Pentesting 101

  1) Scanning As usual, we will scan our target ip first to see if there is any intyeresting service is open. Here, as usual, the http is open so we can open it in browser 2) Initial Access Here try to explore a bit to see if there is any clue, inpect the page, see the connection and all. In this tutorial, I saw nothing interesting so I go straight away to msfvenom to see if the magnusbilling can be exploited. Here as you can see there is a RCE that we can use follow command below to use the RCE. as we got into this part, try to explore each path/directories, but in this tutorial we go straight to /home because the user flag usually lies here.  3) Privilege escalation We use shell command to get a real system shell Meterpreter is not a real shell, so it cannot run Linux commands like sudo, su, or passwd. So we use Shell to drop into a real bash/sh shell on the target system. Now you’re inside the Linux environment itself. -------------------------------------------------------...

1) Identify type of file, change the file permission, and execute Here we need to use command   file "file name" to identify what the file made of  In this example, it is ELF 64-bit Next, we change the permission of the file to 777 with the command of chmod 777 "file name" which gives full permission for us to do anything with the file Next, we try to execute the file with command ./"file name" Here we can see that it prompted us with password: 2) Analyze ELF file using ghidra Open the file in your ghidra Scroll down until you find the "password" section. Here we can see that there is a C code on the right which we can analyze to get our password 3) Code Analysis # include <stdio.h> # include <string.h> int main ( void ) { int iVar1; char local_28[ 32 ]; fwrite( "Password: " , 1 , 10 , stdout ); __isoc99_scanf( "DoYouEven%sCTF" , local_28); iVar1 = strcmp (local_28, "__dso_handle...

1) INITIAL ENUMERATION As usual in this web exploitation challenge, we will start with nmap scan first to see if there are any open ports. Here we can see ssh and http ports are open.  As we go to the website, it mention SPIP, a publishing system. You can read the details below or learn it more on google.  2) DIRECTORY FUZZING We then enumerate more on the URL, hoping to see if there are any path that we can access. Below shown spip directory, which is a bit unique.  As we go around the /spip directory above, there is nothing interesting, so we enumerate the URL once again.  Go through each of above directory, in this tutorial, I found config.txt inside the /local directory, which might reveal the version used by the website that we cna exploit.  Here, it used spip version 4.2.0 3) EXPLOIT RESEARCH use searchsploit 'spip 4.2.0'  command to see more info about spip 4.2.0 here we can see the CVE, so we can search more of it on google.  We then use "sear...