New Nmap Ping Sweep Defaults

(mirrored from carnal0wnage.attackresearch.com)

as a note to self (and anyone who reads the blog)

http://nmap.org/5/#changes

"The host discovery (ping probe) defaults have been enhanced to include twice as many probes. The default is now "-PE -PS443 -PA80 -PP". In exhaustive testing of 90 different probes, this emerged as the best four-probe combination, finding 14% more Internet hosts than the previous default, "-PE -PA80". The default for non-root users is -PS80,443, replacing the previous default of -PS80. In addition, ping probes are now sent in order of effectiveness (-PE first) so that less effective probes may not have to be sent. ARP ping is still the default on local ethernet networks."

The non-sudo/root versions of the -sP should be noted, it could be enough traffic/ports per second to have some firewalls throw a SYN flood alert if you were to scan several hosts (like a Class C).

wireshark captures:

carnal0wnage and Attack Research join forces!

I'm happy to announce that carnal0wnage and Attack Research have joined blog forces!

the new home for the blog will be:

http://carnal0wnage.attackresearch.com/

please point your RSS readers to the new location and enjoy

With the new blog is the ability for a few more people to post. If you want to contribute please email c0arblog@attackresearch.com

-CG

Making Life Easier With Metasploit Libraries

I was explaining some of this to a friend and figured I'd just post it...

If you have ever looked at an exploit module in metasploit most, if not all, will be calling additional libraries to actually "do" what the work for the exploit --this is actually what makes MSF so great.

What I mean by that is, there is an exploit library(Msf at a higher leverl and Rex and lower level) to set up and do most of the protocol work for us. So if we were going to use any sort of webserver exploit if we were writing it in perl we'd have to write all the code to do the http connection for us (there may be a library for perl too -- bare with me). But with Metasploit in this case we'd just have to call the http library which has the connect method in it.

http://trac.metasploit.com/browser/framework3/trunk/lib/msf/core/exploit/http.rb

check line 70 for our connect method.

70	#
71	# Connects to an HTTP server.
72	#
73	def connect(opts={})
74	nclient = Rex::Proto::Http::Client.new(
75	rhost,
76	rport.to_i,
77	{
78	'Msf' => framework,
79	'MsfExploit' => self,
80	},
81	ssl,
82	proxies
83	)

we can also send raw http requests.

171	#
172	# Connects to the server, creates a request, sends the request, reads the response
173	#
174	def send_request_raw(opts={}, timeout = -1)
175	begin
176	c = connect(opts)
177	r = c.request_raw(opts)
178	c.send_recv(r, opts[:timeout] ? opts[:timeout] : timeout)
179	rescue ::RuntimeError => e
180	print_error("An error occurred sending this request: #{e}")
181	nil
182	rescue ::Errno::EPIPE, ::Timeout::Error
183	nil
184	end
185	end
186

All the client and server methods are actually in http.rb. its a good read.

so whats the point?

well if we start to take a look at the http exploits we'll see an include to:

include Msf::Exploit::Remote::HttpClient

this brings in all our http client methods like the one above.

then when we want to send our actual request we can do something simple like:
from: http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/http/belkin_bulldog.rb

55	def exploit
56	c = connect
57
58	dwerd = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call dword [esp+58h]").encode_string
59
60	filler = [target.ret].pack('V') + dwerd + make_nops(28)
61
62	print_status("Trying target #{target.name}...")
63
64	send_request_raw({
65	'uri' => payload.encoded,
66	'version' => '1.1',
67	'method' => 'GET',
68	'headers' =>
69	{
70	'Authorization' => "Basic #{Rex::Text.encode_base64(filler)}"
71	}
72	}, 5)

on line 56 we initialize our connection with connect and on lines 64-72 we send our request with our overflow and payload

If we wanted to see all the options available to use in our send_request_raw request we would check out our rex::proto::http::client (REX = Lower level) code at line 105.

http://trac.metasploit.com/browser/framework3/trunk/lib/rex/proto/http/client.rb

more on this later, hopefully this is enough to get you started looking under the hood of the framework.

-CG

Carnal0wnage will be a BruCon!

I'm happy to announce that I'll be speaking at Brucon in September (18-19) on Open Source Information Gathering.

This is an update to my set of talks last year. After a year of doing OSINT work I've revised the methodology and it should be a pretty good update to the previous talk. I'm planning on focusing a lot on Person/Organization Information Gathering (IG) and should be followed by Chris Nickerson talking about Red and Tiger Team Testing(I call it Full Scope testing) aka putting all the "stuff" we found in my talk to actual use.

should be a good time. plus hoeagaarden on tap!

check the Brucon blog for up to date info
http://blog.brucon.org/

Client-Side Penetration Testing Notacon Edition

Here's the video from the Notacon talk. Audio sucks, sorry...blame the video guy.

Full Scope Security Attacking Layer 8: Client-Side Penetration Testing Notacon '09 Edition from FullScopeSecurity on Vimeo.

Not Dead, just busy

I'm not dead and I haven't quit blogging, just been tired and busy and working on fairly big change to c0 that I think everyone will enjoy. I was hoping it was going to be ready by now but its not...I do this for free...so you'll just have to wait :-) I'm actually waiting on someone else to do something, and they also do what I'm waiting on for free...vicious cycle...

back to your regularly scheduled ranting and pwning

2 Year Anniversary!

Happy Two Year Anniversary of carnal0wnage blog!

Wicked Cool Ruby Scripts Book Review

Wicked Cool Ruby Scripts Book Review

By Steve Pugh

4 stars

Thanks to No Starch Press for my review copy!

From the Description

Wicked Cool Ruby Scripts provides 58 scripts that offer quick solutions to problems like system administration, manipulating images, and managing a website. After getting your feet wet creating simple scripts to automate tasks like file compression and decompression, you'll learn how to create powerful web crawlers, security scripts, and full-fledged libraries and applications, as well as how to:

* Rename files, disable processes, change permissions, and modify users
* Manipulate strings, encrypt files, and sort efficiently
* Validate web links, check for orphan files, and generate forms
* Mass edit photos, extract image information, and create thumbnails
* Parse CSV files and scrape links, images, and pages from the Web


Ruby is a highly extendable and sometimes confusing language especially when you throw in all the various rubygems out there. Wicked Cool Ruby Scripts provides many examples on how to use the various gems to script together quick hacks (wicked scripts) to various problems one may encounter.

Steve walks us through the problem we are trying to solve, the the code to solve the problem, how to run the code, what the results look like, a lengthy discussion on how it works and "hacking the script" with ideas on how to extend what we wrote. All the code is well commented (see the sample chapter on No Starch Press) and well explained.

Pros:
Easy and fun to read, font is readable, doesn't contain pages and pages of uncommented code, source code is available, companion website exists, and the book left me with memorable ways to remember and use the material. I've actually gone back a few times to look at some of the scripts in the book. I also liked the metasploit section (of course). It certainly isn't your typical "Hello World" programming book which is also refreshing.

Cons:
As one other person posted in their Amazon review, its a bit hard to say what level the book is for. Its certainly NOT for beginners as we're expected to already have ruby up and running and understand the basics and its not advanced material either. That leaves us with intermediate which is ok but certainly makes it hard to recommend for knowledgeable programmers. The book is short, its got 58 or so scripts coming in at 170 pages but it would have been nice to have more. Its certainly not "too short" but more would have been nice. I would have liked to had more information on the specific rubygems used for different scripts. Links to where to the specific gem homepages to get further usage would have been nice as well.

View the detailed Table of Contents (PDF)

View the Index (PDF)

Sample Chapter: Chapter 1: "General Purpose Utilities"

Source Code: Source Code from the Book

Programming Book Review Criteria

I don't read too many programming books and I don't usually finish the programming books I do try to read. I ended up getting sidetracked trying out the code and never finish the books. I know excuses, excuses... I also didn't have a programming book review criteria like I do for regular tech books. Chances are a programming book isn't going to bring anything "brand new" to the community or explain a brand new concept; its about programming in whatever language. So the following is what I came up with. I reserve the right to change it for future programming book reviews. I couldn't think of a way an easy way to grant stars so I guess I'll just wing it for the time being.

Programming Book Review Criteria

working ideas:

-how was the book written? easy to understand?

-what level is the book written to? Beginner, intermediate, expert?

-code correct? are there mistakes? do the examples work in real life?

-can you download the source code? does it have a companion site?

-does it have more than 2 pages in a row of code? I hate that!

-if the code is more than a snippet, is it documented?

-if the book uses external libraries (like ruby gems) are links to those libraries included in the book or companion site.

-did it leave me with a memorable way to remember the material?

-how is the font for the text of the book? too small, hard to read, distracting?

Gray Hat Python: Python Programming for Hackers and Reverse Engineers

Gray Hat Python: Python Programming for Hackers and Reverse Engineers (Paperback)
by Justin Seitz

Publisher Description

Python is fast becoming the programming language of choice for hackers, reverse engineers, and software testers because it's easy to write quickly, and it has the low-level support and libraries that make hackers happy. But until now, there has been no real manual on how to use Python for a variety of hacking tasks. You had to dig through forum posts and man pages, endlessly tweaking your own code to get everything working. Not anymore.

Gray Hat Python explains the concepts behind hacking tools and techniques like debuggers, trojans, fuzzers, and emulators. But author Justin Seitz goes beyond theory, showing you how to harness existing Python-based security tools - and how to build your own when the pre-built ones won't cut it.


My Take

I have to start off by saying that I've been looking forward to this book being published for months now. Since it initially popped up on the No Starch website I've been following it and nagging the publishers about it's release. I was fortunate enough to get a copy last Friday and I dove into it full force, even my final exam suffered because I was a little too focused on this book. I have mixed feelings about the book overall, there was definitely a few things I gained from it. On the other hand, there were many more things that could have been added. If you are new to Reverse Engineering then you will most likely obtain a leap of knowledge from the book. Packed with code examples on various open source tools and concepts to create your own, you'll be waste deep in python for a while. If you've been around for the last few years and have already checked out many of the open source tools discussed in the book you may only get a few things out of it. I don't understand CG's rating system so I'm not going to give you a star formula, or even a numeric rating.


Justin does a great job elaborating through the the code examples used throughout the book. The sheer scope of this book makes it difficult to cover everything but Justin definitely attempts to give you a taste for the more common scenarios you may find yourself in. Below I highlight a few chapters that I found interesting and useful. Overall the entire book is useful but a large portion covers open source tools that have a plethora of documentation and examples in existence.

Chapter 3 is just downright awesome. This chapter walks you through creating your own python based debugger that is similar to pydbg. Between the concepts and actual implementation you obtain a solid understanding of what is going on in a Windows based debugger.

Chapter 6 goes over Hooking in 5 pages. This topic could easily fill a few chapters by itself but Justin sums everything up quite nicely with plenty of examples.

Chapter 7 discusses DLL and Code injection which was a pretty interesting topic. The chapter even gets a little "Evil" by showing you how to hide files on a filesystem using python. It goes one step deeper into evilness by demonstrating how to code a back door into files.

Chapter 8 goes into fuzzing concepts and the demonstration is very practical for anyone doing exploitation. Justin shows us how to create a file format fuzzer which I thought was pretty slick.

The last chapter I found pretty interesting was chapter 10 titled "Fuzzing Windows Drivers." This chapter outlines methods of identifying Device names and IOCTL codes using Immunity Debugger. It continues to show examples of an IOCTL Fuzzer that can be used in conjunction with the rest of the scripts outlined in the chapter. Definately some cool stuff. Personally, I'm not quite up to a Drive level fuzzing level but I still found the knowledge very useful and was able to translate some of the immunity scripts into IDAPython scripts for static analysis to find the device names and IOCTL Codes.


The Cons

The entire book was based off Dynamic analysis. This is great for those out there doing RE through execution, but it really sucks for people like me who only does dynamic analysis 10% of the time.

The entire book is windows specific. Yes, most RE work is done on windows, for windows binaries. However, there are closed source applications and even embedded stuff that is Linux based. Would have definitely been useful to have some examples for these types of cases.

At times I found the book drifting into the direction of exploitation. Granted, RE and exploitation go hand in hand but I feel those of us who perform RE for the purpose of compatibility, protocol analysis, and other crap were left out a bit.

The chapter on debugger design did not have all that much to say about designing a debugger. In fact, it was probably more inline with a quick introduction to x86 architecture, specifically registers and stacks. It was not until chapter 3 that you really understand the elements involved.

Overall, I equate this book to Hacking the art of exploitation first edition but for Reverse Engineering. The book is packed with useful information for both the novice to the professional but I hope a second edition comes out with more information, that covers both static and dynamic analysis.