1. Exploiting passwords for fun and profit with Metasploit

2.  David Maloney a.k.a theLightCosine
 Core Developer for Metasploit Commercial Editions
 Metasploit Pro
 Metasploit Express
 Before That:
 Community Contributor to the Metasploit Framework
 Penetration Tester for Time Warner Cable
 Contact Me
 Twitter: @thelightcosine
 Email: thelightcosine@metasploit.com

3. Clients
 Convenience
 Keeps users from having
to remember them
 Manages credentials for
numerous systems in
one place
 Totally Avoidable
 Usually done poorly
 Authentication Purposes
 Must store them to
compare against
provided creds
 Unavoidable
 Getting Better at doing
this
Servers

4.  Who needs an exploit if we have the password?
 Looks like legitimate traffic/access
 Who audits successful logons?
 Shockingly easy to own all the things
 Case of the winscp.reg file

5. The Where

6.  Often Stored in one of two places
 HKEY_LOCAL_MACHINESOFTWARE
 Available to all users all the time
 HKEY_USERS<SID>Software
 Available only to that user and Admins on the system
 Usually client apps
 CoreFTP is one example

7.  Old School way of storing data
 Still in use in some applications
 Mostly seems to be legacy support
 Usually client-side not servers
 WinSCP is an example

8.  Soooo much better than INI Files </sarcasm>
 Still a flat file sitting on the file system
 Even easier to parse than INI files really
 Just grab your favorite XML parser
 Seen both on Clients and Servers
 FileZilla is an example of this

9.  Usually some custom format
 Often Breaks down into common blocks with header
groupings
 Headers usually tell
 Type of data
 Length of data
 Name of field
 Etc
 Can be a real pain to reverse engineer the format on
these

10.  Windows started providing a Credential Store for
saving certain types of credentials
 Managed by the Operating System
 Restricted by user access controls
 Bypass these controls by calling the API functions as our
victim user thanks to Railgun
 See Kx499’s enum_credstore Post module for specifics

11.  Passwords stored in a backend database
 How most webapps work these days
 Usually server apps

12. How we keep you from just looking at the password…in theory

13. Pro
 None
 Never ever store
passwords in plaintext
 Password is wide open to
the world
 This happens more than
you’d think!
 Same for every user
Con

14. Pro
 Not in plaintext
 Attacker has to figure
out what the plaintext
was XORed against
 Easily reversed
 Attacked finds the XOR
value
 XOR cipher text against
the same value to recover
plaintext
 Same for every user
Con

15. Pro
 May be more difficult for
attacker to figure out
 More Complex than
simple XOR encoding,
usually
 Feel 1337 for writing your
own ‘encryption’
 Unless you are a
cryptographer, your
algorithm sucks (sorry,
it’s true)
 Not really encryption
 Easily defeated by
reverse engineering
 Same for every user
Con

16. Pro
 Real Encryption
 Proven Technology
 Not simple reversible
procedure
 Hardcoded static key
used
 Reverse Engineering can
recover the key
 Still the same for every
user
Con

17. Pro
 Real Encryption
 Proven Technology
 Encryption Key is never
given to userland
 We can call the same
APIs as the user with
Railgun
 Statically Coded Key
material
 Same for every user
Con

18. Pro
 Real Encryption
 Proven Technology
 Entropy added on user
by user basis
 Different for every user!
 We can call the API as
the user with Railgun
 Machine hands
decrypted Materials
right over.
 IN Soviet Russia….
Con

20. Pro
 One Way Operation
 Not Reversible (in
theory)
 Great for servers
 Not an option for clients
 Some hashing
algorithms have
weaknesses
 Still always rainbow
tables and bruteforcing
Con

21. Pro
 Real Encryption
 Proven Technology
 No Static Keys!
 Different for every user
 Your users still have to
remember 1 password
 Have to be careful about
how master password is
put into memory
Con

23. FilezillaFTP
Client
•Saved Sites stored in
XML File
•Passwords in
Cleartext
•Filezilla offers ‘kisok
mode’ to prevent
password storage

24. mRemote
•Saved Sites stored in
XML File
•AES-128-CBC
Encryption
•Weak static
Encryption Key
•OpenSource means
everyone can see the
encryption key

26. WinSCP
•Saved Sessions
stored either in the
registry or an INI File
•Passwords stored
with weak custom
encoding routine
•OpenSource means
everyone can see the
routine for
decryption

28. S,artFTP
•Saved Sites stored in
XML File
•Encrypted with
Microsoft CAPI
•Weak Static
Encryption Key
•Called same CAPI
Functions with
Railgun

30. Wheredowego
next?
•Creds stored to
database
•Known creds are
prioritized in the Pro
Bruteforcer
•Run Bruteforcer
with all the stolen
creds
•Give it a few hours….

31. Let’s see you exploit that many systems without setting off
alarms