Practical Pwnage

Security + Efficiency

Secure Media Center Project

no comment

Apologies my friends, it’s been awhile. I’ve been busy working on this London project, doesn’t leave a whole lot of time to write.

Anyways, the majority of my strictly security projects can be found at community.rapid7.com, things like the test enviornment write-ups, vulnerable device listings etc. so if that’s what you’re after, there’s more than enough info up there.

Recently I’ve been working on something a little bit outside the security realm… but not too far. As many of us do, I have a fairly extensive media collection that I’ve collected over the years. Everything from mp3′s, avi’s, pictures, whatever. I also have more than one medium on which I would like to enjoy said media: different laptops, TVs, peripherals, gaming systems, stereos and such. I’ve tried, failed, and tried again to connect all my devices together, and after hundreds of dollars spent and bashing my head against the wall for nearly a year I’ve got something stable, secure, and fast. Today’s post is how I did it.

Setting up a portable, heterogeneous, stable, secure streaming network

 

The challenge:

I’m in a (potentially) temporary space with macbooks, laptops, USB external drives, a PS3, and a 3g mobile wifi modem for internet access. I need to figure out a way to connect all these devices for fast, stable streaming around the house with 2 separate TV’s while still having something that I can just pick up and move if need be. I also need to get the 3g mobile wifi dongle to divy out internet to my 10+ networked devices while it only has the capacity to handle 5 total connections at any given time. I also have a girlfriend who, though extremely intelligent, is not a geek like myself and needs to be able to enjoy using this.

 

The Equipment (purchased and existing):

- Regular W7 laptop w 1.5 tb USB attached (dual 2ghz, 4 gb RAM)
- Netgear WNR3400 dual-band wireless router
- 2 500 Mbps Powerline Adapters
- Ancient VAIO netbook (centrino 933 mhz, 512 mb RAM)
- Macbook Pro (dual 2ghz, 4 GB RAM)
- Playstation 3
- 2 TV’s in separate rooms (HD in the living room, CRT in the bedroom, I’ll explain why later)
- 2 IPhone 4′s
- Various portable speakers w/Iphone/Ipod connections
- Three (the company name is actually 3, not 3 devices) Huaiwei E585 mobile wifi HSPA modem

(keep in mind I didn’t start with this specific hardware, nor was it all by choice)

 

1. Set up the (internal) network:

This part was easy. I set up standard AES256 on both networks (dual band router) and set different subnets; one for me, one for guests. I always call my networks something violent and foreboding, so I called the main one honey badger. Nobody fucks with a honey badger =].

 

2. Set up my first 2 devices:

After a little research, I learned that a PS3 uses the DLNA protocol for sharing and communication (info here)

Based on this, I had a goal for my first connection to be set up like so:

((Laptop w/USB attached storage)) <–wireless–> ((Router)) <–wireless–> ((PS3))

Next up was figuring out how to serve up the information from the laptop/w/attached USB storage over the protocol the Playstation communicates on. After a bit more research,  I came across this PS3 Media Server>, which is an open-source, Java UPnP DNLA server that can transcode video on the fly. Siiick.

I downloaded and installed it on the W7 laptop and started it up without any configuration. I then turned on the Playstation and… gadzooks! It saw the server! This worked fine for streaming music, but I noticed when the video resolution got anything higher than standard 480p, the video would start to chop. If I was trying to do anything else in addition to streaming on the network, the video would become instantly unwatchable.

I did a little research, and remembered that wireless traffic is spread-spectrum and has a tendency to hop frequencies, most likely causing my problem, especially if both devices were sending and receiving wireless traffic simultaneously. Easy fix: wire one of the devices. Since my router and laptop were in the same room, I wired those together. HUGE difference…. but still not perfect. Every once in awhile it would still just drop altogether.

Time for more research. Turns out HD streaming can require up to 30 Mbps, and though my wireless connection can hit those speeds for a time, it can also be as low as 7.8 Mbps at times, and sometimes even drop completely. So my amazing 54 mbps honey badger was essentially worthless for streaming, weak.

So what are my options? I can wire it all the way through… but that would involve a mile of Cat-5 and mounting over doors and across hardwood, nope. Wireless repeater? Expensive and fucking complicated! Plus there’s still a chance I run into those same issues.

After even MORE research, I decided on powerline adapters. Before this project I didn’t even know these things existed, but they’re awesome. Essentially I can run the data through my powerlines by plugging them into the wall, plus you can set up security on them. They weren’t exactly cheap either, but they’re small, stable, secure and no over-air glitches. Super swik.

So far, my setup is looking something like this:

Not that complicated for the amount of work and money it’s taken so far if I’m honest. The rest of the devices in my network don’t really NEED to stream mass amounts of HD video, so just being connected to honey badger would suffice.

 

Step 3: The internet

This part took me the longest to figure out. Even with the network working so well, streaming internally, I still had to connect to a separate AP for internet. There are tons of articles and DIY’s on how to share a wired connections, wireless connections, and even using USB dongles, but NOTHING about using this mifi. I tried everything to bridge it wireless to wired, but apparently the modem lacks the routing capability to get the data from one connection to another.

Yesterday I thought… what if I just plug the mifi into the USB port? Low and behold, a little pop-up asks me if I want to install the drivers, so I do. And… hot damn, I can bridge the connections. The only downside to that is it only really works in Windows (I’m sure it works in Linux as well but I just couldn’t be bothered at this point. If you figure it out, please post) which means I’m going to have to find ANOTHER Windows laptop, or cripple one of my macbooks (not happening).

So I decided to install XP PE on the crappy old VAIO netbook I wasn’t really using. I plugged the mifi into the one USB port it had, installed the drivers, downloaded and installed the NIC driver and bridged the connections. I then took a length of cat5 and plugged one end into the VAIO, the other  into the WAN port on my router, and threw it in the closet. I then took out my Iphone, connected it to honey badger and boom… online. Uber swik.

So at long last, I now had my internal network streaming media and the mifi distributing internet to all of the devices on honey badger. The basics of the final product looks something like this:

I then have other devices with network shares on honey badger as well, sharing music and pictures, all accessible to everything. The CRT TV I referred to earlier is actually a Bang and Olufsen Beocenter One, and rather than let it just sit there I thought I might use it (it’s actually pretty cool if you ask me). To do this I just got a VGA – RCA adaptor and 3.5 mini to RCA jack for the W7 laptop and connected it to the old girl, and for CRT the picture ain’t half-bad.

I also use VLC Media Player for literally everything. And because it’s open source, there have been some great projects centered around it, my favourite being the Remote Control app for Iphone. It’s basically a touch screen management console for your VLC Media Player that works over wifi. There are a bunch, and they are all fairly similar, but I like VLC Amigo because of the playlist management capabilities.

The best part about this whole setup is the core of it I can just pick up and move at any point and set up anywhere else in the world. Next up: timers for everything.

Thanks for reading. Hopefully the next post won’t be a year later.

-m@

House Mix

no comment

This one is actually semi-decent, though slightly sloppy as it was done start to finish in one take after a looong night in LA =] Nonetheless, I present you something that won’t make your ears bleed.

DJ Guile – Neon Bracelet

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Track Listing:

1. Ross Ross Ross – Sebastian’s Edit Recreation
2. Jack Beats – Get Down
3. Congarock – Babylon )Uppermost Rework)
4. Altern 8 – Frequency
5. Nadastron – Pussy (Krafty Kuts Re-Rub)
6. Michael Jackson – Rock With You (Freemasons Remix)
7. Youth Speed Trouble – Cigarettes (Reset Trouble Remix)
8. Matt Gill – Nantengo
9. Streamrocker & Christopher S – Feel the Energy (Shoam & Gavriel Remix)
10. Swedish House Mafia – Silvia to Ibiza
11. Afrojack – Take Over Replica (Ale Mara & Juan P Bootleg)
12. Eiffel 65 – Blue (Jerry Rekonius Remix)
13. Pendulum – The Island Part 1
12. Swedish House Mafia – Leave the World Behind
13. Basement Jaxx – Where’s Your Head At (Klass Remix)
14. Learn to Recycle – 4 on the Floor
15. T-Rex – 20th Century Boy (Steve Andrews 2011 Rework)
16. The Others – Absolutely Flawless
17. Pance Party – Mumble
18. Chris Lake f. Laura V – Changes
19. Silvio Carrano & Sayan – Nafoura (Garden Dub)
20. Chemical Brothers – Swoon
21. Yves Larock & Tony Sylla f. Akil 0 Without Love (Hy2rogen & Fr3cky Remix)
22. Fremasons – Pacific
23. Max Graham – Dusky 2010 (Does She Know Yet)
24. DJ Tiesto – Carpe Noctum
25. Radiohead – Everything in it’s Right Place (Gigamesh Remix)

NCCDC Wrap-Up

no comment

NCCDC was an awesome experience for all involved (even the blue teams). For those that don’t know, NCCDC is the National Collegiate Cyber Defense Competition. The competition is in its 6th year and has never been better. Everything ran incredibly smooth; the management team and setup folks were amazing.  All in all, a very successful event, congratulations to the University of Washington on their big win. More detailed account to come.

 

Building a Vulnerable XP SP3 Machine

2 comments

One of the biggest challenges I run into doing evaluations with Metasploit Pro (or any Metasploit for that matter) is getting an exploit to run successfully. Though Pro is the most efficient way to run a penetration test, there are always still obstacles to getting a successful session.

One way to increase the odds of getting a session is to know the device you’re testing against is vulnerable, and the best way to make sure a device is vulnerable is to make it vulnerable, so here’s a quick and easy way HD taught me to do just that.

The challenge with vulnerability exploitation is there are only so many variables you can control. In order for a successful session to spawn all of these variables must be in the correct state. For example, different parameters will have to be modified on Metasploit if a host firewall or endpoint protection is enabled on the target. When I first set up the test environment I went for the gusto with a bunch of devices with tough vulns to exploit without any success. After hours of frustration I gave myself a reality check and eliminated as many variables as I could. Once I was able to get a successful session open I started introducing other variables into the equation. There were 2 reasons why this was a good idea: One, it boosted my confidence and two, it was as valid sanity check. Without eliminating the variables and actually executing a session, there wasn’t any proof that my network was set up for it.

The easiest way to make an XP machine vulnerable (with a reliable exploit) if you don’t have one available with SP2 is to enable the print spooler vulnerability (details here http://support.microsoft.com/kb/2347290). This exploit for this vulnerability is extremely reliable, so if you’re able to connect to the machine correctly and your variables are in check, you should be able to get a session.

Here’s the actual exploit: http://www.metasploit.com/modules/exploit/windows/smb/ms10_061_spoolss (keep in mind, this isn’t meant to be done on production devices)

Step 1: Open up the XP machine or VM and open up the “Printers and Faxes” menu.

Step 2: Add a local printer. Click next, choose “Local Printer Attached to this Computer”. Click Next.

Step 3: For “Use The Following Port” select “FILE: (Print to File)”. Click Next.

Step 4: Choose a printer type (doesn’t matter what type)

Step 5: Set the printer as a default printer.

Step 6: Share the printer, choose a share name and you’re done.

To exploit this vulnerability, you can run an automated exploitation (after a scan of course) under the “Excellent” category or you can run the individual module 67988 (the OSVDB number). Keep in mind, this exploit takes approximately 2 minutes to execute properly, so if you’re getting impatient, just give it a minute =].

If all your other variables are under control, you should get a Meterpreter session opened.

This was a great first step for me to get things rolling with not only my test environment, but with my understanding of exploitation, variables, and networks. Obviously I wouldn’t want to intentionally make something vulnerable while on an engagement for a client, but for a litness test, or purely for a sanity exercise, it helps out quite a bit.

Raw Sewage Dubstep Mix

2 comments

Decided to do a dubstep mix this time. I will start by saying that this mix is awful, I would equate it to listening to 70 minutes of forced disembowelment. I can’t even listen to it all the way through and I made it. Shout out to @Slavetical for the title of the mix, though I’m sure he doesn’t want his name associated with it, nor would anyone for that matter.

God help anybody who decides to listen to this.

DJ Guile – Raw Sewage

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Track Listing:

1. Torqux & Twist – Hotline (Original Mix)
2. Banna Bomber & Dexx – Gorilla Funk Master
3. Bar 9 – Motion (Original Mix)
4. DJ SS – We Came to Entertain (Mark Instinct Remix)
5. Torqux & Twist – Heavy Rain (Original Mix)
6. Phear Phace – Indecent
7. Rusko – Cockney Thug (Caspa Remix)
8. Muse – Knights of Cydonia (Nostalgia Remix)
9. Giant – Herbert (Original Mix)
10. Genetix – Squid Attack
11. Downlink – Android
12. Zeds Dead – Dark Side Dub (Original Mix)
13. Bar 9 – Extort
14. Picto – Air Raid (Flux Pavilion Remix)
15. Wartech – The Rattlesnake
16. Akira Kiteshi – Pinball
17. Reso – Smash Yer Face In
18. The Rolling Stones – Gimmie Shelter (Zeds Dead Remix)
19. TC – Where’s My Money (Caspa Remix)
20 – Datsik & Flux Pavillion – Game Over (Original Mix)

Again, I am truly sorry. My next post will be better, I promise.

Setting up a Test Environment

no comment

Skill Level: Novice – Expert

What you need:

- A decent box * Multiple Processors/Cores * Lots of RAM (4 GB or more) * Lots of HD space

- Some sort of virtualization software (VMWare, VirtualBox, Hypervisor)

- Pre-built Virtual Machines or installer ISO’s

- A Can-Do Attitude

Optional:

-          A second box with 2 NIC’s (dedicated for Metasploit and assorted other tools)

One of the biggest challenges I’ve had in my time working on this stuff is finding systems to test against. Apparently using your neighbors is “frowned upon” for some reason, and hanging out in a Starbucks and pwning everyone on the public wifi is even worse. So what do we do? Build a test environment. The concept itself isn’t that tough, and there’s definitely easy ways and difficult ways to create these. For my vision, I wanted 2 machines: one with all my VM’s on it, the other with Metasploit and NeXpose on it. This isn’t necessary by any means, but for my particular use-case this Metasploit console will be very high-traffic and I wanted to make sure Metasploit has all the resources it needs.

Target Machine Specs:

- Intel Core 2 Quad @2.66 GHz
- 8 GB Crucial DDR3 RAM
- 500 GB WD HD
- Ubuntu 10.04 LTS 64 bit
- VMWare Workstation

Metasploit Box Specs:

AMD Quad Something, 1.8 GHz
8 GB DDR2 RAM (noname)
500 GB HD
Ubuntu 9.10 64 bit

There are a few reasons I chose this setup. The Core 2 Quad is hyper-threaded (can span tasks across several cores if necessary) which is ideal for VMware Workstation. For the amount of VM’s I wanted 4 GB of RAM simply wouldn’t be enough. This setup lets me run 6-8 VM’s at once, and will scale up or down based on the hardware you choose.

- Metasploitable (Link)
- Ultimate LAMP
- Windows XP SP3
- Windows 2003 Server R2
- RedHat 6.5
- Windows7 RC2
- Windows 2000 Advanced Server SP4

First up was defining my networks. When I built my environment I did this last, but in hindsight it would have been so much easier if I did it first (my loss of 5 hours worth of work, your gain =]). I gave a pretty basic overview of how to do this in my VPN Pivot post, and what I’ll do now is break it down into 2 options.

Option 1: The entire test environment installed on one machine (easy).

For limited resources this is the best way to do it, I have it set up this way on my laptop. All I really had to do was make sure all the machines were set up on the same virtual adapter and I was golden.

First I opened up my virtual network editor (Edit -> Virtual Network Editor) Once in that menu, In Linux I clicked Add Network… In Windows I just chose one from the list (VMNet1 is a good place to start) I switched the network config to Host Only and selected my subnet (I chose 192.168.187.0 but you can pick whatever you want so long as it’s a private range) and saved it. With this set up, I could now assign this virtual network to all the machines as I built them.

Option 2: The test environment is split between 2 machines: tools and targets (tricky).

This one took me a bit to figure out but I’ll try and make it as comprehensive as possible. What made this tricky for me is I didn’t want a bunch of uber vulnerable machines just chillin in my network so I had to keep them private, like in the single machine deployment. The problem with that is if there’s 2 machines involved, there needed to be a way to get the external machine to see the hidden vulnerable machines which is easier said than done. The first thing to notice is that the box I installed Metasploit Pro on has 2 NIC’s, this is for a reason. After fiddling with it for literally days, I learned that there really isn’t any way to give access from the 2nd machine to a “host only” network. To make it easier, I will refer to the Metasploit machine as box A and the machine with the target VM’s as box B. So here’s what I did:

  1. Set up box A so that access out is on eth0 and access to the box with box B is on eth1 (I only did this on Linux, setup will be different on windows). To do this:
    1. I first set up a dhcp server on box A for eth1 ONLY. If you don’t get this correct you can muck up your other interface, but don’t worry… it’s easy.

First, I got dhcp server

root@pro_server: apt-get install dhcp3-server

Next, I fired up my favourite text editor and edited the config so that it only runs on eth1

root@pro_server: vim /etc/dhcp3/dhcpd.conf

Find this line

INTERFACES=”eth0″

Replace with the following line

INTERFACES=”eth1″

Save and exit.

Next I made a backup copy of /etc/dhcp3/dhcpd.conf file

root@pro_server: cp /etc/dhcp3/dhcpd.conf /etc/dhcp3/dhcpd.conf.back

I edited the conf file: /etc/dhcp3/dhcpd.conf file using the following command

root@pro_server: vim /etc/dhcp3/dhcpd.conf file

From here, I just modified the file as I saw fit (you can check out my config here). One thing I wanted to make sure of was the subnet range on eth1 was different from that of eth0 (I chose 10.0.0.0/24). Then I modified my interfaces file:

root@pro_server: vim /etc/network/interfaces

The only thing that needs to be done here is to make the IP of Box A on eth1 static and in the 10.0.0.0/24 range (I chose 10.0.0.2). I saved that, and then ran:

root@pro_server: service dhcp3-server restart

  1. I Plugged a Cat5 in the eth1 port from Box A and connected it to the eth0 (should be the only one) port on Box B.

Now as a result, Box B was completely reliant on Box A for everything. You can also set up other services like Internet Connection Sharing and File Sharing if you’d like, it’s up to you how far you’d like to take it. This method is not necessary by any means, I just built mine this way because this setup was for a test-lab being used by a number of people and I wanted to make sure I would have enough resources.

When installing/building the actual VM’s you’re presented with a ton of options on ram, processor, network adaptors, etc. To figure this out, I just thought about what would be “period correct” for that operating system. That is, what would the minimum spec be to install it when it first came out? After talking to the Metasploit team and taking a look at their specs, I came up with these RAM numbers for my environment:

- Metasploitable: 256 mb (pre-built)
- Ultimate Lamp: 384 mb (pre-built)
- Windows XP SP3: 512 mb
- Windows 2003 Server R2: 512 mb
- RedHat 6.5: 256 mb
- Windows7 RC2: 768 mb
- Windows 2000 Advanced Server SP4: 256 mb

I also assigned a single core to each VM across the board (they’re not going to be doing much processing). Installing the OSes was actually pretty easy. Some of the installers were older and a bit tricky, but for the most part VMware Workstation just did it for me. I know for VirtualBox you may have to install manually, not sure about Hypervisor.

As I went along creating each VM, I also set up the network on each one individually. For Option 1 (the self-contained test environment) I simply assigned the Network setting to VMnet1 (the host-only network we created earlier).

Option 2 was totally different. Since Box A is the actual dhcp server in this scenario, I wanted to make sure all of the VM’s received IPs that would be on the same subnet as Box A. To do this, rather than assigning them each a host-only IP, I bridged the connections. This way, they are all sharing the connection as Box B and therefore can receive IPs from box A.

Now I was ready to run some tests to make sure everything worked. The first thing I did was fire up Metasploit, create a new project and fire off a Scan. Low and behold… Success!

Keep in mind folks, this is not always easy to build and it DEFINITELY took me a few tries to get it right. If you have any questions, feel free to comment or email me directly at matt (at) practicalpwnage.com.

New D&B Mix

1 comment

Unfortunately I’m actually better at this stuff than what this site is dedicated to but whatever. Inspired by my recent trip in Austin…what a weekend. Enjoy!

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

DJ Guile – Austin Weekend

Tracklist:
1. Camo & Krooked – Climax
2. Red Army – Drowned by Angels
3. B-Complex – Beautiful Lies
4. Netsky – I Refuse (Shock One Remix)
5. DC Breaks – Halo
6. Method One – In the Dark Hours
7. Airwalker – Big Sky
8. London Elektricity – Just One Second (Apex Remix)
9. Aaron Bond – Flux Capacitor
10. Sigma – Baltimore (instrumental)
11. Autumn – It’s Always About the Girl
12. Way Out West – The Gift (Logistics Remix)
13. KG – Love Today
14. Logistics – Together
15. Underworld – Scribble

VPN Pivot Test for Metasploit Pro

1 comment

Penetration testing software only shows its true capabilities on actual engagements. However, you cannot race a car before you’ve ever sat in the driver’s seat. That’s why in this article I’d like to show you how to set up a test environment for VPN pivoting, a Metasploit Pro feature for intermediate and advanced users recently described in this post.

VPN Pivoting is one of the best but also most elusive features in Metasploit Pro. It enables users to route traffic through an exploited host to a different network. A TUN/TAP adaptor activates on the Metasploit Pro machine, showing no trace of a new network adapter on the exploited host.

How does it work? VPN pivoting installs hooks at the kernel level of the target system without making any permanent or persistent change to the OS. In layman’s terms, it gives the Metasploit Pro machine an IP address on the network of the exploited host. The use case is pretty cool, but we’ll get into that later.

You will need:

  • A copy of Metasploit Pro (download trial version if you don’t have a license)
  • Some form of virtualization technology (I use VMware Workstation)
  • Two or more vulnerable VMs (at least one Windows because VPN pivoting currently only works on a Windows target)
  • A can-do attitude

Pivoting enables you to jump from one network segment to another. This requires that one target machine has two network adapters, constituting a bridge between the network segments for you to exploit. In my example, I’m using three virtual machines:

  • Metasploit Pro machine (external network)
  • Windows Server 2003 (two network cards, one internal IP, one external IP )
  • Windows XP (internal network )

We want to simulate an external penetration test where we exploit the Windows Server 2003 and then pivot into the internal network to exploit the Windows XP machine. If you can get a session on this machine, you can pivot to gain access to the private network. To simulate this we need one device that has both a public and private IP, and one device that just has a private IP.

I find it easiest to use VMware’s Virtual Network Editor in the Edit menu to configure the VMnet adapters.  You can add up to 8 network interfaces in VMware Workstation, but we’ll only need 2. I chose VMNet1 and VMNet2. If you already have those reserved for something else, just substitute some of the additional adaptors for this use case. Set up the Metasploit Pro machine on vmnet1:

Virtual network adapter Vmnet1 (external network)
Host-only (connect VMs internally in a private network) Yes
Connect a host virtual adapter to this network No
Use local DHCP service to distribute IP addresses to VMs Yes
Subnet IP 192.168.187.0
Subnet mask 255.255.255.0

Windows Server 2003 networking as follows:

Virtual network adapter Vmnet1 (external network) Vmnet2 (internal network)
Host-only (connect VMs internally in a private network) Yes Yes
Connect a host virtual adapter to this network Yes No
Use local DHCP service to distribute IP addresses to VMs Yes Yes
Subnet 192.168.187.0 172.16.255.0
Subnet mask 255.255.255.0 255.255.255.0

Setting up the Windows XP machine is much easier because it only needs one network adapter (vnmnet2):

Virtual network adapter Vmnet2 (internal network)
Host-only (connect VMs internally in a private network) Yes
Connect a host virtual adapter to this network No
Use local DHCP service to distribute IP addresses to VMs Yes
Subnet IP 172.16.255.0
Subnet mask 255.255.255.0

Once completed, your setup should look like this:

Now that we’ve done the heavy lifting, it’s time to have some fun:

  1. Use Metasploit Pro to discover the Windows Server 2003 machine’s external IP address.
  2. Exploit the host to get a session.
  3. Click on Create VPN Pivot from Sessions dialog. This option is only enabled if the shelled machine has a second IP address in a network segment that’s not directly accessible by Metasploit Pro.
  4. Choose the 172.16.255.x network. (VMware’s local DHCP service should automatically give you an IP address, if not just specify one manually).
  5. At this point, the layer 2 traffic from the Metasploit Pro machine is routed into the internal network. It’s very much like you just connected to the target’s corporate VPN, hence the name VPN pivoting.  Unlike other, proxy-based pivoting technologies, Metasploit Pro doesn’t have any networking limitations, so you could also use a vulnerability scanner, such as NeXpose, to carry out an advanced discovery.

  6. Run another discovery specifying the 172.16.255.0/24 network.
  7. Have your face melt when you see that the Windows XP machine appears in your hosts list! Huzzah!

Take some time to browse around the Windows 2003 server – you won’t find a trace of the pivot. Essentially, you are now performing an internal penetration test from the outside. Pretty incredible, right?

Network Trouble in the world of VMWare

no comment

Hey gang.

In the midst of all my testing and what not, the network goes down all the time in my various VM’s. Being lazy, I couldn’t stand having to manually restart the network every time I changed something. Last week when I was in Austin jcran showed me the value of keyboard shortcuts in Linux. Because I couldn’t be bothered to even click a button to open a terminal, he showed me how he mapped it to Alt-F3, which is awesome. After that I thought it couldn’t be that hard to restart the network with the same idea.

First off, I wrote a little script:

I knew the pesky terminal command I needed to run was:

sudo /etc/init.d/networking restart

So instead of having to open a terminal to do this every time, I now had a script to do it for me. I saved this script as network_restart.sh to my /home directory.

Next I went to my keyboard shortcuts:

From here, I created a new shortcut.

I made the name of my shortcut network_restart.

For the shortcut link, I put:

/home/<my home folder>/network_restart.sh

Now that I had my shortcut saved, I clicked on where it says “disabled” and typed:

Ctrl Alt Home


Now my script was mapped to the Ctrl Alt Home shortcut. You can map it to whatever you want, just make sure it isn’t already mapped to something else.

Social Engineering with Metasploit Pro!

no comment

Skill level: Novice

What you need:

- Light html editing skills
- Some place to host a file
- Can-do attitude

Since it’s release last month (and before during beta) I have been mucking about with some of the more advanced features included in Metasploit Professional. Being a deviant (in a past life), the most logical place to go first would be social engineering.

Today we are going to create a 3 pronged social engineering campaign leveraging Microsoft’s LiveMeeting as a platform. You can use whatever input floats your boat, but it’s best to use something that requires a local download of some sort. Pro provides a great framework for real-world web and email phishing, as well as a platform for security awareness training internally. Creation of the overall engagement is very straightforward in Pro, but there are a few extra things you can do to make it far more effective. I’ve created an example of how to use this functionality.

I started off by creating a new project. For those of you not familiar with Pro, it will look alien to you at first. A GUI-based Metasploit? I Say! Blasphemous! Unheard of!

Meh, stick with me…

If you’ve seen Metasploit Express before then this won’t look quite so radical, but you will notice a few new tabs across the top =].

Before I got started with the Campaign, there were a few prerequisites I needed to get out of the way. In order to run an email phishing campaign, I first needed an open relay to send my emails through so they could look like they were coming from LiveMeeting and not me. There are lots of open relays available on the internet (here’s a list I got from a buddy, unverified and some are blacklisted) but best practice is to get one from your ISP or create a little sendmail server yourself, which is what I did. I had heard many horror stories about how difficult Sendmail could be to configure correctly, but  I didn’t have any trouble with this instance. Easiest way to do it, pick a linux box (it can be the same one running Metasploit if you want) and run this command from a root terminal:

root@pracpwn:~# apt-get install sendmail

This will install the sendmail server and start it, this will be our open relay. Next, I needed a way to manage it because I sure as hell wasn’t doing it by command line. So. I got webmin from here(webmin.com). I have a Debian distro (Ubuntu 10.04) so i grabbed the Debian package. Once I got that installed, I browsed to:

<ip where you installed webmin and sendmail>:10000

If everything installed correctly, you will get a prompt that looks like this:

I Logged in using the credentials I use to log into my machine.

Next, I took off all the security to actually make my relay open. After all was said and done I went back and turned on a few aspects like authentication, SSL, etc but to get started I find it’s best to just get it working first =]. To do that I opened up the sendmail settings and turned everything to just run on port 25.

From here, click on Network Ports and check the default radio button as shown:

Save it, and now we’re ready to get into Metasploit Pro!

I then created a new Campaign. Once created, I choose all 3 types: Web, Email, and USB with this config:

Doesn’t really matter what you call the project, but I wanted to match the filename and from address as closely as possible to what a victim would be expecting. From here, I just clicked save and moved on to the web config.

This part was ridiculously easy. All I did was browse to my livemeeting login page (or your target page of choice), copy the page source and paste it into the HTML field. I have done this for several pages, and Pro is very consistent at being able to render these properly. For more advanced pwnage, you can also go in and modify the code to harvest usernames and passwords as well as make one of the buttons download a payload. By default, Pro starts a browser exploit onslaught as soon as the victim browses to this page. Of course, we don’t even need a web template if we can get it done with an email template.

I applied the same concept to my email template config as my web… grabbed an outlook invite with livemeeting info, copied the html from the invite and pasted it into the HTML field.

(Note: for calendar invites, outlook doesn’t let you copy the html directly so I copied the contents of the email and pasted them into NVU first (open source html editor). From there I converted the email to html and copied the html from there back into Pro).

From here I looked through the html for the link to the actual livemeeting (mine was called “Click to Join LiveMeeting”). I took note of this location and hit save.

Next was the list of email addresses. I didn’t have one at the time, so I just put in my gmail address as a test to make sure it works.

Now back at the main campaign page, I had everything set up. The only question was what to do with my new executable, so I decided to make my email template a little more potent. I created a directory structure on one of my hosted servers (livemeeting/meetings) and uploaded my executable to it so that it’s always available. The directory structure wasn’t necessary, but it makes the download look a little more authentic. Then I dug back into my email template config.

Remembering where my link was, I changed the href from the livemeeting site to re-direct to my executable for it to download. Since I named it “launch.exe”, it looks very similar to the “launch.rtc” file downloaded automatically by LiveMeeting. It doesn’t look exactly the same, but you’d be surprised how many ppl don’t really pay attention =].

So now I save that, enter my email addresses, run the campaign, sit back and wait for the sessions! Huzzah!

Keep in mind this is a very basic setup for social engineering, there are many other cool things you can do with this functionality combined with other technologies both in and out of Metasploit that I will write up when I have some time. Until then, enjoy!

 

Search Pracpwn