Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

27 August 2006 | 15,664 views

Sophos Offers Free Rootkit Detection Tool/Software

Cybertroopers storming your ship?

Ah, here at Darknet we have always been a fan of Sophos and the way they operate, a very efficient company and good to see good technical products still coming out of the UK!

Another good move by them, they have decided to offer a free rootkit detection tool called Sophos Anti-Rootkit..Yah I know, not a very imaginative name eh?

Called Sophos Anti-Rootkit, the software will detect and remove both known and unknown rootkits, and it will warn systems administrators if removing the software might harm operating system integrity.

Rootkits are a collection of tools used by hackers to gain administrative privileges on compromised machines. They are typically used to help hide other forms of malware — keyloggers or Trojan horse programs, for example — from antivirus software.

Rootkits got a LOT of press after the whole Sony rootkit fiasco, so it’s good to see a decent free tool being offered to the general public.

Sophos Anti-Rootkit works with the Windows NT, 2000, XP and Windows Server 2003 operating systems. The software features a graphical interface to help guide users through the process of detecting and removing the malicious software.

Since the Sony fiasco, the security industry has paid more attention to the rootkit problem, and there are now a number of free utilities designed to identify this type of software. Other tools include RootkitRevealer, GMER and IceSword.

We shall try out as soon as possible, after all we’ve had chkrootkit on *nix forever…about time someone did something similar for Windows.

You can download Sophos Anti-Rootkit here.

Source: ComputerWorld

Advertisements



25 August 2006 | 122,202 views

Anonymous Connections Over the Internet – Using Socks Chains Proxy Proxies

Introduction

This tutorial is an attempt to help you re-route all internet winsock applications in ms windows trough a socks chain, thus making your connections much more anonymous.

Theory

The more different hops you make your data jump, the more difficult it will be to trace it back. take this route for example:

you –> socks1 –> socks2 –> socks3 –> … –> socksx –> target

People who want to trace you will have to contact x persons to ask their them for their logs. chances are one of them didn’t log… and if they logged, the ip seen by each host/socks is the ip of the previous host/socks in the chain.

This works for:

  • icq-like tools
  • ftp clients
  • mail clients
  • telnet clients
  • portscanners
  • (just about anything that uses the internet)

It doesn’t work on most irc servers since they often check for open wingates
and proxies.

Now let’s do it

1) First you need to find some boxes running wingate, we look for wingates since the default installation of wingate includes a non-logging socks server on port 1080

Visit http://www.samair.ru/proxy/socks.htm or http://www.proxyleecher.com/socks.php for some wide-known wingate ips, or even better: you could try to find some yourself.

To do this, i would suggest you use ‘proxy hunter’, available for download at http://www.proxys4all.com/tools.shtml be sure to look for wingates (port 23) and not for socks, as we only want wingate socks.

You could also use wingatescan, available for download at http://packetstormsecurity.org/wingate-scanner/

Speed is very important since we will be using multiple socks, and we don’t want our programs to time out. with the klever dipstick tool, you can find out which are the fastest ones. (get the klever dipstick program at http://klever.net/kin/static/dipstick.exe)

Just fire off Dipstick. Rightclick in the small green rectangular and choose Show main window. To import a list of wingates, just click on Advanced, choose Import List and select your file.

You can also manually ping a simple host by clicking on Manual Ping. Use those wingates with the smallest average time. *duh*

2) Second, check if the wingates from the list are actually running :)

There are a lot of programs that can help you with this.

3) Third, install a program that will intercept all outgoing networking calls.

I use the great tool sockscap for this purpose. you can get it at http://www.socks.permeo.com/Download/SocksCapDownload/index.asp

In the setting, enter this as socks server : 127.0.0.1 port 8000. Click on ‘socks version 5’. click ‘resolve all names remotely’. Uncheck ‘supported authentication’.

In the main window, choose new and then browse to create a shortcut for the internet client you want to give socks support.

Repeat this step for every program you want.

4) Install SocksChain

Download it at http://www.ufasoft.com/socks

In the service menu, click on new. enter ‘Chain’ as name and ‘8000’ as port to accept connections on.

Click on new and fill in the ips of the fastest wingates you found, but this time, use port 1080 for this (and not the port 23)

Using the ‘<' and '>‘, you can add and remove socks. be sure to test all socks one by one before adding them all to the list in once, because if one of them is bad, you chain will not work and you will not be able to locate the bad socks in the chain.

If all of them seem to work, you use the ‘<' key to add them all (mind speed problems. 4 or less is fine. i think 10 or 13 is the limit put by tcp/ip) Testing your anonymous setup

To check what socks your computer is connecting to, you can use x-ploiters totostat (http://tucows.mundofree.com/preview/7534.html). look for connections to port 1080, the remote ip found there should be the first ip found in your chain in sockschain.

use the shortcut in sockscap that points to your browser, and connect to http://cavency.virtualave.net/cgi-bin/env.cgi or
http://www.junkbuster.com/cgi-bin/show_http_headers

Use your shortcut in sockcap to start your telnet client then telnet to ukanaix.cc.ukans.edu

In all the above cases, the remote server should show you the ip of the last server in the sockschain. if you look at the sockschain program while surfing you should see the chain being built up.

Some final remarks

Never use internet explorer to do tricky stuff as it might reveal your ip. my personal favorite browser is opera 4.0 (http://www.opera.com/), Darknet recommends Firefox.


To avoid info being sent out, we could install another proxy between the sockscap and the sockschainer proxy that would filter out those things. A4proxy is an example of a proxy capable of doing such things or Proximitron which Darknet uses.

Remember, if you want to do the real stuff, better switch to Linux like Ubuntu.

Written by Zoa_chien – EFNet – Updated with current info, lists and URL’s by Darknet.

Digg This Article


23 August 2006 | 4,682 views

libtiff Vulnerability gives hope for a new GTA-less PSP exploit

QJ.net forums have been abuzz lately with the talk of a possible new exploit centered around a libtiff vulnerability. NOPx86 stating that he’d managed to crash the PSP using this method. As those of you who follow these things know, a crash doesn’t always mean an open door to an exploit.

But after a cumulative 60 hours of work and research put in by Skylark and psp250 (with a little help from Fanjita), they can confirm that NOPx86’s method is indeed valid and opens the door for a new exploit. They have confirmed that it will work on 2.0 and 2.01 PSP’s, and could potentially work on firmware as high as 2.80 – although at this moment, this is unconfirmed.

But even if this only works on lower firmwares, it will usher in the age of GTA-less homebrew for 2.01+ PSP’s, which will be a welcome change for homebrew enthusiasts.

Work and research on applying this exploit into a publicly usable form will take some time, and it will take even more time to put this to use on PSP’s with higher firmware, but there definitely are possibilities. As always, we’ll keep you up to date on this developing story as soon as more information becomes available.


17 August 2006 | 4,870 views

Bot Herders Go After MS06-40 Exploit

Malware herders are speeding up, the first wave is already here for MS06-40.

It’s basically a variant of some old malware suited to the new vulnerability. Same old story then, same packer, technique, new exploit.

Same as the days of autorooters.

It’s basically the Mocbot trojan that was used in the Zotob worm attack in August 2005.

The first wave of malicious attacks against the MS06-040 vulnerability is underway, using malware that hijacks unpatched Windows machines for use in IRC-controlled botnets.

The attacks, which started late Aug. 12, use a variant of a backdoor Trojan that installs itself on a system, modifies security settings, connects to a remote IRC (Internet Relay Chat) server and starts listening for commands from a remote hacker, according to early warnings from anti-virus vendors.

I hope the AV first are on top of things, people are patching their machines in a timely fashion (especially in corporate environments – come on people, get SUS!) and awareness is going up.

“Amazingly, this new variant of Mocbot still uses the same IRC server hostnames as a command-and-control mechanism after all these months. This may be partially due to the low-profile it has held, but also may be due to the fact that the hostnames and IP addresses associated with the command-and-control servers are almost all located in China,” LURHQ said in an advisory.

Historically, Chinese ISPs and government entities have been less than cooperative in taking action against malware hosted and controlled from within their networks, the company said.

On Aug. 13, a second variant of the Trojan was detected, confirming fears that botnet herders are already playing cat-and-mouse with anti-virus vendors.

Quite surprising in a way, but also not really as it’s China and they are notoriously un co-operative.

Source: Eweek


14 August 2006 | 4,217 views

OpenOffice.org Security ‘Insufficient’

It seems people are turning some attention towards the security of Open Office finally, I for one say this is a good thing as it means it’s making inroads, it’s becoming popular, it’s getting to be a contender.

If people are seriously considering the security implications of using Open Office it means they are actually really interested in using it.

With Microsoft Corp.’s Office suite now being targeted by hackers, researchers at the French Ministry of Defense say users of the OpenOffice.org software may be at even greater risk from computer viruses.

“The general security of OpenOffice is insufficient,” the researchers wrote in a paper entitled “In-depth analysis of the viral threats with OpenOffice.org documents.”

“This suite is up to now still vulnerable to many potential malware attacks,” they wrote.

The paper describes four proof-of-concept viruses that illustrate how maliciously encoded macros and templates could be created to compromise systems running the open-source software. “The viral hazard attached to OpenOffice.org is at least as high as that for the Microsoft Office suite, and even higher when considering some … aspects,” they wrote.

This is an interesting paper, I’m glad someone did take a rather more in-depth look at the flaws in the Open Office suite.

At least they patch the flaws almost instantly.

A number of the problems described in the report have to do with the basic design of the software. For example, OpenOffice.org does not perform adequate security checks on the software it runs, the researcher said. And because of the extreme flexibility of the free office suite, there are many ways for writers to create malicious macros, the researchers found.

The OpenOffice.org team has already fixed a software bug discovered by the French researchers, and the two groups are in discussions about how to improve the overall security of the software, said Louis Suarez-Potts, an OpenOffice.org community manager.

“The one real flaw in the programming logic has been fixed,” Suarez-Potts said. “The others are theoretical.”

I’d be interested to see some more focus on OpenOffice.Org and it’s security architecture, and of course following this to see all the flaws fixed to make it a strong contender.

Source: InfoWorld


13 August 2006 | 4,398 views

Microsoft Takes an Effort at Cutting Down Blogspam – Splogs

Splogs are becoming a huge problem, half the stuff you search for nowadays returns a splog, mostly auto syndicated content.

I find a lot of my own entries on there, surrounded by Adsense ads.

New age scrapers I guess.

Technorati returns a lot of results from splogs too, but at least they have made some efforts to clean that up and Google and being making sign-ups for blogspot much stricter so people are having to resort to their own domains, like the scrapers.

Microsoft today released new research on the epidemic of spam blogs — or “splogs” — as well as the “comment spam” that dodgy marketers splatter all over blogs in a bid to improve their sites’ search-engine rankings. Redmond’s research team found that splogs hosted on Google’s Blogspot.com appear to be widely spammed and fairly effective at jacking up the search results for the spammers’ Web sites.

Comment spam is also getting pretty bad, I can get a couple of hundred a day on some sites.

I’m glad they are making some kind of effort to sort it out.

Yi-Min Wang, manager of Microsoft’s cybersecurity and systems management research group, told me that the goal of Search Defender is to help the software giant automate the filtering of splogs and comment spam links in search results returned on MSN.com.

“We now have a method to identify spammers so that before they get indexed into search results, we can block them,” Wang said. “When this is fully automated, the spammers will need to spend a lot more effort trying to get into our search results.”

We ourselves as writers also have to take measures to curb the comment spam, I use Akismet and find it extremely effective!

But that’s just a start: Sitepoint has some excellent tips on fighting comment spam. Also, most of the major blogging sites now include pointers on how to use antispam features. Blogger.com lets users require commenters to follow a verification process — essentially a captcha — to help weed out automated processes. WordPress has its own tips here, or users can outsource their blogspam patrol (well, sort of) with Akismet, a free (for personal use) tool that compares any link, trackback or comment left on your WordPress blog to a service “which runs hundreds of tests on the comment and returns a thumbs up or thumbs down.” SixApart, which runs TypePad and LiveJournal, also lists a number of tips for users fed up with blogspam.

At least everyone is aware of it now, we just need to get back to fighting it.

Source: Washington Post


12 August 2006 | 9,179 views

TCPReplay suite 3.0.beta10. Released

Another good tool updated! TCPReplay suite 3.0.beta10 has been released.

For those that don’t know Tcpreplay is a suite of BSD licensed tools written by Aaron Turner for *NIX operating systems which gives you the ability to use previously captured traffic in libpcap format to test a variety of network devices. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 headers and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS’s. Tcpreplay supports both single and dual NIC modes for testing both sniffing and inline devices.

Tcpreplay is used by numerous firewall, IDS, IPS and other networking vendors, enterprises, universities, labs and open source projects.

Beta10 contains a number of major enhancements as the code continues to stabilize for the 3.0 stable release. The big changes include removing Libnet as a requirement, tcpprep and tcprewrite no longer requiring root access and improved packet timings for tcpreplay. There are also a number of smaller enhancements and bug fixes.

Also a lot of time has been spent updating the online manual on the wiki which covers most if not all the features of tcpreplay, tcpprep and tcprewrite.

This should be the final beta release and it’s expected to have the first release candidate in a month or so. Please download and test!

You can download it here:

TCPReplay

The new Wikified manual is here.

Download: http://prdownloads.sourceforge.net/tcpreplay/tcpreplay-3.0.beta10.tar.gz?download


10 August 2006 | 4,561 views

OWASP – Fortify Bug Taxonomy

Ah at last a good solid collaborative effort to identify and categorise software vulnerabilities with a solid taxonomy and good organisation!

It seems very well written too in terms that anyone familiar with software development or programming can understand.

Fortify Software, which identifies and remediates software vulnerabilities, has contributed its collection of 115 types of software security errors to the Open Web Application Security Project (OWASP), a six-year old non-profit with almost 5,000 members whose “mission is to find and fight the causes of insecure software.”

The work will become part of OWASP’s Honeycomb Project.

This is a very good thing.

The OWASP Honeycomb project.

In the Honeycomb project, OWASP is assembling the most comprehensive and integrated guide ever attempted to the fundamental building blocks of application security (principles, threats, attacks, vulnerabilities, and countermeasures) through collaborative community efforts.

You can find the taxonomy itself here:

The Fortify Taxonomy of Software Security Errors

This site presents a taxonomy of software security errors developed by the Fortify Software Security Research Group together with Dr. Gary McGraw. Each vulnerability category is accompanied by a detailed description of the issue with references to original sources, and code excerpts, where applicable, to better illustrate the problem.

Source: Zdnet Blog


08 August 2006 | 5,079 views

Cyberwar Efforts Step-Up – NASA Sites Hacked

Ah cyberwar, cyber terrorism, efforts are ramping up, more sites are going down.

The war in Lebanon is now showing its consequences in the digital world and a huge number of websites has been attacked and defaced as a protest against the invasion of Lebanon by Israel.

Today two NASA websites were attacked as well. The intrusion was carried out by the Chilean group of crackers known as Byond Hackers Crew through a leak in the SQL Injection they entered the system and subtracted user names, passwords and e-mails from the NASA web server.

Seems like a pretty straight forward attack..but a high profile government site being prone to SQL injection that allow admin escalation?

That’s pretty bad..

After that these information had been stolen, they managed in entering the administrative area by using an administrator user ID and password , and finally they made the defacement replacing the homepage with their message.

This group goes with the others that in last days carried out attacks against governmental and commercial websites both from America and Israel, whereas other blackhat groups attacked Israeli websites provoking a denial of service (DDoS) of that particular webpage.

Let’s hope things don’t boil over to attacking powerstations or anything that will cause collateral damage.

Source: Zone-H


07 August 2006 | 11,857 views

Wapiti – Web Application Scanner / Black-box testing

Wapiti allows you to audit the security of your web applications.

It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data.

Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Wapiti can detect the following vulnerabilities :

  • File Handling Errors (Local and remote include/require, fopen, readfile…)
  • Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
  • XSS (Cross Site Scripting) Injection
  • LDAP Injection
  • Command Execution detection (eval(), system(), passtru()…)
  • CRLF Injection (HTTP Response Splitting, session fixation…)

Wapiti is able to differentiate ponctual and permanent XSS vulnerabilities. Wapiti prints a warning everytime it founds a script allowing HTTP uploads. A warning is also issued when a HTTP 500 code is returned (useful for ASP/IIS). Wapiti does not rely on a vulnerability database like Nikto do. Wapiti aims to discover unknown vulnerabilities in web applications. It does not provide a GUI for the moment and you must use it from a terminal.

Efficiency

Wapiti is developed in Python and use a Python library I made called lswww. This web spider library does the most of the work.
Unfortunately, the html parsers module within Python only works with well formated html pages so lswww fails to extract informations from bad-coded webpages.

You can read more here:

Wapiti