0x0e.org | a pentester's view

what’s that you say? The PCI DSS (wireless supplement) now requires that you have to do quarterly wireless scanning at your facility?

oh? you have no budget?

no problem. get an ipod touch, and download WiFiFoFum from Aspecto Software. For $2.99, you’ve got yourself a wireless scanning solution.

UPDATED: 11/19/2009

little script i threw together for local network enumeration – uses arp-scan, propecia, and nmap. was going to use it to dynamically generate my subnet (hence the IP parsing), but got lazy at the last minute.

#!/bin/bash
##jcran – 2009

## Gather user options
## ——————–
if [ $# -lt 1 ]; then
echo “Usage: $0 [projectname] [scan? (0/1) ] “
exit -1
fi

PROJECT=$1    ## name of the project
SCAN=$2        ## whether to scan with propecia / nmap

echo “creating project $PROJECT”

if [ -d $PROJECT ]; then
echo “project exists”
else
mkdir $PROJECT
fi

IP=`ifconfig eth0 | grep “inet addr:” | ips |cut -d “:” -f 2 | cut -d ” ” -f 1`
SUBNET=`ifconfig eth0 | grep “inet addr:” | ips |cut -d “:” -f 3 | cut -d ” ” -f 1`
RANGE=`ipcalc $IP/$SUBNET | grep “Network:” | cut -d ‘ ‘ -f 4`

echo $RANGE

if [ $SCAN -eq 1 ]; then

echo arp scanning “$RANGE”
sudo arp-scan “$RANGE” –interface eth0 > $PROJECT/arp.targets.txt

echo local segment targets
cat $PROJECT/arp.targets.txt | ips > $PROJECT/ip.targets.txt

echo “scanning for web servers – :80, :443″
propecia $RANGE 80 > $PROJECT/80.targets.txt
propecia $RANGE 443 > $PROJECT/443.targets.txt

echo “scanning for basics – :21 :22 :23 :111″
propecia $RANGE 21 > $PROJECT/21.target.txt
propecia $RANGE 22 > $PROJECT/22.targets.txt
propecia $RANGE 23 > $PROJECT/23.targets.txt
propecia $RANGE 111 > $PROJECT/111.targets.txt

echo “scanning for windows boxes – :445″
propecia $RANGE 445 > $PROJECT/445.targets.txt

echo “scanning for sql server tds – :1433″
propecia $RANGE 1433 > $PROJECT/1433.targets.txt

echo “scanning for oracle tns – :1521″
propecia $RANGE 1521 > $PROJECT/1521.targets.txt

echo nmap-scanning local ips
nmap -iL $PROJECT/ip.targets.txt -oA $PROJECT/local-attack

fi

cheers

-jcran

so… you say you were able to grab LM / NTLM hashes from a windows box??? cool. now use them in the scanner/smb/login to check & see which systems use the same hashes:

msf exploit(psexec) > use scanner/smb/login
msf auxiliary(login) > info

Name: SMB Login Check Scanner
Version: 0
License: Metasploit Framework License (BSD)

Provided by:
tebo <tebo@attackresearch.com>

Basic options:
Name       Current Setting  Required  Description
—-       —————  ——–  ———–
RHOSTS                      yes       The target address range or CIDR identifier
RPORT      445              yes       Set the SMB service port
SMBDomain  WORKGROUP        no        SMB Domain
SMBPass                     no        SMB Password
SMBUser    Administrator    no        SMB Username
THREADS    1                yes       The number of concurrent threads

Description:
This module will test a SMB login on a range of machines and report
successful logins. If you have loaded a database plugin and
connected to a database this module will record successful logins
and hosts so you can track your access.

msf auxiliary(login) > set RHOSTS 10.1.1.0/24
RHOSTS => 10.1.1.0/24
msf auxiliary(login) > set SMBPass XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (hash goes here)
SMBPass => XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
msf auxiliary(login) > exploit
[*] 10.1.1.6 – FAILED 0xc000006d – STATUS_LOGON_FAILURE
[*] 10.1.1.21 – SUCCESSFUL LOGIN (Windows Server 2003 3790 Service Pack 2)
[*] Recording successful SMB credentials for 10.1.1.21
[*] 10.1.1.25 – SUCCESSFUL LOGIN (Windows 5.0)
[*] Recording successful SMB credentials for 10.1.1.25
[*] 10.1.1.29 – SUCCESSFUL LOGIN (Windows Server 2003 3790 Service Pack 2)
[*] Recording successful SMB credentials for 10.1.1.29
[*] 10.1.1.28 – SUCCESSFUL LOGIN (Windows Server 2003 3790 Service Pack 2)
[*] Recording successful SMB credentials for 10.1.1.28
[*] 10.1.1.31 – SUCCESSFUL LOGIN (Windows Server 2003 3790 Service Pack 1)

To speed it up, set THREADS > 1. Be careful not to set it too high:

[*] Error: 10.1.1.189: ActiveRecord::StatementInvalid SQLite3::BusyException: database is locked: INSERT INTO “hosts” (“address”, “name”, “comm”, “os_lang”, “mac”, “os_sp”, “arch”, “os_flavor”, “address6″, “os_name”, “desc”, “created”, “state”) VALUES(’10.1.1.189′, NULL, ”, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ’2009-11-06 10:48:09′, ‘unknown’)

Thanks to tebo for the excellent work. Now, if only it worked with credcollect.

so you have some windows creds, and you want to check if they’re valid or not. turns out there’s a bunch of ways to do this:

1) auxiliary/scanner/smb/login
2) db_autopwn -m
3) msfcli scripting
4) sussuro’s method (python scripting through xmlrpc)

others?

just had a quick refresher on exploiting suid bits (and why they’re so darn evil):

jcran@aldatmak:/usr/bin$ ls -la id
-rwxr-xr-x 1 root root 35232 2008-06-26 20:31 id

jcran@aldatmak:/usr/bin$ id
uid=1000(jcran) gid=1000(jcran) groups=30(dip),127(vboxusers),1000(jcran)

jcran@aldatmak:/usr/bin$ sudo chmod u+s id

jcran@aldatmak:/usr/bin$ ls -la id
-rwxr-xr-x 1 root root 35232 2008-06-26 20:31 id

jcran@aldatmak:/usr/bin$ id
uid=1000(jcran) gid=1000(jcran) euid=0(root) groups=30(dip),127(vboxusers),1000(jcran)

jcran@aldatmak:/usr/bin$ sudo chmod u-s id

The first time it’s executed (no suid bit) – the euid is 1000, jcran. the second time, after the suid bit has been set, i’m effectively root.

finding all suid binaries on a system:

 find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \;

note, this technique doesn’t work on bash if it’s been set SUID.

is there room for it?

after reading this post on the metasploit blog, i started thinking about how well I currently evaluate product implementations within a typical penetration test. If configuration auditing has been included, I’ll do some of this. However, as a pentester, it pays to know the products in use, and to be familiar with the differences between say, trend micro and kaspersky antivirus or Splunk and syslog. It would be useful to include specific measurements and recommendations around the products in use on the network.

for instance:

• Antivirus: Trend Micro – Configured properly, managed well. Recently garnered the top spot in an
• Spam filtering: Ironport – Not well configured. Recommend moving to the Sophos appliance for ease of use. (based on strengths of the team)
• Monitoring: Snort – Configured poorly. Recommend switching to bro to support policy / functionality separation. would streamline IT processes
• Vuln scanning: Nessus – AdHoc – Need to move to automated process, more advanced web-scanning tool. Look into qualys / ncircle / rapid7.
• Firewall: Cisco PIX
• Logging: Syslog server – …
• etc..
  

Now, the issue becomes two-fold. one, the tester needs to have a solid understanding of each of the products he’s evaluating / recommending and a clear understanding of the client’s needs. It’s not a typical penetration test function, but would definitely provide value to a customer. (The more i write here, the more it turns into a full configuration audit of the customer’s systems, and while would be a nice-to-have on a pentest, isn’t part of a typical assessment)

i think most shops steer clear of this under the ‘product agnostic’ label, but as long as that’s been made clear up front, i’d say go for it.

i love tools with personality:

Caught exit of DirBuster
Writing report
Report saved to 192.168.254.8.dirbuster.html
Enjoy the rest of your day

The compilation process of nmap comes to mind:

awesome

as does KARMA:

Loading config file etc/karma-scan.xml
DNS-SERVER is running
DHCP-SERVER is running
Delivering judicious KARMA, hit Control-C to quit.

Others?

#!/bin/bash
#webservercheck.sh
for i in `cat $1`  ## for all lines in the file provided to the script
do
    echo “Nikto’ing $i”
    ##NOTE: Nikto needs to have been untarred here.
    /home/jcran/toolkit/nix/attack-net-webserver/nikto/nikto.pl -host $i -config /home/jcran/toolkit/nix/attack-net-webserver/nikto/config.txt | tee report.nikto.$i.txt

    ## Wget
    echo “wgett’ing HTTP://$i/”
    wget -r -l 2 http://$i/

    ## dirbuster
    java -jar /home/jcran/toolkit/nix/brute-web/DirBuster-0.12/DirBuster-0.12.jar -H -l /home/jcran/toolkit/wordlist/directory-list-2.3-tiny.txt -e asp,aspx,jsp -v -P -R -r $i.dirbuster.html -u http://$i
done

Call it as: ./webservercheck.sh <file with ips>

Ignore the awful pathing problems if you can. Anyhow, it does a nikto / wget / dirbuster for every host. handy if you’ve run a portscan on :80 (using something like nmap or propecia).

jcran

Doing a little research on an exploit, i came across SecurityDot.Net. Google provided the link. However, when i clicked on it, i got this:

Of the 174 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-11, and the last time suspicious content was found on this site was on 2009-09-11.Malicious software includes 2 trojan(s), 1 exploit(s). Successful infection resulted in an average of 3 new process(es) on the target machine.

Malicious software is hosted on 5 domain(s), including odile-marco.com/, google-analyze.org/, 213.163.89.0/.

This site was hosted on 1 network(s) including AS25220 (GLOBALNOC).

Also, when i tried to browse to the site directly, i got this:

Which turns out to be a built-in interface for the same google-stopbadware database.