Greetings, I'm Professor Kay and initiate video presentation.
We're going to see how we go about completing the CTF walk through for InfoSec Prep OCP.
This ETF was created by foreign spy with the support of the staff at InfoSec, this ETF is rated as
easy, but there are plenty of walkthrough available on the Internet and on YouTube that make it much
harder than it needs to be.
This walk through was built using a number of online resources and walk Theroux's, including the walk
through from the YouTube channel of I.T. Security Labs and the website of passing OCP by Alex Dhiab.
The lab requirements for this capture flag exercise are one install of either virtual box or VM where
those virtual boxes preferred, one virtual install of Linux and one virtual install of the infosec
prep Colen OCP oveI file, which can be downloaded from the volume hub site.
All links are provided for you inside of the lab while.
To begin the lab, we both, your Calli attack machine and the OCP target are up and running inside
of either virtual box or VMware next, ensure both their network settings are configured for net network.
Let's see how that's done.
So I'm going to upgrade a device on the go to network.
And I'm going to do this on both my machine and the target machine, and I'm going to ensure that the
network settings are that network.
Once you have both virtual machines up and running, open up your target machine and you will have a
terminal at the top left of the terminal, you will see an IP address that's been assigned to you for
this particular machine.
Take note of that IP address.
You will need it for the lab.
The next thing you want to do is open up a terminal on your calling machine and you and I have config.
You show that you have an IP address for your Ethernet zero adapter or whatever Ethernet adapter is
currently being used to connect you to this virtual network between you and your target is going, Taiping,
clear.
Now, I'm going to go ahead and ensure that I have connectivity between my calling machine and my target
by doing a ping.
And I have good replies now to break out of the sequence, I'm just going to do a control, see?
And I can close out my terminal.
On your counting machine, right, click on the desktop and from the context, when you scroll on down
to where it says great folder, you're going to create a new folder and you can call it OCP.
Once you have that folder created, go ahead and right, click on it and select from the context menu
open terminal in here.
And so as with every captured flag exercise or Pentax, the first thing we have to do is enumerate.
So we have a target and we're going to enumerate it using and map and we're going to be looking for
any services or ports that are currently running on that target that we might be able to exploit.
So at the command prompt and map space Desh Small Letter S Capital C Space Desh Small Letter S Capital
V followed by the IP address of my target.
Now this is my IP address for my target.
Your IP address will differ.
Go ahead and hit.
Enter.
And Matt quickly returns our scan results and we see that our target is running S.H. on Port Twenty,
an Apache Web server running on Port 80.
We also have all the Virgin information for the software running on Port twenty two point eighty that
we need in case we need to download exploits or run scripts.
Now, what's interesting about the Web server is it shows us that there is a robust text file and it
has one disallowed entry that might be of interest to us.
And it also has a secret dot text file that is part of that robust text.
So we're going to take a look at that in just a moment.
But for first, going to do some more numeration, so let's go ahead and minimize this terminal, and
if we need to, we can come back to the information later and we're going to open up a new terminal
and we're going to continue on with our numeration running go buster.
And I'm going to go ahead and copy and paste this long command from my left file.
Ghostbuster is a tool for brute force in your eyes.
Files and directories and DNS subdomains.
So what I've done here is I typed in Ghostbusters space.
I wanted to look for directories, DVR, dash you on the server with the address of 10 zero to 17,
and we're going to use a word list.
That's what the Dash W stands for.
And that word list is located up inside of the US are for SlideShare for word list, a directory inside
of that dirt buster directory.
And it is called.
Directory dash list dash to dot, three dash medium dot text, and we're looking for file types, which
is what the Dash X represents.
I want to look for file times for p h, html and text.
Go ahead, run the command.
As I go, but the results continue to flow in, we learn that we have a WordPress site running on our
target.
We have the WordPress content, the login license, the read me dot org, html file.
And, of course, a robust text, along with the secret dot text that we're going to take a look at
in just a moment.
But you see that we have a lot of good targets that we can go after here and we can run WP scan.
We could run some other tools if we so desire, but we're still in the enumeration phase.
And so what I'm interested in is what's inside of that robust text file.
And I'm especially interested in what's going on with that secret dot text.
So what we're going to do next is open up a Web browser and we're going to go after that low hanging
fruit that we just discussed.
So let's go ahead and minimize this terminal, we can come back to it later if we so desire, and let's
go ahead and open up a Web browser.
So I've opened up my browser up inside of my desktop and I've just typed in the IP address of the target,
which was 10 to 17.
This is my IP address.
Your IP address will probably differ and we can start by going over some of the information that's available
to us up inside of this Web site.
So let's begin by looking over the homepage here.
And one thing that is of interest is that we find that there's only one user account that is available
for this box and that user is Osip.
We'll need to know that for later on.
We can also take a look at the source information so I can click on this Web page and I can view the
page source.
Now, a lot of times up and side of the page source, you'll find that there's a lot of comments and
there may be little pieces of information regarding passwords, user accounts and other information.
Now, we're not seeing none of that on here.
But as you go through these other sites and you do your prep for the OCP, this is something that you
want to be aware of.
Always look at the page source information to ensure that you're not missing anything that's going to
set you back.
Want to make sure you scroll on down here and you take a look at all the different links that you have
available.
There's Hello, World.
You've got a number of different links in here that you can take a look at now, all of these are avenues
for possible exploits, but we're going to do it a little different.
We're not going to use tools for this CTF.
Primarily, what we're going to do is use just the command line and we're going to capture that flag
and see how we do that.
Now to look at the robots that text file.
All I have to do is type in or append a four robots, not text to the front of the IP address of the
target.
And you'll see here that we have something called secret and we go ahead and adjust my.
View here, Mizo.
OK, that's better now you can see that we have a secret check now the robust tax is designed to tell
any of the spiders out there that are crawling the web looking for information to catalog, to ignore
the secret text.
In this case, we're telling the web crawlers do not catalog this particular resource that is on this
Web server, disallow it.
And a lot of times you also find other information up here, such as versioning, and you might even
find a username or even a password that might be available to you that's been posted by the admin.
Now, to look inside of that seekers' dot text, all I did was remove the robots dot text from the front
of the IP address and I appended a four secret dot text to the IP address.
I hit Enter and now I'm showing the contents.
And what we have here is a base64 code and it's probably going to be for an SSA key.
Now, the next thing we need to do is take everything that's inside of this secret text that we're going
to copy it.
So I'm going to go ahead and make sure I have everything copied from the top to the bottom.
I'm going to right click and I'm going to copy, I'm then going to open up a new browser tab and in
the search bar I'm going to type in base64 decoded.
From those results, I would take the first one and I'm going to launch and I'm going to go to the website
that's going to allow me to decode this base64 hash in his first window.
I'm going to go ahead and do a control V and paste everything that I just copied off of that secret
text file.
I want to scroll on down and I'm going to press the decode button.
And this is your decoded sixty four code that we copied over from that secret text file.
Now, in this case, we have what's called a private key for our open S.H. So we're going to go ahead
and copy this and say I'm going to do this, which is placed my mouse inside of the second window.
I'm going to do a control.
I'll do a control.
See, I'm now going to minimize my browser.
Once I back to my desktop, I'm just going to find my working directory, which is OSTP, right, click
on it from the context menu.
I'm going to select open a terminal here.
Now I'm going to create a text file using an editor.
Now my editor choice.
Now you're free to use any text editor you want.
I'm going to type in nano space key dot RSA.
I'm going to hit enter now.
I have a blank file.
I'm going to right click inside of this blank file and I'm going to say page clipboard.
Now I'm going to page the contents of that open S.H. private key into this text file and I'm going to
save it by doing a control act.
I do a control X and then it asks me, do you want to say the modified buffer?
I'll type in Y for yes.
Now I'm going to hit enter and we're back to the prompt now to see if I actually have that file inside
of my OCP directory.
I'll just type in ls.
I see that I do have a file called Ketut RSA, if I want to see if I actually say the contents to this
text file called Key Dot RSA, I can just do a cat.
Space type in the name of the file that I want to print out to the terminal, which in this case is
key, the RSA can enter and I see that I have the private key.
You can go ahead and close out this terminal now, the next day we have to do for that file that we
just created for the open S.H. private key is we have to set the permissions so that we have access
to it when we get ready to launch that SSA shell over on to the target.
Now to do this.
I'm going to do the change my command and I'm going to use the numbers.
Six hundred and I'm going to sign this permission to the key dot RSA file.
I'm going to go ahead and hit enter.
And it comes back to the command prompt, let me know that my command completed successfully.
So earlier on, we discovered that there was only one user on that Web server, and that was Osip up
inside of the secret text, we discovered the base.
Sixty four code for the open, a private key.
Now that we have both of those pieces of information, we can attempt to establish and assess each session
on to the target machine.
At my prompt, I typed in S.H. Space the name of the user, which is OSTP at the IP address of my target,
which is 10 dot zero dot to 17 space dash I which means use the following file for the key, which is
key dot RSA.
I want to go ahead and hit enter.
And it comes back and locks me on as OSTP to the target machine using S.H., I want to see if I can
find the permissions and see that if I'm logged on a suitable or route and to do that, I'm just going
to type in pseudo space.
Dash I.
Hit enter.
And now it wants the pseudo password, which we don't have.
So the next thing that we need to do is find out exactly what permissions I currently have available
to me as the logged on user that I currently am now to do this.
I'm just going to type in the following command here, meaning of all this.
That is to say, the command syntax is available to you up inside the lab while.
I'm going to go ahead and hit enter.
And as you can see, is pulling up all of the files and directories that I currently have access to.
It's not telling me that permissions, but that's OK.
I think we've got an option here that's going to get us into the route, which is where we need to be,
and that's going to be used in the Basche.
But let's see how we do that.
Now, Bash is most likely going to have.
Route access to the system, and that means that who's ever using it is going to have route access.
So we're going to go ahead and type in the following.
We're going to type in a forward slash USAR forward slash bend forward slash bash.
And we want to assign these permissions to the current user.
So I'm typing a dash p now.
If I run the ID command, we can see exactly what permissions that the user who's using the Basche permissions
actually has some type and ID hit enter.
And you can see that I'm now a member of the Group Zero which has route access and that's what we need.
So the next time we want to do is change over to the root of the machine to do this and you can type
in code for I'm a hit enter and now I'm at the root of the machine.
Now, the next time we want to do is analysis to see what's actually available to us here.
So I'm typing less and you'll see that we have a root folder.
So we want to get into the root folder, because that's where our flag is some type and see the four
root.
And I should be inside of that root folder now and it's check, I can just do another else hit enter
and you'll see that we have a number of items inside of here.
And one of those is the flag.
That text now to get the key to complete this capture the flag exercise for this voucher.
I'm going to go ahead and get that text file out by typing in cat space.
When I got text and you'll see that we have the key presented to us and so you can see that this capture,
the exercise was very easy, but it was made easy by the individuals that actually worked on producing
the walkthrough that I use for this video presentation.
Now, that doesn't mean that it's always easy because there are a lot of other work crews that are 40
minutes long, 15 minutes long and even over an hour long as they go through the process of trying to
capture that flag.
But we captured the flag without using any of the utilities at our disposal.
We didn't have to run, scan or any other tools to try to capture a password or figure out how to get
access to a shell on the target.
We did it using just observation and enumeration of the target and looking for clues.
And so that's going to conclude this short video presentation on how we go about completing the walkthrough
for the infosec OCP capture to flag exercise.
You got questions.
You got concerns.
Don't hesitate to reach out and contact your instructor and I'll see you in my next video.