When spawning new web shell, it is commonly just nothing but the dumb terminal. To explorer target system better, it is mandatory to use fully interactive shell. There are few ways to make it, but I believe those two options were the best.
1)discovery : which ports are opened? – only 80 port is opened
2)enumerate : input/output sanitization? third platform? – check the website, does it use open source platform? any known vulnerabilities? – inject malicious strings, %00, {, |, . are acceptable? – can execute remote script?
3)manipulate webpage : any possible exploits? – exploit db, python code compile -> cmd shell (okay) – but, better way?
4)get a reverse shell : can we get a reverse web shell? – manipulate HTTP request by using burp – pawn a powershell
5)privilege escalation : any mis-configurations or vulnerabilities? – upload/execute powershell script
1)discovery : which ports are opened? – only 80 port is opened
2)enumerate : third party web platform? – use gobuster to check directory structure – check the website, does it use open source platform? any known vulnerabilities? – are those files really images? or have weird sizes compared to other one? – find username and password by enumerating webpage, image files – ask google for a help, research blog
3)manipulate webpage : any possible exploits? – inject php code
4)get a reverse shell : can we get a reverse web shell? – manipulate HTTP request by using burp – php cmd shell
5)privilege escalation : any mis-configurations or vulnerabilities? – pspy to check system process – focus on cronjob which as privileged permission
6)manipulate file – replace file to /etc/shadow in cronjob – copy normal users hashed password to root in /etc/shadow
Regardless of program language there are device’ slave address and bus number are pre-defined. It is required to change those values to be synchronized with local environment.
When the binary was compiled based on .NET framework, the dnSpy is the shortcut to decompile it.
Unfortunately, IDA and Ghidra do not support .NET compiler, so there is no alternative. When we take a look into condition, we might find proper variable names then debug in real time to check the string value.
OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications! (https://www.owasp.org/)
$cd /opt
$git clone https://github.com/CTFd/CTFd.git
Modify the docker-compose.yml file from the repository to specify a SECRET_KEY environment for the CTFd service.
: Environment
- SECRET_KEY=<SPECIFY_RANDOM_VALUE>
$docker-compose up
Hyper-V provide a specific PowerShell tool for converting other VMs to Hyper-V disk(*.vhd, *.vhdx), but when converting images, it generally occurs errors depending on environment. After some trial errors, I found those errors can be categorized.
OVA files are simply tar archive files containing the OVF directory. After renaming *ova file to *.tar, we can extract .vmdk file from *.tar.
Next step is same as vmdk
Dealing with errors
Common errors are starting with “The entry… us not a supported disk database entry fir the descriptor”
The dsfok tool helps modifying descriptor. It extracts descriptor from vmdk file then can combine them together. First take a descriptor from image file with difo.exe then inject it with dsfi.exe.
A cross compiler is a compiler capable of creating executable code for a platform other than the one on which the compiler is running. For example, a compiler that runs on a Windows 7PC but generates code that runs on Android smartphone is a cross compiler (Wikipedia)
We should install three pre-requisite packages (actually, two packages) – dpkg-cross, g++arm-linux-gnueabihf and gcc-arm-linux-gnueabihf $sudo apt-get install dpkg-cross g++arm-linux-gnuabihf
Then, finally crossbuild-essential-armhf can be installed. $sudo apt-get install crossbuild-essential-armhf
Tried many things to make BBB connected to internet. There’re few different ways such as by enabling ethernet port or adding USB Wi-Fi dongle. But it won’t work stable when we move BBB to difference environment. Thus, I think sharing host internet is easiest way to give BBB an internet access. To make this we should route all outbound packets to this device from the BBB to the Internet via the Internet access interface.
First thing first, make USB connection between BBB and host machine. Then check the IP address on USB port.
USB0 has 192.168.7.1 and it is a default gateway for BBB’s usb0 interface.
Host Setting
#Enabling traffic re-routing to Internet Access interface on host machine #In this case, Internet traffic fro BBB’s USB0 enx4c3fd3c18fa6 will be routed to host’s Wi-Fi interface wlp10 $sudo sysctl net.ipv4.ip_forward=1 $sudo iptables --table nat --append POSTROUTING --out-interface wlp1s0 -j MASQUERADE $sudo iptables --append FORWARD --in-interface enx4c3fd3c18fa6 -j ACCEPT
Open source ? or commercial product? I believe they have pros and cons respectively. PfSense is working perfect as a centralized firewall includes almost everything but need more computing power when it deals with massive network traffic. Cisco ASA series are robust and fast, but expensive. So, maybe mid-range companies or organizations might prefer to use pfSense and big companies seem to use legacy bare-bone firewalls. Anyways it would be better for us to use both side of firewalls and compare its functions together.
Factory reset
Boot up then push esc key few times rmmon #0>confreg select no rmmon #1>confreg 0x41 rmmon #2>boot ciscoasa> ciscoasa>enable blank password ciscoasa#write erase ciscoasa#configure terminal ciscoasa(config)# config-register 0x01 ciscoasa(config)# exit ciscoasa#show version ciscoasa#write ciscoasa#reload login with blank password ciscoasa(config)#configure factory-default
We should also install the JRE since ADSM is running on JAVA Then add JRE path on system environment variables.
Then we can just start making initial configuration for physical ethernet ports. These are might be wan, management, dmz1 or dmz2 depending on purposes, but I would like to say we need to check consoles and GUI together to make sure that configurations are well synchronized. We can add up Cisco routers or switches to expand or isolate traffics.
