Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

23 October 2014 | 512 views

Pipal – Password Analyzer Tool

Check Your Web Security with Acunetix

Pipal is a password analyzer tool that can rapidly parse large lists of password and output stats on the contents. Pipal will provide you with stats on things like the most frequently used password, password lengths, dates (months/days/years) or numbers used, the most common base words and much more.

It also makes recommendations based on the password makeup/charsets and gives you Hashcat masks.

Pipal - Password Analyzer Tool

Usage

NOTE: The app will only work with Ruby 1.9.x, if you try to run it in any previous versions you will get a warning and the app will close.

There are not a whole lot of tools out there similar to this, in fact the only one we’ve covered is PACK – Password Analysis & Cracking Kit.

Info Provided by Pipal

  • Total Entries
  • Total Unique Entries
  • Top 10 Passwords
  • Top 10 Base Words
  • Password Length (Count ordered & Length ordered)
  • Password Type (Only lowercase, only uppercase, only alpha, only numeric etc)
  • Passwords That Contain Months or Days (including abbreviations)
  • Passwords That Contain Years
  • Passwords With Digits On The End
  • Character Sets Used

You can download Pipal here:

master.zip

Or read more here.



21 October 2014 | 1,353 views

Apple’s OS X Yosemite Spotlight Privacy Issues

So Apple pushed out it’s latest and great OS X version 10.10 called Yosemite, but it’s facing a bit of an uproar at the moment about some Spotlight privacy issues. For those who are not familiar, Spotlight is some kinda of super desktop search that searches everything on your computer (and now also the Internet) – which is not cool as every search means your physical location & search term is sent to Apple (and 3rd parties like Microsoft) every time you use Spotlight.

OS X Yosemite Spotlight Privacy Issues

The upside? Yosemite is pretty cool and also security wise it comes with patches for both POODLE and Shellshock.

Even so, Apple should know better than this and respect privacy by default as they surely understand how something like can blow up.

There’s growing disquiet over Apple’s desktop search app Spotlight, which sends queries for things back to the company’s servers to process.

Spotlight phones home in OS X Yosemite, version 10.10, and it is enabled by default: it can be switched off, but with Apple insisting that it now takes people’s privacy seriously, the software has raised some eyebrows. It appears Spotlight sends queries, along with your location, back to Apple over the internet so the company can suggest related things from the web using Microsoft’s Bing engine. Apple says it needs to see your queries so it can improve Spotlight’s algorithms for suggesting things.

So, for example, searching for “weather” on a Register Mac running OS X 10.10 reveals files, folders and installed applications (such as the Windows 8.1 weather app in Parallels) on the machine containing the keyword; that’s the local search part. This is what you’d expect to see.

But then Spotlight contacts Apple remotely to get recommended software from the Apple App Store, and a search by Bing for any relevant websites.

I can see why they turn it on by default though, the majority of users wont know what is happening and they will enjoy the richer search experience that Spotlight gives them now – ala Facebook style. Do something that pisses off a small subset of more technical users, and see how the public backlash is – if it’s not too bad you profit.

This has spread far and wide though, reaching some mainstream news sites – I’m not exactly sure if the average user will be enraged though as we seem to live in a post-privacy kind of society now where people accept companies collect their data.

Yosemite was released late last week after a string of betas were made available to developers, the first in June. The OS was finalized as Apple chief exec Tim cook started waving around his company’s alleged efforts to safeguard privacy; Cook hopes to use privacy as a differentiator in the iGiant’s ongoing battle against arch rival Google.

But the people behind Fix-macosx.com reckon Spotlight isn’t the only component of OS X Yosemite that unnecessarily phones home. “A myriad system and user processes are sending data to Apple in a default configuration, and we want to fix those, too,” they promise.

A collaborative project to identify additional data collected by Apple and other third parties has been set up by the Fix Mac OS X team. “This work is powered by Net-Monitor, our open-source toolkit for auditing phone home behaviour system-wide,” the developers add.

Apple’s collection of search queries in its cloud is not limited to OS X Yosemite: the Spotlight Suggestions and Bing Web Results are also included in iOS 8. “It has to do with sending data to Apple,” Sean Sullivan, a security advisor at F-Secure, told The Register. “It’s a being-spied-on-by-the-cloud issue.”

How to restore your privacy

Disable these options:

Disable Spotlight Options

  • Disable “Spotlight Suggestions” and “Bing Web Searches” in System Preferences > Spotlight > Search Results.
  • Safari also has a “Spotlight Suggestions” setting that is separate from Spotlight’s “Spotlight Suggestions”. This uses the same mechanism as Spotlight, and if left enabled, Safari will send a copy of all search queries to Apple.
  • You’d be forgiven for thinking that you’d already disabled “Spotlight Suggestions”, but you’ll also need to uncheck “Include Spotlight Suggestions” in Safari > Preferences > Search.

There’s also a Python script to do it here – fix-macosx.py

Source: The Register


18 October 2014 | 1,597 views

RIPS – Static Source Code Analysis For PHP Vulnerabilities

RIPS is a tool written in PHP to find vulnerabilities using static source code analysis for PHP web applications. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by user input (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities RIPS also offers an integrated code audit framework for further manual analysis.

RIPS - Static Source Code Analysis For PHP Vulnerabilities

Features

  • detect XSS, SQLi, File disclosure, LFI/RFI, RCE vulnerabilities and more
  • 5 verbosity levels for debugging your scan results
  • mark vulnerable lines in source code viewer
  • highlight variables in the code viewer
  • user-defined function code by mouse-over on detected call
  • active jumping between function declaration and calls
  • list of all user-defined functions (defines and calls), program entry points (user input) and scanned files (with includes) connected to the source code viewer
  • graph visualization for files and includes as well as functions and calls
  • create CURL exploits for detected vulnerabilties with few clicks
  • visualization, description, example, PoC, patch and securing function list for every vulnerability
  • 7 different syntax highlighting colour schemata
  • display scan result in form of a top-down flow or bottom-up trace
  • only minimal requirement is a local webserver with PHP and a browser (tested with Firefox)
  • regex search function

There are other PHP-centric tools we’ve covered such as:

RATS – Rough Auditing Tool for Security
Skavenger – Source Code Auditing Tool!
SpikeSource Spike PHP Security Audit Tool

If you are interested in more tools of this type you can find our complete list here (which covers various languages) – Code Auditing Tools.

NOTE: The authors have stated that RIPS 0.5 development is abandoned. A complete rewrite is in the works and used as an academic prototype but it is not publicly available yet. So we’ll be keeping an eye on what happens with that.

But for now you can download RIPS here:

rips-0.54.zip

Or read more here.


16 October 2014 | 2,575 views

Everything You Need To Know About POODLE SSLv3 Vulnerability

So yah, it’s been quite a year – not long after Heartbleed and then Shellshock we now have POODLE SSLv3 vulnerability.

Yes, that’s right – POODLE. It is actually an acronym this time though, yay (Padding Oracle On Downgraded Legacy).

POODLE SSLv3 Vulnerability

Is it a huge risk? Not really as it doesn’t allow any type of remote exploitation, it does however allow for SSLv3 Man-in-the-middle (MITM) attacks though – which is not good. It’s a fundamental design flaw in SSL/TLS which authenticates before encrypting.

Researchers have discovered a security vulnerability in SSL 3.0 that allows attackers to decrypt encrypted website connections.

Miscreants can exploit a weakness in the protocol’s design to grab victims’ secret session cookies. These can be used to log into online accounts, such as webmail, social networks, and so on. The attack is, we’re told, easy to perform, and can be done on-the-fly using JavaScript – provided you can intercept the victim’s packets, perhaps by setting up a malicious Wi-Fi point in a cafe or bar.

SSL is supposed to encrypt your communications, such as your connection to your bank’s website, so eavesdroppers can’t steal or tamper with your sensitive information while it’s in transit. Google revealed details of the design flaw on Tuesday, and dubbed it POODLE – short for Padding Oracle On Downgraded Legacy Encryption. It is a blunder within the blueprints of SSL 3.0 rather than a software bug, so it affects any product following the protocol – from Google Chrome and Mozilla Firefox to Microsoft Internet Explorer.

To fix it in nginx use the following options:

For Apache:

Basically, disable SSLv3.

Stats on SSLv3 usage can be found here – POODLE Attack and SSLv3 Support Measurement

CloudFlare also noted only 0.65 percent of the HTTPS encrypted traffic on CloudFlare’s network uses SSL 3. (which is a good sign) and shows this should not have a massively wide spread effect.

Google security bod Bodo Möller explains that snoopers can trigger network faults to push web browsers into using SSL 3.0, an 18-year-old protocol that should have been binned long ago. Ideally, the browser should be using the superior encryption protocol TLS, which does not suffer from the POODLE shortcoming.

“Because a network attacker can cause connection failures, they can trigger the use of SSL 3.0 and then exploit this issue,” Möller said. One simple solution is to stop using SSL 3.0 and instead use TLS only. This applies to web browsers and websites.

Google’s response to the flaw is to scrub SSL 3.0 support from its flagship Chrome browser. Websites and other browsers are also expected to end support for SSL v3 as it’s now considered insecure by design, and instead enforce the use of TLS for HTTPS connections. Google also recommends browsers and web servers use TLS_FALLBACK_SCSV, the Transport Layer Security Signalling Cipher Suite Value that blocks protocol downgrades.

Doing so will be more effective than simply killing off SSL 3.0 support: that’s because using this magic value should prevent all future downgrade attacks. Chrome and Google’s web servers already support TLS_FALLBACK_SCSV, we’re told.

Websites that end support for SSL v3 will become incompatible with older browsers and OSes – particularly Internet Explorer 6 and Windows XP. The POODLE vulnerability could well be the final nail in the coffin for machines stuck on IE6 and XP once major websites stop supporting the legacy insecure protocol.

Firefox has already pushed out an update of their browser with SSLv3 disabled, but only for the nightly build. It will hit the public on November 25th when Firefox 34 is released, their notes are here – The POODLE Attack and the End of SSL 3.0.

There’s a good technical analysis of the flaw here: POODLE attacks on SSLv3

The full paper is here: This POODLE Bites: Exploiting The SSL 3.0 Fallback [PDF]

If you want to check your servers I suggest using this SSL diagnostic tool which will show you what protocols your setup supports:

DigiCert® SSL Installation Diagnostics Tool

It will also point out if you’re using SSLv3.0 and mark you as insecure if you are. A secure setup should return the following:

Protocol Support

TLS 1.2, TLS 1.1, TLS 1.0

Source: The Register


14 October 2014 | 745 views

ThreadFix – Vulnerability Aggregation & Management System

ThreadFix is a software vulnerability aggregation and management system that reduces the time it takes to fix software vulnerabilities. ThreadFix imports the results from dynamic, static and manual testing to provide a centralized view of software security defects across development teams and applications. The system allows companies to correlate testing results and streamline software remediation efforts by simplifying feeds to software issue trackers. By auto generating application firewall rules, this tool allows organizations to continue remediation work uninterrupted. ThreadFix empowers managers with vulnerability trending reports that show progress over time, giving them justification for their efforts.

ThreadFix - Vulnerability Aggregation & Management System

ThreadFix also allows users to input the results of manual penetration testing, code review and threat modeling to provide a comprehensive view of software security for an organization. Once a unified list of security vulnerabilities has been created, ThreadFix allows application security managers to further prioritize discovered vulnerabilities via a centralized dashboard. The platform allows companies to correlate testing results and streamline software remediation efforts by simplifying feeds to software issue trackers. As the development team resolves defects, status updates are synchronized within ThreadFix, enabling the security team to schedule follow-up testing to confirm that security holes have indeed been closed.

Features

  • Consolidated View of Application Test Results – Consolidate and de-duplicate imported results from open source, commercial dynamic and static scanning tools, as well as the results of manual testing and threat modeling to get a complete view of the state of your applications.
  • Reports – Get the latest security status of your applications while providing an eagle’s-eye view of your organization’s progress over time to pinpoint any process problems.
  • Defect Tracker Integration – Help security professionals translate application vulnerabilities into software defects and push tasks to developers in the tools and systems they are already using.
  • Virtual Patching – Create virtual Web Application Firewall (WAF) rules to help block malicious traffic while vulnerabilities are being resolved. While your organization takes on remediation of your applications, virtual patching helps guard against common vulnerabilities such as Cross-Site Scripting (XSS) and SQL Injections.
  • Compatible with Open Source and Commercial Products – ThreadFix is compatible with a number of commercial and freely available dynamic and static scanning technologies, SaaS testing platforms, IDS/IPS and WAFs and defect trackers.

You can download Threadfix 2.1RC1 here:

2.1RC1-tag.zip

Or read more here.


10 October 2014 | 1,289 views

Retarded E-mails – Satilight Hacking, Website Cloning, Detailo & More!

It’s been a good 3 years since my last entry in this category and I’ve had a steady stream of retarded e-mails recently fit for posting. Plus I actually had 1-2 people e-mail me and tell me they missed the posts in the Retards category and that it always gave them a good laugh – so please could I post some more.

Retarded E-mails

So yah, here we are – let’s see what we’ve harvested from the crop this time around.

An evergreen classic, he really can’t download ‘the hacking tools’.

From: kj
Subject: hacking software

Message Body:
darknet,
im still having trouble downloading the hacking tools..can you help where i can get this..
credit card wizard v.1.1
and for bank account..and money transfer software..damn im really broke..help me..

Another very common theme amongst these e-mails, that I seem to be some free resource for helping people to hack random stuff.

From: binshad
Subject: brutus

Message Body:
sir,
i need your help i want to bruteforce and i want to crack the password from a website freesms8.com using brutus ae2. i cannot able to configuare the brutus for that attack can you help me. its .aspx website dotnet.

PERHAPS LEARN HOW TO USE CAPS LOCK FIRST.

From: Ras Wayne
Subject: I WANT TO LEARN HACKING

Message Body:
I WOULD LIKE TO LEARN HACKING,CC HACKING AND ALSO BANKS INFO HACKING, LET ME KNOW IF YOU GUYS CAN BE OF HELP.

THANKS.

Free cash, what does that even mean? Surely if cash is free it has no intrinsic value – wait, is that too deep?

From: jemma
Subject: cash fast

Message Body:
how to get free cash fas

Er what? I guess the answer is yes, but that’s because I don’t really understand the question.

From: marijan
Subject: question

Message Body:
is it possible to hack a usb modem to hack mobile internet. its a huawei k3520 model

If you need to hack a college/uni to get in, you should perhaps be thinking about vocational qualifications.

From: Akinsola
Subject: ADMINISTRATION HACKING TOOLS FOR INSTITUTION

Message Body:
Which tool can i use to hacking a website, to give me admission into their institution

This guy sounds reasonably articulate, which makes the fact he wants to completely rip off someone elses hard work even sadder. He included his whole home address, phone number, fax number and name.

From: Kip
Subject: Building a new website – copying from an existing website.

Message Body:
Building a new website – copying from an existing website.

I have a question: Is there a way to extract the username and password of a hosted website? Can someone copy a website on their computer, (without having the username and password). Then edit it and make it in a completely new website with their name and details, and changes. And then publish it with a new hosting.
The idea is to take the help and advantage of the built in coding.
I want to duplicate the formula of some successful money making websites. Please tell me if this is possible. Kindly help.

All .zip downloads with passwords have the passwords CLEARLY stated in the post. If you can’t read, you probably shouldn’t be trying to hack stuff.

From: Abdirizak
Subject: I need your help

Message Body:
Hello,

I am hereby want to help me your tools is restricted by password please tell me.

I want to learn in the detailo too.

From: Ronnie
Subject:

Message Body:
How can I learn Hacking in detailo???Please mail me…..

This one is just strange.

From: Semy Chan
Subject: ORDER

Message Body:
Dear sir

I’m very interest with your product. I’d like buy some of your product,

but before I order from you I want ask something:

– Do you accept credit card payment ?

– Could you dispatch to singapore ?

and i want buy :

-CTEK Multi XS 25000 Battery Chargers QTY: 15 Unit

Please calculate total cost my order including shipping cost via
fedex Express ,DHL or UPS EXPRESS ship to singapore, Looking forward
hearing from you soon.

Best regards

Man this satilight sure does sound like fun.

From: vijay
Subject: satilight hacking

Message Body:
i want satilight hacking software.and mobile hacking software.

Well Sue, thanks for letting me know.

From: Sue
Subject: Google Chrome

Message Body:
I had to uninstall it because my facebook got hacked through it and couldn’t make any security changes until I uninstalled it.

I would hazard a guess this has to do with our Elevator Hacking post, but I think he missed the point somewhat.

From: Fon Abumbi
Subject: Elevator Lift:

Message Body:
I am looking for a company that is capable of supplying large quantity of Passengers Elevator Lifts to the republic of Cameroon.

For sure, want me to come over and pre-digest your food for you as well?

From: youngkizzy
Subject: need full hacking tutorial sent to my mail.

Message Body:
pls i will like you to mail me full hacking tutorial in pdf format, pls i in haste to see your reply….Thanks

Well just because you asked and it will make you seriously LOL.

From: SlyTheGod
Subject: Retards?

Message Body:
Sorry to bother you, but I have been looking through your “retards” section and saw some questionable stuff. If you are so sure something is retarded, what is your example of a non-retarded question? If you don’t want us to ask you how to hack, then what do you want us to send you? Why do you even have a “contact us” section? Would it be “retarded” to ask how to sql inject into a site? If you put this as a retarded question I will seriously LOL.

I have the Contact Darknet page for people to send me news articles and tool information/updates not for nob-end skiddies to ask me how to sql inject into a site. Basically, don’t use the contact form to ask me any questions unless it’s something along the lines of “How much does it cost to advertise on your site?”.

I’m fine with questions along those lines. It actually states on the Contact Darknet page, exactly in explicit terms why it exists:

Drop us a line here if you have an interesting story or article to share, tool updates and announcements are most welcome – especially if you have something new you would like to share with our readers.

This selection was from January-October 2011, more here – Retards.


08 October 2014 | 1,969 views

IPFlood – Simple Firefox Add-on To Hide Your IP Address

IPFlood (previously IPFuck) is a Firefox add-on created to simulate the use of a proxy. It doesn’t actually change your IP address (obviously) and it doesn’t connect to a proxy either, it just changes the headers (that it can) so it appears to any web servers or software sniffing – that you are in fact using a proxy.

IPFlood (previously IPFuck) - Simple Firefox Add-on To Hide Your IP Address

This add-on is a “proof of concept” to show anyone who isn’t already aware that IP address has become obsolete and that no one should use an IP address as an evidence any more. This plug-in is just one of many ways to spoof an IP address and these spoofing could lead to outrageous accusation of innocents.

How does it work?

You can imagine that if I could just overwrite any existing information about your IP address I would have done so (or somebody else would have a while back ago)…

But it’s actually a little more tricky : when sending a request to a server you will provide several information about your IP address : three of them come from the Application Layer and the last one comes from the Transport Layer. This last one I can’t modify : you wouldn’t get the answer to your request if that was done. But the three others can be overwritten without any consequence to your browsing…

These three headers were created to provide information on the real IP of a person surfing through a proxy server. So when you enable IPFuck, the websites you are visiting will believe that your real IP is a proxy server and (if the website was done correctly) focus on the false IP you are sending…

A lot of websites try and figure out who is hiding behind a proxy server. And if you don’t believe me (I won’t mind), just check out this Google search request : get real ip address php. Most of the snipplets given here will check HTTP headers (the one we overwrite) before the Transport Layer information (‘REMOTE_ADDR’).

You can install IPFlood (previously IPFuck) for Firefox here:

ipflood-1.2.1-fx.xpi

Or read more here.


06 October 2014 | 1,035 views

JPMorgan Hacked & Leaked Over 83 Million Customer Records

So yah last week we all discovered, OMG JPMorgan Hacked! This set a lot of people on edge as JPMorgan Chase & Co is the largest US bank by assets – so it’s pretty seriously business. The breach happened back in July and was only disclosed last Thursday due to a filing to the US Securities and Exchange Commission.

JPMorgan Hacked

This is a HUGE breach (76 million households and 7 million small businesses), one of the biggest in history – especially when it comes to the banking sector. Fortunately no really ‘critical’ data was leaked such as credit card details or social security numbers, but there was important information like addresses and phone numbers which at this volume are definitely valuable on the black market.

The July cyberattack on JPMorgan Chase & Co. that compromised the names, addresses, phone numbers and contact information of over 83 million people are believed to have originated in Russia with at least some level of state approval.

“It could be in retaliation for the sanctions” placed on Russia, one senior official briefed on the intelligence told The New York Times on Saturday. “But it could be mixed motives — to steal if they can, or to sell whatever information they could glean.”

JPMorgan Chase has worked with the Treasury, the Secret Service and intelligence agencies since the attack, which did not completely shut out the attackers until August, the paper reported. More than 90 servers were accessed and over 7 million small businesses were compromised.

There’s a lot of speculation that the hackers that pulled of this rather sophisitacted attack are Russian and somehow linked to Putin (although I’m not sure how they figured that out). The news also broke today that it was not only JPMorgan Chase & Co that was infiltrated – but they were just 1 of 9 financial institutions breached as part of this attack.

This includes banks and brokerages, more here: JPMorgan CYBER-HEIST: 9 US financial firms snared by ‘Russian hackers’, says report

“It was a huge surprise that they were able to compromise a huge bank like JPMorgan,” said Al Pascual, a security analyst with Javelin Strategy and Research, told the Times. “It scared the pants off many people.”

Experts fears that similar attacks in the future could ignite a financial crisis. JPMorgan Chase may be particularly vulnerable: The Times noted that the hackers were able to steal “a list of every application and program deployed on standard JPMorgan computers that hackers can crosscheck with known, or new, vulnerabilities in each system in a search for a backdoor entry.”

JPMorgan Chase has responded to the hacking by disabling compromised accounts and resetting passwords for its employees. The company also notified customers that they would not need to change their passwords or account information, nor would they be held liable for unauthorized transactions, The Associated Press reported Thursday.

It’s interesting that the hackers didn’t seem to go after the money, they really just wanted as much data as possible on JPMorgan customers.

It’ll be interesting to see if any of the other currently unnamed financial institutions are released to the press or if any of them suffered monetary losses – or they were all similar data grab scenarios.

Source: The Washington Times


03 October 2014 | 2,494 views

iSniff-GPS – Passive Wifi Sniffing Tool With Location Data

iSniff GPS is a passive wifi sniffing tool which sniffs for SSID probes, ARPs and MDNS (Bonjour) packets broadcast by nearby iPhones, iPads and other wireless devices. The aim is to collect data which can be used to identify each device and determine previous geographical locations, based solely on information each device discloses about previously joined WiFi networks.

iSniff-GPS - Passive Wifi Sniffing Tool

iOS devices transmit ARPs which sometimes contain MAC addresses (BSSIDs) of previously joined WiFi networks, as described in here: Anatomy of a leak: how iPhones spill the ID of networks they access. iSniff GPS captures these ARPs and submits MAC addresses to Apple’s WiFi location service (masquerading as an iOS device) to obtain GPS coordinates for a given BSSID. If only SSID probes have been captured for a particular device, iSniff GPS can query network names on wigle.net and visualise possible locations.

By geo-locating multiple SSIDs and WiFi router MAC addresses, it is possible to determine where a device (and by implication its owner) is likely to have been.

Components

iSniff GPS contains 2 major components and further python modules:

  • iSniff_import.py uses Scapy to extract data from a live capture or pcap file and inserts it into a database (iSniff_GPS.sqlite3 by default).
  • A Django web application provides a browser-based interface to view and analyse the data collected. This includes views of all detected devices and the SSIDs / BSSIDs each has probed for, a view by network, Google Maps views for visualising possible locations of a given BSSID or SSID, and a pie chart view showing a breakdown of the most popular device manufacturers based on client MAC address Ethernet OUIs.
  • wloc.py provides a QueryBSSID() function which looks up a given BSSID (AP MAC address) on Apple’s WiFi location service. It will return the coordinates of the MAC queried for and usually an additional 400 nearby BSSIDs and their coordinates.
  • wigle.py provides a getLocation() function for querying a given SSID on the wigle.net database and returns GPS coordinates. It must be configured with a valid wigle.net auth cookie. Please respect the wigle.net ToS in using this module.

You can download iSniff-GPS here:

master.zip

Or read more here.


02 October 2014 | 2,590 views

OpenVPN Vulnerable To Shellshock Exploit

So last week the big news was about the cross platform exploit in BASH that we covered in our article – Everything You NEED To Know About Shellshock Bug In BASH.

As mentioned in the comments, a certain combination of circumstances and configuration options can leave OpenVPN vulnerable to Shellshock.

OpenVPN Vulnerable To Shellshock Exploit

This could be a pretty serious issue as I’m sure there are thousands of OpenVPN servers sitting around fairly idle, that are unlikely to be updated and around about to get pwned. If the OpenVPN is using system level pre-auth with the auth-user-pass-verify option – they will be in trouble.

The Shellshock Bash bug, the gift that just keeps on taking, could also sting OpenVPN users, according to researcher Fredrick Stromberg. Pre-authentication vectors affect communication through the popular and formerly secure VPN platform, he says.

Shellshock affected the crucial and ubiquitous *nix component Bash up to and including version 4.3. Mullvad chief technology officer Stromberg described the flaw in a forum post overnight, adding that he disclosed the vulnerability to OpenVPN sometime last week.

“OpenVPN servers are vulnerable to Shellshock under certain configurations,” Stromberg said. “OpenVPN has a number of configuration options that can call custom commands during different stages of the tunnel session. Many of these commands are called with environmental variables set, some of which can be controlled by the client.

“One option used for username+password authentication is auth-user-pass-verify. If the called script uses a vulnerable shell, the client simply delivers the exploit and payload by setting the username. This attack vector is pre-auth.”

There’s a whole list of Shellshock PoCs here on Github including the one for OpenVPN – Shellshocker PoCs. The exploit walkthrough is available here, including the OpenVPN config and log output – OpenVPN ShellShock PoC.

I’m honestly not sure how much impact this will actually have in the wild as to know that we’d have to know how common it is for OpenVPN systems to auth in this manner.

A proof of concept for the exploit has surfaced online. Those using OpenVPN can dodge Shellshock by preventing Bash from running scripts. OpenVPN’s Gert Doering told Threat Post OpenVPN was vulnerable only on systems where /bin/sh points to /bin/bash, or when scripts running bash as an interpreter were called explicitly.

“What you want to do from OpenVPN’s point of view is to ensure that you’re not using a 2.2.x version anymore, and that you just do not run your scripts using bash (#!/bin/bash) but use a shell that is better suited to script usage, like ash/dash,” Doering told the publication. “Also, always use client certificates, as the username verification script that is the attack vector here is only called after successful verification of a client cert.”

Vendors have released solid and borked patches for the Shellshock bug over the last week since the flaw was revealed. The patching prompted Blighty’s privacy watchdog to urge organisations patch their Bash instances

Apple has issued a patch for the smaller subset of affected users, while F5 has moved to stop holes in its line of BIG-IP products including the ARX, Enterprise Manager and BIG-IQ systems, but not FirePass or LineRate proxy systems. Stromberg in April identified the susceptibility of OpenVPN to the HeartBleed vulnerability.

The OpenVPN systems will only be vulnerable if /bin/sh points to /bin/bash and if they don’t use an alternative (more suitable) shell like ash/dash (which is the default shell in Debian systems).

There are also other vectors being exposed like QNAP NAS devices (which was one of my worries), anything Linux based with BASH that is unlikely to get updated is at fairly high risk:

Shellshock Attacks Hit Major NAS Kit; IoT Next?

Shellshock – the bug that just keeps on giving.

Source: The Register