Successfully reported this slideshow.

Extrabacon's sploit core

1

Share

Upcoming SlideShare
Eduar perea ppp
Eduar perea ppp
Loading in …3
×
1 of 25
1 of 25

Extrabacon's sploit core

1

Share

Download to read offline

A description of my project to port the core of the Extrabacon exploit out for general exploit development.

A description of my project to port the core of the Extrabacon exploit out for general exploit development.

More Related Content

Related Books

Free with a 14 day trial from Scribd

See all

Extrabacon's sploit core

  1. 1. ExtraBacon's Sploit Framework Or: How to break the Ruby Bonds of Metasploit By: Daniel Reilly (Oni) https://github.com/dreilly369 https://the-it-ninja.blogspot.com/ https://www.linkedin.com/in/daniel-reilly-58b28171
  2. 2. Disclaimer ● This is my own work not endorsed, supported, or generally approved of, by good people. ● I don't encourage malicious attacks. ● I do encourage offensive security and asymmetric layered defense
  3. 3. Where'd this come from? ● ShadowBrokers announces their supposed Equation Group tool dump and teaser files. ● Cisco Confirms EXBA is effective against several versions of ASA * ● Researchers report porting the exploit to newer ASA versions * ● Gov't (sort of) acknowledges tools by charging Harold T. Martin III * ● I Decide to fork the core Sploit code and port one of my favorite configuration exploits (postgeSQL lo_creat()) as a PoC
  4. 4. Let me be clear ● I love Metasploit...but - – You don't always need a tank. – I am not a fan of Ruby. – Custom Tools F.T.W. – Sploits can run from much smaller devices. ● Possibly IoT small (currently a hypothesis)
  5. 5. Workflow of a MSF Exploit ● Make sure Postgres is configured/running ● Start MSFConsole or Armitage ● db_nmap the target subnet ● Run some favorite exploit/payload combos based on services discovered ● If you're fancy you export all of these commands to a resource script
  6. 6. Sploit's place in the world ● Sploit is for turning an exploit into a tool. ● Metasploit is for when you have a target and need to find an exploit. Sploit is the opposite. ● Normal flow might be: – Find an exploitable flaw (or borrow one like I have) – Write Exploit by extending the Sploit class – Convert exploit script to command line tool using distutils ● Py2exe compile a windows executable? Sure why not. – Distribute tool to minions. – Minions hack the Gibsons
  7. 7. What is a Sploit? ● Sploit is a Python class for flexible exploit delivery. By default it was designed to deliver custom SNMP packets to firewalls. But why stop there? ● extrabacon_1.1.0.1.py can be thought of as similar to a MSF resource script...on steroids. It handles fingerprinting, version selection, exploit running, post exploit cleanup, etc. It extends the Sploit Class with exploit- specific functionality ● Zen of Sploit Development: “Define exploit workflow as subcommands”. These in turn define the actions available for each step.
  8. 8. Structure of a Sploit
  9. 9. Sploit Functions Core ● __init__() ● __del__() ● _init_parser() ● description() ● enable_debugging() ● launch() ● pre_exploit() ● send_exploit() ● post_exploit() ● run() ● send_touch() Communication Management ● create_socket() ● build_payload() ● build_shellcode() ● version_check() ● generate_exploit() ● generate_touch() ● parse_error() ● perform_healthcheck() Data Management ● get_key_dir() ● get_key_file() ● list_from_file() ● post_touch() ● report_key() CLI Parameter Management ● add_connection_params() ● add_healthcheck_params() ● add_key_params() ● add_logging_params() ● add_subcommand() ● pre_parse() ● post_parse() ● setup_parser()
  10. 10. Types of Subcommands ● Information Subcommands – Generate data about systems. In my example the “seek” and “dict” Subcommands. Also the Crypto Key Management subcommands ● Action Subcommands – Attempt to change the state of the target in some way. In my example the “destroy” Subcommand ● Shortcut Subcommands – Combine two or more Subcommand ideas into one command. In my example I combine all three exploit steps into one command “seek-and-destroy”
  11. 11. Versions ● The Extrabacon release had ~17 different version files focused between 8.0.1 and 8.4.4 (with the notable exception of 8.1.x) ● Version files hold the details about the modifications to the exploit needed for specific version of the target app (NOP length, offsets, etc.) ● The Versions files could also be used to differentiate between O.S.es, architectures, payload choice, etc. ● Not all Sploits need multiple version files.
  12. 12. Versions Files
  13. 13. Veganowner ● Based on msf/modules/exploits/multi/postgres/postgres_createlang.rb ● Uses C instead of scripting ● Writes a pseudo-randomly named malicious DLL to the system which contains a reverse_tcp Shell. ● Credit and thanks for the original exploit module go to : – 'Micheal Cottingham', # author of this module – 'midnitesnake', # the postgres_payload module that this is based on, – 'Nixawk' # Improves the module
  14. 14. Veganowner Subcommands
  15. 15. Seek
  16. 16. Dict(ionary)
  17. 17. Destroy
  18. 18. Seek-And-Destroy
  19. 19. Demo Time
  20. 20. Initial Infection
  21. 21. Reverse TCP Callback
  22. 22. Persistent Bot
  23. 23. Sockets & Spoofing ● Original EXBA Exploit can use Scapy to manually construct TCP packets with Spoofed src info ● PostgreSQL uses TCP 5432 ● Conclusion: IP white-listing/black-listing is not a sufficient defense. – TCP traffic NEEDS IPSec and/or a separate VPN/C. – Check out Karyn Benson's research on Internet Background Radiation (IBR)
  24. 24. Concluding thought
  25. 25. Resources ● http://www.securityweek.com/leaked-cisco-asa-exploit-adapted-newer-versions ● https://blog.silentsignal.eu/2016/08/25/bake-your-own-extrabacon/ ● https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp ● https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/cisco/cisco_asa_extrabacon.rb ● https://www.youtube.com/watch?v=wjva6ZJyhwE ● https://gist.github.com/sampsyo/462717 ● https://www.goodreads.com/author/show/3787.Daniel_Schorr ● Audio Track - “BackOUt” by BlakOpz ● https://www.youtube.com/watch?v=OJgOUITOpQ8

×