In this episode of Lab Matters, Kaspersky Lab malware researcher Tim Armstrong joins Ryan Naraine to examine the security posture of the Android mobile operating system. Armstrong looks at strengths and weaknesses of the open-source platform and warns about the risks associated with jailbreaking/rooting Android devices.
"Wednesday, March 16, 2011
VNC passwords and Metasploit and DES
VNC passwords and Metasploit and DES: "
inside your meterpreter shell run getvncpw
meterpreter > run getvncpw
[*] Searching for VNC Passwords in the registry....
[*] FOUND in HKLM\Software\RealVNC\WinVNC4 -=> 3290e903b5bf3769 =>
you're probably asking yourself what the F kind of password 3290e... is. Well its DES encrypted. Lucky for us the key is hardcoded (0x238210763578887) and since VNC is open source...
code here:
http://packetstormsecurity.org/files/view/10159/vncdec.
change the relevant section
/* put your password hash here in p[] */
char p[]={0x59,0x58,0x6e,0x10,0xa4,0x48,0xd3,0x80};
getvncpw spit out: 3290e903b5bf3769
char p[]={0x32,0x90,0xe9,0x03,0xb5,0xbf,0x37,0x69};
cg@segfault:~/pentest$ gcc vncdec.c -o vncdec
cg@segfault:~/pentest$ ./vncdec
demopass
or use this one
http://www.consume.org/~jshare/vncdec.c
where you can just put your hash on the command line and don't have to recompile every time.
Ophcrack 3.3.1 & LiveCD – Free Rainbow Table Password Cracking Tool
Ophcrack 3.3.1 & LiveCD – Free Rainbow Table Password Cracking Tool: "Ophcrack is a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. It comes with a Graphical User Interface and runs on multiple platforms. It works based on a time-memory trade-off using rainbow tables.
You can download Ophcrack 3.3.1 here:
Windows – ophcrack-win32-installer-3.3.1.exe
Source – ophcrack-3.3.1.tar.bz2
Or download the LiveCD here:
To crack XP hashes – ophcrack-xp-livecd-2.3.1.iso
To crack Vista hashes – ophcrack-vista-livecd-2.3.1.iso
Features
- Runs on Windows, Linux/Unix, Mac OS X
- Cracks LM and NTLM hashes.
- Free tables available for Windows XP and Vista.
- Brute-force module for simple passwords.
- Audit mode and CSV export.
- Real-time graphs to analyze the passwords.
- LiveCD available to simplify the cracking.
- Loads hashes from encrypted SAM recovered from a Windows partition, Vista included.
- Free and open source software (GPL).
WASC WHID Semi-Annual Report for 2010: July - December
WASC WHID Semi-Annual Report for 2010: July - December: "
"
SpiderLabs just released our WASC Web Hacking Incident Database (WHID) Semiannual Report for 2010 (July - December). You can download the full report here (registration required). In this report, we analyze the WHID events from the 2nd half of the year and provide information such as top:
- Outcomes
- Attacks
- Application Weaknesses
- Attacked Vertial Markets
- Vertical Market Breakdown
Report Summary Findings
An analysis of 75 Web hacking incidents from the second half of 2010 conducted by Trustwave’s SpiderLabs team shows the following trends and findings:
- A steep rise in attacks aimed at causing downtime – currently the new no. 1 outcome (up 21% from previous reporting period). This is mainly a result of ideological hacking efforts utilizing distributed denial of service (DDoS) attacks as part of the Anonymous Group versus Anti-Piracy and WikiLeaks events.
- Corresponding to downtime outcomes, denial of service attacks made the largest jump for Attack Methods to no. 1 (up 22% from the previous reporting period).
- Organizations have not properly implemented nor tested anti-automation defenses for their Web application architecture to ensure application availability during denial of service (DoS) attacks.
Vertical Market Breakdown
The most valuable way to use WHID data is to apply a vertical market view. This will give you a much closer view of what issues are effecting your market. To this, you can utilize the Real-time Statistics interface on the WHID Project Site and choose your vertical market from the drop-down list. Here is quick breakdown of the top vertical markets from 2010:
Government
- Outcome – Defacement
- Attack Method – SQL Injection
- Application Weakness – Improper Input Handling
Finance
- Outcome – Monetary Loss
- Attack Method – Stolen Credentials
- Application Weakness – Insufficient Authentication
Retail
- Outcome – Credit Card Leakage
- Attack Method – SQL Injection
- Application Weakness – Improper Input Handling
WHID Top 10 Risks for 2010
As part of the WHID analysis, here is a current Top 10 listing for 2010 of the application weaknesses that are actively being exploited (with example attack method mapping in parentheses). Hopefully this data can be used by organizations to re-prioritize their remediation efforts.
| WHID Top 10 for 2010 |
1 | Insufficient Anti-Automation (Brute Force and DoS) |
2 | Improper Output Handling (XSS and Planting of Malware) |
3 | Improper Input Handling (SQL Injection) |
4 | Insufficient Authentication (Stolen Credentials/Banking Trojans) |
5 | Application Misconfiguration (Detailed error messages) |
6 | Insufficient Process Validation (CSRF and DNS Hijacking) |
7 | Insufficient Authorization (Predictable Resource Location/Forceful Browsing) |
8 | Abuse of Functionality (CSRF/Click-Fraud) |
9 | Insufficient Password Recovery (Brute Force) |
10 | Insecure Indexing (Search Engines) |
Attack Likelihood Metrics
Another use for WHID data is to help provide event likelihood data for various industry web application security efforts such as:
Both of the reports have historically been heavily weighted towards vulnerability prevalence. Hopefully, WHID data can assist both of these efforts when creating future versions by providing data on event likelihood which in turn would help to re-prioritize the rankings of issues.
Links and Notes
Links and Notes: "Forensic Meet-up
There are plans afoot for a forensics meet-up in the Northern VA area (Chantilly - Centreville - Herndon - Reston) on 31 Mar 2011. The meet-up will likely start around 6:30pm - 7pm, and the location is TBD for the moment...keep an eye here, or on the Win4n6 group. This first meet-up will be free-form, and I'll work up something of an informal agenda.
As more folks become aware of this meet-up, I guess my initial concern would be where to meet. I'd like this to be informal, and everyone to relax and have a beer. If the interest is for something a bit more formal, then we may move to a different agenda later. Eventually, my hope is that this becomes something useful to folks, as we can discuss and implement innovation in the DF and IR fields...
F-Response Patent
On Fri, 11 Mar 2011, Matt announced that F-Response had received a patent for remote forensic innovation! Congrats, Matt...this is very well deserved!
Of specific note is that F-Response provides, '...forensic grade write-protection...' for remote forensics and raw access to systems.
This is fantastic news for Matt, and for the community as a whole! Matt's contributions to the field have been phenomenal, to say the least.
RegRipper Plugins
I recently wrote up some new plugins (and updated the samparse.pl plugin)...
notify.pl - Parses the Notify subkeys within the Software hive for registered Winlogon Notification DLLs, based on Mark's Case of the SysInternals-Blocking Malware post
init_dlls.pl - Checks for keys similar to the one mentioned in Mark's Case of the Malicious AutoStart post
renocide.pl - Checks for an artifact key mentioned on the MMPC site for the Win32/Renocide malware
These plugins are meant to demonstrate a couple of things...first, that Registry analysis can be used in conjunction with other analysis methods to detect malware within acquired images, where AV scanners might fail. I've run AV scans before where two commercial and three free AV scanners didn't find anything, but the fourth free scanner found something. I've also seen where AV used by customers has failed due not to having the incorrect DAT file, but to having the incorrect scanning engine. We're all susceptible to this, and if you use AV as part of your malware detection process for when you examine acquired images, then this is something that you'll need to be aware of, as well.
Second, all three of these plugins took me less than 30 minutes...total...to write and test. In fact, the only real slow-down was deciding how to make the output a bit more useful...for the notify.pl plugin, I copied code from the userassist.pl plugin to list all of registered DLLs sorted based on their key LastWrite times. This means that if I want to deploy any of these plugins as part of my timeline creation toolkit, it's simply a matter of minutes for me to modify them. So in less than 30 minutes, I was able to add three new plugins to the library, and saved everyone who uses those plugins the time for researching and writing those plugins themselves. This serves not only as a force multiplier, but also as a library for institutional knowledge within the community as a whole.
You can get copies of these plugins from Brett's RegRipper.net site.
As a side note, running RegRipper is just part of the malware detection process that I use regularly, and what I'm writing about and detailing for my next book. Part of the supporting materials for this book will include a checklist, as well.
"
There are plans afoot for a forensics meet-up in the Northern VA area (Chantilly - Centreville - Herndon - Reston) on 31 Mar 2011. The meet-up will likely start around 6:30pm - 7pm, and the location is TBD for the moment...keep an eye here, or on the Win4n6 group. This first meet-up will be free-form, and I'll work up something of an informal agenda.
As more folks become aware of this meet-up, I guess my initial concern would be where to meet. I'd like this to be informal, and everyone to relax and have a beer. If the interest is for something a bit more formal, then we may move to a different agenda later. Eventually, my hope is that this becomes something useful to folks, as we can discuss and implement innovation in the DF and IR fields...
F-Response Patent
On Fri, 11 Mar 2011, Matt announced that F-Response had received a patent for remote forensic innovation! Congrats, Matt...this is very well deserved!
Of specific note is that F-Response provides, '...forensic grade write-protection...' for remote forensics and raw access to systems.
This is fantastic news for Matt, and for the community as a whole! Matt's contributions to the field have been phenomenal, to say the least.
RegRipper Plugins
I recently wrote up some new plugins (and updated the samparse.pl plugin)...
notify.pl - Parses the Notify subkeys within the Software hive for registered Winlogon Notification DLLs, based on Mark's Case of the SysInternals-Blocking Malware post
init_dlls.pl - Checks for keys similar to the one mentioned in Mark's Case of the Malicious AutoStart post
renocide.pl - Checks for an artifact key mentioned on the MMPC site for the Win32/Renocide malware
These plugins are meant to demonstrate a couple of things...first, that Registry analysis can be used in conjunction with other analysis methods to detect malware within acquired images, where AV scanners might fail. I've run AV scans before where two commercial and three free AV scanners didn't find anything, but the fourth free scanner found something. I've also seen where AV used by customers has failed due not to having the incorrect DAT file, but to having the incorrect scanning engine. We're all susceptible to this, and if you use AV as part of your malware detection process for when you examine acquired images, then this is something that you'll need to be aware of, as well.
Second, all three of these plugins took me less than 30 minutes...total...to write and test. In fact, the only real slow-down was deciding how to make the output a bit more useful...for the notify.pl plugin, I copied code from the userassist.pl plugin to list all of registered DLLs sorted based on their key LastWrite times. This means that if I want to deploy any of these plugins as part of my timeline creation toolkit, it's simply a matter of minutes for me to modify them. So in less than 30 minutes, I was able to add three new plugins to the library, and saved everyone who uses those plugins the time for researching and writing those plugins themselves. This serves not only as a force multiplier, but also as a library for institutional knowledge within the community as a whole.
You can get copies of these plugins from Brett's RegRipper.net site.
As a side note, running RegRipper is just part of the malware detection process that I use regularly, and what I'm writing about and detailing for my next book. Part of the supporting materials for this book will include a checklist, as well.
EnScript to parse classic (.evt) event log entries in unallocated
EnScript to parse classic (.evt) event log entries in unallocated: "
"
This EnScript was inspired by a blog reader who emailed me to ask for a solution to parse some windows event log entries that were found in unallocated.
There are a couple ways I could think of to solve this issue. The easiest was to just build a parser to read a single event log record that was found in unallocated and display the data in the single record. The problem with that solution is it does not scale well and it will become very tedious when there are numerous records found in unallocated and requires a person to parse each one individually.
The final solution was an EnScript to perform a search for the magic value of "LfLe" which appears in every valid event log record. Once a hit is found, then the record is parsed and exported out into a separate .EVT file. Every hit is exported out into the same .evt file and in the end, you will have a single "eventlog.evt" that contains all the valid windows event log entries that were found in unallocated. You can then use your favorite 3rd party event log viewer (Event log explorer, etc..) or the native Windows event viewer (eventvwr.exe) to read all the records that were found in unallocated.
Each event log entry maintains a event record number. When searching in unallocated, it is possible that you could find two records with the same record number, therefore this EnScript renumbers all the records found in unallocated, but leaves the remaining data intact and as exactly as found in unallocated. Each record is assigned a new record number and then exported into the new .Evt file. A new header and footer is built based on the exported data so it can then be read with all the common event log viewing tools.
The exported records viewed in the EVENTVWR app in Windows 7:
The exported records viewed in the Event Log Explorer app in Windows 7:
Prerequisites:
There are a couple ways I could think of to solve this issue. The easiest was to just build a parser to read a single event log record that was found in unallocated and display the data in the single record. The problem with that solution is it does not scale well and it will become very tedious when there are numerous records found in unallocated and requires a person to parse each one individually.
The final solution was an EnScript to perform a search for the magic value of "LfLe" which appears in every valid event log record. Once a hit is found, then the record is parsed and exported out into a separate .EVT file. Every hit is exported out into the same .evt file and in the end, you will have a single "eventlog.evt" that contains all the valid windows event log entries that were found in unallocated. You can then use your favorite 3rd party event log viewer (Event log explorer, etc..) or the native Windows event viewer (eventvwr.exe) to read all the records that were found in unallocated.
Each event log entry maintains a event record number. When searching in unallocated, it is possible that you could find two records with the same record number, therefore this EnScript renumbers all the records found in unallocated, but leaves the remaining data intact and as exactly as found in unallocated. Each record is assigned a new record number and then exported into the new .Evt file. A new header and footer is built based on the exported data so it can then be read with all the common event log viewing tools.
The exported records viewed in the EVENTVWR app in Windows 7:
The exported records viewed in the Event Log Explorer app in Windows 7:
Prerequisites:
None - This EnScript performs a search automatically. There is no need to search, select (blue check) or preprocess anything. The EnScript will search every unallocated object found, so if you have multiple drives loaded into the case, each one will be searched automatically. The EnScript automatically bookmarks all the 'LfLe' search hits (valid and invalid). Some basic error checking is done to validate the record to attempt to ensure it is a complete and valid record before it is exported into the new .EVT file. The new 'eventlog.evt' file is created in the default export folder for the active case.
Limitations:
This *only* searches and rebuilds classic Windows NT/2000/XP event (.evt) records. It does not yet support the newer .EVTX (xml) records that are used in Vista, 2008 & 7.
Download here
Limitations:
This *only* searches and rebuilds classic Windows NT/2000/XP event (.evt) records. It does not yet support the newer .EVTX (xml) records that are used in Vista, 2008 & 7.
Download here
"Understanding EXT4 (Part 2): Timestamps"
"Understanding EXT4 (Part 2): Timestamps": "Hal Pomeranz, Deer Run AssociatesWell I certainly didn't plan on three months elapsing between my last post on EXT4 and this follow-up, but time marches on. That was supposed to be a clever segue into the topic for this installment-- the new timestamp format in the EXT4 inode. OK, I know what you all are thinking now: "Shut up Hal and get to the geeky stuff." Your wish is my command!Setting the StageLet's set up another test file in an EXT4 file ssytem:# echo Time for knowledge >testfile# touch -a -t 211101231917.42 testfile# touch -m -t 204005160308.19 testfileI'm using the touch command as root to ..."
Subscribe to:
Posts (Atom)