Without Internet Connection, Do Security Testing of your Linux Box

Introduction

As you know Penetration testing can be done manually or using Automated tools. But most of the tools available in the market requires internet connection to suggest the vulnerabilities of target. Imagine a tool which can help ethical hackers to do pentesting without any network dependencies.

{ "@context": "http://schema.org", "@type": "HowTo", "totalTime": "PT15M", "name": "Htbenum", "description": "Htbenum is penetration testing tool. Htbenum tool is use to scan the system to find out the vulnerabilities", "tool": [ { "@type": "HowToTool", "name": "the data from the system and stores in server and tmp directory" }, { "@type": "HowToTool", "name": ", we can execute this tool when we are not connected to the internet" }, { "@type": "HowToTool", "name": "even connected to internet by using our own webserver" } ], "supply": { "@type": "HowToSupply", "name": ". To execute this tool python must be required" }, "step": [ { "@type": "HowToSection", "name": "Use this command to clone the file", "position": "1", "itemListElement": [ { "@type": "HowToStep", "image": "https://www.securitynewspaper.com/snews-up/2020/04/tool-launch-min-1.jpg", "name": "Use the cd command to enter into the directory", "position": "1", "url": "https://github.com/SolomonSklash/htbenum", "itemListElement": [ { "@type": "HowToDirection", "position": "1", "text": "use this command to launch the tool and we can also see help commands" }, { "@type": "HowToTip", "position": "2", "text": "Use this command to update the tool ./htbenum -u" } ] }, { "@type": "HowToStep", "image": "https://www.securitynewspaper.com/snews-up/2020/04/update-tool-min-1536x424.jpg", "name": "Now, type this command to start our own web server", "position": "2", "url": "https://github.com/SolomonSklash/htbenum", "itemListElement": [ { "@type": "HowToDirection", "position": "1", "text": "Now, open another shell, go to file path and type this command to scan the system for find the vulnerabilities in our own machine" } ] }, { "@type": "HowToStep", "image": "https://www.securitynewspaper.com/snews-up/2020/04/servernotconnected-min.jpg", "name": "It scan automatically. This tool has 5 different enumeration scripts", "position": "3", "url": "https://github.com/SolomonSklash/htbenum", "itemListElement": [ { "@type": "HowToDirection", "position": "1", "text": "After scanning the system it will create a report and stores in server and tmp file" } ] } ] }, { "@type": "HowToSection", "name": "Now, extract the tar file by using this command tar xvf linenum-report.tar.gz", "position": "2", "itemListElement": [ { "@type": "HowToStep", "image": "https://www.securitynewspaper.com/snews-up/2020/04/scan-not-connected-min.jpg", "name": "Here, we found 2 vulnerabilities on the victim’s machine", "position": "1", "url": "https://github.com/SolomonSklash/htbenum", "itemListElement": [ { "@type": "HowToDirection", "position": "1", "text": "[CVE-2017-0358] ntfs-3g-modprobe and [CVE-2019-18634] sudo pwfeedback" } ] }, { "@type": "HowToStep", "image": "https://www.securitynewspaper.com/snews-up/2020/04/scan-not-connected-min.jpg", "name": " When the user is entering the password in the background for each key It shows asterisk (*)", "position": "2", "url": "https://github.com/SolomonSklash/htbenum", "itemListElement": [ { "@type": "HowToDirection", "position": "1", "text": "sudoer files even the user can be triggerd a stack-based buffer overflow due to this vulnarability" } ] } ] }, { "@type": "HowToSection", "name": "Google project zero jann Horn discovered before executing the modprobe with high privileges", "position": "3", "itemListElement": [ { "@type": "HowToStep", "image": "https://www.securitynewspaper.com/snews-up/2020/04/vulnarabilitiesnew-min.jpg", "name": "that NTFS-3G a read write NTFS drive for fuse that does not disturb the environment", "position": "1", "url": "https://github.com/SolomonSklash/htbenum", "itemListElement": [ { "@type": "HowToDirection", "position": "1", "text": "the local user can take the advantage of the root user" } ] } ] } ] }

Htbenum is a enumeration and exploit suggestion scripts, which can be used while doing penetration testing of your Linux Box. Htbenum tool is used to scan the system to find out the vulnerabilities, even when you are not connected to Internet. To execute this tool python is required.

Environment

• OS: Kali Linux 2019.3 64 bit
• Kernel version: 5.2.3

Installation Steps

• Use this command to clone the tool.
• git clone https://github.com/SolomonSklash/htbenum

root@kali:/home/iicybersecurity# git clone https://github.com/SolomonSklash/htbenum
Cloning into 'htbenum'...
remote: Enumerating objects: 72, done.
remote: Counting objects: 100% (72/72), done.
remote: Compressing objects: 100% (58/58), done.
remote: Total 72 (delta 37), reused 35 (delta 14), pack-reused 0
Unpacking objects: 100% (72/72), 167.10 KiB | 77.00 KiB/s, done.

• Use the cd command to enter into the directory

root@kali:/home/iicybersecurity# cd htbenum/
root@kali:/home/iicybersecurity/htbenum# ls

• Use this command to launch the tool and we can also see help by running command.
  • ./htbenum

• Use this command to update the latest version of tool  ./htbenum -u

• Now, type this command, this will start our own web server on port 25.
  • ./htbenum -i 127.0.0.1 -p 25 -w

• Now open another shell, go to tool path and type this command to scan your Linux Box for vulnerabilities.
  • ./htbenum.sh -i 127.0.0.1 -p 25 -r

• It will scan automatically and this tool uses 5 different enumeration scripts.
  • Linux-smart-enumeration
  • LinEnum
  • Linuxprivchecker.py
  • Uptux
  • SUID3NUM
• It also uses two Exploit suggestion tools (linux-soft-exploit-suggester, LES: Linux privilege escalation auditing tool)

• After scanning the system it will create a report and stores the result in /home/iicybersecurity/htbenum folder.

• Now to see the results we will extract the tar file by using this command
• tar xvf linenum-report.tar.gz

• Now it will create a tmp directory. There we can find all the results.

• Lets dig down and see the vulnerabilities.
• For understanding we will see on vulnerability suggested on our Linux Box.

[CVE-2019-18634] In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Conclusion

So we saw on how we can scan our Linux Box without any Internet dependency and it is easy for penetration testers to use this tool to find out the vulnerabilities.