file upload vulnerability in its careers page.

msfvenomphp4

Go to its file upload page and upload the shell. That shouldn’t be a big problem.

msfvenomphp5

Now go to the shell we just uploaded through the website.Normally its located in the uploads directory ( In real websites, you need to locate it ). The shell will look like below.

msfvenomphp6

In the listener we startedan the attacker system, we should have already got the meterpreter shell. Happy hacking.

msfvenomphp7

Good evening friends. Today we will see the second part of WAPT with HPWebinspect. If you didn’t go through the first part, we ended it by scanning a website for vulnerabilities. The results have given us vulnerabilities categorized as critical, high, medium and low. That was the easiest part. Now we will go through analysis of these vulnerabilities.

Wait, but why do we need this analysis? Just because we have used an automated tool doesn’t mean it is cent percent effective. There may be lot of false positives and in the worst case false negatives. The threat it shows as critical may not be really that dangerous or a threat it shows as medium may be critical depending on the situation.

The analysis is very important part of the WAPT. Let us see how to perform this analysis with HPWebinspect. We will take our previous scan report.

hpwapt1

Before we do the analysis, let us have a look at the interface of HPWebinspect.  To the down left, we have view options of the scan ( site and sequence ). The “site view” shows us the hierarchical structure of website we just scanned with vulnerabilities found highlighted as shown below to the left. We can see that in account part of the website there is a critical vulnerability.

hpwapt2

The sequence view shows us the order in which WebInspect scanned the URLs. It is shown below.

hpwapt3

Occupying large area of the interface is the Scan dashboard with a pictorial representation of vulnerabilities. It also has vulnerabilities classified into its attack types ( how exactly these vulnerabilities will be used ).To its left, we have sections called scan info, session info and host info. The scan info has four options : dashboard, traffic monitor, attachments and false positives. We have already seen dashboard and others are self explanatory.

Below scan info we have have session info. It is empty because we didn’t include any sessions in our scan.

hpwapt4

Below session info, we have the host info which is obviously information about the host we scanned. It will provide us info like P3P info ( protocol allowing websites to declare their intended use of information they collect about users) , AJAX, certificates etc, etc, etc. Let us look at the cookies collected by the scan.

hpwapt5

It also shows us the emails we found during scan.

hpwapt6

Also the forms.

hpwapt7

Now we come to the most important part of the interface which is right down below. These are the vulnerabilities found during the scan. As already said, these are classified according to the dangers posed by them but there may be false positives. We need to analyse each vulnerability for this exact reason.

hpwapt8

In this howto, we will cover analysis of one or two vulnerabilities. Expand the “critical” section of vulnerabilities. We can see that there is a XSS vulnerability in the search page. We will analyse this vulnerability.

hpwapt9

Click on the vulnerability. The dashboard will show information about the particular vulnerability ( in our case XSS ) and how hackers might exploit this.

hpwapt10

Scroll down the dashboard to get more info about the vulnerability. We can see the exact query used by the tool to get the result. In this case, our target is using tag removal to prevent XSS but we can bypass using the query given below. ( We will learn more about XSS and its evasion filters in a separate howto)

hpwapt10a

Now right click on the vulnerability we are analysing. In the menu that opens, click on “View in Browser” to see this exploit practically in the browser.

hpwapt11

We can see the browser result below. In this case, it is displaying a messagebox with a number but hackers can use it to display cookies and session ids. Hence this is definitely a critical vulnerability.

hpwapt12

Right click on the vulnerability and select the option “Review vulnerability”. This is helpful in knowing more precisely about the vulnerability.

hpwapt13

Another window will open as shown below. It will automatically show you the browser view.

hpwapt14

We can click on “Request tab”to see the request sent by our tool.

hpwapt15

Similarly the response tab shows us the response given by the target.

hpwapt16

We already saw this before in the dashboard. The “vulnerability tab” give us information about the vulnerability and how hackers might exploit it. There are also options like “Retest” and “Mark as”. The Retest option allows us to test the vulnerability again. We shall see the “mark as” option below.

hpwapt17

Close the window. Once again right click on the vulnerability. You can see the option “change severity”.

hpwapt18

For instance, the vulnerability detected by HPwebinspect is not that critical, we can change its severity suitably to high or medium or low.

hpwapt19

Now what if the vulnerability detected  is not an actual vulnerability. This is known as false positive. For example, we have this send feedback page of the target website. Let us assume it is just a false positive. In that scenario, just below the “review vulnerability” option we have “Mark as” option.

hpwapt20

We can also access this option from the “review vulnerability” window as already shown above.

hpwapt20a

When we click on that option, we get two sub-options to mark it either as false positive as shown below

hpwapt21

or to completely ignore the vulnerability. We can only ignore the vulnerability if it doesn’t pose any valid threat. We can also provide some description about why we are marking it as false positive or ignoring.

hpwapt22

When we have successfully finished reviewing each vulnerability, it’s time to write the penetration testing report. To automatically generate a report, click on “Reports” tab. Select the scan for which you want to generate the report and click on “Next”.

hpwapt23

Select whatever you want to include in your report as shown below and click on Finish.

hpwapt24

The report generation takes some time depending on the options you selected. The report generated would be in the format as shown below. That’s all for now and in our next howto, we will see more about the tool.

hpwapt25

 

Web application penetration testing refers to evaluating the security of websites and web applications. Websites evolved from being simple static HTML pages to incorporate complex dynamic features with bells and whistles. These bells and whistles also brought with them lot of vulnerabilities and thus websites became common targets for hackers. So web application penetration testing is considered very important nowadays.

WAPT could be performed manually or through automatic tools. Automated tools provide lot of advantages over manual testing most importantly the speed. HP Webinspect is one such tool.

It is an automated web application security scanning tool from HP. It helps the security professionals to assess the potential vulnerabilities in the web application. It is basically an automated dynamic application security testing (DAST) tool that mimics real-world hacking techniques and attacks, and provides comprehensive dynamic analysis of complex web applications and services. See how to install HPwebinspect in Windows.

Today we will see how to perform website vulnerability assessment with HPWebinspect. Open the program and click on basic scan. We will see other scan options in the following parts of this tutorial. As its name implies, this option performs a basic security scan on a website.

webinspectbasicscan1

As we select the basic scan option, the “scan wizard” opens as shown below. As I am using a trial version of HPWebinspect I am only allowed to scan the website deliberately provided by HP for this purpose. This website simulates a bank ( named zero bank ) and this will be our target from now on.

I allot the given name. Below the scan name option, we have features with radio buttons. Let’s see these options.

crawl:- This process makes a list of all the pages  on the entire website and builds its structure.

auditing:- Auditing is the process in which HPwebinspect will attack the website to find out the vulnerabilities.

I have selected the “crawling and auditing” option. HP Webinspect provides four types of scans.

Standard scan:- Normal scan.
List Driven scan:- You can specify the list of urls for the tool to scan. It will only scan those urls.
Workflow Driven scan:- Similar to list driven scan. You can scan a port of your website by specifying a macro.
Manual scan:- You can specify each link you want to scan. step by step.

Next specify the website you want to scan and click on “Next”.

webinspectbasicscan2

In the next window, you will be prompted for authentication. If your website or network requires authentication, provide them . Choose if you want network proxy or not and click on “Next“.

webinspectbasicscan3

The profiler automatically samples the website and recommends best configuration for the scan. You can select the option. We will see more about profiler later. There are some other settings. Leave them to their default settings and click on “Next”.

webinspectbasicscan4

You will get a congrats message telling about the successful configuration of scan settings. It’s time to start the scan. Click on “scan”.

webinspectbasicscan5

The scan will start as shown below. It will take some time dependent on the size of the website you are scanning.

webinspectbasicscan6

After the scan is finished, it will show the results as shown below. This tool classifies vulnerabilities into critical, high, medium, low and info. That was about basic scanning of website with HPWebinspect.

webinspectbasicscan7

In our next part, we will see analyzing these vulnerabilities.

Webinspect is an automated web application security scanning tool from HP. It helps the security professionals to assess the potential vulnerabilities in the web application. It is basically a dynamic black box testing tool which detects the vulnerabilities by actually performing the attack. Today we will see how to install HP Webinspect in Windows.

We will be installing it on Windows 10. HP Webinspect requires SQL server to be installed on the system. So first install SQL server express on Windows as shown here. After SQL server is installed successfully, download the latest version of HP Webinspect from their website. We will use version 16.10 for this howto. Right click on the downloaded file and run with administrator privileges.

The installation wizard will start with the welcome message as shown below. Click on”Next”.

hpwebinspect1

Accept the license agreement and click on “Next”.

hpwebinspect2

You can change the installation folder if you want although keeping it default will not hurt. Click on “Next”.

hpwebinspect3

If you want to setup Webinspect as a sensor, select the option and click on “Next”.

hpwebinspect4

Click on “Install” to start installation process.

hpwebinspect5

Once the installation is over, it will show you the below window. If you want to start HP webinspect, select the option and click on “Finish”.

hpwebinspect6

The program will launch as shown below.

hpwebinspect7

If you get something like below, you have no SQL server installed on your system. Install SQL server express and launch the program again.

hpwebinspect8

The program will prompt you for activation as shown below. The program also offers 15 days trial. I am registering for the trial.

hpwebinspect9

hpwebinspect10

Once the registration process is over, the program will open as shown below. Update the program. In our next howto, We will see how to perform  web app pentesting with HP Webinspect. Until then, Happy Weekend.

hpwebinspect12

 

 

Good morning friends. Today we will see how to install SQL server express 2012 in Windows 10.  Download the relevant SQL server 2012 express from here.  Right click on the downloaded file and run with administrator privileges. The below window should open. Click on the “New SQL server stand-alone installation” option since we are installing a new version of the database server.

sql2012e1

Accept the license terms and click on “Next”.

 

sql2012e2

Most probably the server will update to service pack 1. Leave it to update and after successful update, click on “Next”.

sql2012e3

Click on “Install”. The installation process will start. As it will download setup files, it will take some time.

sql2012e4

It will prompt you to select the features you want to install. If you are not sure what you want, leave the default selection and click on “Next”.

sql2012e5

The Instance configuration window opens. Leave the default options and click on “Next”.

sql2012e6

Click on “Next”.

sql2012e7

Configure the authentication for the SQL server. If you have no idea, once again leave the default options and click on “Next”.

sql2012e8

If you want to send any errors to Microsoft, select the option and click on “Next”.

sql2012e9

The installation will start as shown below.

sql2012e10

The installation progress will end with the below window. Congrats, You have successfully installed SQL server express 2012 in Windows 10.

sql2012e11

 

Good evening friends. Recently we have seen privilege escalation in Windows 7 with bypass uac exploit. Today we will see another exploit ms16-016 mrxdav.sys WEBDAV for privilege escalation in Windows 32bit machines. mrxdav.sys is a Windows driver. It is also called as Windows NT WebDav Minirdr and is used on Windows computers to utilize WebDAV servers. This exploit uses the Microsoft Web Distributed Authoring and Versioning (WebDAV) client to send specifically crafted input to a server to escalate privileges.

First hack the system with Metasploit by using one of the methods shown  in Latest hacks. Once you got a meterpreter session, check the privileges by typing command “getuid“.  We don’t have system privileges. Background the session by typing command “background” as shown below.

webdav1

Load the ms16_016_webdav exploit as shown below.

webdav2

We need only one option: session id of the session we just backgrounded. Set the session id as shown below. Run the exploit. The exploit ran successfully.

webdav3

Now verify the privileges by typing “getuid” command once again as shown below.  We successfully got system privileges.

webdav4