When you get a reverse shell during a pentest or a CTF, the shell you receive is usually very limited. It is not a real terminal, just a raw stream of input and output over a socket. This is where the TTY treatment comes in, the process of upgrading that basic shell into a fully interactive one.

Usage is an easy Linux machine that features a blog site vulnerable to SQL injection, which allows the administrator’s hashed password to be dumped and cracked. This leads to access to the admin panel, where an outdated Laravel module is abused to upload a PHP web shell and obtain remote code execution. On the machine, plaintext credentials stored in a file allow SSH access as another user, who can run a custom binary as root. The tool makes an insecure call to 7zip, which is leveraged to read the root user’s private SSH key and fully compromise the system.

Alert is an easy-difficulty Linux machine with a website to upload, view, and share markdown files. The site is vulnerable to cross-site scripting (XSS), which is exploited to access an internal page vulnerable to Arbitrary File Read and leveraged to gain access to a password hash. The hash is then cracked to reveal the credentials leveraged to gain SSH access to the target. Enumeration of processes running on the system shows a PHP file that is being executed regularly, which has excessive privileges for the management group our user is a member of and allows us to overwrite the file for code execution as root.

Scrambled is a medium Windows Active Directory machine that requires a technical chain of exploitation starting with initial web enumeration to acquire credentials for the user ksimpson under a strict environment where NTLM authentication is disabled in favor of Kerberos. Using these credentials to access public SMB shares uncovers intelligence regarding an internal SQL service. Active Directory enumeration reveals that the SqlSvc account has a registered Service Principal Name (SPN), enabling a Kerberoasting attack to harvest and crack its service ticket hash. With the SqlSvc credentials obtained, an attacker performs a Silver Ticket attack to forge a valid Kerberos ticket and impersonate the Administrator user against the remote MSSQL instance. Querying the database exposes credentials for the MiscSvc account, which are used to gain initial code execution on the host via PowerShell Remoting. Further internal enumeration reveals a custom .NET application listening on port 4411. Reverse engineering this application exposes the use of the insecure BinaryFormatter serialization class, which is leveraged to upload a malicious payload and achieve final privilege escalation to NT AUTHORITY\SYSTEM through insecure deserialization.

Health is a medium Linux machine that features an SSRF vulnerability on the main webpage that can be exploited to access services that are available only on localhost. More specifically, a Gogs instance is accessible only through localhost and this specific version is vulnerable to an SQL injection attack. Due to the way that an attacker can interact with the Gogs instance the best approach in this scenario is to replicate the remote environment by installing the same Gogs version on a local machine and then using automated tools to produce a valid payload. After retrieving the hashed password of the user susanne an attacker is able to crack the hash and reveal the plain text password of that user. The same credentials can be used to authenticate to the remote machine using SSH. Privilege escalation relies on cron jobs that are running under the user root. These cron jobs are related to the functionality of the main web application and process unfiltered data from a database. Thus, an attacker is able to inject a malicious task inside the database and exfiltrate the SSH key file of the user root, thus, allowing him to gain a root session on the remote machine.

Hydra Cheatsheet to help make your brute-force testing a whole lot easier. If you always forget the exact flags for target protocols, user lists, or multi-threading, this guide is for you. It’s straight to the point, easy to read, and perfect for your cybersecurity toolkit.

Nmap Cheatsheet to help make your network scanning a whole lot easier. If you always forget the exact flags for OS detection or fast scans, this guide is for you. It’s straight to the point, easy to read, and perfect for your cybersecurity toolkit.

In this post, you'll learn how the TCP and UDP protocols work and how connections are established using the Three-Way Handshake.