search
Page cover

h4cked

Find out what happened while analyzing a .pcap file and hack your way into the machine.

hashtag
Task 1: Oh no! We've been hacked!

To clear the SYN and ACK segments that do not have data of interest, use the command frame.len != 66 and frame.len != 74, with this we indicate that the frames with a size different to 66 and 74 do not show them, in my case they were the sizes of these segments that did not serve me at all.

This way everything is cleaner and "prettier" to the eyes.

hashtag
The attacker is trying to log into a specific service. What service is this?

ftp

Aca vemos como el atacante esta intentando loggearse

There is a very popular tool by Van Hauser which can be used to brute force a series of services. What is the name of this tool?

hydra

The attacker is trying to log on with a specific username. What is the username?

jenny

Se ve como en el campo user

What is the user's password?

password123

Aca vemos como el usuario despues de introducir la contraseña "password123" el sistema le devuelve con un "Login successful"

What is the current FTP working directory after the attacker logged in?

/var/www/html

Cuando ejecuta el comando "pwd" podemos ver que le responde con un "/var/www/html"

The attacker uploaded a backdoor. What is the backdoor's filename?

shell.php

The backdoor can be downloaded from a specific URL, as it is located inside the uploaded file. What is the full URL?

Which command did the attacker manually execute after getting a reverse shell?

whoami

What is the computer's hostname?

wir3

Which command did the attacker execute to spawn a new TTY shell?

python3 -c 'import pty; pty.spawn("/bin/bash")'

Which command was executed to gain a root shell?

sudo su

The attacker downloaded something from GitHub. What is the name of the GitHub project?

reptile

The project can be used to install a stealthy backdoor on the system. It can be very hard to detect. What is this type of backdoor called?

rootkit

hashtag
Task 2: Hack your way back into the machine

  1. Since the previous hacker changed the password we will have to do brute force against ftp using hydra.

We see that the password is 987654321

  1. We connect with the credentials, with the command put we upload our shell, and give it run permissions with. chmod 777

  1. We tap with the command nc -lvnp 6666 and on the web we access our shell to run so it gives us the reverse shell.

  1. Now all that's left is to upgrade to TTY with python3 -c 'import pty; pty.spawn("/bin/bash")', after that we change user to jenny using the same ftp credentials, and with sudo su we become root.

PreviousGaming ServerNextBuffer Overflow Prep OSCP

Last updated