Oracle Sid Enumeration Metasploit Auxiliary Module

I recently pushed out (again with MC's) help an Oracle Sid enumeration MSF auxiliary module for Oracle versions less than Oracle 10g Release 2. Starting with 10g Release 2 the TNS listener is protected and wont just cough up the SID for free, you'll have to guess it or brute force it (hopefully the SID guess module will come soon).

Here it is in action

msf > use auxiliary/admin/oracle/oracle_sid
msf auxiliary(oracle_sid) > info

Name: Oracle SID Enumeration.
Version: $Revision$

Provided by:
CG

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 1521 yes The target port

Description:
This module simply queries the TNS listner for the Oracle SID. With
10g Release 2 and above the listener will be protected and the SID
will have to be bruteforced or guessed.

msf auxiliary(oracle_sid) > set RHOST 192.168.0.43
RHOST => 192.168.0.43
msf auxiliary(oracle_sid) > run

[*] Identified SID for 192.168.0.43: admin1
[*] Identified SID for 192.168.0.43: admin2
[*] Identified SID for 192.168.0.43: database
[*] Identified SID for 192.168.0.43: dba3
[*] Identified SID for 192.168.0.43: dba5
[*] Identified SID for 192.168.0.43: dba7
[*] Identified SERVICE_NAME for 192.168.0.43: admin1
[*] Identified SERVICE_NAME for 192.168.0.43: admin2
[*] Identified SERVICE_NAME for 192.168.0.43: database
[*] Identified SERVICE_NAME for 192.168.0.43: dba3
[*] Identified SERVICE_NAME for 192.168.0.43: dba5
[*] Identified SERVICE_NAME for 192.168.0.43: dba7
[*] Auxiliary module execution completed
msf auxiliary(oracle_sid) >

If its protected you'll see this:

msf auxiliary(oracle_sid) > set RHOST 192.168.0.137
RHOST => 192.168.0.137
msf auxiliary(oracle_sid) > run

[-] TNS listener protected for 192.168.0.137...
[*] Auxiliary module execution completed

If you are on the MSF 3.3 trunk a svn update should be all you need to do.

More exploits pls.

mc committed 5 exploit modules, 2 browser & 3 fileformat, I'd put together to the metasploit trunk the other day. Just run 'svn update' to update your install with them. The five are:

[1] CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow
[2] VeryPDF PDFView OpenPDF ActiveX OpenPDF Heap Overflow
[3] DjVu DjVu_ActiveX_MSOffice.dll ActiveX ComponentBuffer Overflow
[4] Microsoft Works 7 WkImgSrv.dll WKsPictureInterface() ActiveX Exploit
[5] SasCam Webcam Server v.2.6.5 Get() method Buffer Overflow

Cheers,
Dean

More Oracle Pwnage...I Lost Count...New Version Module

Thanks to help from MC, I pushed out a oracle_version scanner module today for MSF that uses MC's TNS mixin.

here it is in action:

msf > use auxiliary/scanner/oracle/oracle_version
msf auxiliary(oracle_version) > info

Name: Oracle Version Enumeration.
Version: $Revision$

Provided by:
CG

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target address range or CIDR identifier
RPORT 1521 yes The target port
THREADS 1 yes The number of concurrent threads

Description:
This module simply queries the TNS listner for the Oracle build..

msf auxiliary(oracle_version) > set RHOSTS 192.168.0.0/24
RHOSTS => 192.168.0.0/24
msf auxiliary(oracle_version) > run

[-] The connection timed out (192.168.0.0:1521).
[-] The connection timed out (192.168.0.1:1521).
[-] The connection timed out (192.168.0.2:1521).
[-] The connection timed out (192.168.0.3:1521).
[-] The connection timed out (192.168.0.4:1521).
[-] The connection timed out (192.168.0.5:1521).
[-] The connection timed out (192.168.0.6:1521).
[-] The connection timed out (192.168.0.7:1521).
[-] The connection was refused by the remote host (192.168.0.8:1521).
[-] The connection timed out (192.168.0.9:1521).
[-] The connection timed out (192.168.0.10:1521).
[-] The connection was refused by the remote host (192.168.0.11:1521).
[*] Host 192.168.0.12 is running: 32-bit Windows: Version 10.2.0.1.0 - Production
[-] The connection timed out (192.168.0.13:1521).
[*] Host 192.168.0.14 is running: Linux: Version 10.2.0.1.0 - Production
[-] The connection timed out (192.168.0.15:1521).
[-] The connection timed out (192.168.0.16:1521).
---SNIP---You get the idea---

If you are running the framework trunk, you can svn up and get the aux module as well as MC's 8i TNS overflow exploit.

Weak Password Brings 'Happiness' to Twitter Hacker

From Wired Threat Level

"An 18-year-old hacker with a history of celebrity pranks has admitted to Monday's hijacking of multiple high-profile Twitter accounts, including President-Elect Barack Obama's, and the official feed for Fox News.

The hacker, who goes by the handle GMZ, told Threat Level on Tuesday he gained entry to Twitter's administrative control panel by pointing an automated password-guesser at a popular user's account. The user turned out to be a member of Twitter's support staff, who'd chosen the weak password "happiness."

http://blog.wired.com/27bstroke6/2009/01/professed-twitt.html

great stuff, twitter got for free what would have cost them 20k+ from any other pen test shop.

How to digitally sign...

all kinds of things for your client side attack

http://blog.didierstevens.com/2009/01/05/howto-add-a-digital-signature-to-an-office-document/

http://blog.didierstevens.com/2009/01/04/howto-add-a-digital-signature-to-a-pdf-file/

http://blog.didierstevens.com/2008/12/31/howto-add-a-digital-signature-to-executables/

http://blog.didierstevens.com/2009/01/01/howto-add-a-digital-signature-to-a-firefox-add-on/

and how to make your own cert

http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/

UK to allow warrantless "remote searching"

"TheHome Office has quietly adopted a new plan to allow police across Britain routinely to hack into people’s personal computers without a warrant.

The move, which follows a decision by the European Union’s council of ministers in Brussels, has angered civil liberties groups and opposition MPs. They described it as a sinister extension of the surveillance state which drives “a coach and horses” through privacy laws.

The hacking is known as “remote searching”. It allows police or MI5 officers who may be hundreds of miles away to examine covertly the hard drive of someone’s PC at his home, office or hotel room."

http://www.timesonline.co.uk/tol/news/politics/article5439604.ece

MSF VBA payload Demo

Pretty good demo by Mark Baggett using the MSF Payload with VBA output and creating a malicious word document.

http://markremark.blogspot.com/2009/01/metasploit-visual-basic-payloads-in.html

Its a shame everyone can do this now, its been ol'reliable for quite awhile :-(

Dissecting a Multistage Web Attack that uses IE7 0day

Couple of great posts over on AttackResearch on Dissecting a Multistage Web Attack that uses IE7 0day Parts 1 & 2.

http://blog.attackresearch.com/?q=node/4
http://blog.attackresearch.com/?q=node/5

Googling Security: How Much Does Google Know About You? Book Review

Googling Security: How Much Does Google Know About You?

Greg Conti

5 stars

Witty (hopefully) Title for Amazon: Google may not be evil, but its still worth keeping an eye on

Disclaimer: I know the author personally and was given a review copy of the book.

I haven't read many (non-religious) books that totally change my outlook about the world we live in. In 2008, Robert O'Harrow's "No Place to Hide" is one such book and Greg Conti's Googling Security is the second.

The book begins with a simple question. "Have you ever searched for something you wouldn't want you grandmother to know about?" A simple but powerful question. Of course all of us have searched for topics we would rather our grandmother, friends, or spouse not know about. Would you ever consider posting the sum of your Google queries on your blog or website? Probably not, but just about all of us have given this information to Google in our dealings with them over the years. The book helps you take a look at how the sum of that information gathered through the use of the multitude of Google's "free" tools adds up to take a huge chunk of our privacy and very well could be giving Google a solid look into our personalities to include things most of us would prefer keep private.

Breakdown of the chapters:

Chapter 1: Googling 1

Chapter 2: Information Flows and Leakage 31

Chapter 3: Footprints, Fingerprints, and Connections 59

Chapter 4: Search 97

Chapter 5: Communications 139

Chapter 6: Mapping, Directions, and Imagery 177

Chapter 7: Advertising and Embedded Content 205

Chapter 8: Googlebot 239

Chapter 9: Countermeasures 259

Chapter 10: Conclusions and a Look to the Future 299

A common theme that the author found while conducting research for the book was "Google will collect personal information from you to provide you with a better experience."
Right now we expect Google to "do no evil" and their current policies say they don't personally identify its users but as the author points out through the chapters in the book; Google gathers A LOT of data they DO tell us about and the ability to gather even more data is already built into its "free" services.

Some other reviewers have said that its "preaching to the choir." While I agree that the normal person that would buy this book is in the IT field, I wouldnt be so quick to immediately say that the average system admin or evern security guy understands the magnitude of information gathering that could possibly be going on and the value and power of that information. While not specifically mentioned in the book I would encourage anyone interested in the topic to check out Conti's DEFCON 16 presentation on "Could Googling Take Down a President, a Prime Minister, or an Average Citizen?" When you think about the importance or value of that first page of results returned by Google and think about how events, commerce, or public opinion could be shaped by crafting the results that are returned you have a powerful tool(weapon?). What if the top results for a certain political candidate consistently only returned negative commentary? or if events were "buried" by Google never returning those results? Just because Google doesn't currently appear to be altering results or collecting and using personal information, its important to understand the power every user gives to Google in both personal information and the power of controlling what is presented to searchers.

One of the best things the book has that most books covering similar (privacy) type topics is a countermeasures chapter. While saying "don't use Google" really isn't an option for most people the best advice from the chapter was teaching people to know and understand what they are disclosing and adjusting the behavior accordingly.

My only dislike in the book was the coverage of "physical" information leakage (TEMPEST). The material is good, but I don't think it was pertinent to the Google and privacy discussion.

Conti's DEFCON 16 INFO

Abstract: http://www.defcon.org/html/defcon-16/dc-16-speakers.html#Conti
Materials: http://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-conti.pdf

Book Review Criteria: http://carnal0wnage.blogspot.com/2008/03/book-review-criteria.html

Happy New Year!

If you're subscribed to the blog or just found yourself here by accident.

Happy New Year!

Here's to good things in '09.