Pentest with spirit

Friday, 30 August 2019

Tale of Spirited wolf walkthrough

August 30, 2019  

Hello pentesters,
 I am glad you came here to check my all walkthroughs that I have written over last year. Here are all the articles that I have written. 
  1. https://www.peerlyst.com/posts/how-to-hackthebox-bastard-machine-write-up-part-1-spirited-wolf
  2. https://www.peerlyst.com/posts/how-to-hackthebox-sneaky-machine-writeup-part-2-spirited-wolf
  3. https://www.peerlyst.com/posts/how-to-hackthebox-shrek-machine-writeup-spirited-wolf (My personal favorite)
  4. https://www.peerlyst.com/posts/how-to-hackthebox-tenten-machine-writeup-spirited-wolf
  5. https://www.peerlyst.com/posts/how-to-hackthebox-cronos-machine-writeup-spirited-wolf
  6. https://www.peerlyst.com/posts/how-to-hackthebox-haircut-machine-writeup-spirited-wolf
  7. https://www.peerlyst.com/posts/how-to-hackthebox-popcorn-machine-writeup-spirited-wolf
  8. https://www.peerlyst.com/posts/how-to-hackthebox-bashed-machine-writeup-spirited-wolf
  9. https://www.peerlyst.com/posts/how-to-hackthebox-arctic-machine-writeup-spirited-wolf
  10. https://www.peerlyst.com/posts/how-to-hackthebox-brainfuck-machine-writeup-spirited-wolf?trk=user_notification
  11. https://www.peerlyst.com/posts/how-to-hackthebox-charon-machine-writeup-spirited-wolf
  12. https://www.peerlyst.com/posts/how-to-hackthebox-jeeves-machine-writeup-spirited-wolf
  13. https://www.peerlyst.com/posts/how-to-bsides-vancouver-2018-workshop-machine-writeup-spirited-wolf
  14. https://www.peerlyst.com/posts/how-to-mrrobot-machine-writeup-spirited-wolf
  15. https://www.peerlyst.com/posts/how-to-billu-box-machine-writeup-spirited-wolf
  16. https://www.peerlyst.com/posts/how-to-break-into-toppo-machine-walkthrough-spirited-wolf
  17. https://www.peerlyst.com/posts/how-to-break-into-wakanda-machine-writeup-spirited-wolf
  18. https://www.peerlyst.com/posts/how-to-break-into-lampiao-1-machine-writeup-spirited-wolf
  19. https://www.peerlyst.com/posts/how-to-break-into-fourandsix-1-machine-writeup-spirited-wolf
  20. https://www.peerlyst.com/posts/how-to-break-billu-box-2-machine-on-vulnhub-video-writeup-spirited-wolf
  21. https://www.peerlyst.com/posts/how-to-break-into-stapler-1-machine-writeup-spirited-wolf
  22. https://www.peerlyst.com/posts/how-to-break-into-hacklab-vulnix-machine-writeup-spirited-wolf
  23. https://www.peerlyst.com/posts/how-to-break-into-skytower-machine-writeup-spirited-wolf
  24. https://www.peerlyst.com/posts/how-to-break-brainpan-1-machine-on-vulnhub-video-writeup-spirited-wolf
  25. https://www.peerlyst.com/posts/how-to-break-into-dev-random-pipe-machine-writeup-spirited-wolf
  26. https://www.peerlyst.com/posts/how-to-break-into-tr0ll-1-machine-writeup-spirited-wolf
  27. https://www.peerlyst.com/posts/how-to-break-into-tr0ll-2-machine-writeup-spirited-wolf
  28. https://www.peerlyst.com/posts/how-to-break-into-bob-1-0-1-machine-writeup-spirited-wolf
  29. https://www.peerlyst.com/posts/how-to-break-into-darknet-1-0-machine-ctf-writeup-spirited-wolf
  30. https://www.peerlyst.com/posts/how-to-break-into-pwnlab-init-machine-writeup-spirited-wolf
  31. https://www.peerlyst.com/posts/how-to-break-into-holynix-1-machine-ctf-writeup-spirited-wolf
  32. https://www.peerlyst.com/posts/how-to-break-into-sickos-1-1-machine-writeup-spirited-wolf
  33. https://www.peerlyst.com/posts/how-to-break-into-raven-1-machine-ctf-writeup-spirited-wolf
  34. https://www.peerlyst.com/posts/how-to-break-into-raven-2-machine-a-ctf-writeup-spirited-wolf
  35. https://www.peerlyst.com/posts/how-to-break-into-four-and-six-2-machine-writeup-spirited-wolf
  36. https://www.peerlyst.com/posts/how-to-break-into-dummy-machine-as-a-wizard-writeup-spirited-wolf
  37. https://www.peerlyst.com/posts/how-to-break-into-nullbyte-machine-ctf-writeup-spirited-wolf
  38. https://www.peerlyst.com/posts/how-to-break-into-matrix-machine-ctf-writeup-spirited-wolf
  39. https://www.peerlyst.com/posts/how-to-break-into-fowsniff-machine-ctf-writeup-spirited-wolf
  40. https://www.peerlyst.com/posts/how-to-break-into-dev-random-pipe-machine-writeup-spirited-wolf
  41. https://www.peerlyst.com/posts/how-to-break-into-kuya-1-machine-ctf-writeup-spirited-wolf
  42. https://www.peerlyst.com/posts/how-to-break-into-unknowndevice64-1-machine-ctf-writeup-spirited-wolf
  43. https://www.peerlyst.com/posts/how-to-break-into-dc1-1-machine-ctf-writeup-spirited-wolf
  44. https://www.peerlyst.com/posts/how-to-break-into-r00tme-1-machine-ctf-writeup-spirited-wolf
  45. https://www.peerlyst.com/posts/how-to-break-into-devlife-machine-as-a-wizard-ctf-writeup-spirited-wolf
  46. https://www.peerlyst.com/posts/how-to-break-into-pinky-s-palace-1-machine-ctf-writeup-spirited-wolf
  47. https://www.peerlyst.com/posts/how-to-break-into-matrix-2-machine-ctf-writeup-spirited-wolf
  48. https://www.peerlyst.com/posts/how-to-break-into-sickos-1-2-machine-ctf-writeup-spirited-wolf
  49. https://www.peerlyst.com/posts/how-to-break-into-bot-challenges-dexter-machine-ctf-writeup-spirited-wolf
  50. https://www.peerlyst.com/posts/how-to-break-into-dina-1-0-1-machine-ctf-writeup-spirited-wolf
  51. https://www.peerlyst.com/posts/how-to-break-into-milnet-1-machine-ctf-writeup-spirited-wolf
  52. https://www.peerlyst.com/posts/how-to-break-into-teuchter-0-3-machine-ctf-writeup-spirited-wolf
  53. https://www.peerlyst.com/posts/how-to-break-into-imf-1-machine-ctf-writeup-spirited-wolf
  54. https://www.peerlyst.com/posts/how-to-break-into-flick-1-machine-ctf-writeup-spirited-wolf
  55. https://www.peerlyst.com/posts/how-to-break-into-dc-2-machine-ctf-writeup-spirited-wolf
  56. https://www.peerlyst.com/posts/how-to-break-into-dc-3-machine-ctf-writeup-spirited-wolf
  57. https://www.peerlyst.com/posts/how-to-break-into-dc-4-machine-ctf-writeup-spirited-wolf
  58. https://www.peerlyst.com/posts/how-to-break-into-dc-5-machine-ctf-writeup-spirited-wolf
  59. https://www.peerlyst.com/posts/how-to-break-into-dc-6-machine-ctf-writeup-spirited-wolf
  60. https://www.peerlyst.com/posts/how-to-break-into-kfiofan-1-machine-ctf-writeup-spirited-wolf
  61. https://www.peerlyst.com/posts/how-to-break-into-hackthebox-friendzone-machine-ctf-writeup-spirited-wolf
  62. https://www.peerlyst.com/posts/how-to-break-into-sectalks-bne0x03-simple-machine-ctf-writeup-spirited-wolf
  63. https://www.peerlyst.com/posts/how-to-break-into-rootthis-1-machine-ctf-writeup-spirited-wolf
  64. https://www.peerlyst.com/posts/how-to-break-into-sp-jerome-v1-0-1-machine-ctf-writeup-spirited-wolf
  65. https://www.peerlyst.com/posts/how-to-break-into-sunset-1-machine-ctf-writeup-spirited-wolf
  66. https://www.peerlyst.com/posts/how-to-break-into-sunset-nightfall-machine-ctf-writeup-spirited-wolf
 Continue Reading

Friday, 1 March 2019

SLAE Assignment 1 | Bind TCP Shellcode - Linux x86

March 01, 2019  

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification:
http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: SLAE - 1342

Hey Shellcoders,
   I've enrolled myself in SLAE course 2 months ago maybe and last week I finally get enough motivation to start working on it. So today I'm writing this post as the part of the assignment where I was given a task to create a Bind TCP shellcode.
  • Bind to a port
  • Execs Shell on incoming connection
  • Port number should be easily configurable
First let's see how Bind TCP shell will work theoretically. Have a look at this below image first,


So basically a port will be open in the victim machine and the attacker will connect to the victim machine from that particular open port. This is just the basic that you need to know first. Alright let's begin so first we need to check the equivalent C code for the assembly. For that I went to my favorite website Geeksforgeek [Here]

It gives us a rough idea about what syscalls we will be needing in our journey.
  • socket()
  • bind()
  • listen()
  • accept()
 Alright so these are the syscalls that we need to use, but how would we be able to call them? Well for that we will need socketcall()


Okay so " NR_Socketcall " is at 102 , in hex it's value would be 0x66.

Now in assembly we can't write like use bind() instead the particular value is assigned to each calls. Now we need call number's for the socket,bind,listen,accept and connect call's

Okay we will need 1 to 5 AF_MAX values xD amazing, now let's begin with the assembly code.


 Your assembly must have _start in the code so it will understand that the code will begin from that point. Also one interesting fact in .text section there won't be any ASCII readable text. Quite weird, isn't it? Anyways, now start writing in the _start:


 We all learned about basic Boolean XOR operation in our high school. There a very beautiful property of XOR which we are using here,

 The property says , XOR something with something will always be 0. Here I am refering something to a value that are same.
So, " xor eax, eax " will be NULL the eax register , same with “xor ebx,ebx” ebx register and same with “xor ecx,ecx” ecx register. Whereas to save our 1 byte we used cdq because the CDQ instruction copies the sign (bit 31) of the value in the EAX register into every bit position in the EDX register..


Everything is explained in the comment, let me clear some stuffs. In assembly we use " ; " semicolon to comment something.
  • EAX- System call number
  • EBX- First argument
  • ECX- Second argument
  • EDX- Third argument
  • ESI- Forth argument
  • EDI- Fifth argument
In the end when everything is done we use " int 0x80 " to interrupt the call. In normal language it's like calling kernel giving them all register value and using those value kernel will do the work and get it done for us. Ess Pzz?


 It will call bind() , also if you wanna change the port number then you can simply change " push word 0x3905 " with your hex value of your port number.


listen() will actually put the server socket in passive mode where it will wait for the client to send the request to make a connection.


accept() will just accept the connection and the connection will established between server and the client. Now we will need dup2() , Read more about from [Here]

First thing first, we need to find the dup2 syscall number.

So, it is 63 but it's hex value would be 0x3f ,

Here we are using loop for duplicating in , out and error with the file descriptor. Now here we are left with the final thing.


This is the basic execve() shellcode. It will just pop the " /bin/sh " shell for us xD . Read more about it. [Here]



In top most pane I've just assembled and linked the assembly file / object file. In pane 2 i.e bottom left just " netstat -l " command is running to check if the port 1337 is opened and in listening mode.

In pane 3 the bottom of the right side , I have just shown my IP address to tell I am different host (But in the same network)

In pane 4 the middle one from the right side. I'm using nc command which is short for netcat to connection to the Ubuntu box where port 1337 is running.

Thanks,
 Continue Reading

Saturday, 29 December 2018

My Inf0s3c Journey 0f twenty eighteen

December 29, 2018  

Hello everyone,
  Hope you all are doing great , 2018 was really fun and little bit bad(personal issues) too for me. But so far everything was great in the field of infosec as I completed my first offsec certification i.e OSCP.



I also found various buffer overflow vulnerabilities in softwares. You can check them here on my
Exploit-db profile   :- [Here]


I also made a lot of new friends not much generally 3-7 but still it[s] a lot forme.
Apart from that I also contributed to the community by writing various Walkthrough[s] of the machines that I found great and interesting.

  1. https://www.peerlyst.com/posts/how-to-hackthebox-bastard-machine-write-up-part-1-spirited-wolf
  2. https://www.peerlyst.com/posts/how-to-hackthebox-sneaky-machine-writeup-part-2-spirited-wolf
  3. https://www.peerlyst.com/posts/how-to-hackthebox-shrek-machine-writeup-spirited-wolf (My personal favourite)
  4. https://www.peerlyst.com/posts/how-to-hackthebox-tenten-machine-writeup-spirited-wolf
  5. https://www.peerlyst.com/posts/how-to-hackthebox-cronos-machine-writeup-spirited-wolf
  6. https://www.peerlyst.com/posts/how-to-hackthebox-haircut-machine-writeup-spirited-wolf
  7. https://www.peerlyst.com/posts/how-to-hackthebox-popcorn-machine-writeup-spirited-wolf
  8. https://www.peerlyst.com/posts/how-to-hackthebox-bashed-machine-writeup-spirited-wolf
  9. https://www.peerlyst.com/posts/how-to-hackthebox-arctic-machine-writeup-spirited-wolf
  10. https://www.peerlyst.com/posts/how-to-hackthebox-brainfuck-machine-writeup-spirited-wolf?trk=user_notification
  11. https://www.peerlyst.com/posts/how-to-hackthebox-charon-machine-writeup-spirited-wolf
  12. https://www.peerlyst.com/posts/how-to-hackthebox-jeeves-machine-writeup-spirited-wolf
  13. https://www.peerlyst.com/posts/how-to-bsides-vancouver-2018-workshop-machine-writeup-spirited-wolf
  14. https://www.peerlyst.com/posts/how-to-mrrobot-machine-writeup-spirited-wolf
  15. https://www.peerlyst.com/posts/how-to-billu-box-machine-writeup-spirited-wolf
  16. https://www.peerlyst.com/posts/how-to-break-into-toppo-machine-walkthrough-spirited-wolf
  17. https://www.peerlyst.com/posts/how-to-break-into-wakanda-machine-writeup-spirited-wolf
  18. https://www.peerlyst.com/posts/how-to-break-into-lampiao-1-machine-writeup-spirited-wolf
  19. https://www.peerlyst.com/posts/how-to-break-into-fourandsix-1-machine-writeup-spirited-wolf
  20. https://www.peerlyst.com/posts/how-to-break-billu-box-2-machine-on-vulnhub-video-writeup-spirited-wolf
  21. https://www.peerlyst.com/posts/how-to-break-into-stapler-1-machine-writeup-spirited-wolf
  22. https://www.peerlyst.com/posts/how-to-break-into-hacklab-vulnix-machine-writeup-spirited-wolf
  23. https://www.peerlyst.com/posts/how-to-break-into-skytower-machine-writeup-spirited-wolf
  24. https://www.peerlyst.com/posts/how-to-break-brainpan-1-machine-on-vulnhub-video-writeup-spirited-wolf
  25. https://www.peerlyst.com/posts/how-to-break-into-dev-random-pipe-machine-writeup-spirited-wolf
  26. https://www.peerlyst.com/posts/how-to-break-into-tr0ll-1-machine-writeup-spirited-wolf
  27. https://www.peerlyst.com/posts/how-to-break-into-tr0ll-2-machine-writeup-spirited-wolf
  28. https://www.peerlyst.com/posts/how-to-break-into-bob-1-0-1-machine-writeup-spirited-wolf
  29. https://www.peerlyst.com/posts/how-to-break-into-darknet-1-0-machine-ctf-writeup-spirited-wolf
  30. https://www.peerlyst.com/posts/how-to-break-into-pwnlab-init-machine-writeup-spirited-wolf
  31. https://www.peerlyst.com/posts/how-to-break-into-holynix-1-machine-ctf-writeup-spirited-wolf
  32. https://www.peerlyst.com/posts/how-to-break-into-sickos-1-1-machine-writeup-spirited-wolf

But sadly I wasn't able to create video[s] for my channel this year because of my laptop. I bought new mic but it does not work on my laptop. I am a student and generally don't do bug hunting , so it's still quite hard for me to buy a new high configured gaming laptop. If you wish you can support me too on patreon. 

Also I forgot to mention that I won a CTF or two in 2018.




 Haha... but the life is too big and we have so much to learn and accomplish.  If you know me or like my work please subscribe to my channel && follow me on twitter.

See you all next year with new air, new life , new work , new things , new mindset , new tools, new knowledge and as a nice human.

Thanks & Regards,
Spirited Wolf

 Continue Reading
Subscribe to: Posts (Atom)
Designed By: Blogger Templates | Templatelib