This is more of a question than anything else for you guys.
I'll probably be busy with PWB for the next few weeks until I get to college. In the mean time I'm interested in what you guys are interested in hearing from me.
Here are some of my ideas:
1. iOS Security (would have to be after PWB or around exam time due to time needed to setup and other things)
2. Daily Life and Thoughts
3. More fuzzing and exploitation info.
4. My life in colledge as I learn a hacking degree.
5. *Insert your item here*
Leave a comment below and let me know what you think :)
-tekwizz123
Tuesday, July 10, 2012
Saturday, July 7, 2012
PWB Update
Hey guys,
So its been a while. I apologize for that but between traveling and trying to work on this course I haven't given this blog too much thought until now. So time to make up for all of that.
So the course is actually getting much harder now. At present I now have about 9 hosts left in the student labs, I have one on the IT labs and I have yet to get into the admin or dev networks. Oddly though I did find a host that was dual homed, but it doesn't seem to have a network-secret.txt file anywhere to be found, which is a bit odd; makes me wonder if I got into the Dev networks or not. I only have about 25 days left so its starting to get a bit tight. I always seemt o wonder if I will get into anymore hosts, and then I prove myself wrong.
That being said I have recently had a period where I just felt like giving up. I couldn't see any way of getting into these hosts at all. Again this is where enumeration comes in handy, because yesterday I found that I actually was able to get into one, through the sheer luck of testing a random exploit and finding that it worked. I had overlooked that the website was running a piece of software that was still using a default password and thus allowed me to gain top level privileges on the system.
Anyway I won't be touring as much now, this week i will mostly be in one place.
In other news, if any of you are going to the HOPE conference in New York, please, please leave a comment below. I would love to meet you guys in person and have a chat. I know most of you probably won't be in the area (or the country even) but if you are going it would be a pleasure. Details can be found on the website www.hope.net.
So its been a while. I apologize for that but between traveling and trying to work on this course I haven't given this blog too much thought until now. So time to make up for all of that.
So the course is actually getting much harder now. At present I now have about 9 hosts left in the student labs, I have one on the IT labs and I have yet to get into the admin or dev networks. Oddly though I did find a host that was dual homed, but it doesn't seem to have a network-secret.txt file anywhere to be found, which is a bit odd; makes me wonder if I got into the Dev networks or not. I only have about 25 days left so its starting to get a bit tight. I always seemt o wonder if I will get into anymore hosts, and then I prove myself wrong.
That being said I have recently had a period where I just felt like giving up. I couldn't see any way of getting into these hosts at all. Again this is where enumeration comes in handy, because yesterday I found that I actually was able to get into one, through the sheer luck of testing a random exploit and finding that it worked. I had overlooked that the website was running a piece of software that was still using a default password and thus allowed me to gain top level privileges on the system.
Anyway I won't be touring as much now, this week i will mostly be in one place.
In other news, if any of you are going to the HOPE conference in New York, please, please leave a comment below. I would love to meet you guys in person and have a chat. I know most of you probably won't be in the area (or the country even) but if you are going it would be a pleasure. Details can be found on the website www.hope.net.
Monday, June 25, 2012
A Complete Agglomeration of Fail
Well I guess you could make that two fails now that I look back on this. First fail: I havn't been blogging nearly as much as I thought I would. Then again that might be a good thing considering how much time has been required for this lab and getting the info + hosts I have gotten so far.
But so far is now only a relative term. Because guess what? I deleted my stuff.
How?
Here's how:
rm -rf * (the directory I wanted to delete instead)
Guess what that equates to? This:
rm -rf *
So poor little me lost about a good 70% of his work in about 10 seconds. Yay. Shall I give a little overview?
Downsides:
Plus Sides:
Yeah, so my 20-22 or so hosts that I exploited have to be redone again by hand. Double yay.
/end rant
In other news, I will be heading off to America soon to tour countries with my bro for colledge. Internet will be intermittent so if you have me on Skype just know that I won't be on very often. Because ontop of repairing all this damage I also have to try and wrap up the labs and exploit the last couple of hosts. To add to that I will also be traveling around quite a lot, and thus on those 6 hour car rides you can be sure as hell I won't have internet then.
Anyway, just giving an update on what happened and giving you your daily lolz.
-tekwiz123
But so far is now only a relative term. Because guess what? I deleted my stuff.
How?
Here's how:
rm -rf * (the directory I wanted to delete instead)
Guess what that equates to? This:
rm -rf *
So poor little me lost about a good 70% of his work in about 10 seconds. Yay. Shall I give a little overview?
Downsides:
- Lost all scans and most of my notes.
- Lost all my pictures.
- All files downloaded from machines are now gone.
- All dumped hashes are now gone.
- The notes on the actual exploits for each machine are now gone.
- Pretty much f***ing everything is now deleted or is not available to me.
Plus Sides:
- For some odd reason, shutter happens to save each photo that you take as a snapshot before you choose the save as button and save it elsewhere. So I still have all my photos, just in a different place.
- My memory for things is good, so I should be able to remember most of the exploits for the various hosts.
- Downloaded files are actually not that big of a problem. Most of them were just downloaded because I could, a few actually mattered though.
- The outline format for the notes still exists, so I know what information needs to go where, I just have to get the info first.
Yeah, so my 20-22 or so hosts that I exploited have to be redone again by hand. Double yay.
/end rant
In other news, I will be heading off to America soon to tour countries with my bro for colledge. Internet will be intermittent so if you have me on Skype just know that I won't be on very often. Because ontop of repairing all this damage I also have to try and wrap up the labs and exploit the last couple of hosts. To add to that I will also be traveling around quite a lot, and thus on those 6 hour car rides you can be sure as hell I won't have internet then.
Anyway, just giving an update on what happened and giving you your daily lolz.
-tekwiz123
Saturday, June 9, 2012
Try Harder :)
So its now been 1 week since I first started this course and I must say its starting to kick me in the ass in some places. A prime example of this was today.While I obviously can't release all the details of the challenge, the specific challenge that I was struggling with was the extra mile challenge from chapter 6 of the lab.
The second one was actually very hard to do. First off, the exploit must end in "}" for the exploit to be triggered, making it rather interesting to find out where to located your shellcode and how it would fit into the provided space. Second off, as noted in one of the fourms, you had to use a DLL from the application itself and not from the OS to get the POP POP RET to work for the SEH. This caused much frustration and confusion for me...though in actually it was pretty obvious that I should have done that as its standard to check application DLLs first, then OS DLLs as this makes the exploit more reliable (the application DLLs load in the same place across OS versions, where as many OS DLLs do.)
The third challenge was getting all of the bad characters sorted out. To do this I used generatecodes.pl and sent this as the payload, then manually checked the results. This allowed me to find that an extra character was also causing problems in addition to the standard ones I had already filtered out, and thus made the application execute the standard SEH handler as per normal.
The fourth and hardest challenged that faced me though was the limited space available for the shellcode. While I can't tell you what I did to go about it, I can say that Corelan's tutorials definitely helped here, and I was able to craft some shellcode that ultimately resulted in a bind shell on port 4444, created via a fairly standard msfpayload encoded to remove all the bad characters.
The main thing I want to point out here is that all of this was possible because when one faces the wall, you really do have to try harder. What I found works best is working at it in chunks. I worked till I felt like I was about to give up, tried a thing or two more, and, wait for the magic...., took a break. Yep. A break really does help, and it lets you calm down and think things through more. This last exploit took me literally a day to create (from 12 am to about 10 pm) on and off so it was a lot of work but the breaks helped to make things clearer.
Well thats all I have for now. :)
-tekwizz123
Wednesday, June 6, 2012
4 Days In
Yep thats all it took. 4 days in and i broke my machine somehow..... busy backing it up atm, so I thought it would be a good time to give an overview of my thoughts on this course.
So far its been an amazing course. I know im going to be reflecting the thoughts of others here but even if I don't pass, the amount of info and the clarity of its presentation is simply top notch for the most part (a few videos went a bit fast for me, but so far its only been 1-2)
Futhermore the extra mile challenges are, well, actually quite a challenge. So far i have done all of them except for the DNS extra mile challenge, which i skipped because i was too tired to do it then...will have to come back to that one.
As for the actual exploiting part, i managed to get a few boxes on the first day, followed by 1-2 a day on Monday and Tuesday. From there its kinda stopped, and i know have about 6 boxes so far. The total number of boxes in the lab is about 45 or so, so i still have a long way to go.
One of the most interesting things about this course though is that although they don't tell you how to exploit any of the machines, they do give you some help by walking you though how to do different enumeration techniques in the videos, and then ask you to perform these on the labs. This makes for a very enjoyable experience as you get to learn how Mutts would go about doing it, and then your given the opportunity to recreate that in the lab, both learning the skills and gaining knowledge that you will need for later pentests.
Now one of the many things that is asked when taking this course is how much programming language that you need. From my personal experience, walking into this course I had known some programming from my exploit development and Grey Hat Python book, but i had no experience in Bash whatsoever. Personally speaking, I do think you need a bit of programming knowledge to understand some sections reguarding Python if you don't want to get caught up and have to look everything up, but then again you could enter this course without any experience in it; it just might hinder your progress a little bit.
As for the bash side, if you don't know it don't worry. So long as you know how to move around and do basic things in Linux, you will be fine. Honestly I didn't know how the cut command worked at all, and Muts provided one of the best examples of it, and know I love it. /being lame comment Bash has sort of become my new best friend in a way /end lame comment
Overall, very very good course. Unfortunetly I can't say much more as im only beginning module 6 + I don't want to spoil the course for you guys who might be considering taking it.
Now im going to go fix this dang pc...........raaaaaagh.....i think i might also have some cookies with that ;)
-tekwizz123 (*munch*)
So far its been an amazing course. I know im going to be reflecting the thoughts of others here but even if I don't pass, the amount of info and the clarity of its presentation is simply top notch for the most part (a few videos went a bit fast for me, but so far its only been 1-2)
Futhermore the extra mile challenges are, well, actually quite a challenge. So far i have done all of them except for the DNS extra mile challenge, which i skipped because i was too tired to do it then...will have to come back to that one.
As for the actual exploiting part, i managed to get a few boxes on the first day, followed by 1-2 a day on Monday and Tuesday. From there its kinda stopped, and i know have about 6 boxes so far. The total number of boxes in the lab is about 45 or so, so i still have a long way to go.
One of the most interesting things about this course though is that although they don't tell you how to exploit any of the machines, they do give you some help by walking you though how to do different enumeration techniques in the videos, and then ask you to perform these on the labs. This makes for a very enjoyable experience as you get to learn how Mutts would go about doing it, and then your given the opportunity to recreate that in the lab, both learning the skills and gaining knowledge that you will need for later pentests.
Now one of the many things that is asked when taking this course is how much programming language that you need. From my personal experience, walking into this course I had known some programming from my exploit development and Grey Hat Python book, but i had no experience in Bash whatsoever. Personally speaking, I do think you need a bit of programming knowledge to understand some sections reguarding Python if you don't want to get caught up and have to look everything up, but then again you could enter this course without any experience in it; it just might hinder your progress a little bit.
As for the bash side, if you don't know it don't worry. So long as you know how to move around and do basic things in Linux, you will be fine. Honestly I didn't know how the cut command worked at all, and Muts provided one of the best examples of it, and know I love it. /being lame comment Bash has sort of become my new best friend in a way /end lame comment
Overall, very very good course. Unfortunetly I can't say much more as im only beginning module 6 + I don't want to spoil the course for you guys who might be considering taking it.
Now im going to go fix this dang pc...........raaaaaagh.....i think i might also have some cookies with that ;)
-tekwizz123 (*munch*)
Friday, June 1, 2012
The Day Before....
Okay so its the day before PWB starts and im super bored so I thought I would give ya all an update.
Anyway, today I'm officially graduating from school :) Ceromony starts at 2pm and as I write this right now its 10:30 am, though I was up at 8 am after by bro busted into my room to find a calculator for his SAT test (yep today is one of those days)
This also means that im going to spend the good part of an hour waiting for my diploma, since i go last as my last name starts with a "W"......yaaay....big woop.
Futhermore that also means my family can't see me either......
Anyway enough about me, and onto my thoughts about PWB. Yesterday I asked around to find what would be the best way to prepare on my last day before the exam and some people have recommended that you do some boot2roots. (A great list can be found on g0tmi1k's website. Search google for "vulnerable by design" and you should find it)
So naturally I downloaded some, specifically all of the Kioptrix ones. So far as of this morning I have managed to get through the first three, though I had to ask for help on one of them (the second level) because the exploit on exploit-db is out of date, and thus won't work, and on another one.
Specifially that second one was an interesting lesson. This is something you may want to keep in mind when pentesting:
Why? Well, if you don't rename the file, wget will automatically interpret that file for you on the server. Which is not good if all that results in is a shell on your own server rather than on the remote host hehe.
Yeah other than that i'm working on r00ting Kioptrix Level 4 atm, but it seems like one of the files is missing from the archive.....odd, but i'll figure it out soon.
Also have downloaded a few wordlists from g0tmi1k's site in case I need them for bruteforcing and went ahead and printed out his privledge escalation guide that will help me when I get stuck on getting r00t on the linux hosts.
That's pretty much all i have to say for now....lets see what tomorrow brings.
Anyway, today I'm officially graduating from school :) Ceromony starts at 2pm and as I write this right now its 10:30 am, though I was up at 8 am after by bro busted into my room to find a calculator for his SAT test (yep today is one of those days)
This also means that im going to spend the good part of an hour waiting for my diploma, since i go last as my last name starts with a "W"......yaaay....big woop.
Futhermore that also means my family can't see me either......
Anyway enough about me, and onto my thoughts about PWB. Yesterday I asked around to find what would be the best way to prepare on my last day before the exam and some people have recommended that you do some boot2roots. (A great list can be found on g0tmi1k's website. Search google for "vulnerable by design" and you should find it)
So naturally I downloaded some, specifically all of the Kioptrix ones. So far as of this morning I have managed to get through the first three, though I had to ask for help on one of them (the second level) because the exploit on exploit-db is out of date, and thus won't work, and on another one.
Specifially that second one was an interesting lesson. This is something you may want to keep in mind when pentesting:
- Don't upload php files to a server via wget without renaming them to .php.txt first.
Why? Well, if you don't rename the file, wget will automatically interpret that file for you on the server. Which is not good if all that results in is a shell on your own server rather than on the remote host hehe.
Yeah other than that i'm working on r00ting Kioptrix Level 4 atm, but it seems like one of the files is missing from the archive.....odd, but i'll figure it out soon.
Also have downloaded a few wordlists from g0tmi1k's site in case I need them for bruteforcing and went ahead and printed out his privledge escalation guide that will help me when I get stuck on getting r00t on the linux hosts.
That's pretty much all i have to say for now....lets see what tomorrow brings.
Friday, May 25, 2012
PWB
Okay just wanted to give a heads up to those who are interested.
Its finally offical. As of next Sunday, I am starting PWB from OffSec. What will follow over the next couple of weeks after this will be a weekly or semi-weekly (depending on how busy I am) journal of my current thoughts and opinions on the course. Please note I might take a while to post the entries as I don't want to leak course details that would ruin the fun for others.
Hope to see ya all soon,
tekwizz123
Its finally offical. As of next Sunday, I am starting PWB from OffSec. What will follow over the next couple of weeks after this will be a weekly or semi-weekly (depending on how busy I am) journal of my current thoughts and opinions on the course. Please note I might take a while to post the entries as I don't want to leak course details that would ruin the fun for others.
Hope to see ya all soon,
tekwizz123
Subscribe to:
Posts (Atom)