Metasploit and VNC Password Bruteforcing

You probably missed it but jduck recently snuck in a VNC mixin and vnc_login module to the trunk.

This is awesome because before that I had to use Immunity's VAAseline to do VNC bruteforcing. But now you can just use vnc_login.

So the scenario is you find yourself on the other end of a VNC server.

Its tedious to password guess like this

Instead let's use the metasploit module


and throw a dictionary attack against the VNC server

Looks like the VNC no auth module had been ported and stuck in there too :-)


-CG

Conducting a Phishing Campaign in Metasploit Pro

So new job gets me new fun toys. Figured i'd try the fancy shmancy tools and do a phish campaign with metasploit pro.

1. Go click on campaigns and star filling stuff out like what you want to call it


2. Set up your web campaign. With the web campaign you can actually host a webpage along with your exploit instead of just getting the typical "please wait" stuff.


3. Fill out your name of the template and the html of what you want it to say


4. By default it will run browser autopwn


5. Lets just pick an exploit to throw at them instead of all of them


6. Once you click save, it should look something like this:


7. After that you can set up the email portion of the phish


8. Fill out the sending server options

9. Then fill out the text for the body of your email


10. After you click save, you'll go to the add email addresses section where you can import a list, or type them in


11. Kinda looks like this when its all filled out. To start click the start campaign button


12. You can see the status of your sent emails and as people click them the percentage will change


13. I guess what the email could look like if you werent trying too hard :-)


14. And the web page serving up the exploit


15. You can now see that a user clicked the link and our percentage has changed


I'll cover hosts and sessions later. Only gripe is the lack of configuration ability in the exploit payload section. I've been told this will be addressed shortly even though a lot of work has been put into smart defaults the ability to change it when necessary would be nice.

-CG

iPhone + Burp

This is one of those things that is super simple and I figure most folks have already done or know how to do. There may be a few people out there whose time I save with this post. Who knows. Lets get on with it.

Just as with the Droid apps, when an untrusted certificate (Burp) shows up for an app requiring SSL/TLS, the app crashes and burns. The best way (same as Droid) to fix this is to import Burp as a trusted Certificate Authority (CA).

Why would we want to do this? Apps on mobile phones are cool but some would argue the web-services the apps are communicating with can be even juicier. We'd like to intercept the communication to the web-services and play around a bit.

You'll need to export the Burp Certificate, I usually open Firefox, set the browser to run thru Burp, view the certificate, export the certificate. Much like this.........

Browse to https://twitter.com (while proxying thru Burp)

"Get Certificate"

Select PortSwigger's cert

Save Certificate with a .cer extension (.cer is what the iPhone recognizes)

Start a web server to host the PortSwiggerCA.cer 

Browse to the location of the PortSwigger.cer file

The iPhone detects .cer, asks you to install as a CA, do it :-)

WiFi configuration, click the blue arrow on the right of your network

  Configure with Burp's IP & Proxy

Hopefully that was easy enough to follow along. Now you can proxy your iPhone apps thru Burp.

~Happy Hacking

wXf Videos from AppSec DC 2010

Here are some of the videos from AppSec DC 2010 and our presentation (Seth Law, Chris Gates and I) on wXf (Web Exploitation Framework).

Background: Back in March of this year, Seth approached me with the idea of creating a framework that would allow us to put all of our discontiguous scripts together. Then we decided "our" could mean the AppSec community as a whole. Why not take everyone's one-off scripts, proof-of-concept tools and ideas and centralize them? So........we've worked off and on since March to build it.

The only frameworks available to us at the time (and even now) which were "WEB-centric" had user interfaces that weren't what we were looking for, broke after updates and/or randomly OR just didn't have the HTTP libs we needed (SOAP, JSON, Flex, etc).

So the first thing we focused on was the console interface. We figure this will probably be the interface with the most mileage. At the moment, we are still working on the console interface as well as improving the core. The framework won't be perfect from day one but we'd like to make it as easy to use as possible.

We decided Metasploit is possibly the best designed piece of open source software/framework that we've seen and it works incredibly well. People are familiar with it and it looks nice. So we decided to make wXfconsole look like msfconsole. Same *general* type of commands  and interface layout.

Release will occur in the next couple of months. We have a list of people to "beta-test" the software and want to ensure we limit the amount of bugs to a minimum upon release.

Now, for the videos.





User Agent Fuzzer by Chris Gates (carnal0wnage) from cktricky on Vimeo.








wXf Directory Traversal Fuzzer by Chris Gates (carnal0wnage) from cktricky on Vimeo.








wXf Web Server Stack by Seth Law from cktricky on Vimeo.

Tethering Your Droid to a Linux System

Image my happiness with i got the droid update and saw usb tethering available.

Then image my sadness-->rage that VendorX wants to charge to charge another 15 bucks to tether.

so following the instructions from here it is possible to tether via USB on linux. Evidently PDAnet works great but i dont use windows cept for powerpoint and i cant afford a mac.

so here's how to get it going if you dont want to click the link...plus i'll never remember that URL.

install proxoid on your droid

download & extract the android sdk to your linux system

turn on android usb debugging -->application-->development-->usb debugging

turn on proxoid

connect usb

cg@c0:~$ cd android-sdk-linux_86/tools/

cg@c0:~/android-sdk-linux_86/tools$ sudo ./adb start-server

cg@c0t:~/android-sdk-linux_86/tools$ ./adb forward tcp:8080 tcp:8080

set your FireFox network settings to use localhost 8080 and you can surf. You should also be able to set your whole system to go thru the droid as well if you set the system wide network proxy.

Adobe XML Injection Metasploit Module

I just pushed out code coverage for the Adobe XML External Entity Injection vulnerability in multiple adobe products including: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and
8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data
Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2

References Here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-3960
http://www.osvdb.org/62292
http://www.securityfocus.com/bid/38197
http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf
http://www.adobe.com/support/security/bulletins/apsb10-05.html

I recommend you read security-asessment's pdf on it, its good.

Anyway, its a cool bug.
1 -->because it affects several products although most people have probably never heard of most of them except for ColdFusion.
2 -->its enabled by default on all those products you've never heard of except for ColdFusion, with the exception of CF 8 which appears to have it turned on by default.
3 -->You have to apply patches for CF individually and there is no automated process. Since this vuln got little media attention I've seen alot of hosts that are still missing this patch and/or didn't turn off the vuln service.

On with the demo!

So against a patched host or someone that has disabled the service in ColdFusion you'll see one of two things; either 404's for the checks or 200 for /flex2gateway/ and 500 for the http or https check.



If you get a bunch of 400's then you need to set the VHOST


When it works, you'll see something like this for /etc/passwd


and like this when you asked for a file that doesn't exist or doesn't have permission to read (since CF doesn't run as root on linux, requesting /etc/shadow wont work) :-(


At this point, you're probably like "so what" well whats cool about arbitrary file read is that 1. it also works on Windows:

and 2. that whole password.properties attack is now cool again because you can just request that file too


-CG

A new definition of "win"

Ben Tomhave has a good post over on his blog

http://www.secureconsulting.net/2010/10/there_is_no_win.html

go read it. its short...wont take long, I promise.

In part I agree, you are never going to "win" by keeping an attacker out. Like he puts in the post:

Traditionally we've held the mindset that we "win" if we stop the attackers. This mindset is sheer folly. To "win" in this scenario we need to successfully defend against 100% of attacks, whereas the attacker need only succeed once (probabilistically this works out to being far less than 100%).

Instead, we need to acknowledge the nature of our asymmetric threat and realize that there is no way to achieve "perfect" security and resist 100% of attacks. To think otherwise is willfully ignorant. Instead, we must accept a new status quo based on survivability. That is, despite successful attacks, we can consider ourselves victorious in conflict merely by surviving.

Protecting YOUR important data on the network is ultimately the goal of most network security. Keeping the attackers out is a silly goal. You are one adobe/flash/java/whatever 0day away from failing to keep attackers out and thus "losing".

Surviving a network attack is not the same as surviving a mortar attack on a FOB where if I'm still breathing and have use of my limbs at the end of it i can call that a "win". In turn, its not a successful penetration test or attack if merely "get in" and pop a bunch of shells (see Chris Nickerson's Top 5 Ways To Destroy A Company talk). Its a "win" when I steal what makes that company money, extract it without them knowing, then show it to them later for the "poop in the pants" moment. A report with a bunch of screenies of shells doesn't convey the same sense of "oh shit" that the first 100 entries of their key database does. In this case while the business may have thought they "survived" they in fact "lost".

We're getting really good at teaching our clients how to catch penetration testers and their methodologies and conditioning them that this a "win" when in fact most times defenders fail to see and catch people with a modified methodology, non public tools, or "non-standard" goals.

Hacking: The Next Generation Book Review

Hacking: The Next Generation Book Review

Nitesh Dhanjani, Billy Rios, & Brett Hardin

5 stars


Good Intro to Next Gen Attacks

First Impressions...skinny book. Strike One. Chapter 1 -- "Intelligence Gathering: Peering Through the Windows to Your Organization" spends a lot of time on physical security and social engineering and no mention of Maltego. I'm not sure how anyone can write a book on Intelligence Gathering and NOT include Maltego. Strike Two.

At this point i was thinking I had a dud on my hands BUT Chapter 2 --- "Inside-Out Attacks: The Attacker Is the Insider" redeems. Tons of code and examples to make XSS work in "realistic" scenarios mix the right amount of tech and narrative. My only gripe was that they talked about using XSS shell for XSS exploitation instead of using BEeF which is actively maintained and developed.

All the other chapters (except for Chapter 3) were very good, none of the others are as technical as chapter 2 but I believe they cover the current trends in a entertaining and readable way. Like one reviewer mentioned the information covered in Chapter 5 -- "Cloud Insecurity: Sharing the Cloud with Your Enemy" was not what I expected. It covered high level "possible" attacks versus any "probable" attacks. With the exception of possibly making insecure VM's and getting people to run it. Chapter 7 -- "Infiltrating the Phishing Underground: Learning from Online Criminals?" was a "chapterfied" version of the authors talk on the subject. Chapter 4 -- "Blended Threats: When Applications Exploit Each Other" was a good overview of stringing vulnerabilities that would be/were not considered high risk into high risk issues by combining one or more together which actually is "next generation".

Chapter 3, IMO didnt cover anything new. Mostly a discussion of insecure protocols, arp spoofing, email spoofing. While still a relevant issue in security not "next generation".

AppSec DC 2010 and Web Exploitation Framework

Back in March, I spoke of inactivity on this blog because of time being devoted to a new tool.

The post can be found Here :

The tool is actually a combination of tools or Web Exploitation Framework (wXf). The idea is to roll the massive amounts of various AppSec tools into a single framework. Simplifies things, we hope.

Come November 10th, at AppSec DC 2010 we will be presenting the framework and laying out a road-map. I hope it becomes useful to consultants and application security practitioners.

More info can be found at the following link (full schedule):

OWASP FULL SCHEDULE

...and here (wXf Specific):

WXF PRESENTATION

Look forward to seeing you all there.

~Happy Hacking

cktricky

Grabbing Index Pages Of Webservers

Grabbing the index pages of web servers seems like a no brainer and something every pentester is going to perform on a test. The problem I ran into is how do you get this info once your inside and using meterpreter as your pivot into the network.

Your current options are to port forward to each host or set up a route via your meterpreter session and run some sort of auxiliary module. You can tcp port scan and find open ports or use the http_version module to see server version but you don't get a feel for whats actually on the site.

I opted to write something that would scan a range, perform a HTTP GET of / on the ip, then take the resulting body from the response, which should be html, and save it to a file to look at afterwards.

Looks like this when it runs...

msf auxiliary(http_index_grabber) > set RHOSTS carnal0wnage.com/24
RHOSTS => carnal0wnage.com/24
msf auxiliary(http_index_grabber) > run
[+] Received a HTTP 200...Logging to file: /home/cg/.msf3/logs/auxiliary/http_index_grabber/209.20.85.4_20100904.4426.html
[+] Received a HTTP 200...Logging to file: /home/cg/.msf3/logs/auxiliary/http_index_grabber/209.20.85.5_20100904.4429.html
[*] Received 301 to http://drumsti.cc/ for 209.20.85.10:80/
[-] Received 403 for 209.20.85.8:80/
[+] Received a HTTP 200...Logging to file: /home/cg/.msf3/logs/auxiliary/http_index_grabber/209.20.85.12_20100904.4432.html
...
[*] Received 302 to http://209.20.85.57/apache2-default/ for 209.20.85.57:80/ [+] Received a HTTP 200...Logging to file: /home/cg/.msf3/logs/auxiliary/http_index_grabber/209.20.85.56_20100904.4503.html
[*] Received 302 to http://209.20.85.51/session/new for 209.20.85.51:80/

you can then check out the folder with the results


code is here:
http://carnal0wnage.googlecode.com/svn/trunk/msf3/modules/auxiliary/admin/random/http_index_grabber.rb