Decompiling Flash Files with SWFScan

Inspired by Rafal Los' talk at AppSec DC I started taking a look at SWFScan.

SWFScan download

SWFScan FAQ

A good description here so I don't have to plagiarize

Did a quick search for login.swf and found one (actually lots). Let's fire up SWFScan and see what we can see.


Open it and decompile the .swf. We see a hardcoded password.


Just to be sure that it actually does any checking


Ok its working. They're not letting just anyone in there!


Because the code just jams the username and password box together we can just throw the whole thing in the username block or mix it up however you want.


weeeeeeeeeeeeee!



Just to make sure it wasnt beginner's luck...


Happy decompiling...

Additional Info can be found on the pdc #172 show notes:
http://pauldotcom.com/wiki/index.php/Episode172

Link to Blackhat talk
http://www.blackhat.com/presentations/bh-dc-09/Jagdale/BlackHat-DC-09-Jagdale-Blinded-by-Flash.pdf

Metasploit In Color!

Metasploit now has color in MSFConsole. weeeeeeeee!

BToD Using Burp Extender & DirChex to extract all HTML comments

Today's Burp Suite Tip of the Day is a video showing quite a few things.

1) How to compile and package the Burp Extender utilizing BackTrack 4.

2) We build the plug-in coded by Daniele Costa (ref: portswigger.net )

3) How to install DirChex on BT4

4) How to utilize both DirChex and BurpSuite (along with plug-in) to extract all html comments from a web application.

You can download DirChex at DirChex Project Page

Enjoy & Happy Hacking!!

cktricky & BurpSuite Tip of the Day - Extracting HTML from cktricky on Vimeo.

BackTrack 4 version of DirChex now available

Hey folks,

As promised k3r0s1n3 has delivered! We now have a BT4 specific version of DirChex_v1.1 available. If you navigate to the DirChex Project Page you can download the zip file containing the program and the install script. Just unzip the file, 'cd DirChex_v1.1' and then 'bash install.sh'...........that is about it!

Then fire up the program 'ruby DirChex_v1.1.rb'

Okay folks so here is a screenshot:

k3r0s1n3 is the man for whipping this up in such short time. You can visit his blog Here .

Also SPECIAL thanks to @mubix for helping to troubleshoot various errors for the release. Without his help the program wouldn't be a fully functioning stand-alone windows executable.

Happy Hacking!

Side Note: DirSnatch_v2.0

So, in case you were annoyed by the .exe version of DirSnatch opening a console window along with the main program....you will be happy to know this has been removed. I've uploaded a recompiled version which does not require the console window pop-up.

It can be downloaded at the same location as always which is the DirSnatch Project Page.

Cheers,

cktricky

&

Happy Hacking!!!

Adding DLLs with OCRA

Hey folks, for those of you who create wxruby apps and package them with OCRA but customers receive an error (Windows) about MSVCR** or MCVCP** missing (or something along those lines) here is what you do.

Simply copy over your DLL files (the ones the app complains about) to \Ruby\bin\ then run OCRA like so:

C:\ruby\lib\ruby\gems\1.8\gems\ocra\bin\ocra --dll MSVCR**.dll --dll MSVCP**.dll

AND you will be in business.

Cheers,

cktricky

DirChex_v1.1 Release

As promised the follow-up program to DirSnatch ==> 'DirChex' has been released. You can download the tool Here The tool automates the task of requesting a list of URLs via an intercepting proxy with the User Agent of your choice.

Right now the layout suxx for BT4 so I wouldn't even bother trying BUT in case you wanted to the README offers up some instructions.

Lots of upgrades and different stuff to do so please let us know if you have problems, requests, etc. they are all welcomed.

By "us" I mean @k3r0s1n3 and I.

Here is a screenshot

One last thing, additional usage instructions for the tool are located on k3r0s1n3's blogs

Happy Hacking!

More On Metasploit Meterpreter & Timestomp

Well, probably "more" I honestly didn't look.

So there is blurb on the metasploit unleashed course on using timestomp. Unfortunately it leads you to believe that blanking the MACE values on a file or whole directory is better than hiding in plain sight. I suppose this can be debated (so feel free).

But... timestomp has a few other options worth discussing, notably setting MACE times from a file or individually setting attributes or setting all four attributes at once to a MACE time of your choosing.

meterpreter > timestomp

Usage: timestomp file_path OPTIONS

OPTIONS:
-a Set the "last accessed" time of the file
-b Set the MACE timestamps so that EnCase shows blanks
-c Set the "creation" time of the file
-e Set the "mft entry modified" time of the file
-f Set the MACE of attributes equal to the supplied file
-h Help banner
-m Set the "last written" time of the file
-r Set the MACE timestamps recursively on a directory
-v Display the UTC MACE values of the file
-z Set all four attributes (MACE) of the file

Check our current values

meterpreter > timestomp C:\\boot.ini -v
Modified : Wed Aug 12 18:12:39 -0400 2009
Accessed : Thu Oct 29 16:13:12 -0400 2009
Created : Wed Aug 12 11:06:54 -0400 2009
Entry Modified: Wed Aug 12 18:23:34 -0400 2009

Set the Modified time to 11/11/2011 at 11:11:11

meterpreter > timestomp C:\\boot.ini -m "11/11/2011 11:11:11"
[*] Setting specific MACE attributes on C:\boot.ini

Did it work?

meterpreter > timestomp C:\\boot.ini -v
Modified : Fri Nov 11 11:11:11 -0500 2011
Accessed : Thu Oct 29 16:13:12 -0400 2009
Created : Wed Aug 12 11:06:54 -0400 2009
Entry Modified: Wed Aug 12 18:23:34 -0400 2009

Set them all to 11/11/2011 at 11:11:11

meterpreter > timestomp C:\\boot.ini -z "11/11/2011 11:11:11"
[*] Setting specific MACE attributes on C:\boot.ini

Did it work?

meterpreter > timestomp C:\\boot.ini -v
Modified : Fri Nov 11 11:11:11 -0500 2011
Accessed : Fri Nov 11 11:11:11 -0500 2011
Created : Fri Nov 11 11:11:11 -0500 2011
Entry Modified: Fri Nov 11 11:11:11 -0500 2011


From a file

meterpreter > timestomp C:\\update.exe -v
Modified : Fri Apr 30 05:59:36 -0400 2004
Accessed : Fri Oct 23 20:28:36 -0400 2009
Created : Thu Apr 29 22:33:55 -0400 2004
Entry Modified: Fri Apr 30 06:22:35 -0400 2004

meterpreter > timestomp C:\\update.exe -f C:\\boot.ini
[*] Setting MACE attributes on C:\update.exe from C:\boot.ini

meterpreter > timestomp C:\\update.exe -v
Modified : Fri Apr 30 05:59:36 -0400 2004
Accessed : Sat Oct 24 05:34:03 -0400 2009
Created : Thu Apr 29 22:33:55 -0400 2004
Entry Modified: Fri Apr 30 06:22:35 -0400 2004

meterpreter > timestomp C:\\boot.ini -v
Modified : Fri Apr 30 05:59:36 -0400 2004
Accessed : Sat Oct 24 05:34:03 -0400 2009
Created : Thu Apr 29 22:33:55 -0400 2004
Entry Modified: Fri Apr 30 06:22:35 -0400 2004

Happy Hiding in plain sight.

-CG

DirSnatch_v2.0 is released

Hey guys, well my brother @k3r0s1n3 and I decided to give an upgrade to DirSnatch before moving on to QwickR which is sort of like part 1 or 2.

Feel free to download the app at the DirSnatch Project Page

Anyway, here are some pics of the new version

Choosing directory to list

Choosing either http:// or https:// to prepend

Location to save the list to

This is what it will look like when all options are chosen

Beyond the obvious visual changes we've included error handling in this version. Okay folks, next up, QwickR!!

Happy Hacking!

DirSnatch has gone GUI

Hey all, as promised I have something coded up and it works well enough to release. Still a lot of functionality to add so you can give your customers something nice to look at it and fairly dummy proof.

DirSnatch, the script I wrote with @k3r0s1n3 was really something my customers liked (due to expedited testing times) but was basically really ugly. It was ugly because it was a dreaded console app :(

Okay, so using the ruby gems 'ocra' and 'wxruby' k3r0s1n3 and I were able to create a windows based stand-alone executable in GUI form.

Again, there is a TON to add to this tool and make it just cooler to work with.

Also, we are working on making Qwickr (formerly qwick_request) GUI.

Qwickr currently allows you to request URLs in a text file (such as the output from DirSnatch) in a threaded fashion thru the intercepting proxy of your choice. This is also helpful if you intercepting proxy doesn't allow you to save the URLs you've spidered. This creates a site map in no time.

The console version of Qwickr is finished but we don't want to release until its functioning as a GUI app. So be on the look out for that.

Here is a screen shot of DirSnatch_v1.1

This is what the output.txt looks like

So the new version can be download Here

The file annotated GUI_DirSnatch.rb works on linux but you must perform a 'gem install wxruby'

Happy Hacking!