NetChameleon.com
VulnHub Write-ups
Stapler v1
Initial port scans
unicornscan or all TCP ports
unicornscan or all UDP ports
Further investigation into exposed services
FTP service on port 21
HTTP service on port 80
NETBIOS-SSN service on port 139
Unknown service on port 666
MySQL service on port 3306
HTTP server on port 12380
Wordpress website content
Nikto scan from wordpress website directory
Enumerating Wordpress users manually
Scanning with wpscan
phpMyAdmin
Plan of attack
Exploitation
Using LFI exploit to obtain database user password
Fixing the exploit to work with Stapler
Testing the modified exploit
LFI wp-config.php
LFI /etc/passwd
Gain command execution using MySQL
Privilege escalation
Alternative Methods for initial shell
Targeted Brute forcing SSH passwords
Alternative privilege escalation
Exploit Cron job
Vulnix
Initial port scans
unicornscan or all TCP ports
Cisco
Cisco IPSec VPN Configuration
Scenario
Define IKE phase 1 policy
Create ACL to define traffic to tunnel
Assign the crypto map to interface
Raspberry Pi Console Server
Hardware Requirements
Option 1 - using single USB to Serial adapters
Option 2 - using single USB to multiple Serial adapters
Optional for 1 & 2
Deciding what hardware to use
Hardware Installation
Software Installation
Creating udev rules
Configure ser2net
Start and enable ser2net at boot
Testing
The Finished Console server
SQL Injection
SQL Injection notes
SQL Injection
Overview
Example vulnerable PHP login code
Testing possible injections
Bypass authentication
Database enumeration
ORDER BY
UNION SELECT
Code execution
NetChameleon.com
Docs
»
VulnHub Write-ups
»
SQL Injection notes
View page source
SQL Injection notes
ΒΆ