CEH ILABS Pratice Note

1.
NTLMV2 Hash Crack (Kali Linux)
Linux of Responder ko default log directory ma NTLMV2 ko hash file xa. Crack garera
password nikalna vanxa.
1. Default hash file directory: /usr/share/Responder/Log/
2. Hash file name: something like [Link]
3. Wordlist file: ~/Desktop/Wordlist/[Link]
4. Command: john --format=netntlmv2 --wordlist ~/Desktop/Wordlist/[Link]
/usr/share/Responder/Log/[Link]
we can use “locate [Link]” also to find the exact location.
$ sudo john home/user/[Link]
Answer: dragon
2.
Diyeko Network ma kun OS or IP ma FTP service enabled xa vanera dinxa. Answer ma options
haru hunxa, IP or OS nikalney ani right option ma click garney.
nmap –p21 [Link]/24
Port open vayeko IP or tyo IP ko OS rakhney.
Or, mathi initial approach ma nmap scan batah save gareko [Link] ma gayera 21
search garney and kun IP ma open raixa herney.

3.
Diyeko Network ma kun OS or IP ma RDP service enabled xa vanera dinxa. Answer ma options
haru hunxa, IP or OS nikalney ani right option ma click garney.
nmap –p3389 [Link]/24
Port open vayeko IP or tyo IP ko OS rakhney
Or, mathi initial approach ma nmap scan batah save gareko [Link] ma gayera 3389
search garney and kun IP ma open raixa herney.
 5. Diyeko Network ma kun OS or IP ma SNMP service enabled xa vanera dinxa. Answer
ma options haru hunxa, IP or OS nikalney ani right option ma click garney.
nmap –U –p161 [Link]/24

5: Wordpress username enumeration

Hint: Diyeko network ma kunai aouta IP ma [Link] wordpress site host vako xa and tya
5 ota users haru xan, (User1, User2, User3, User4) 4 ota vaye vani baki rako user ko username k
ho vanera sodxa.
Command: wpscan --url [Link] --enumerate u
Approach: Attacker machine (Kali Linux + Windows server) bahek jamma 6,7 ota IP haru live
hunxa, so maile chai sabai live victim IP haru ma scan gardai gaye. Aouta ma 5 ota username
haru enumerate hunxa. Mathi question ma deko users haru bahek arko user chai answer hunxa.

6: Wordpress password bruteforce

Hint: john vanney user le password birsiyo so password patta laga vanxa.
Command: wpscan –url [Link] --wordlist
~/Desktop/Wordlist/[Link] --usernames john
OR,
Command: wpscan –url [Link] -P
~/Desktop/Wordlist/[Link] --usernames john
Answer: coffee
nmap -T4 -sV <IP> It will display http/apache something like this of hosting ports of web
NOTE: $ wpscan –url //<IP:8080> CEH -P wordlist/[Link]

7: SQL Injection
[Link] vanney site ma janey. Login panel aouxa. Username and password
available hunxa.
1. Profile tab ma janey
 2. URL copy garney [Link]/profile?id=1
3. Page inspect garney network tab ma janey ani page refresh garney.
4. Cookie pani copy garney.
5. Command: sqlmap –u [Link]/profile?id=1 --cookie=”cookie halney” -
-dbs
6. Database list garney. Question ma goodshooping database ko login vanney table ko 6th
login ID vako login name k ho vanera sodya hunxa
7. sqlmap –u [Link]/profile?id=1 --cookie=”cookie halney” -D
goodshopping –dump
or
sqlmap –u [Link]/profile?id=1 --cookie=”cookie halney” -D
goodshopping –T <Table-name> --dump
8. Jamma aouta table hunxa yo db ma ani login id 6 vako row ko login name is answer.
Sqlmap -u vulnerable_endpoint --cookie=”” -dbs
Sqlmap -u vulnerable_endpoint --cookie=”cookiecur

8: Parameter Tampering
1. Mathi kali URL ma janey [Link]/profile?id=1
2. Id ko value 1 batah 3 ma change garney.
3. Kety vanney user ko phone number answer hunxa.

9:Command Injection
1. Wordpress install vayeko IP browser ma halney ani dvwa path add garney
2. [Link]
3. Username ra password available hunxa dvwa ko question mai, halney
4. DVWA ko panel khulxa.
5. Suru ma Severity ma janey ani impossible lai low ma change garney.
6. Command Injection ma janey.
7. Text Field ma: [Link]& net user halney.
Or
| net user
8. 6 ota users haru hunxan but question ma Guest user bahek kati jana user xan vaneko
hunxa. Guest user aouta hunxa. So, 5 is the answer.

10: FTP username and password brute force with hydra.

1. FTP installed vayeko IP note garney. Refer to question 2.
 2. Hydra user garera brute force garney. Username ra password ko worlist kali ko desktop
ko wordlist vitra huxna [Link] ra [Link] name vako.
3. Command: hydra –L [Link] -P [Link] [Link]
$ ftp IP eg ftp [Link]

ftp> ls
ftp> get [Link]
ftp> bye
$ ls //we can see the [Link]
$cat [Link].

4. Crack vako username and password ftp ma login garera file download garney ani read
garney.
5. Command: wget –m [Link]
6. File download hunxa, File vitra flag hunxa, tei submit garney.
7.

11: File Hash Match

1. Windows ko Document folder ma aouta [Link] vanney file hunxa jun ma 5 ota hash
hunxa users haru ko.
2. Windows ko Document > Accounts folder ma 5 ota text file hunxa.
3. HashCalc tool install pre installed hunxa.
4. Open garney.
5. Ani Document > Accounts ma vayeko file lai palai pilo open garney ani hash calculate
garney.
6. Ani [Link] ma vako hash sanga match garney.
7. Jun user ko hash ra text file ko hash mildaina, Tyo answer huxna.

12: Steganography.
1. Quick stego tool install garney.
2. Local Disk E -> System Hacking -> Steganalysis vitra huxna
3. Image file chai Documents vitra Stegnanography vanney folder vitra hunxa
4. Palai pilo sabai file lai read garney quick stego batah.
5. 4 or 5 ota image hunxa, sabai ma “Sorry wrong image“ type ko msg hunxa, aouta ma
account number hunxa. Account number submit garney.

13: Veracrypt.
Hint: Kunai aouta IP ma RDP garera tya vayeko encrypted disk vitra vako flag read gar vanxa.

1. [Link] file batah RDP enabled vayeko IP khojney.

2. Windows server ma gayera RDP app open garney.
3. IP halney
4. Username ra password deko hunxa question ma login garney.
5. Login garesi tyo window ma agadi nai veracrypt vanney tool installed vako hunxa.
6. Veracrypt open garney.
7. Encrypted disk chai Document vitra veracryptfolder type ko name ma hunxa.
8. Tool open garera tyo encrypted folder lai open garney.
9. Mount vanney button click garney ani password magxa.
10. Password Documents vitra hunxa. [Link] type ko.
11. 5 ota jati password hunxa, aouta milxa ani file mount hunxa.
12. File open garera flag read garney.

14: Apache Version find garney vanxa.

Wordpress install vayeko or DVWA install vayeko IP ma curl use garney.
curl -S -I [Link]
nmap -T4 -sV <IP>
Apache version aouxa.

15: Hint: Diyeko Network ma aouta IP ma Ubuntu OS installed hunxa, tyo cloud OS ma login
garera bank account number pata lagauney hunxa.
Document folder ma [Link] type ko file name hunxa jun ma username hash haru hunxa.
1. Open rainbowcrack application, if installed xaina vani,
2. Local Disk E -> Cryptography -> rainbow crack hunxa install garney.
3. Rainbow crack open garney.
4. Document folder vitra vako username ko hash file lai open garney tool batah.
5. Tool ko menu baru ma rainbow tables vanney option hunxa, Rainbow tables open garney.
6. Ani afai hash decrypt hunxa thalxa.
7. 5,6 ota jati decrypted text ma, aouta username hunxa and aouta password hunxa.
8. Mero ma chai 1st ko username thio and second last ko password thio.

DVWA installed vakai ip ma janey browser ma.

[Link]
Username ra password magxa, login garesi 3,4 ota folder hunxa, Bank1, Bank2, Bank3, Bank4
vanera, Bank 2 ma account number hunxa aru ma error message hunxa.

16: DoS
1. [Link] file hunxa. Teslai wireshark batah open garney.
2. Jun IP le ACK gareko xaina tyo chai DOS vako hunxa, tei IP is answer.
3. Or,
4. Tesma vako destination IP ma jun ma highest number of packet count hunxa, tyo chai
victim hunxa.
[Link] == 1 and [Link] == 0

17: HTTP Traffic

1. Find password in pcap file.
2. Diyeko pcap file wireshark bata open garney.
3. Wireshark ko filter ma
4. http contains Password
5. Lekhney.
6. Filter vako connection ma follow TCP stream garney.
7. Password find garney .

18: Covert TCP.

1. Question ma covert tcp perform vako suru ko connection ko source port ra destination
port lekhna vanxa.
2. IPs Ma vako first connection ko source port and destination port hunxa answer.

19: RAT
1. Windows server bata live packet capture garney.
2. Jun IP le tyo range vanda bahira or unique IP ma connection gariraxa, that is answer.

Questio 20:
Given IP ma kun OS installed xa vaneko hunxa
[Link] file open garera tyo IP lai search garney ani OS find garney.