z0rs

lampungprov.go.id jatimprov.go.id jatimprov.go.id jabarprov.go.id sulutprov.go.id sulutprov.go.id kaltaraprov.go.id kepriprov.go.id sumbarprov.go.id jabarprov.go.id

z0rs

mci.gov.sg cpf.gov.sg hdb.gov.sg ema.gov.sg ura.gov.sg nhb.gov.sg nparks.gov.sg sfa.gov.sg nric.gov.sg nrb.gov.sg

z0rs

acehprov.go.id sumutprov.go.id sumbarprov.go.id riau.go.id kepriprov.go.id jambiprov.go.id bengkuluprov.go.id sumselprov.go.id babelprov.go.id lampungprov.go.id

z0rs

Incident Summary

This report outlines the compromise of a WordPress server exploited through a vulnerable plugin by a threat actor. The attack, simulated in HackTheBox's Sherlock: Ultimatum challenge, targeted a known vulnerability in the Ultimate Member plugin, enabling the attacker to create a backdoor admin account and gain full control over the server. This detailed report examines the attack timeline, indicators of compromise (IoCs), and post-exploitation activities.

---

1. Objective

The objective of this investigation was to analyze the compromise of a WordPress server suspected of being attacked via a vulnerable plugin. The aim was to identify the exploit, document the attacker's methods, and gather actionable intelligence for remediation.

z0rs

const deleteTweetsBetweenDates = async (startDate, endDate) => {
  const processedButtons = new Set();
  const delay = (ms) => new Promise(resolve => setTimeout(resolve, ms));

  console.log("Script started");

  while (true) {
    console.log("Looking for tweets...");

    const deleteButtons = Array.from(document.querySelectorAll('[data-testid="caret"]'))

z0rs

Penetration Testing Report for Target System 192.168.8.4 - August 2024

Date: August 13, 2024
Pentester: Eno Leriand

---

Table of Contents

1. Report Overview

• 1.1 Executive Summary

z0rs

Dalam kasus ini, interface yang aktif adalah wlp2s0 dengan IP 192.168.8.2(ip addr) dan gateway 192.168.8.1 (ip route show).

Step 1: Install Tools

Pastikan arpspoof, sslsplit, dan dsniff. Ini biasanya tersedia di Arch Linux.

sudo pacman -S dsniff sslsplit

Step 2: ARP Spoofing

z0rs

#!/bin/bash

# Variables
HOSTAPD_CONF="/etc/hostapd/hostapd.conf"
DNSMASQ_CONF="/etc/dnsmasq.conf"
HOTSPOT_IP="192.168.20.1"
DHCP_RANGE_START="192.168.20.10"
DHCP_RANGE_END="192.168.20.50"

z0rs

3. Man-in-the-Middle (MITM) Attack

Tools: ettercap, mitmproxy, Wireshark

Langkah-langkah:

A. ARP Spoofing dengan Ettercap

1. Install Ettercap:

   sudo apt-get install ettercap-graphical

z0rs

Table of Contents

• Statement of Confidentiality
• Approach
• Scope
  • In Scope Assets
• Assessment Overview and Recommendations
• Detailed Walkthrough Informa
  • Scan Summary
  • Open Ports and Services
• Detailed Findings