End-to-End Article Hacking Lecture Notes

Introduction

• Learning about end-to-end article hacking by targeting a specific system.
• Objective: Gain complete control of a computer system.
• Important Reminder: Hacking is illegal; do not attempt these techniques on unauthorized systems.

Scanning Devices

1. Purpose of Scanning

   • Identify vulnerabilities in various devices (servers, phones, etc.).
   • Look for loopholes to gain control of the system.

2. Post-Exploitation

   • Explore what can be done after gaining access.
   • Elevate privileges to gain complete control (e.g., breaking passwords).

3. Initial Scanning Steps

   • Identify services running on the target (e.g., FTP, SSH, websites).
   • Gather version information to determine attack methods.

Tools for Scanning

• Nmap:
  • Used to scan IP addresses and determine running services.
  • Example command: nmap -sV -O 192.168.0.114
  • Analyze results for open ports and service versions.

Directory Enumeration

• Dirb Tool:
  • Used to discover directories on the target server.
  • Example command: dirb http://192.168.0.114/
  • Target interesting results, such as /cgi-bin/ directory.

Exploit Targeting

• Metasploit Framework:
  • Use Metasploit to find and exploit vulnerabilities.
  • Example command to start: sudo msfconsole
  • Search for specific exploits (e.g., search shellshock).

Executing the Attack

1. Setting Up the Exploit
   • Use commands to prepare and execute the exploit.
   • Example exploit: exploit multi/http/apigee_mod_cgi_bash_env_exec.
2. Achieving a Reverse Shell
   • Exploit the vulnerability to gain a reverse shell.
   • Firewalls often allow outbound connections, making this method viable.
3. Checking Access
   • Verify access using commands like whoami and checking directory permissions.

Privilege Escalation

• Uploading a File:
  • Create a C file for privilege escalation and upload it to the server.
  • Example command: gcc 37292.c -o ofs
• Executing the File:
  • Change permissions and execute the uploaded file to gain root access.
  • Example command: ./ofs

Password Extraction

• Obtain usernames and passwords from the target system:
  • Use commands like cat /etc/shadow and cat /etc/passwd to retrieve info.
• Save data for further analysis and password cracking.
  • Use tools like John the Ripper for password cracking.

Conclusion

• Always conduct security testing on servers to identify vulnerabilities.
• Essential for protecting production workloads against potential exploits.
• Encouragement to like, share, and subscribe for more tutorials.