Posts

First of all, I believe CTFs are, at their core, about learning and problem-solving. They present you with a variety of challenges that you are expected to solve yourself, awarding points for each one and ranking players based on how many challenges they manage to solve. Why it changes the competition Over the last few years, AI usage has skyrocketed in pentesting, and naturally, it has also made its way into CTFs. Nowadays, we can see challenges being solved in seconds and scoreboards reaching extremely high scores only a few minutes into a competition. ...

Last week, I took the Certified Red Team Professional course. My goal was to build a strong foundation in Active Directory attack and defense, and honestly, I couldn’t have asked for a better course. From the materials to the lab experience, everything exceeded my expectations. Course Experience I started by watching the video tutorials, which explain core Active Directory concepts. These are a must-watch, as they cover everything essential. Taking good notes on these videos can save you a lot of research time later. ...

Initial Enumeration So lets deploy the machine and start enumerating. We can see ssh open on port 22 and a http web server on port 80. If we enter on 10.10.199.61 we see Apache2 Ubuntu Default Page. After some directory enumeration, we find the following: /blog /phpmyadmin /javascript /wordpress/wp-login.php It is necessary to add internal.thm to our /etc/hosts file to navigate through the website. Since we know admin is a user because he has a post on the website, we can brute force the login page using wpscan and rockyou.txt for the password. ...

Enumeration Nmap scan for open ports nmap -p-15000 -vv 10.200.81.200 Nmap scan for OS recognition through headers nmap -vv 10.200.81.200 --script=http-headers Exploitation Once vulnerability is found, download script from github. git clone https://github.com/MuirlandOracle/CVE-2019-15107 For python pip install: sudo apt install python3-pip If privileges are missing use: chmod +x yourfile.py Now we can open the reverse shell: Set up netcat listener to catch reverse shell. nc -lvnp 4444 Use rlwrap to stabilise the shell. Now lets get ssh credentials since we won’t be able to crack password hash. ...

Metasploit Basic Commands search x use x info show options, show advanced options SET X (e.g. set RHOST 10.10.10.10, set payload x) Meterpreter Commands background sessions -l sessions -i 1 sysinfo, ifconfig, route, getuid getsystem (privesc) bypassuac download x /root/ upload x C:\\Windows shell use post/windows/gather/hashdump Networking Attacks Brute Force with Hydra hydra -L users.txt -P pass.txt -t 10 10.10.10.10 ssh -s 22 hydra -L users.txt -P pass.txt telnet://10.10.10.10 Windows Shares with null sessions ...