I can't remember when I first heard about this new Sandbox feature but when I did, I got excited.  There are a number of times when we all get a suspicious attachment and we're not quite sure if we want to open it or delete it.  If we all had a safe place to take a look, we would.  On the surface, the Sandbox feature sounded like that's what we would be getting with the 1903 update. 

    I'll be honest, after seeing it, it should be called the "litter box" feature and you can use your imagination for my reasoning.  

    1903 was released and I wasn't really paying attention because my computer updates frequently, reboots frequently, and I just assumed it was already present.  It wasn't but if you need to download it manually, here's the link:

    I'm playing around the other day and I find what looks to be a server which is vulnerable to Local File Inclusion (LFI).  I used to work for a company a long time ago and when something would break, I would declare:  "Bad code".  LFI is bad coding or perhaps I should say that it's a short sighted developer who doesn't anticipate the harm that can be caused by calling a file directly with something like:  http://example.com/index.php?file=SOMEFILENAME

    Seems harmless enough until someone comes along and decides to change the url to:  http://example.com/index.php?file=/etc/passwd 

    Now all of the sudden -- it doesn't seem all that harmless.  So that pretty much gets you up to speed and I assume that if you were searching for WAF Bypass, you already know this and probably more.  So as I said, I'm playing around and I discover:

    I'm visiting a Linux users group tomorrow and part of their focus is the Raspberry Pi.  I've been working on my Pi recon device which I've called:  "consPire" but it's only half ready because I keep coming up with more ideas for what I want it to do.  Rather than bring a half baked project, I thought about other uses for the Pi.  One thing that came to mind, that's fairly simple to build, is a proxy server.  There are a number of uses for a proxy but at the very least, it's another layer between your browser and the Internet... so why not??

    Scrounging around my desk, I found an extra MicroSD card and with balenaEtcher, I burned a Raspbian image to the card.  I used the lite version of Raspbian which lacks the GUI but it's a Pi and the GUI is S L O W.  Once the OS was installed and running, using raspi-config, I added SSH.  With SSH installed, I logged into the Pi and  I did everything else remotely.

    You’ve run your Nmap scan and you found the open web port. From the open web port, you’ve worked your way into the system and you have a low privilege shell. Now what?

    The enumeration process starts all over again.

    There are more than a few privilege escalation scripts as well as written documents that will aid in this process but only if you’re familiar with the operating system. If you’re hunting for that needle in the haystack but you don’t know what a needle looks like, how will you find it?  Recognizing that needle will come with time and I’m not trying to say you shouldn’t use those scripts.  Do use them but realize it could be overwhelming until you’re a bit more seasoned.

    First off, let me say that this was a very cool box.  The description says "easy / intermediate" but I really think that depends on your set of skills.  I could see how someone could get stuck at a certain point and I think if that's the case, I can point you to something else I've written which should help clarify what you're dealing with and how to get past the obstacle.  I don't want to spoil too much at this point so let's just start off like we normally do.

    We kick off with an Nmap scan:

    The stock Kali Linux distribution contains a number of password and word lists.  The most notable password list, RockYou, is from a breach that occurred in 2009.  The biggest revelation to come from this breach was the frequency of the most basic passwords.  The top five most used passwords in RockYou are:


    In total, there were 32 million passwords in the RockYou breach but in the Kali version of this list, there are only 14 million passwords.

    © 2020 sevenlayers.com