PETIR CYBER SECURITY – Page 2 – Tim kompetisi Capture The Flag (CTF) Universitas Bina Nusantara – Tempat untuk Belajar Lebih Dalam tentang Cyber Security secara Intensif dan Kompetitif.

[Cyber Jawara 2020 Qualification] – Syscall

Pada soal ini, sesuai dengan deskripsi soal, kita diminta untuk melakukan syscall. Mari kita coba lihat isi netcat. Program memberikan address untuk alamat flag yang akan berubah setiap saat nc di eksekusi. Kemudian, program akan meminta input nomor syscall, kemudian argument yang diperlukan untuk syscall yang ingin dipanggil. Namun, terdapat beberapa syscall yang di blacklist.… Continue reading [Cyber Jawara 2020 Qualification] – Syscall

[Cyber Jawara 2020 Qualification] – ROP

Pada soal ini, peserta tidak diberikan binary, melainkan hanya informasi mengenai binary yang berjalan di server. Dari informasi yang diberikan pada deskripsi soal, binary yang berjalan memiliki konfigurasi kurang lebih sebagai berikut: RELRO: Partial RELRO Canary: Disabled NX: Enabled PIE: No PIE Selain itu diberikan informasi dari file elf_info dimana kita dapat mengetahui architecture dari… Continue reading [Cyber Jawara 2020 Qualification] – ROP

[TJCTF2020] – Admin Secrets

Given a website, where a person can login and register. Both are irrelevant to the challenge, so I will cut the chase. The other feature, the ‘relevant’ feature of the challenge, is a feature that allows the user to write a note and even send the note to an admin (evil laugh). It isn’t hurt… Continue reading [TJCTF2020] – Admin Secrets

[TJCTF 2020] – File Viewer

Given Challenges looking like this, entering one of that files opens it Looking closer to the URL we can see that it’s most likely some type of file inclusion challenge Trying standard LFI stuff seems to be a success As you can see, we can access ‘/etc/passwd’, soo… what can we do? First thing comes… Continue reading [TJCTF 2020] – File Viewer

[HackTheBox] – Traverxec

HackTheBox dengan OS Linux Mari kita lakukan enumerasi awal terhadap machine ini terlebih dahulu dengan nmap

Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-07 00:01 EST
Nmap scan report for 10.10.10.165
Host is up (0.27s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA)
|   256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA)
|_  256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519)
80/tcp open  http    nostromo 1.9.6
|_http-server-header: nostromo 1.9.6
|_http-title: TRAVERXEC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.10 - 4.11 (92%), Linux 3.18 (92%), Linux 3.2 - 4.9 (92%), Crestron XPanel control system (90%), Linux 3.16 (89%), ASUS RT-N56U WAP (Linux 3.4) (87%), Linux 3.1 (87%), Linux 3.2 (87%), HP P2000 G3 NAS device (87%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (87%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   280.93 ms 10.10.14.1
2   280.96 ms 10.10.10.165

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 40.36 seconds

Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-07 00:01 EST

Nmap scan report for 10.10.10.165

Host is up (0.27s latency).

Not shown: 998 filtered ports

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)

| ssh-hostkey:

| 2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA)

| 256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA)

|_ 256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519)

80/tcp open http nostromo 1.9.6

|_http-server-header: nostromo 1.9.6

|_http-title: TRAVERXEC

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port

Aggressive OS guesses: Linux 3.10 - 4.11 (92%), Linux 3.18 (92%), Linux 3.2 - 4.9 (92%), Crestron XPanel control system (90%), Linux 3.16 (89%), ASUS RT-N56U WAP (Linux 3.4) (87%), Linux 3.1 (87%), Linux 3.2 (87%), HP P2000 G3 NAS device (87%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (87%)

No exact OS matches for host (test conditions non-ideal).

Network Distance: 2 hops

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)

HOP RTT ADDRESS

1 280.93 ms 10.10.14.1

2 280.96 ms 10.10.10.165

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 40.36 seconds

Ada service http di port 80 dan ssh di port 22. Hal yang menarik untuk dilihat adalah nampaknya website menggunakan aplikasi bernama nostromo 1.9.6 Mari kita buka sebentar webnya sebelum ngegas vulnerability buat nostromo 1.9.6 nya , just… Continue reading [HackTheBox] – Traverxec

[HackTheBox] – Wall

Sebuah machine Hack The Box dengan ip 10.10.10.157, nampaknya akan didasarkan oleh eksploitasi CVE. Mari kita lakukan nmap terhadap ip tersebut

nmap -sC -sV 10.10.10.157

1	nmap -sC -sV 10.10.10.157

Lakukan dirbuster dengan wordlist medium Terdapat directory yang menarik bernama monitoring dengan error code 401, yang berarti memerlukan authentication. Mari kita coba buka Kita menemukan page yang di proteksi oleh basic http authentication,… Continue reading [HackTheBox] – Wall

[HackTheBox] – Sniper

Box Sniper dengan IP 10.10.10.151 dengan OS Windows *painful af OS Mari lakukan basic enumeration dengan nmap, hasil nmap menunjukkan

Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-07 02:40 EST
Nmap scan report for 10.10.10.151
Host is up (0.26s latency).
Not shown: 996 filtered ports
PORT    STATE SERVICE       VERSION
80/tcp  open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Sniper Co.
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h01m53s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-03-07T14:43:14
|_  start_date: N/A

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   252.60 ms 10.10.14.1
2   254.10 ms 10.10.10.151

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.37 seconds

Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-07 02:40 EST

Nmap scan report for 10.10.10.151

Host is up (0.26s latency).

Not shown: 996 filtered ports

PORT STATE SERVICE VERSION

80/tcp open http Microsoft IIS httpd 10.0

| http-methods:

|_ Potentially risky methods: TRACE

|_http-server-header: Microsoft-IIS/10.0

|_http-title: Sniper Co.

135/tcp open msrpc Microsoft Windows RPC

139/tcp open netbios-ssn Microsoft Windows netbios-ssn

445/tcp open microsoft-ds?

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port

OS fingerprint not ideal because: Missing a closed TCP port so results incomplete

No OS matches for host

Network Distance: 2 hops

Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:

|_clock-skew: 7h01m53s

| smb2-security-mode:

| 2.02:

|_ Message signing enabled but not required

| smb2-time:

| date: 2020-03-07T14:43:14

|_ start_date: N/A

TRACEROUTE (using port 80/tcp)

HOP RTT ADDRESS

1 252.60 ms 10.10.14.1

2 254.10 ms 10.10.10.151

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 83.37 seconds

Terdapat web service, mari kita coba cek Terdapat user login portal Setelah mencoba beberapa payload basic dan basic credentials, tidak ditemukan apa apa yang bisa digunakan Pada page services, dan setelah berpindah ke page… Continue reading [HackTheBox] – Sniper

[Angstrom CTF 2020] – canary

Diberikan sebuah binary dengan konfigurasi sebagai berikut: Berikut adalah list dari semua fungsi pada binary: Berikut adalah pseudocode dari fungsi yang memiliki celah:

unsigned __int64 greet()
{
  char format; // [rsp+0h] [rbp-60h]
  char v2; // [rsp+20h] [rbp-40h]
  unsigned __int64 v3; // [rsp+58h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Hi! What's your name? ");
  gets(&format);
  printf("Nice to meet you, ");
  strcat(&format, "!\n");
  printf(&format);
  printf("Anything else you want to tell me? ");
  gets(&v2);
  return __readfsqword(0x28u) ^ v3;
}

unsigned __int64 greet()

{

char format; // [rsp+0h] [rbp-60h]

char v2; // [rsp+20h] [rbp-40h]

unsigned __int64 v3; // [rsp+58h] [rbp-8h]

v3 = __readfsqword(0x28u);

printf("Hi! What's your name? ");

gets(&format);

printf("Nice to meet you, ");

strcat(&format, "!\n");

printf(&format);

printf("Anything else you want to tell me? ");

gets(&v2);

return __readfsqword(0x28u) ^ v3;

}

Dilihat program menggunakan gets() yang memiliki kelemahan buffer overflow dan printf(&format) memiliki kelemahan format string attack. Tujuan dari soal ini adalah untuk memanggil fungsi flag(). Namun dari nama soal dan konfigurasi binary, terdapat stack canary… Continue reading [Angstrom CTF 2020] – canary

[Joints2020] – crackme

Diberikan sebuah binary 64 bit not stripped. Pseudocode dari fungsi main adalah sebagai berikut:

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4; // [rsp+0h] [rbp-30h]
  _BYTE v5[3]; // [rsp+5h] [rbp-2Bh]
  _BYTE v6[6]; // [rsp+Ah] [rbp-26h]
  int v7; // [rsp+14h] [rbp-1Ch]
  char v8; // [rsp+19h] [rbp-17h]
  unsigned __int64 v9; // [rsp+28h] [rbp-8h]

  v9 = __readfsqword(0x28u);
  __isoc99_scanf("%5c-%5c-%5c-%5c-%5c", &v4, v5, v6, &v6[5], &v7);
  v8 = 0;
  if ( checker(&v4) )
    unlock();
  else
    printf("Invalid serial key");
  return 0;
}

int __cdecl main(int argc, const char **argv, const char **envp)

{

char v4; // [rsp+0h] [rbp-30h]

_BYTE v5[3]; // [rsp+5h] [rbp-2Bh]

_BYTE v6[6]; // [rsp+Ah] [rbp-26h]

int v7; // [rsp+14h] [rbp-1Ch]

char v8; // [rsp+19h] [rbp-17h]

unsigned __int64 v9; // [rsp+28h] [rbp-8h]

v9 = __readfsqword(0x28u);

__isoc99_scanf("%5c-%5c-%5c-%5c-%5c", &v4, v5, v6, &v6[5], &v7);

v8 = 0;

if ( checker(&v4) )

unlock();

else

printf("Invalid serial key");

return 0;

}

Dilihat program meminta input sepanjang 25 karakter dan kemudian input akan diproses oleh fungsi checker() dan bila hasil dari checker() adalah true maka fungsi unlock() akan dipanggil. Berikut pseudocode dari fungsi unlock():

int unlock()
{
  char i; // al
  FILE *stream; // [rsp+8h] [rbp-8h]

  stream = fopen("flag.txt", "r");
  for ( i = fgetc(stream); i != -1; i = fgetc(stream) )
    putchar(i);
  return fclose(stream);
}

int unlock()

{

char i; // al

FILE *stream; // [rsp+8h] [rbp-8h]

stream = fopen("flag.txt", "r");

for ( i = fgetc(stream); i != -1; i = fgetc(stream) )

putchar(i);

return fclose(stream);

}

Fungsi tersebut akan membuka file flag.txt pada server nc. Berikut pseudocode dari fungsi checker():

[HackTheBox] – Nest

HackTheBox machine “Nest” , SPOILER ALERT INI DIFFICULTY NYA TIDAK EASY , AT LEAST MEDIUM (?) Mari kita nmap dengan syntax biasa, nmap -sV -sC -A 10.10.10.178

Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-01 08:14 EDT
Nmap scan report for nest.htb (10.10.10.178)
Host is up (0.27s latency).
Not shown: 999 filtered ports
PORT    STATE SERVICE       VERSION
445/tcp open  microsoft-ds?

Host script results:
|_clock-skew: 2m25s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-04-01T12:17:25
|_  start_date: 2020-04-01T04:15:20

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 80.76 seconds

Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-01 08:14 EDT

Nmap scan report for nest.htb (10.10.10.178)

Host is up (0.27s latency).

Not shown: 999 filtered ports

PORT STATE SERVICE VERSION

445/tcp open microsoft-ds?

Host script results:

|_clock-skew: 2m25s

| smb2-security-mode:

| 2.02:

|_ Message signing enabled but not required

| smb2-time:

| date: 2020-04-01T12:17:25

|_ start_date: 2020-04-01T04:15:20

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 80.76 seconds

Port yang open hanya samba share, mari kita listing share yang ada di port 445 tersebut

smbclient -L //10.10.10.178

1	smbclient -L //10.10.10.178

Ada beberapa share yang menarik yaitu Data, Secure$ dan Users… Continue reading [HackTheBox] – Nest