Posts

Prologue While exploring devices on my college network, I managed to gain Remote Desktop Access to a server for one of our institute’s websites. The method I used to obtain access to the interface is out of the scope of this blog. Upon gaining access, I found that the server was running Ubuntu. The terminal displayed user as the current user. I added my public key to /home/user/.ssh/authorized_keys and checked the SSH connection. With SSH access confirmed, it was time to escalate our privileges to the root user. ...

Portainer Portainer is an open-source management tool designed for containers. It offers a user-friendly, lightweight web interface that simplifies the deployment and management of Docker environments. It’s important to note that while Portainer itself does not run with root privileges, if the Docker service managed by Portainer operates with root permissions, it could potentially lead to a remote root shell vulnerability, as discussed further. Information Gathering Collecting Target Devices We’ll use Shodan Search Engine to Collect Target Devices. On Shodan Search Engine search with query product:portainer, this would list out all the Devices that were identified running Portainer by Shodan. After setting the requeired filters, we can download the results. The Number of Results that can be downloaded depends upon your query credits available(1 Query Credit = 100 Results) After Shodan has done compiling the data, it sends us a Mail that Data is ready for Download or we can alernatively wait on Shodan Download Page while the data is being compiled The Download will be in the format .json.gz. Shodan provides a Command-Line Utility to Parse the data in these download files. The utility can be installed with the command ...

Compromising CCTVs 101 RTSP Protocol RTSP Protocol stands for Real Time Streaming Protocol and by default runs on Port 554. As the name tells, its an application level protocol designed to transport streams over a network and is commonly used by Devices like CCTVs. The RTSP Protocol doesn’t offer encryption, therefore everything is transparent to an Attacker eavesdropping on the Network Traffic of a Device using RTSP. We won’t cover MITM (Man-in-the-Middle) Attacks and other eavesdropping methods in this blogs, rather will focus on gaining direct access to CCTVs. ...

How passwords are stored on servers? Passwords are stored on databases by hashing them alone or after appending them with random values. Hashing is a one-way function that converts a given string of characters into another value. A strong hashing algorithm has to be quick, deterministic, and irreversible. In this blog, we explore how a hashed password can be cracked. Hashing Algorithms Hashing algorithms are mathematical functions that take an input (often a string of characters, such as a password) and produce a fixed-size string of characters, known as a hash value or hash code. These algorithms are designed to be one-way functions, meaning that while it’s easy to compute the hash value from the input (password), it’s computationally infeasible to reverse the process and obtain the original input from the hash value. Some common hashing Algorithms are: ...