Greetings on Professor Kay.
And in a short video presentation, we're going to be conducting a walkthrough for the Capture the Flag
Exercise EVM version one.
Even version one was created by code and is intended to be an easy beginner, boot to root challenge.
This lab works best when used with virtual box.
The CTF is designed to introduce those new to CTF exercises, some of the basics of pen testing.
For this lab requirement, you will need one install a virtual box, one virtual install of Linux and
one virtual install of the target olva file.
Once you have your virtual machines up and running inside a virtual box, do ensure that you have the
networking for both machines configured for host only adapter.
You're going to go up to devices, you're going to go to network, you're going to click on network
settings, and you're going to select from the attached to host only adapter.
You'll want to do that on both of your virtual machines.
We can assume that we have already recovered and identified our target, which is the site itself that
takes care of step one of the hackers methodology, reconnaissance, our next step and the hackers methodology
would be network scanning.
And now that we have the target network identified, we need to find the IP address of our target machine
and for that we need to identify our network IP now to begin this process.
I'm just going to open up a terminal on my calling machine.
And I've zoomed in to the terminal prop itself, so you can better see exactly what it is I'm doing
at the terminal now to identify my network IP, I have to find the first three octets of my IP address
to do this.
I'm just going to type in I-F config.
And you'll notice that Ethan, as you know, is the network adaptor that we're going to focus with,
so that IP address that is assigned to it is one nine two one six eight, not 56, not one, two, three.
The first three octets of this IP address are the network IP.
That last octet gives us our host IP.
I'm now going to go ahead and clear the terminal.
Now, if you didn't have any idea of what the network IP for the network was, you could just run net
discover without any of the switches or the IP address or the subnet mask, but that's going to take
a long time.
So I've typed in net discover space Stasha, which stands for the range.
And I'm typed in one nine two one six eight five six, which is the network portion of the IP address,
that zero and I've given it a twenty four, which means that you're going to ignore the first three
octets of this IP address and just focus on the fourth octet, which is the host IP.
This is all I want from you.
That's approximately two hundred and fifty five IP addresses that can be used as opposed to scanning
hundreds and thousands of IP addresses to get the same result.
So I'm going to go ahead and hit enter.
And net discovery is now sending out our request to anybody on the network that will listen.
And after just a moment, you'll notice that the results come back and it gives you a couple of different
IP addresses.
Now, the IP address that we're interested in is the one nine two one six eight five six one zero three
IP address.
That's going to be the IP address of our target.
Now, any IP addresses that I'm showing you, such as the one from my calling machine or for the target
apply to me, those are my IP addresses and your IP addresses may differ.
To break out of the scan, I'm just going to take control, see?
That brings me back to the I'm a go ahead and type in clear.
And now we're going to conduct an MRI scan and we're going to continue on with the scanning portion
of our hacker's methodology.
We're not ready to run that and map scan to look for any parts or services that may be available to
us for exploitation on our target machine.
Now, for this particular scan, I've typed in Dash SC, which is the Inmet switch for launching a number
of scripts against a target.
There is a number of default scripts that in MAP will run against the target.
Now the dash small letter s capital S. That is the typical TCP IP scan.
That and map runs the dash capital O is version checking on the target.
Now interestingly enough, I can actually do an aggressive scan and to do that all I have to do is just
get rid of all these.
Let's take a look at that real quick.
If I get rid of all these switches here and I type in just capital A.
I get the same thing.
Let's see how that works.
Now, if you get this error message about a DNS server not being available, don't sweat it, just ignore
it.
We don't have a DNS server needed because we are in the local area network.
So using the switch dash capital A with within map gets the same results as using the dash small letter
s capital C, the small letter S capital s dash capital O.
The results are exactly the same, but for testing purposes such as a certification exam, you would
want to know all of these different switches and what they actually do when you're running in Matt.
And so our unmap results are in and it tells us that the falling port numbers twenty to fifty three
eighty one ten one thirty nine, one forty three and part four, four or five are open and running the
following services, S.H., DNS, HTP, Pop, three net bios and IMAP.
And you can scroll up and down here and you can see all the different information about the scripts
that were written as well.
And down here, closer to the bottom, you'll see that we also have some information about the version
of lining's that is running on the target.
We get some information about the colonel, we get some details.
And, of course, we got the traceroute results, which tells us that the target is just one hop away.
Let's go ahead and minimize our terminal and let's bring up a browser.
So we know that we have HTP running on our target machine and is running an Apache Web service, so
let's take a look at the Web page now.
I consider this the low hanging fruit when it comes to testing.
This is the easy stuff.
And this is where we can usually find some type of comment, we can find some type of code, and that
would be located up inside of the source for that Web page.
Let's take a look at how we do that.
So I'm going to open up a browser and in the address bar, I'm just going to type in the IP address
of the target machine that is running a Web service.
And it comes up with a default page for Apache, and if we scroll down here just a little bit, we get
our first clue and it says, you can find me at a directory.
Located on this machine called WordPress, I'm vulnerable.
Webapp, OK, that's a pretty good clue.
Now, you can also right click and you can view this selection source and see if anything else is going
on in here, and I don't see nothing else except that little bit of a message we were just given about
something being vulnerable.
Close that out.
So we can minimize our Web browser, send it up to the task bar.
So to confirm that there actually is a directory called WordPress on the Apache server, we can use
another application called Derp.
Derp is a Web content scanner.
It looks for existing and or hidden Web objects.
Derp works by launching a dictionary based attack against a Web server and analysing the responses.
Let's go ahead and open up a fresh terminal.
Dirt comes preinstalled with your Calli installation, so at the pump, all I have to do is just type
in derp space and the you are RL for that target machine and that's going to be HTP calling, for example,
or the IP address.
I'm going to go ahead and hit enter.
Dirt comes back right away and it tells us that there actually is a directory located on that Web server
called WordPress and we can see the results right here.
Now, we know that this is also going to be a WordPress site because we can see the contents down here
that tell us that all of these default directories belong to a WordPress application.
Let's go ahead and minimize this terminal as well, and let's open up a new terminal.
Now, another tool that comes preinstalled with your installation of Calli, the WP scanned WP stands
for WordPress.
So we're going to scan that WordPress installation onto the Web server and we're going to find hopefully
a user name and then we're going to look for a password.
So let's look at what I've typed in here.
I typed in scan space, dash dash u rl space the you are L and the directory we want to look in.
So I've typed in http calling for slide four one nine two one six eight dot five six one zero three
four slash WordPress.
That is the directory for WordPress.
And then another four give it a space, a dash E and a space a t dash e space a p dash e.
Capital, you let's go ahead and run this.
Now, the first time that you run WP scan on Calli, it's going to want to go out to the Internet and
pull down any updates that it has for the application.
So you're going to want to go up inside of your networking.
And you're going to want to change on your calling machine, only the adapter from host only adapter
to that network, you're going to rerun the command.
It'll update when it's done updating.
You come back in to the networking settings for just your call and you're going to change it back to
host only adapter.
You're then going to run that command one more time and you will get these results.
So the user we have identified is called corrupted brain.
And now we're going to look for a password for this user called corrupted brain.
Let's go ahead and minimize this terminal.
Now, before we can brute force a password using WP scan against a user called Corruptor Brain, we
need a wordlist.
Now let's look where these wordlist are located.
So back on my Caleigh desktop, I'm going to open up my file system.
I'm going to scroll on down here till I come to UCR.
Open up that directory on the next window pane to the right, I'm going to open up that share directory
now.
I'm going to scroll all the way down to the WS and I'm going to look for Wordlist.
And there it is.
Let's open it up now, the word is that we want to use is the Roku text, but you won't have the Roku
text by default because it's in an archive because it's rather large.
So what you're going to want to do is when you get in here for the first time is right.
Click on the archive for the RockYou text and you're going to select extract here that is going to give
you the text file for the Iraq you dot text wordlist.
It's going to close it out, it's going to bring back up our last terminal, and what we're going to
do here is just go ahead and clear it.
So, again, we're going to do a brute force against that user up inside of that WordPress site called
Corrupted Brain using WP scan.
So again, I've typed in the command scan space dash, dash your URL, that same URL that we had before
going up inside of that WordPress directory, giving it a dash u, which stands for user and the name
of this user is corrupted brain.
Give it a space dash.
Capital P stands for password.
Now I'm going to have to give it the path that I wanted to use to find that RockYou text.
So it's the same path that we used to go find or look at the rock you dot text forward slash USAR forecast
share four slash wordlist and finally for RockYou text.
Now this is a very particular command, so make sure that these switches are at the right color.
Now when you copy and paste, it's the first time they might not be in color.
They could just be the same default text of white.
That means that the switches are not being read or understood correctly by the back shell.
So make sure that this happens because this is a very particular command.
Hopefully this is going to work one time and we don't have to troubleshoot it.
Let's go ahead and give it a go hit enter.
And you'll notice down at the bottom, it begins the scanning of the word list for the password for
our user corrupted brain.
And so our scan completed in three minutes and 15 seconds, it found a valid combination for the username
corrupted, underscoring what they password up to four nine nine two four nine nine.
We're now going to use a well known exploit that's available to us up inside of medicine.
This is going to allow us to establish a reverse shell, which is something every pan tester wants to
do.
We're going to get access as limited as it is to the target machine using a terminal.
And so that's going to conclude this.
First, two parts of the Hackers Methodology Network, STANNING and Enumeration.
And we're going to continue on in the second video with doing the exploitation and privilege escalation
steps.
So I'll see you in the next video, part two.