Get Your Hacking Videos Here!

Well not here as in the SynJunkie blog but here, as in the Learn Security Online site. The guys over at LSO have revamped the site and it's looking pretty sweet.



Whenever I have a few minutes spare I love to watch how some of the experts out there attack systems and use the tools that projects such as BackTrack and Metasploit make available to us. Or if I am learning something new it's great to see a demonstration of a tool or process. So the guys over at LSO have done all the hard work for us and linked to them all. As well as all of there own vidoes there are links to over 80 non-LSO videos.

So if you want to see how the experts perform SQL Injection or run the latest MetaSploit exploits then check out the video section at Learn Security Online.

Windows Eventlog Fun with Free Tools

This week at work I was asked to find why a specific account was constantly being locked out. Sounds pretty easy eh. Well the thing is, this was a service account and I have quite a lot of DC's where this could be happening from.

I did a little research on my favorite site www.ultimatewindowssecurity.com and ran a few tests to make sure I new what I was looking for and I set about getting the remote logs to my site so I could perform some analysis.

I started out with Dumpevt from Somarsoft. I could just grab a single event log using the following:

dumpevt.exe /computer=SERVER01 /logfile=sec /outdir=c:\Temp\Dump /all


But then I figured that I really needed to automate the retrieval of the logs so I threw in a FOR loop to go through a list of servers:

FOR /f %i in (c:\servers.txt) do @dumpevt.exe /computer=%i /logfile=sec /outfile=c:\Temp\Dump\%i-SecLog-%random% /all


As I sat back and waited...and waited .....and waited I figured that this probably wasn't the most efficient use of time or bandwidth as the logs were all over 250MB in size. I took the logs I had so far and opened them in Mandiant's excellent tool Highlighter. Well that's when I hit my second problem. Highlighter took absolutely ages to open the logs using my measly 512MB of RAM.

So I needed a way to parse the logs on the server and return just the events of interest. I then turned to the Microsoft tool EventComb. This tool is allowed me to search through a list of servers for just the events I needed. It had predefined searches in that could be useful. Eventcomb also allowed me to set the amount of threads I wanted to run and allowed me to search through events within a specific date range. The events were then output from each server to individual text files which allowed me to search through them easily with highlighter.

Whilst I was having all this fun I also wrote a few scripts in log parser for fun. Here's a couple of the scripts I put together in LogParser and the commandline to run them:


LogParser.exe file:logon-failure.sql -i:EVT -o:datagrid

------------logonfailure.sql--------
Select
ComputerName, Timegenerated AS LogonTme, EventID, EventType, EventCategoryName,
extract_token(strings, 1, '|') AS ComputerName,
extract_token(strings, 0, '|') AS User,
extract_token(strings, 2, '|') AS Logon_Type,
extract_token(Message, 0, ':') AS Message,
extract_token(Message, 2, ':') AS Reason

FROM \\Server01\Security
WHERE EventID IN (

529)
--------------end--------------------


And for the account lockouts here's an example of throwing the script into a loop that I could just cut and paste onto the commandline to output the results from multiple servers into a csv file:

FOR /f %i in (c:\servers.txt) do @LogParser.exe -i:EVT -o:csv -headers:auto -Filemode:0 "Select ComputerName, Timegenerated AS LogonTme, EventID, EventType, EventCategoryName, extract_token(strings, 1, '|') AS ComputerName, extract_token(strings, 0, '|') AS User INTO C:\failedlogons-%random%.csv FROM \\%i\Security WHERE EventID IN (644)"


My conclusion from this was whilst I really like LogParser it does take a while to get it tuned to find exactly what I wanted. However, it is an extremely flexible tool for searching many different types of logs and if you get the Syngress book there is a great example of creating an IDS tool with LogParser. The benefit of LogPaser is that it can be scripted to run regularly as a scheduled task for arching those events you might be interested in.

EventComb was easy to use, let me save my searches for reuse later and used along with Highlighter proved to be just what I needed to get to the detail very quickly and resolve my problem.


Resources
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx
http://www.systemtools.com/somarsoft/
http://www.mandiant.com/software/highlighter.htm
http://support.microsoft.com/kb/308471
http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx

Log Parser Fun

Recently I needed to interogate the event logs of about 80 servers for a particular event. Well Windows doesn't exactly make that sort of thing easy. Being a fan of the free tool Log Parser I was able to make pretty short work out of what could have been a very time consuming task.

First I set about getting the names of all my servers into a text file called servers.txt (each server on a new line).

Then I used a simple FOR loop with Log Parser to rip through the servers event logs and look for the particular event. Any instances it found I placed into a new log file. The FOR loop I used was simply:

FOR /f %i in (c:\servers.txt) do @LogParser.exe -i:EVT -o:CSV "SELECT computername,message FROM \\%i\System WHERE eventid= '531'" >>c:\event-capture.log

The script can be run direct from the commandline and all it does is loops the the servers looking for the event 531 in the System Event Log and outputs the computername and message fields in csv format to a text file called event-capture.log

And that's pretty much it on Log Parser for now.

I do recommend the Log Parser book from Syngress Publishing for some really funky uses of Log Parser and a nice post from George Starcher can be found here on integrating Log Parser with other tools for some real geeky fun!

Log Parser is a free tool and can be downloaded from here. Whilst googling around I came across another free tool that is like a GUI front end for Log Parser called Log Parser Lizard. It's well worth a look and can be found here.

Abusing Mail Servers

This is a quick post on what I discovered a while ago when i played a joke on a friend. I thought I would post it up as it might be interesting to someone else.

Basically, what i'm going to demonstrate in this post is how the SMTP service on an Exchange Server can be abused. It's quite trivial to send a message to someone else using an Exchange server without having a mail account. And as I'll demonstrate also, it's quite easy to spoof your IP address so even if they examine the headers they'll never know where it came from.

Now, why is this useful to an attacker? Well firstly I can send a message to someone and link to a file. If the reciever usually trusts that person I'm pretending to be they will likely click on the link. Secondly, I can spam the world and become a small time spam king and attract many beautiful women.

Bear in mind that the SMTP stuff can be done with telnet to any SMTP server but the IP Spoofing will only work if you are on the same subnet as it uses Arp poisoning.

Okay, heres how it goes.


Tools
>Sterm or Telnet



Method
1. Find a Exchange mail server by either sniffing traffic or scanning for servers with port 25 open

2. Launch Sterm. Select configuration, and enter the IP you want to spoof and the MAC address you want to spoof.



When I played a joke on a certain individual I did my homework and made sure these tied into the same addresses as the person I was spoofing.

After specifying the spoofing settings click on the file drop-down menu and select connect. you need to then enter the IP and port which you want to connect to.

3. At the prompt type :

helo servername.domainname.com

Obviously the FQDN should be used. You could also just type "helo IP-Address" with IP-Address being the one that you are spoofing.


4. Now we would enter who the message is going supposedly from:

mail from: blobby.knob@company.com


5. Now we enter who the message is to:

rcpt to: poor.victim@company.com

Often this address needs to be an internal address as mail relay may be turned off This can be testd though by sending a message to throw-away webmail account.


6. Now we specify the data we are going to send.

data

After typing "data" you should recieve the response 354. This means that you can send data.


7. Enter a subject line and press return:

subject: check this out!


8. Enter some aluring text:

Does my arse look big?
http://goatse.unfg.org/asciigoatse.htm


9. Now finsh the message buy pressing return, entering a period, and pressing return again.

The server should send a 250 code indicating the message is queued. Type quit to finish.


Now, when the recipient get the message they think its from the person it said in the senders details and they will follow the link and ........... well thats what you get for following links right!

Should they look at the headers they will see the spoofed IP address.

As I said, this can be done with Telnet but the IP spoofing part needs Sterm.

Oh and one last thing. Sorry Paul, it was just a joke.

Wireless Fun For Bad People!

his blog post is a quick one to demonstrate just how vulnerable your information is if your using a network, be it wired or wireless.

Strong encryption would mitigate this risk, however it would only mitigate it if you are the only person on that network. So if your on a work network, a coffee shop wireless network or any other network with other people also on the network, this type of attack is totally possible. In my examples below i am on a wireless network using WPA encryption, however my attacker is also authenticated to the same wireless access point. This is a common scenario.

In the case of a wired network this attack would only work if the atacker is on the same LAN as his victim.

Okay, on to the attack. In the examples below the victim is 192.168.1.200, the gateway (WAP) is 192.168.1.5.

What I used.

• Ettercap
• Webspy (part of the dsniff suite of tools)
• Driftnet
• Firefox (or any browser)

What I did

In this scenario i'll be running Ubuntu (7.10) as root. It is important that I use root to use the tools listed above. Once I have figured out where the gateway which is easy enough (route) i pick my target (192.168.1.200) and the gateway and i arp poison them to become the Man-in-the-Middle.

ettercap -T -M arp:remote -i eth1 /192.168.1.200/ /192.168.1.5/



This effectively sets me up between the target and the gateway and i receive all the traffic. If i had wanted to grab all traffic going out from any host on that LAN i would have used:

ettercap -T -M arp:remote -i eth1 /192.168.1.5/ //


I then configure ip forwarding by running the following command:

echo 1 > /proc/sys/net/ipv4/ip_forward

I then use cat to check it's enabled (1).

cat /proc/sys/net/ipv4/ip_forward



Next i set up Webspy. Webspy is part of the Dsniff suit of tools and will send any URL's visited to my browser. I did try to use the Remote Browser plugin for ettercap but it wouldn't work as reliably as Webspy.

webspy -i eth1 192.168.1.200



Webspy is pretty cool and in testing sent about 80% of the URL's to my listening browser but not all of them and not secure sites using SSL (https).


Next start up Firefox. This needs to be done as root. Any browsed URL's will be sent to this browser and open up a new tab for each URL. Other browsers will probably work bu i never tested them.


Then i might set up Driftnet. Driftnet can capture images or audio and save it to a directory, but in my example i will just send it to my screen.

driftnet -i eth1



As you can see from my Driftnet window above my target is browsing Binrev and obviously has great taste!

I could have also fired up Dsniff to grab password and stuff at this stage using:

dsniff -i eth1

So if it's not to obvious by now why this is a problem, think of it like this. When you log into your email in a web cafe or on a train on the wireless network, when you look at your email, or read anything online, even if your computer is fully patched and your using a super new firewall and it's set up correctly, your still vulnerable to someone seeing amost everything you do online.

And that's it. Just a little sniffing fun. And remember, as i said this type of fun can be had on wired LANs too.

Using and Abusing Alternate Data Streams

This blog post is to detail a very simple method that has been used by viruses, malware authors and others to hide data.


What are Alternate Data Streams (ADS)
Alternate Data Streams (ADS) were created to make NTFS compatible with the HFS file system. In NTFS there are 2 streams to a file, the data portion and the resource portion. It is relatively simple to hide data in the resource portion and without using specific tools this data would remain hidden.


How to Hide Data in an ADS
Below is an example of how to hide a file in the Alternate Data Stream. The file can be any type of file such as a normal text file, a word file or in this case an executable. This example is run from a command prompt and the disk i am using is NTFS formated.

1. Copy calc.exe into the directory your in, my examples will assume C:\ads\

2. Making sure you are in C:\ads\ run "echo test >hello.txt". This will create a file called hello.txt with the word "test" in.



3. Run "start hello.txt". This should open the file you just created in notepad or your text file editor of choice. This demonstrates the file is accessible and usable.

4. Run "type calc.exe > C:\ads\hello.txt:calc2.exe" This puts calc.exe into the ADS of hello.txt and renames it to calc2.exe. After placing calc.exe in the ADS of hello.txt run dir to check the file sizes.



By looking at the file size before and after the calc.exe is added into the ADS you will notice that no there is no change to the file size.

5. Run "del calc.exe". This deletes the calc.exe that you copied in step 1.



6. Run "start C:\ads\hello.txt:calc2.exe"



This will start calc.exe from he ADS. The full path is important to start the file.




By running "start hello.txt" (or by opening the file in the normal way) you will only see the original file, this can be added to or amended without affecting the file in the ADS.

If the file is copied to a partition that is not NTFS or a USB device that is not NTFS it will lose the file in the ADS.

Tools such as LADS.EXE and SFIND.EXE from the Forensic Toolkit (foundstone) will both discover files hidden in ADS.


Futher Reading

http://www.securityfocus.com/infocus/1822