Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

16 December 2014 | 1,966 views

BlueMaho Project – Bluetooth Security Testing Suite

Check For Vulnerabilities with Acunetix

BlueMaho is GUI-shell (interface) for a suite of tools best used for Bluetooth security testing. It is freeware, opensource, written on python, uses wxPython. It can be used for testing BT-devices for known vulnerabilities and major thing to do – testing to find unknown vulns. Also it can form nice statistics.

I did get interested in Bluetooth for a while and the security implications of a personal area network protocol which includes discovery/broadcast etc. I ended up only posting one article at the time though which was about Haraldscan – BlueTooth Discovery Scanner.

BlueMaho Project - Bluetooth Security Testing Suite

I have a bunch more Bluetooth related resources to share though, so I’ll be putting them out from time to time. Some (like this) aren’t particularly up to date, but give you a great base to start with and play around.

Features

  • Scan for devices, show advanced info, SDP records, vendor etc
  • Track devices – show where and how much times device was seen, its name changes
  • Loop scan – it can scan all time, showing you online devices
  • Alerts with sound if new device found
  • on_new_device – you can spacify what command should it run when it founds new device
  • It can use separate dongles – one for scaning (loop scan) and one for running tools or exploits
  • Send files
  • Change name, class, mode, BD_ADDR of local HCI devices
  • Save results in database
  • Form nice statistics (uniq devices by day/hour, vendors, services etc)
  • Test remote device for known vulnerabilities (see exploits for more details)
  • Test remote device for unknown vulnerabilities (see tools for more details)
  • Themes! you can customize it

Requirements

The main requirements are:

  • OS (tested with Debian 4.0 Etch / 2.6.18)
  • Python 2.4
  • wxPython
  • BlueZ

You can download BlueMaho here:

bluemaho_v090417.tgz

Or read more here.

Advertisements



13 December 2014 | 3,667 views

Oryon C Portable – Open Source Intelligence (OSINT) Framework

Oryon C Portable is a web browser designed to assist researchers in conducting Open Source Intelligence investigations. Oryon comes with dozens of pre-installed tools and a select set of links catalogued by category – including those that can be found in the OI Shared Resources.

Oryon C Portable - Open Source Intelligence Framework

  • Based on SRWare Iron version 31.0.1700.0 (Chromium)
  • More than 70 pre-installed tools to support investigators in their everyday work
  • More than 600 links to specialized sources of information and online investigative tools
  • Additional privacy protection features
  • A ready to use opml file containing a sorted collection of information sources in the fields such as: OSINT, Intelligence, online research, InfoSec, defense, and more.

You can download Oryon C Portable here:

Oryon C Portable.exe

Or read more here.


11 December 2014 | 1,406 views

Sony Digital Certs Being Used To Sign Malware

So at the end of November, Sony got owned, owned REAL bad – we wrote about it here: Sony Pictures Hacked – Employee Details & Movies Leaked. It seems in as a part of the massive haul of documents, the digital certificates used to sign software were also stolen.

Which is bad, as you can imagine. Not SSL certs, but software crypto-certs that verify the executable comes from a trustworthy source (in this case Sony).

Sony Digital Certs Being Used To Sign Malware

It’s something of a malware-ception too, as the software that is thought to have been used in the Sony Pictures compromise is the very software being signed with the Sony cert to boost it’s effectiveness.

Miscreants were quick to capitalize on the theft of Sony’s cryptographic certificates – used to sign software to make it look legit.

An analysis of malware dubbed Destover was published by Kaspersky Lab on Tuesday, and shows the code was signed using a private certificate belonging to Sony to evade malware filters.

These certificate were apparently taken from Sony Pictures servers, which were comprehensively ransacked by hackers at the end of November, and leaked online.

It’s believed the infiltrators used a version of Destover to attack Sony’s network. And it appears the stolen digital certs were used to sign another build of Destover on Friday, which then ended up in the wild over the weekend.

When Windows examines an executable, it looks to see if the program has been signed by a recognized, trusted developer before running the code. As far as the operating system was concerned, the signed Destover was legit.

It’s a pretty nifty trick, but it wouldn’t work for long (the beauty of cert schemes) is that the issuer can also revoke the cert. Which apparently, in this case, happened pretty fast. So if you try and run the Sony signed malware on Windows now – it should reject it.

I’m not exactly sure the message Windows gives and if it’s any different between a revoked cert and and running something with no cert.

“The stolen Sony certificates (which were also leaked by the attackers) can be used to sign other malicious samples,” Kaspersky warned on Tuesday.

“In turn, these can be further used in other attacks. Because the Sony digital certificates are trusted by security solutions, this makes attacks more effective. We’ve seen attackers leverage trusted certificates in the past, as a means of bypassing whitelisting software and default-deny policies.”

Sounds pretty scary, right? But before anyone panics, it’s worth pointing out that malware writers can no longer use the code-signing keys.

The certificates were issued by DigiCert, a US biz that sells security certs. Kaspersky said it warned DigiCert about the issue, so El Reg checked with the crypto-company to find out what the situation was.

“This certificate is already revoked,” a spokeswoman for DigiCert told The Register on Tuesday, meaning Windows systems should reject the Destover build when its cryptographic signature is checked by the operating system.

“We received a report about the malware last week and immediately revoked the certificate,” she added.

I imagine they managed to get the malware deeper into a few places with the signed version, maybe only for a day or two – but a crack team of people with bad intentions could really capitalise on that.

There’s some good info about certs and certificate revokation here: DIGGING INTO CERTIFICATE REVOCATION LISTS

I honestly don’t think this will have caused a massive amount of damage, but it sure is interesting reading. We’ll have to see if any more news about this crops up.

Source: The Register


09 December 2014 | 2,452 views

InsomniaShell – ASP.NET Reverse Shell Or Bind Shell

InsomniaShell is a tool for use during penetration tests, when you have ability to upload or create an arbitrary .aspx page. This .aspx page is an example of using native calls through pinvoke to provide either an ASP.NET reverse shell or a bind shell.

ASP.NET is an open source server-side Web application framework designed for Web development to produce dynamic Web pages. It was developed by Microsoft to allow programmers to build dynamic web sites, web applications and web services.

It was first released in January 2002 with version 1.0 of the .NET Framework, and is the successor to Microsoft’s Active Server Pages (ASP) technology. ASP.NET is built on the Common Language Runtime (CLR), allowing programmers to write ASP.NET code using any supported .NET language.

InsomniaShell - ASP Reverse Shell Or Bind Shell

A bind shell is basically binding the command prompt to a listening port on the compromised machine, a reverse shell is sending a command prompt to a listening port on the attackers machine (used when the hacked server doesn’t have a public IP).

InsomniaShell has the added advantage of searching through all accessible processes looking for a SYSTEM or Administrator token to use for impersonation.

If the provider page is running on a server with a local SQL Server instance, the shell includes functionality for a named pipe impersonation attack. This requires knowledge of the sa password, and results in the theft of the token that the SQL server is executing under.

You can download InsomniaShell here:

InsomniaShell.zip


06 December 2014 | 2,236 views

WhatWeb – Identify CMS, Blogging Platform, Stats Packages & More

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1500 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

WhatWeb - Identify CMS, Blogging Platform, Stats Packages & More

WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called ‘stealthy’, is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests.

Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. meta name="generator" content="WordPress 2.6.5", but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for “/wp-content/” within relative links.

We wrote about WhatWeb way back in 2010, and there actually hasn’t been a release since 2011 (v0.4.7). I was glad to find however it still is under active development and there is work being done on what is going to become 0.4.8 at some point, it has many changes (as listed below) but hasn’t yet been released.

But due to the wonders of technology, you can grab the unreleased development version from Github now (link also below).

Features

  • Over 1500 plugins
  • Control the trade off between speed/stealth and reliability
  • Performance tuning. Control how many websites to scan concurrently.
  • Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.
  • Proxy support including TOR
  • Custom HTTP headers
  • Basic HTTP authentication
  • Control over webpage redirection
  • Nmap-style IP ranges
  • Fuzzy matching
  • Result certainty awareness
  • Custom plugins defined on the command line

Sample Output

Changes in 0.4.8-dev

  • Added over 700 new plugins
  • Added aggressive version detection using md5 static file matches to several plugins
  • Added support for raw HTTP headers when scanning local files
  • Added –dorks to return google dorks for the selected plugin
  • Added google dorks to more than 500 plugins
  • Added ./addons/hunter
  • Added ./addons/gggooglescan
  • Added ./addons/country-scanner
  • Added SQL logging with --log-sql and --log-sql-create arguments.
  • Added raw header support by monkey patching the net/http library
  • Added context searching for plugin matches[].
  • Added the matches keyword, :search.
  • Added methods for aggressive plugins to send HEAD and POST requests
  • Added –grep, -g option to be easier than –custom-plugin.

You can download the latest ‘stable’ dev version (if such a thing exists) here:

master.zip

Or read more here.


04 December 2014 | 4,522 views

Sony Pictures Hacked – Employee Details & Movies Leaked

Sony hasn’t always had the best of times when it comes to being hacked, back in 2011 Sony basically had to rebuild the PlayStation Network (PSN) because of a hack which rendered the service off-line for almost a whole week.

Plus the fact the PSN hack could have leaked up to 10 million user accounts which included credit card details. And again in 2011 they lost 25 Million Customer Account Details Through SOE (Sony Online Entertainment).

Sony Pictures Hacked - Employee Details Leaked

The hack was so bad, it basically shut down Sony Pictures – the above picture is a photo of a desktop in the Sony Pictures office and apparently all computers were showing this. Similar images came from various sources in different offices showing that this is indeed a seriously pervasive attack.

If you downloaded the archive from the URLs in the pictures, it contains text files which are basically HUGE lists of filenames, files that have leaked from Sony servers. And there’s some serious stuff in there including Hollywood stars passport scans, ppk files (SSH private keys), password lists and much much more.

There’s some discussion on the contents and analyse on Reddit here: I used to work for Sony Pictures.

The password lists/SSH keys also led to the compromise of many more related services and accounts (many film related Twitter accounts were hacked).

Sony Pictures is investigating a breach that has seen hackers supposedly steal reams of internal data and splash defacements across staff computers. The company is now in lock-down as it wrestles with the problem.

The beleaguered company, writes Variety, has requested staff disconnect their computers and personal devices from the Sony network and shut down virtual private networks.

Cracking group Guardians of Peace claimed responsibility for a defacement appearing on staff machines that it stole internal corporate data. The group says it will leak more details to the public web depending on what Sony ‘decided’ in what appeared to be a reference to demands quietly sent to the company earlier.

Source: The Register

Sony Pictures e-mail servers were still totally off-line the day after the attack and they made a statement saying it could take between 1-3 weeks to rectify the matter.

It seems like the attackers are really leaking the files they stole too as details of Sony employees were leaked including personal details and salaries.

It’s getting worse for Sony: the latest dump from the raid that’s brought the company to an IT standstill include the personal detas of staff.

Documents leaked through BitTorrent show the names, home addresses, salaries (and bonuses), and social security numbers of thousands of staff, including executives.

Sony Pictures Entertainment could not be reached for comment by the time of writing.

Some 17 executives, from programming to advertising, were listed as having salaries over US$1 million. Severance pays also appeared to be listed.

Source: The Register

It’s 8 days since the attack and Sony Pictures is still struggling to recover, it also seems like some unreleased movies might (including Annie) have been leaked during the compromise.

Sony, the studio behind “The Amazing Spider-Man” films and the “Breaking Bad” television series, restarted many of its computer systems on Monday after a Nov. 24 breach by a group calling itself #GOP, for Guardians of Peace. Executives at the entertainment company said they were also making progress in fighting the apparently related Internet pirating of five complete films, including the unreleased “Annie.”

Source: New York Times

The virus was pretty nasty and wiped all the machines + removed the master boot record rendering most of Sony’s Microsoft based desktops useless. There are some suspicions North Korea could be involved due to the malware used.

Back in August Sony was under attack by a massive DDoS attack aimed at PSN, and then just as they recovered – this.

The latest details to pop-up are that the leaked data dump is being seeded by a bunch of Amazon EC2 servers that host Sony PlayStation websites..which is odd, as the Sony Pictures network and the Sony PlayStation network should be totally separate.

Sony PlayStation website servers were used to distribute a 27.78GB archive potentially containing sensitive data swiped from Sony Pictures computers, it’s claimed.

Until early on Tuesday afternoon, San Francisco time, more than 60 systems seeding the archive on the BitTorrent network appeared to be virtual servers in the Amazon EC2 cloud, according to security researcher Dan Tentler.

A number of those fingered server instances – eg, 54.77.62.39 – are also serving websites for Sony Computer Entertainment. The EC2 instances serving up the data were checked by another researcher, who found some had SSL certificates signed by Sony.

Source: The Register

This is quite possibly the worst hack of a major US company ever perpetrated, especially in terms of business disruption and data loss – the financial implications of this could be HUGE. Especially for their biggest Christmas movie Annie.

I’m sure we’re going to see more data dumps dropping in the next week or so, it’s certainly an interesting case and it’s definitely not over yet.


02 December 2014 | 2,698 views

Gruyere – Learn Web Application Exploits & Defenses

This codelab is built around Gruyere – a small, cheesy web application that allows its users to publish snippets of text and store assorted files. “Unfortunately,” Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The goal of this codelab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general, it’s a great way to learn web application exploits & defenses.

Gruyere - Learn Web Application Exploits & Defenses

The codelab is organized by types of vulnerabilities. In each section, you’ll find a brief description of a vulnerability and a task to find an instance of that vulnerability in Gruyere. Your job is to play the role of a malicious hacker and find and exploit the security bugs. In this codelab, you’ll use both black-box hacking and white-box hacking. In black box hacking, you try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior. You do not have access to the source code, although understanding how to view source and being able to view http headers (as you can in Chrome or LiveHTTPHeaders for Firefox) is valuable.

Using a web proxy like Burp or WebScarab may be helpful in creating or modifying requests. In white-box hacking, you have access to the source code and can use automated or manual analysis to identify bugs. You can treat Gruyere as if it’s open source: you can read through the source code to try to find bugs.

Gruyere is written in Python, so some familiarity with Python can be helpful. However, the security vulnerabilities covered are not Python-specific and you can do most of the lab without even looking at the code. You can run a local instance of Gruyere to assist in your hacking: for example, you can create an administrator account on your local instance to learn how administrative features work and then apply that knowledge to the instance you want to hack. Security researchers use both hacking techniques, often in combination, in real life.

If you want to find more similar apps, you can do so here: Vulnerable Web Applications.

Exploits Available

There is a good variety of stuff to learn in Gruyere including:

  • Cross-Site Scripting (XSS)
  • Client-state Manipulation
  • Cross-Site Request Forgery (XSRF)
  • Cross Site Script Inclusion (XSSI)
  • Path Traversal
  • Denial of Service (DoS)
  • Code Execution
  • Configuration Vulnerabilities
  • AJAX Vulnerabilites

It doesn’t cover SQL Injection as it doesn’t use SQL.

Or you can download Gruyere here:

gruyere-code.zip

Or read more here.

Was previously known as Jarlsberg.


29 November 2014 | 3,965 views

isowall – Completely Isolate A Device From The Local Network

Isowall is a mini-firewall that allows you to completely isolate a device from the local network. This is for allowing infected machines Internet access, but without endangering the local network.

isowall - Completely Isolate A Device From The Local Network

Building

This project depends upon libpcap, and of course a C compiler.

On Debian, the following should work:

This will put the binary isowall in the local isowall/bin directory.

This should also work on Windows, Mac OS X, xBSD, and pretty much any operating system that supports libpcap.

Running

First, setup a machine with three network interfaces.

The first network interface (like eth0) will be configured as normal, with a TCP/IP stack, so that you can SSH to it.

The other two network interfaces should have no TCP/IP stack, no IP address, no anything. This is the most important configuration step, and the most common thing you’ll get wrong. For example, the DHCP software on the box may be configured to automatically send out DHCP requests on these additional interfaces. You have to go fix that so nothing is bound to these interfaces.

To run, simply type:

Configuration

The following shows a typical configuration file

You can download isowall here:

master.zip

Or read more here – the author can be found on Twitter here @erratarob.


27 November 2014 | 3,371 views

Bitcoin Not That Anonymous Afterall

One of the big advantages touted by Bitcoin (and other cryptocurrencies) was always the anonymity of the transactions, yes you can track a wallet address and see the transaction history. But there’s no real way to link that wallet address to a real person (so we thought).

I mean other than any leaky fiat exchange process (most of which do require proper registration using passport/ID etc), but now it seems there is a way.

Bitcoin Not That Anonymous Afterall

It seems like 11% of Bitcoin transactions can be ‘unmasked’ fairly easily, without any sign that it’s happening. Unmasking in this context meaning linking the transaction in the blockchain to a public IP address.

The cyber-libertarian poster-child Bitcoin, meant to usher in a new age of anonymous transactions, is rubbish at protecting users’ IP addresses according to research from the University of Luxembourg.

In this Association of Computing Machinery (ACM) conference paper by Alex Biryukov, Dmitry Khovratovich and Ivan Pustogarov of the Laboratory of Algorithmics, Cryptology and Security, “few computers” and a budget of €1,500 per for servers and traffic charges should be enough to start unmasking users’ addresses with as much as 60 per cent accuracy.

If an attacker needed to be stealthy, their success rate would drop to 11 per cent.

In what they call “a generic method to deanonymise a significant fraction of Bitcoin users and correlate their pseudonyms with public IP addresses”, the authors say clients can be uniquely identified by their “entry nodes”, and that these identify the origin of the transaction.

With a small amount of resources (in terms of servers, storage and bandwidth) the attacker (or in this case, researcher) can unmask up to 60% of user IP addresses using entry nodes.

Obviously using something like TOR could protect against this, but even then they can reject TOR connections (But that’s very likely to be noticed in this privacy sensitive part of the Internet).

“In a concrete example, an attacker with a few GB of storage and no more than 50 connections to each Bitcoin server can disclose the sender’s IP address in 11 per cent of all transactions generated in the Bitcoin network”, the paper claims.

Even more scary: the boffins reckon they can identify users behind NAT firewalls – and think their attack could be extended to other P2P networks.

The key phase of the researchers’ attack includes four steps:

  • Getting a list of Bitcoin servers using the GETADDR message and working out if the responder is a server using the ADDR response and sending it a VERSION message;
  • Building a list of nodes as targets for deanonymisation;
  • Mapping clients to entry nodes; and
  • Mapping transactions to entry nodes.

The paper notes that TOR would protect against this, but that, too, can be defeated if the attacker is willing to take a risk: Bitcoin servers can be prohibited from accepting TOR connections, but refusing those connections would be noticed.

Also likely to be noticed: to get their 60 per cent deanonymisation rate, the attackers noted, required “a slight DoS of the network”.

On a positive note (if you’re a cryptocurrency fan), is that this shows that Bitcoin is gaining traction with academics spending their effort looking into it. I’m glad these kind of issues are being uncovered, I just hope they get addressed by the core dev team.

Interesting times ahead I reckon.

Source: The Register


25 November 2014 | 4,277 views

LinEnum – Linux Enumeration & Privilege Escalation Tool

LinEnum will automate many Local Linux Enumeration & Privilege Escalation checks documented in this cheat sheet. It’s a very basic shell script that performs over 65 checks, getting anything from kernel information to locating possible escalation points such as potentially useful SUID/GUID files and Sudo/rhost mis-configurations and more.

An additional ‘extra’ feature is that the script will also use a provided keyword to search through *.conf and *.log files. Any matches will be displayed along with the full file path and line number on which the keyword was identified.

LinEnum - Linux Enumeration & Privilege Escalation Tool

After the scan has completed (please be aware that it make take some time) you’ll be presented with (possibly quite extensive) output, to which any key findings will be highlighted in yellow with everything else documented under the relevant headings.

Usage

Checks/Tasks Performed

  • Kernel and distribution release details
  • System Information:
    • Hostname
    • Networking details:
    • Current IP
    • Default route details
    • DNS server information
  • User Information:
    • Current user details
    • Last logged on users
    • List all users including uid/gid information
    • List root accounts
    • Extracts password policies and hash storage method information
    • Checks umask value
    • Checks if password hashes are stored in /etc/passwd
    • Extract full details for ‘default’ uid’s such as 0, 1000, 1001 etc
    • Attempt to read restricted files i.e. /etc/shadow
    • List current users history files (i.e .bash_history, .nano_history etc.)
    • Basic SSH checks
  • Privileged access:
    • Determine if /etc/sudoers is accessible
    • Determine if the current user has Sudo access without a password
    • Are known ‘good’ breakout binaries available via Sudo (i.e. nmap, vim etc.)
    • Is root’s home directory accessible
    • List permissions for /home/
  • Environmental:
    • Display current $PATH
  • Jobs/Tasks:
    • List all cron jobs
    • Locate all world-writable cron jobs
    • Locate cron jobs owned by other users of the system
  • Services:
    • List network connections (TCP & UDP)
    • List running processes
    • Lookup and list process binaries and associated permissions
    • List inetd.conf/xined.conf contents and associated binary file permissions
    • List init.d binary permissions
  • Version Information (of the following):
    • Sudo
    • MYSQL
    • Postgres
    • Apache
    • Checks user config
  • Default/Weak Credentials:
    • Checks for default/weak Postgres accounts
    • Checks for default/weak MYSQL accounts
  • Searches:
    • Locate all SUID/GUID files
    • Locate all world-writable SUID/GUID files
    • Locate all SUID/GUID files owned by root
    • Locate ‘interesting’ SUID/GUID files (i.e. nmap, vim etc)
    • List all world-writable files
    • Find/list all accessible *.plan files and display contents
    • Find/list all accessible *.rhosts files and display contents
    • Show NFS server details
    • Locate *.conf and *.log files containing keyword supplied at script runtime
    • List all *.conf files located in /etc
    • Locate mail

You can download LinEnum v0.5 here:

master.zip

Or read more here.