2017

    Pentestit Lab v11 - Connect Token (7/12)

    In my previous lab “Pentestit Lab v11 - Director Token (6/12)”, we footprinted the DIR Subnet using a comprised SSH Key for the 172.16.0.252 Router in the Main Office, utilized compromised credentials for RDP Access, utilized Interceptor-NG for ARP Poisoning and a MitM Attack to attain Shell Access on the Director’s computer, and found our sixth token. Today we will continue footprinting the 192.168.x.x subnets - which will include the following:

    Pentestit Lab v11 - Director Token (6/12)

    In my previous post “Pentestit Lab v11 - CUPS Token (5/12)”, we footprinted the CUPS server, exploited a SQL Injection Vulnerability that allowed us to gain access to the CUPS server, found an SSH Private Key, and found our fifth token. Today we will utilize our newly found SSH Private Key to gain access to the Director Subnet - which will include the following:

    Pentestit Lab v11 - CUPS Token (5/12)

    In my previous post “Pentestit Lab v11 - AD Token (4/12)”, we footprinted the AD server, utilized Pass the Hash by using our newly found hash for SMB Authetntication, and found our fourth token. Today we will continue our attack on the Main Office by attacking the CUPS Server - which will include the following:

    Pentestit Lab v11 - AD Token (4/12)

    In my previous post “Pentestit Lab v11 - RDP Token (3/12)”, we footprinted the Office 2 subnet, utilized SSH tunneling to attain RDP access, enumerated and brute forced RDP username/passwords, utilized the MS16-032 Privilege Escalation Exploit, found a user password hash and found our third token. Today we will return back to the Main Office to utilize our newly found hash to compromise the AD Server, and the AD Token - which will include the following:

    Pentestit Lab v11 - RDP Token (3/12)

    In my previous post “Pentestit Lab v11 - Site Token (2/12)”, we found an SSH Login to Office 2 via Intelligence Gathering, brute forced OpenVPN which allowed access to the Main Office, exploited a SQL Injection Vulnerability, and found our second token. Today we will leverage our SSH Login to carry out Intelligence Gathering on the Office 2 subnet, and to compromise the RDP Token - which will include the following:

    Pentestit Lab v11 - Site Token (2/12)

    In my previous post “Pentestit Lab v11 - CRM Token (1/12)”, we found a SQL Injection Vulnerability on the main WordPress site and a Remote Code Execution Vulnerability in VTiger CRM via Intelligence Gathering, brute forced the CRM, attained user information and login credentials, exploited our newly found authenticated RCE vulnerability, and found our first token! Today we will leverage our new found credentials to gain access to the internal network, and to compromise the site - which will include the following:

    Pentestit Lab v11 - CRM Token (1/12)

    In my previous post “Pentestit Lab v11 - Introduction & Network”, we covered the Network, and VPN Connection. Today we will be covering the first steps taken to attack the lab - which will include the following:

    Pentestit Lab v11 - Introduction & Network

    Hello readers, and welcome back to another series of the Pentestit Write-ups! I know it has been a while since I last posted here - but with the release of the v11 Pentestit Lab I became ecstatic and managed to find some time to go through the lab and create these write ups.

    Pentestit Lab v10 - Cloud Token (13/13)

    In my previous post “Pentestit Lab v10 - WIN-DC0 Token (12/13)”, we utilized our VPN access and the WIN-TERM machine to pivot into the WIN-DC0 machine, gathered account and domain information, exploited the MS14-068 vulnerability to forge a Kerberos Ticket, mounted the Admin share of WIN-DC0 to the WIN-TERM machine, and found our twelfth token. Today we will utilize our VPN and compromised domain to attack the Cloud machine - which will include the following:

    Pentestit Lab v10 - WIN-DC0 Token (12/13)

    In my previous post “Pentestit Lab v10 - WIN-TERM Token (11/13)”, we utilized our VPN tunnel to access the WIN-TERM machine via RDP, exploited the MS16-032 vulnerability to escalate our privileges to System, mounted an encrypted share via TrueCrypt, accessed a KeePass database, and found our eleventh token. Today we will utilize our WIN-TERM access to pivot into the WIN-DC0 machine and compromise the domain - which will include the following:

    Pentestit Lab v10 - WIN-TERM Token (11/13)

    In my previous post “Pentestit Lab v10 - Web-Control Token (10/13)”, we utilized our VPN tunnel via SSH on the compromised gw machine to access the internal network, brute forced our way into a custom application running on the Web-Control machine, exploited a Command Injection Vulnerability, and found our tenth token. Today we will be utilizing our VPN access to attack the WIN-TERM machine - which will include the following:

    Pentestit Lab v10 - Web-Control Token (10/13)

    In my previous post “Pentestit Lab v10 - Hall of Fame Token (9/13)”, we continued utilizing our gw machine as a pivot point, utilized SSHuttle as a VPN to access the internal network, exploited an SST Inject on the Hall of Fame website, and found our ninth token. Today we will be utilizing our VPN access to the internal network to attack the Web-Control machine - which will include the following:

    Pentestit Lab v10 - Hall of Fame Token (9/13)

    In my previous post “Pentestit Lab v10 - News Token (8/13)”, we continued to utilize the compromised gw machine as a pivot point to attack the News Machine, utilized our SSH Tunnel to gain access to the website, exploited an Open Sessions vulnerability on the News site, and found our eight token. Today will be utilizing our pivot point to attack the Hall of Fame Machine - which will include the following:

    Pentestit Lab v10 - News Token (8/13)

    In my previous post “Pentestit Lab v10 - Captcha Token (7/13)”, we pivoted further into the internal network via an SSL Tunnel to access the Captcha Machine, exploited a Command Injection vulnerability, established a VPN connection via SSH to gain a foothold on the internal network, and found our seventh token. Today we will continue our pivot into the internal network and attack the News Machine - which will include the following:

    Pentestit Lab v10 - Captcha Token (7/13)

    In my previous post “Pentestit Lab v10 - Blog Token (6/13)”, we further utilized the gw machine to pivot into the internal network and access the Blog via an SSH Tunnel, exploited Joomal with an Account Creation/Privilege Escalation exploit, and found our sixth token. Today we will be pivoting further into the network and attacking the Captcha Machine - which will include the following:

    Pentestit Lab v10 - Blog Token (6/13)

    In my previous post “Pentestit Lab v10 - Store Token (5/13)”, we took a step back to map the attack surface of the Store Web Application, utilized the compromised gw machine to create an SSH Tunnel to bypass access control restrictions, exploited a Blind SQL Inject via sqlmap, and found our fifth token. Today we will be pivoting into the internal network via our compromised gw machine and attacking the Blog Machine - which will include the following:

    Pentestit Lab v10 - Store Token (5/13)

    In my previous post “Pentestit Lab v10 - SSH-Test Token (4/13)”, we utilized the compromised gw machine to pivot into the internal network, used previously compromised private SSH Keys to gain access the SSH-Test Machine, and found our fourth token. Today we will be taking a step back and attacking the main Store - which will include the following:

    Pentestit Lab v10 - SSH-Test Token (4/13)

    In my previous post “Pentestit Lab v10 - SSH Token (3/13)”, we leveraged newly found credentials for SSH Access on the gw machine, enumerated files and directories with a custom python script, extracted private data - such as private SSH Keys - and finally found our third token. Today we will leveraging the compromised gw machine to access the internal network and compromise the SSH-Test machine - which will include the following:

    Pentestit Lab v10 - SSH Token (3/13)

    In my previous post “Pentestit Lab v10 - Site Token (2/13)”, we mapped the attack surface of the GDS Blog, exploited a SQL Inject while bypassing the WAF filter, cracked user credentials, gained administrative access to the blog, and scored our second token. Today we will be leveraging our new found credentials to compromise the gw machine - which will include the following:

    Pentestit Lab v10 - Site Token (2/13)

    In my previous post “Pentestit Lab v10 - Mail Token (1/13)”, we attained usernames through Intelligence Gathering, brute forced the SMTP Service, attained login credentials, and scored our first token. Today we will take our first steps at compromising the Global Data Security website - which will include the following:

    Pentestit Lab v10 - Mail Token (1/13)

    In my previous post “Pentestit Lab v10 - Introduction & Network”, we covered the Network, and VPN Connection. Today we will be covering the first steps taken to attack the lab - which will include the following:

    Pentestit Lab v10 - Introduction & Network

    Ever wondered how it feels like to hack a company? To breach their systems, traverse their network, and gain complete and total control of their domain - but all in bounds of legality? Well look no further!

    SANS 2016 Holiday Hack Challenge

    Happy Holidays and a Happy New Year 2017 readers! Thanks for joining me today as we go over the SANS 2016 Holiday Hack Challenge! Which honestly, was the most fun I ever had!

    2016

    VulnHub - Kioptrix 5

    Welcome back to the Final Chapter of the Kioptrix VM Series!

    VulnHub - Kioptrix 4

    Welcome back to the Kioptrix VM Series!

    VulnHub - Kioptrix 3

    Welcome back to the Kioptrix VM Series!

    VulnHub - Kioptrix 2

    Welcome back to the Kioptrix VM Series!

    VulnHub - Kioptrix 1

    “Try Harder”… the quote that brings fear and confusion into every PWK participant; all working hard to obtain the prestigious OSCP Certificate.

    NCL CTF - Regular Season: WiFi Cracking & Exploitation

    Welcome back to part 2 of my NCL Regular Season posts. This post will cover the WiFi Cracking and Exploitation parts of the CTF.

    NCL CTF - Regular Season: Crypto & Log Analysis

    The NCL Regular Season has finally come to an end, and I must say that I really enjoyed it! The challenges ranged in easy to hard difficulty, and really required some “out of the box” thinking and previous knowledge of coding, log analysis, forensics, and hacking!

    NCL CTF - Preseason: Network Traffic Analysis (Part 2)

    Welcome back to the continuation of the NCL Preseason Posts! Today we will be covering Part 2 of the Network Traffic Analysis portion of the NCL Preseason game - this is also the final content that was presented during this CTF. If you don’t know what the NCL is, or what these posts are about, then I suggest you go back and read my Introduction Post which can be found here!

    NCL CTF - Preseason: Network Traffic Analysis (Part 1)

    Welcome back to the continuation of the NCL Preseason Posts! Today we will be covering Part 1 of the Network Traffic Analysis portion of the NCL Preseason game. If you don’t know what the NCL is, or what these posts are about, then I suggest you go back and read my Introduction Post which can be found here!

    NCL CTF - Preseason: Log Analysis

    Welcome back to the continuation of the NCL Preseason Posts! Today we will be covering the Log Analysis portion of the NCL Preseason game. If you don’t know what the NCL is, or what these posts are about, then I suggest you go back and read my Introduction Post which can be found here!

    NCL CTF - Preseason: Cryptography

    Today we will be covering the Cryptography portion of the NCL Preseason game. If you don’t know what the NCL is, or what these posts are about, then I suggest you go back and read my Introduction Post which can be found here!

    NCL CTF - Preseason: Intro & OSINT

    The National Cyber League Fall 2016 Season has officially started! And I am way beyond excited to be competing this year, and to be testing my knowledge against thousands of college students across the nation.

    VulnHub 'SickOS: 1.1' - CTF

    Welcome back to another VulnHub CTF write-up! Today we will be pwning SickOS 1.1 - which can be found here on VulnHub.

    VulnHub 'Stapler: 1' - CTF

    Welcome back to my 2nd - VulnHub CTF! This time we will be tackling Stapler: 1!

    VulnHub 'Mr.Robot 1' - CTF

    When a bug finally makes itself known, it can be exhilarating, like you just unlocked something. A grand opportunity waiting to be taken advantage of. - Mr. Robot, 2016

    OverTheWire: 'Natas' Solutions 16-20

    Welcome back! This post is the continuation of the Natas wargame from OverTheWire.

    OverTheWire: 'Natas' Solutions 11-15

    Welcome back! This post is the continuation of the Natas wargame from OverTheWire.

    M-Trends 2016: Cyber Threat Report Overview

    Another one… over a million records were released to the public; usernames, passwords, credit card information. It’s just another breach in a long line of breaches. The year of 2015, and 2016 was pretty big for cyber attacks, affecting major companies and many users worldwide. It’s become of norm now, with the ever expanding field of technology… cyber security is gruelingly trying to keep up with the ever evolving threat of cyber crime.

    OverTheWire: 'Natas' Solutions 1-10

    Web Hacking; one of the most dangerous attack vectors out on the internet in today’s world. Web Hackers have gotten away with millions of user accounts and passwords, credit card information, and even social security numbers!

    OverTheWire: 'Leviathan' Solutions 1-8

    Leviathan: A large aquatic creature of some kind. The Bible refers to it as a fearsome beast having monstrous ferocity and great power. Today, the word has become synonymous with any large sea monster or creature. In literature it refers to great whales, and in Modern Hebrew, it simply means “whale”. And trust me… you will have a “whale” of a time with this wargame! Eh? EH? No? – Fine, I’ll see my way out…

    OverTheWire: 'Bandit' Solutions 11-25

    Hey, Welcome Back! This post is the continuation to the “Bandit” Wargame found at: overthewire.org.

    OverTheWire: 'Bandit' Solutions 1-10

    Over the past couple weeks, I have been digging deeper and deeper into the realm of penetration testing (or as many like to call it… hacking). I have been obsessively doing researching, practicing, and honing my basic level Linux skills, as well as expanding my toolset knowledge.