Month: May 2020

hacker in flight guide
METASPLOIT

Metasploit

I was first introduced to Metasploit at NOLACON around 2013 or so.  I knew about it, but only because I had been watching Hak5 since they were filming out of a garage.  I was extremely interested in all the hacking stuff, but never went into the exploitation side of things.  I took a class by Georgia Weidman that was based on her book, Penetration Testing, a Hands-on Introduction to Hacking.  I read this book, but never did the series of exercises, but definitely had the smell of blood on my palette for exploits.  
Today, I took the next step of applying everything that I had learned.  I did all of the basic steps for setting up metasploit, updating the database, connecting to a machine for an exploit, taking over the machine, elevating privileges, and recording the results.  As I do this, I am constantly adding to the quick reference tools that I have listed within the menus on this site.  Just look for metasploit, and each of the useful commands to help you remember what works well.
Continue Reading
hacker in flight guide
INTRODUCTION KALI LINUX WINDOWS

My Routine

Right now, it is 1-hour away from the first manned Space-X launch.  As I sit here watching the live feeds, I figured it would be a good time to get the keyboard in front of me and talk about what my routine has been during this journey.

It’s been about two months so far since I decided to go full-up on this journey to be a professional hacker.  In that time, I’ve ordered three online courses, signed up for two hacking sites (HTB and THM), and subscribed to countless YouTube, Twitch, and Facebook channels.  

Interestingly enough, Twitch has turned out to be my favorite.  I have never been a gamer, and therefore made the assumption that Twitch was a streaming platform for only game players.  This is definitely not the case.  As an example, one of my subscriptions is ‘The Cyber Mentor‘ who live streams each day to answer questions and show live hacks.  The nice thing about Twitch is that it will send a notification when one of your followed channels is about to live stream.  Via YouTube, I have been watching recordings of many of these streams, but never had the experience of interacting while the live stream happened.  Twitch has completely opened my eyes into the way social media works now, and I’m a fan.

So needless to say, social media will remain a part of my strategy on this journey.  It not only gives insights into how others think, it also allows a conduit for the most important part of being part of a community… networking!!

So now that you’re aware of my new social media habits, let’s talk about the courses that I intend to enjoy.  The first is a course that I picked up in January.  I was getting the idea that I wanted to take this journey, but hadn’t made all of the decisions to go full-in.  The course was a Udemy course taught by The Cyber Mentor (same as the social media) and was on sale for $20!  As most of these courses offer themselves for a couple hundred, I figured it would be worth picking it up, even if I didn’t start it for a while.  The course was about 24 hours worth of material, and at the moment of this writing, I am about 2/3 the way through. 

The next course that I intend to take is one that showed up for free during the time of this pandemic.  It is from the International Cybersecurity Institute.  Using the code “#StaySafeHome” i was able to sign up for the Certified Network Security Specialist and bypass the seven hundred euro price tag.  Even if I simply skim what they have to offer, it’s learning and definitely worth the price!

The third course that I intend to take is a new one that The Cyber Mentor just released which is on Windows privilege escalation.  Since I was already a student on his first course, i received an invitation to get his next one for $20 as well.  With his first course being so wonderful, I definitely look forward to taking his second… and more if he offers them.

With all of that, and many books in the mix, I intend to sign up for the OSCP course.  I haven’t figured out if the exam can be taken without the course… if that’s the case, I may go straight to the exam.  If it’s not the case, I have no problem with learning more.  The course is about $1k, and includes the exam.  It’s actually called ‘PWK’ which is Penetration Testing With Kali Linux.  There are four other courses offered by the company Offensive Security, but i’ll have to decide later if I want to complete those, or move onto a different company with separate views on teaching hacking.

So for now, that’s my path forward.  I have a full-time job on the side, so it will definitely take priority over this journey… but I am extremely persistent and will prioritize my time and learning accordingly.

hacker in flight guide
EQUIPMENT

My Equipment Evolution

It occurred to me recently that many of my posts should be supplemented with information about what I have running on my machines.  So I figured I’d take a second to explain the chaos of organization that I have behind my equipment.

hacker in flight guide
hacker in flight guide

What you see in the picture above is about the hundredth time (i actually have no clue how many) that I’ve changed things around.  I’d like to think that each time I create another cable, or setup another subnet, that I’m hardening my rig and making things more awesome… and yep, I do make things more awesome!

Before I explain everything that’s in the picture, let’s start from the beginning.  My original environment (for this house) was nine stand-alone computers, all having their own role.  I always have a web server up and running, and possibly an email server depending on my applications.  I would also have a file server on standby (maybe with nextcloud) and then have some shell boxes at the ready using GateOne just in case port 22 was blocked at work.  

With every lesson learned, and each time I discovered an interesting server install, I found myself over writing the OS, and starting from scratch.  In many cases, I didn’t want to flash a hard drive because I liked the old configuration… so I would grab a new hard drive, and do the install there.  Before long, I found that I was not re-using the old hard drives, and they were stacking up!

hacker in flight guide
hacker in flight guide

So it was time for a new strategy.  Knowing this, I looked over each of the bare-metal rigs to see what was underneath.  In most cases, I had an i5 intel processor with 16Gb of RAM.  In two of them, however, I had taken some old parts from an HP server (i have no idea which one) and rigged it to work within a tall, full sized tower… I should do a write-up on that one because it was intense!  It had 48Gb of EEC RAM, plus a couple Xenon 6-core processors, and a 1K watt power supply.  These two would be quite useful in the plan that I was concocting.  VMs!

 

hacker in flight guide
hacker in flight guide

I’ve setup and used VMWare’s system called ESXi many times before; however I didn’t want to bother with the licensing… even the free one.  Also, they use Windows to manage their proprietary systems, and that can be annoying as well… so I went searching for something else.  And then it happened, I found what I would stick to for quite a while, and still use to this day.  It’s called XCP-NG (https://xcp-ng.org/).  It’s extremely similar to ESXi, however it’s completely open source and offers many of the features that I was looking for.

Armed with two of these HP servers, and the new VM OS which talks directly to the server hardware, it was time to rock.

Over the next few weeks, I began changing many of my bare-metal boxes into VMs housed on these two servers.  I probably went about two years in this configuration.  No longer did I have to worry about a stack of hard drives… now I was taking snapshots and creating ‘high availability’ redundant servers.  It was glorious!

Around this same time, I added a Network Area Storage server called FreeNAS to the mix.  I did this on a bare-metal box and added several hard drives with a mirroring RAID configuration.  I was able to connect each of our family computers to it (keep photos/videos) and also use it as a repository of ISO (OS install) files, and hard drive space dedicated for the VM installs.  Unfortunately, FreeNAS was somewhat short lived.

INSERT DIFFICULT LESSON HERE: 
Redundancy is GREAT!  It can mean that when one hard drive goes out, you have another with the information to take the load… but redundancy is NOT the same as backup.  In backup, there’s the rule of three’s, and I didn’t follow this rule when I set up the FreeNAS system.  The rule of three’s says that you need your data, plus an on-site backup of your data, plus an off site backup of your data.  That ensures that you have access to the information if ever something happened to your primary location.  In the case of this FreeNAS box, I didn’t create the backup sites, and totally relied on the redundancy of the hard drives.  This would have been all well and good, however it wan’t the hard drives that failed… it was the block that held the RAID’s records.  When it went corrupt, that meant that all of the drives in the array went corrupt as well… BAD!  I had to do a forensics recovery to get back the data that was accessible, but overall, we lost some important stuff.  As a result, I made it part of my religion to include backups, and never trust redundancy!  the redundancy piece is nothing more than convenience.  Of note, it turns out that it was a bad stick of RAM that caused all of the trouble.

So back to the evolution of my equipment.  At this point, I was able to create two XCP-NG servers housing around sixteen VMs, and was pretty happy; but there was one problem… the temperature in that office practically doubled, and our energy bill did the same.  I think that because those HP servers were older, and didn’t have the same cooling that their proprietary cases had, they were sucking up energy like a gas-guzzling engine.  I loved them, but would once again have to adapt to this new finding.

In looking for an overhauled setup, I decided to try out something which was becoming pretty popular.  Synology had just come out with a new four-bay NAS that had some amazing capabilities.  Surveillance, for one, was included in their OS.  In addition, it was easy to incorporate any of the network transfer protocols.  This was important because I run about 4 types of Linux OSs, Mac OS, and Windows… as well as all of our smart phones and iPads.  So a one-stop-shop was sounding pretty awesome… and it was!

With the Synolgy in the picture, and consolidating down to only one of those big servers, I decided it was time to segregate my networks, and prepare for the courses of which you are familiar: hacking.

To segregate my network, I created a pfSense firewall in bare-metal, and connected it to a Unifi managed switch with P0E+.  This allowed me to make as many virtual LANs as I wanted, and port them seperately through any of the 8 ports on the front of the switch.  I wrote all of the firewall rules to segregate, and managed the devices through a Ubiquity Cloud Key.  It turned out to be a lot of fun learning an entirely new system like Ubiquity.  

The segmented networks were great!  I had fiber internet coming into my house at a 1Gb up and down speed with a static IP… but then I figured out that I could configure any of the four ports on the modem to either be static OR dynamic.  So in the end, I created my business network on the static IP, and left my home network on the dynamic address.  It was awesome!  Segmentation through the ISP, who knew?!?

With my network exactly in the configuration I wanted it to be, and my equipment stable with redundancy and backup, it was time to build myself the ultimate rig for hacking… something that I could learn on, mess up, and rebuild if needed.  For the journey that I was about to partake, I made a decision that I never thought was possible for me.  I did something that was completely against my religion, and made me die just a little bit inside… I used Windows as my base OS.

After having used this rig for a while now, I standby my decision to use Windows as the Base OS, but it still hurts just a little every day.  The reason I decided to do this was because so many common things reside on Windows including the Adobe suite that I use often, and it’s extremely easy to create a new virtual machines using VMware Workstation.  In fact, segmenting networks within the VMware suite is equally awesome, and allows me to hack with ease knowing that it would be fine if someone got into my instance of Kali.  I simply installed a dedicated network card into the rig, and only allowed one of the vlans through the port in the manged switch.  It’s flexible, too, in the fact that through vmtools, I can copy/paste things direct from Windows to Kali or ParotOS.  So overall, I am extremely happy with my decision, and it’s been quite convenience as well.

The last piece of equipment that I’ll mention before I actually say what i have in this rig is the eGPU.  I had one setback with the VMware Workstation on Windows setup… I couldn’t have one of the VMs talk directly to the hardware within the rig.  This is called hardware passthrough.  It’s possible on the ESXi setup, but not within Windows on a VMware Workstation instance.  I thought that if I hooked up the Thunderbolt 3 (USB-C connection) to an external GPU (eGPU), I may be able to connect that USB instance to the VMware Workstation running within Windows.  But low and behold, I was completely wrong.  The connection isn’t one of USB 2, or USB 3… it actually shows up on the computer as a PCI bus, and therefore, is an extension of the motherboard.  It was fun to give it a shot and try to connect it to the VM… but in the end, it was better to connect the video card to bare-metal to perform my password cracking.  So I purchased a little Intel NUC which had a thunderbolt 3 port, and decided that when I needed to crack passwords, I could conveniently move the eGPU over.

It turns out that hashcat, which I use for the password cracking, is available in a Windows version.  I had no clue of this since I hated Windows so much… but out of necessity with my new rig, figured it out.

So now onto the description of the rig that I will be using for this journey into becoming a professional hacker!

My Equipment:
i9-9900K 8-core Intel 3.6GHz
(5.0 GHz Turbo)
64 GB OLOy DDR4 3600
ASUS Prime Z390-A Motherboard
ASUS ThunderboltEX3 Extension Card
Rosewill ATX Mid Tower
x2 Sebrent 256 M.2 SSDs
x2 Samsung 1TB SSDs
x1 Western Digital 4TB 7200
eGPU Razer Core X Chroma
NVIDIA GeForce RTX 2080 ti FE

Thank you for reading… I look forward to our great experiences together!

hacker in flight guide
ACTIVEDIRECTORY WINDOWS

Open the Window

Today was a fun day because I was finally able to delve into Windows hacking.  I’ve been concentrating on unix machines for quite a while now, and have been very curious about the various hacks that can occur.  I now, finally, have some insights into them.

The thing is, I’ve been using Windows (both server and desktop) for years, and have been very aware of the defenses we use on an enterprise network to detect, track, and overcome attacks.  In fact, I was the lead on a project to get our network rid of the ‘welchia’ virus back in 2003; it was a crazy replicating virus that denied us our network, but didn’t cause any damage.  So knowing Windows, and having been an admin on several large networks, i’m realizing now just how much we didn’t know!

Taking advantage of the features within an Active Domain system, the hacks performed today weren’t even owning the boxes… they were simply intercepting things like password hashes via the standard operating procedures that Windows uses.  It was pretty easy, in fact… scary easy.

One of the things learned today that was a surprise to me was that I could run the program hashcat on Windows.  Throughout this journey, I’ve set up several versions of hacking platforms, and all had hashcat installed by default.  The problem always was the access to video card drivers.  I’ll probably write more about that at another time (I took notes each time I did an install), but for now, I’ll say that being able to run hashcat on Windows allows me to use my huge rig that houses my VMs to also access the graphics card directly.  VMs are unable to have direct access to the PCI bus, which is why I was building a bare-metal rig to do nothing but hashcat.  Now, I can use that as a backup firewall for my segmented networks, and also monitor the resources used by hashcat on Windows.  I thought that was pretty cool.

So overall, a LOT was learned today, and a possible change in my network structure was considered.  I haven’t changed anything yet, but if I do, I’ll write it up.  There’s a lot more to do in the Windows privilege escalation realm, and I’m well on my way to learning it.  I’ve purchased an entire course on nothing but this topic, and can’t wait to start it.  I’ll let you know if the class was worth it, but i have a feeling i already know the answer.  See my references page for all of the courses I’ve taken, and if they were worth the my time.

hacker in flight guide
KALI LINUX

WEB SERVER EXPLOIT

All about web server hacking…

Today was an interesting day to learn.  I came across a tutorial which described itself as taking over a linux box.  Low and behold, it turned out to be a web server hosted on an Ubuntu box.  

My go-to web server box is usually a CentOS flavor of Linux.  This is because when I created my very first web server on linux many years ago, i did it on a Fedora Core 3 version of Linux.  Since then, I’ve been fond of a Red Hat environment without the cost of a Red Hat enterprise subscription.  In 99% of the cases where I make a server, I don’t need a graphical user interface (GUI) either, so I shied away from Red Hat proper early, and went to minimal installs of CentOS.  I use Ubuntu when I need a GUI, and therefore recognized that www-data as the user and group meant that it was likely Ubuntu.

So, with all that, I recognized the structure of the server pretty much right away.  There was a guide on how to do all of the hacking, but that tends to be no fun.  I only reference that stuff if I’ve been on a certain problem for way too long, and want to press on.  In the case of this server, I just visited the web site to see what was going on.

The site itself was very plain.  my nmap results showed that it was using a different port than normal, and a directory scan showed that there was an uploads section.  Whenever an upload section is found, it can usually be used as an attack vector.  In this case, I was able to upload a web file with a php reverse shell, and request it in my browser.  Using netcat to wait for a connection, i saw the server react to the uploaded file and grant me a connection right away.

The connection had privileges for only the www-data user, which is the web server.  This makes sense because i was granted access through an upload exectued by the web service.  So with this connection, it was time to look around.

The exporing lead to listed users (/home/user), and some other things, but nothing that was noteworthy.  Instead of snooping around  with the ‘ls -alh’ command everywhere, i took an easier approach.  I simply used the find command to figure out which files on the system were executable.  In the find command, we can search with the SUID bit set for permission of 4000.  When a file called /bin/systemctl showed up as user executable, it was fairly obvious that the box could be pwnd using a service.  that systemctl is what starts and stops services, so now a new bogus service with malicious code can be created and started.  In theory, if we set up another listener through netcat, the service would execute as root, and give me a shell with root privileges.

As www-data user, i could write a new file to the web folders.  So it was time to do just that, and build the services file.  Here’s the funny part, though.  I didn’t have access to vi, or vim, or nano, so it was going to be difficult to just copy and paste from a website.  As a result, I ended up doing an echo command with >> to ammend the file each time I send the echo command.  If I messed up any of those commands, I would need to wipe the file and start over.  Luckily, I was able to do it correctly on the first try.  When it was done, I checked the privileges, and pressed on to the privilege escalation to root.

It was only one easy command… systemctl enable test.service.  After that, I just started the service and waited at my kali terminal for netcat to pick up the connection.  When it did, i had root privileges and the box was pwnd.

Pretty sweet!  

hacker in flight guide
INTRODUCTION

Introduction

Hello! My name is ‘usafitz’ and I am an IT professional from all over the U.S. I’ve been all around the world and seen many things, but what absolutely gets my blood flowing are servers and technology. Throughout this blog, you’ll be witness to a brand new journey to which I’ve decided to embark… full-time hacking.

Before I start writing about my journey, i wanted to give some background on what I’ve been up to these past years. At the moment of this writing, I am about to turn forty. Just like most people’s experiences, I’ve had a roller coaster of ups and downs; but there’s always been an incredible drive to keep going and learn more! The center of everything I’ve done has been my love and adoration of servers. I say servers instead of computers because when I look at a machine, my imagination goes wild with what it can accomplish. A computer, in my eyes, represents a simple dumb terminal that becomes a tool to accomplish the goal you set forth. A server is where the real magic happens.

Continue Reading
Scroll to top