Metasploit and Ncrack

For some days now i'm working in a case for a client, a pentest project. The story goes like that, there is a server and the price is to get access to that server. The system is a running a control panel to allow clients easy configuration on their domains. As usual there is nothing given except the ip of the server and the papers to sign. From there you are on your own. So where to start.

Only with the IP i couldn't see much on the system just the default page and nothing else, portscan shows some ports open nothing to attack directly or with known vulnerabilities then it occurred to me, this panel by default, is replying on reverse DNS with the full list of the domains that is supporting. So a nslookup IP IP did the trick and i had a list of the domains on the system. I started slowly to browse around the domains looking for outdated applications and other details, one point of entry. It didn't take long to find a misconfigured application that allowed file upload. My first choice was to use the meterpreter from metasploit to initiate a reverse connection ( everything running through a php shell ), it didn't took me long to realize then that the system was firewalled in almost every port. Second choice ahead, meterpreter on reverse https port ! And that did the trick, i had connection.

Almost ready to close the case and write a report to the client, being confident and all, that it's just 2 lines from now to get full access on the system i typed on the console,
meterpreter > use priv
Loading extension priv...success.
meterpreter > 

Followed by the getsystem command where i was greeted with the following not so happy for me message,
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: 5
meterpreter >
I got the same or similar error message for all methods and even for the latest method, brand new shinny KiTrap0D that to my surprise it didn't work. Most of the time these servers are not often rebooted ( patched from windows updates ) in order to maintain high uptime on the websites that they are serving.

Not giving up yet, there is always the motto,  "Brute force, when you are not succeeding, you are not using enough". The first option was to brute force on the ftp server for accounts, but i already know that this panel is not allowing the administrator account to login through the ftp, and this account is the only one that i want to find out. I could go for remote desktop brute force but then it will take time, the whole process is very slow on rdp,and then i came across a very good network cracker, ncrack if only i could use it on the system that has the 445 port firewalled...

And here comes again the metasploit,
meterpreter >
portfwd add -l 445 -p 445 -r IP
meterpreter >

The port 445 was forwarded to my system, free from the firewall at last. Time for ncrack to take place.
 ./ncrack -vv -U users.txt localhost:445

and after a few minutes, the first results
Discovered credentials on smb://127.0.0.1:445 'user1' 'abcdef123'
Discovered credentials on smb://127.0.0.1:445 'user2' 'abcdef123'
Discovered credentials on smb://127.0.0.1:445 'user3' 'abcdef123'
Discovered credentials on smb://127.0.0.1:445 'user4' 'abcdef123'

It took almost three hours and 20 minutes to find the administrator password, but finally i had it!

Fuzzers and fuzzing

It's been a while now i was trying to time to test some fuzzers. Fuzzing as it is defined in Microsoft's SDL (Security Development Lifecycle):

"Fuzzing is a testing technique that can help find denial of service and security vulnerabilities in software. The principle of fuzzing is very simple: create invalid data, force an application to consume that malformed data, and then observe the application as it executes. If the application crashes, then a bug may have been found in the target application. By identifying this crash, you are able to quickly target potential problems in the underlying code and determine if changes are needed to fix the crash (and any related potential security issues) from affecting your users."


Microsoft is providing minifuzz for free (http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=b2307ca4-638f-4641-9946-dc0a5abe8513) and was the first choice of the day.

After installing minifuzz and running it we get the following screen:

There are two options that we really have to insert here, the rest can stay on the default. The options that we need are, the process to fuzz and the location of the Template files. Template files are files that we will provide at the application in order to test it. These files are the normal input files that the application should accept. For my case i choose to try Easy RM to MP3 Converter an older version that it's known for the vulnerabilities ( http://www.corelan.be:8800/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ )

Here is the fuzzer working

Quotting again the SDL process from Microsoft,
Fuzzing, as an SDL requirement, requires a minimum of 100,000 malformed files per file parser. So if your application parses three discrete file formats, .FOO files and .BAR files, then you need to create and correctly parse (ie; not crash) 100,000 FOO files and 100,000 BAR files. 

So be ready for long hours. In another post we will see other fuzzers with examples.

Flood bots and others

Today i found a bot running in a client's server system. The bot is designed for flood mainly and as it state in its name "Enjoy FloodBot based on OverKill". The problem on the server was a website that had an sql injection point, from there the attackers were able to take control on the site and add files through the custom cms. The content of the bot consist mainly of executables to perform flood attacks.

Link for research follows.

Flood Bot

PE code injection part 3

A very good post on http://www.x-n2o.com/clever-tricks-against-antiviruses/, clever tricks against antivirus. Inside the post there is a main topic, "No imports!". Even though it's not new concept it's very nice explained with code examples. The same is done from different commercial packers eg. Themida for a very long time now.

Windbg and malware

From the presentation of Mark Russinovich on malware cleaning, he pointed out a very nice way to clear possible kernel patches ( malware with rootkit behavior ) that are hijacking the system.

From the help file,

The !chkimg extension detects corruption in the images of executable files by comparing them to the copy on a symbol store or other file repository.

Using the command in the debugger with the following form we can observe the patches, or mismatched areas according to the symbols:
lkd> !chkimg -d nt
and clearing the patches from the system can be done easily with the following command:
lkd> !chkimg -f nt

More to come

PE code injection part 2

Looking for code injection and trying to add sections on PE, i found a very nice work done by KOrUPt ( http://korupt.co.uk/?cat=6 ) he has already implement a very nice injector that you can download with the source code at http://korupt.co.uk/KInfect2.rar the only piece missing is a custom stub. His improved version is the kcrypter2 available in forums.

PE code injection

Trying for awhile now to achieve 0 detection from antivirus engines, i believe the only solution is to move to manual encryption of the exe file or use a commercial cryptor. The problem with most packers/cryptors/protectors is that they are already considered as suspicious from the avs and many of them have requirements on the code.

Muts in 2008 made a nice presentation with the title Bypassing Anti-virus in Windows Vista, or "Piss on your AV" ( http://www.offensive-security.com/videos/shmoocon-presentation-2008-video/piss-on-your-av.html ). The presentation is nice, but not detailed. Some things are omitted,and other things not explained in details. Muts is using the last section of the PE header to add his stub, this is very convenient since the last section is the only one that can be easily extended without affecting other sections. But this is not the case always. Many times you cannot extend the last section and what you really need is to add a section or extend one section in the middle of the PE header. This will be in the next post, going for 0 detection.