THM - Vulnersity
These are notes taken while doing the vulnersity course in THM
General Theory
NMAP
first run two scans : First for low hanging fruit (default 1000 ports)
Next run the full 65535 using -p- run in background
-T<paranoid | sneaky | polite | normal | aggressive | insane>:
first 2 for IDS evasion (0, 1)
Polite mode 2 slows down scan to use less bandwidth and target machine resources
Normal mode is default 3
Aggressive mode speeds scan up by assuming a fast network
Insane mode sacrifices accuracy for speed
Enumeration
dirbuster - commonly used in a lot of hacking challenge videos/write-ups though it’s popularity seems to be fading in favor of Gobuster. Can run multi-threaded and has a (not great) GUI interface.
dirb - operates similarly to dirbuster but is CLI only. Some people think it’s slower than dirbuster while others say dirb gives them more consistent results. Your mileage may vary.
gobuster - the new hotness. Written in golang and meant to address the failings of both dirbuster and dirb.
dirsearch - I came across this one while reading another write-up for this challenge. It seems to perform well enough so it’s included here and you can make your own decision whether you like it or not.
Example use :
Wordlists are usually in /usr/share/wordlists/dirb
gobuster dir -e -u http://10.10.164.121:3333 -w /usr/share/wordlists/dirb/common.txt dir: uses directory/file brute forcing mode -e: expanded mode, print full URLs -u: the target URL or domain -w: path to word list
Fuzzing and Compromise :
Using Burp Suite
When it’s active it functions as a web proxy so you need to configure your browser to use it. It also helps to install Burp’s CA certificate in your browser’s trust store.
If you are a Firefox user then a good quality of life companion to use with Burp is FoxyProxy. It’s an add-on that once configured will allow you to easily switch between web proxies with a single click.
The last component to set up are SecLists (you’ll see why in a minute). These are also super easy to install, just use APT to pull it from the repos. --> example : /usr/share/seclists/Fuzzing/extensions-most-common.fuzz.txt
use burp intruder to fuzz the target and find file extension the server will accept
specify payloads, type of attack
Now check for length column that stands out from the rest
Reverse Shell :
Kali comes preloaded with a bunch of useful web shells located in /usr/share/webshells.
upload file via the fuzzed /internal/ subdomain page
using phtml extension as fuzzed
now callback the URL to activate :
http://IP ADDRS/internal/uploads/nameofshell.phtml
Privilege Escalation
Now that we have a remote shell on our target the next step is to try to escalate our privileges to root. A common technique for privesc when doing CTFs or online challenges like this is to look for files that have the SUID bit set. Here is a great article that explains in-depth what the SUID bit is and includes several examples to break it down further.
Last updated