Hacking For Ramen

The machine that will force you to TRY HARDER

#tryhackme #pentest
https://telegra.ph/Relevant-09-23

Relevant is the eighth machine in the “Advanced Exploitation” part of TryHackMe’s “Offensive pentesting” path. > Enumeration Nmap scan result: nmap -sC -sV -o nmap.txt <target_ip> 80/tcp open http Microsoft IIS httpd 10.0 135/tcp open msrpc Microsoft Windows…

84 views16:56

Hacking For Ramen

The last writeup on Offensive Pentesting learning path from me. Kicking Wordpress and Jenkins instance in that one.

https://telegra.ph/Internal-09-23-2

Telegraph

Internal

Internal is the last machine in the “Advanced Exploitation” part of TryHackMe’s “Offensive pentesting” path. Enumeration As I’m starting to prepare for my “Dry run” for the OSCP exam, this time I will use more stuff from my methodology. We already learned…

86 views17:20

Hacking For Ramen

Found my old HackTheBox writeup, that is also can be useful for OSCP prep. In Tabby, you need to break into the Tomcat instance and escape from the LXD container for a PrivEsc. Pretty cool machine, this PrivEsc vector is quite common, but still underrepresented in the majority of labs.

#hackthebox #pentest
https://telegra.ph/Tabby-09-27

Telegraph

Tabby

Tabby is an easy Linux machine from HackTheBox, that is part of the pool of machines that recommended for preparation for OSCP certification. > Content table Enumeration Exploitation of Tomcat Privilege escalation with LXC containers > Enumeration Start with…

90 views07:24

Hacking For Ramen

To the hardcore part. While we are still on the OSCP note, it is wort mentioning the crucial part of the exam - the Buffer Overflow exploitation. That machine will give you 25 points (from 70 to pass the exam), and it is very different from all other machines. To handle that one, you will need to have some basic experience with Binary Exploitation and Exploit Development, as you will need to develop an exploit, that by manipulating of the program's input and memory, could execute arbitrary code to spawn a shell.
Without further ado, let's gain you some experience:
https://telegra.ph/Buffer-Overflow-101-09-27

#exploitdev #binaryexploitation #oscp

Telegraph

Buffer Overflow 101

> Introduction What is a Buffer Overflow?

104 views07:42

Hacking For Ramen

Preparing for the OSCP? I captured my journey, thoughts and a bunch of advances in this long read OSCP review.
Is it good? Should you take it? Does it worth it? It's all here!
Enjoy!

#oscp #cert #review
https://telegra.ph/OSCP-review-09-27

Telegraph

OSCP review

> Table of Content Introduction About the PWK/OSCP course Expectations Before taking the course Lab time Preparations for the exam The exam Closing thoughts Useful resources > Introduction The OSCP (Offensive Security Certified Professional) also, knows as…

115 viewsedited 10:34

Hacking For Ramen

#memes

95 views10:48

Hacking For Ramen

My eWPT review is almost done, but it's make no sense to post it, as I'm still waiting for the result to arrive.
Oh well...
I will continue with the start of another series and interrupt it with the review later on. Stay tuned.
Spoiler: eWPT is nice

84 views20:04

Hacking For Ramen

A bunch of upcoming post will be all about wargames from https://exploit.education/, formerly known as exploit-exercises.com.
It's a great collection of virtual machines that could help to develop essential skills for vulnerability research, and exploit development.
It might seem too simple at the beginning, but the learning curve will smash me shortly, no doubt in that.

93 views20:19

Hacking For Ramen

#exploitdev #nebula
https://telegra.ph/Nebula---00-10-22

Telegraph

Nebula - 00

> Intro After a long break from posting anything I’m pleased to start the new series - Exploit Development. I decided to start with the Nebula challenge from exploit.education. The idea is to walk through and document my journey in the order Nebula ⇾ Phoenix → Fusian.…

85 views20:20

Hacking For Ramen

#exploitdev #nubula
https://telegra.ph/Nebula---01-10-22

Telegraph

Nebula - 01

> Source code #include <stdlib.h> #include <unistd.h> #include <string.h> #include <sys/types.h> #include <stdio.h> int main(int argc, char **argv, char **envp) { gid_t gid; uid_t uid; gid = getegid(); uid = geteuid(); setresgid(gid, gid, gid); setresuid(uid…

83 viewsedited 20:21

Hacking For Ramen

#exploitdev #nebula
https://telegra.ph/Nebula---02-10-22

Telegraph

Nebula - 02

> Source code #include <stdlib.h> #include <unistd.h> #include <string.h> #include <sys/types.h> #include <stdio.h> int main(int argc, char **argv, char **envp) { char *buffer; gid_t gid; uid_t uid; gid = getegid(); uid = geteuid(); setresgid(gid, gid, gid);…

98 views20:23

Hacking For Ramen

#exploitdev #nebula
https://telegra.ph/Nebula---03-10-22

Telegraph

Nebula - 03

> Source code There is no source code available on the site, but we will work with the script /home/flag03/writable.sh level03@nebula:/home/flag03$ cat writable.sh #!/bin/sh for i in /home/flag03/writable.d/* ; do (ulimit -t 5; bash -x "$i") rm -f "$i" done…

95 views20:24

Hacking For Ramen

#exploitdev #nebula
https://telegra.ph/Nebula---04-10-22

Telegraph

Nebula - 04

> Source code #include <stdlib.h> #include <unistd.h> #include <string.h> #include <sys/types.h> #include <stdio.h> #include <fcntl.h> int main(int argc, char **argv, char **envp) { char buf[1024]; int fd, rc; if(argc == 1) { printf("%s [file to read]\n"…

96 views20:25

Hacking For Ramen

I realized it's hard to keep up in series like that (because of the same picture, maybe?). They all look alike!
I'll try to add more context to each post for that sake.

In level 5 of Nebula wargame we will learn a bit about privileges in Linux, and how you can a private ssh key that you might find in the backup of a compromised computer.

#exploitdev #nebula
https://telegra.ph/Nebula---05-10-26

Telegraph

Nebula - 05

> Source code There is no source code available for this level. > Getting the flag By checking the flag05 directory we can find unprotected .backup folder: level05@nebula:/home/flag05$ ls -lah total 9.0K drwxr-x--- 1 flag05 level05 80 2021-06-16 00:17 . drwxr…

81 views15:54

Hacking For Ramen

Let's crack some passwords! In the level 6 of #nebula wargame we will learn how to crack the hash of the password.

#exploitdev
https://telegra.ph/Nebula---06-10-26

Telegraph

Nebula - 06

> Source code There is no source code available for this level. > Getting the flag Nothing interesting in the /home/flag06 folder, but by poking around in previous challenges I noticed that flag06 user has the hashed password in the /etc/passwd: level06@…

81 views15:57

Hacking For Ramen

Finally! The fun part starts here. All levels before that were to warm up.
In the level 7 of the #nebula wargame we got the source code of the application. We need to read, understand, and find how to exploit the bug there.

#exploitdev
https://telegra.ph/Nebula---07-10-26

Telegraph

Nebula - 07

> Source code #!/usr/bin/perl use CGI qw{param}; print "Content-type: text/html\n\n"; sub ping { $host = $_[0]; print("<html><head><title>Ping results</title></head><body><pre>"); @output = `ping -c 3 $host 2>&1`; foreach $line (@output) { print "$line";…

92 views16:02

Hacking For Ramen

Finding the password from the next level of #nebula wargame in the TCP stream by using Wireshark.
#exploitdev
https://telegra.ph/Nebula-08-09-20

Telegraph

Nebula - 08

> Source code There is no source code available for this level. > Getting the flag The .pcap file is in the flag08 folder, let’s download it to the main machine and analyze it with Wireshark. One of the ways could be spawning a SimpleHTTPServer on the machine:…

87 views16:05

Hacking For Ramen

In this #nebula challenge, we will analyze and exploit the vulnerable PHP code wrapped around in a C SUID binary.

#exploitdev
https://telegra.ph/Nebula-09-09-20

Telegraph

Nebula - 09

> Source code <?php function spam($email) { $email = preg_replace("/\./", " dot ", $email); $email = preg_replace("/@/", " AT ", $email); return $email; } function markup($filename, $use_me) { $contents = file_get_contents($filename); $contents…

91 views16:07

Hacking For Ramen

There you go, some #memes to keep you entertained

92 views16:23

94 views16:23