Tactical Exploitation: The other way to pentest

This presentations covers an assortment of penetration testing techniques and was originally presented at Black Hat USA in 2007. This was co-presented by HD Moore and valsmith.

A whitepaper is available at https://www.defcon.org/images/defcon-15/dc15-presentations/Moore_and_Valsmith/Whitepaper/dc-15-moore_and_valsmith-WP.pdf.

A video of the presentation is available at https://www.youtube.com/watch?v=DPwY5FylZfQ

Transcript

1. Las Vegas – August 2007
   Tactical Exploitation
   Tactical Exploitation
   “
   “the other way to pen-test “
   the other way to pen-test “
   hdm / valsmith
   hdm / valsmith
   

   View Slide

2. Las Vegas – August 2007
   who are we ?
   who are we ?
   H D Moore
   BreakingPoint Systems || Metasploit
   Valsmith
   Offensive Computing || Metasploit
   

   View Slide

3. Las Vegas – August 2007
   why listen ?
   why listen ?
   •
   A different approach to pwning
   •
   New tools, fun techniques
   •
   Real-world tested :-)
   

   View Slide

4. Las Vegas – August 2007
   what do we cover ?
   what do we cover ?
   •
   Target profiling
   •
   Discovery tools and techniques
   •
   Exploitation
   •
   Getting you remote access
   

   View Slide

5. Las Vegas – August 2007
   the tactical approach
   the tactical approach
   •
   Vulnerabilites are transient
   •
   Target the applications
   •
   Target the processes
   •
   Target the people
   •
   Target the trusts
   •
   You WILL gain access.
   

   View Slide

6. Las Vegas – August 2007
   the tactical approach
   the tactical approach
   •
   Crackers are opportunists
   •
   Expand the scope of your tests
   •
   Everything is fair game
   •
   What you dont test...
   •
   Someone else will!
   

   View Slide

7. Las Vegas – August 2007
   the tactical approach
   the tactical approach
   •
   Hacking is not about exploits
   •
   The target is the data, not r00t
   •
   Hacking is using what you have
   •
   Passwords, trust relationships
   •
   Service hijacking, auth tickets
   

   View Slide

8. Las Vegas – August 2007
   personnel discovery
   personnel discovery
   •
   Security is a people problem
   •
   People write your software
   •
   People secure your network
   •
   Identify the meatware first
   

   View Slide

9. Las Vegas – August 2007
   personnel discovery
   personnel discovery
   •
   Identifying the meatware
   •
   Google
   •
   Newsgroups
   •
   SensePost tools
   •
   www.Paterva.com
   

   View Slide

10. Las Vegas – August 2007
    personnel discovery
    personnel discovery
    •
    These tools give us
    •
    Full names, usernames, email
    •
    Employment history
    •
    Phone numbers
    •
    Personal sites
    

    View Slide

11. Las Vegas – August 2007
    personnel discovery
    personnel discovery
    CASE STUDY
    

    View Slide

12. Las Vegas – August 2007
    personnel discovery
    personnel discovery
    •
    Started with just a name and title
    •
    Found online personnel directory
    •
    Found people / email addresses
    •
    Email name = username = target
    

    View Slide

13. Las Vegas – August 2007
    personnel discovery
    personnel discovery
    DEMO
    

    View Slide

14. Las Vegas – August 2007
    network discovery
    network discovery
    •
    Identify your target assets
    •
    Find unknown networks
    •
    Find third-party hosts
    •
    Dozens of great tools...
    •
    Lets stick to the less-known ones
    

    View Slide

15. Las Vegas – August 2007
    network discovery
    network discovery
    •
    The overused old busted
    •
    Whois, Google, zone transfers
    •
    Reverse DNS lookups
    

    View Slide

16. Las Vegas – August 2007
    network discovery
    network discovery
    •
    The shiny new hotness
    •
    Other people's services
    •
    CentralOps.net, DigitalPoint.com
    •
    DomainTools.com, Paterva.com
    •
    RevHosts PIG/VHH modules:
    •
    http://revhosts.net/
    

    View Slide

17. Las Vegas – August 2007
    network discovery
    network discovery
    •
    What does this get us?
    •
    Proxied DNS probes, transfers
    •
    List of virtual hosts for each IP
    •
    Port scans, traceroutes, etc
    •
    Gold mine of related info
    

    View Slide

18. Las Vegas – August 2007
    network discovery
    network discovery
    •
    Active discovery techniques
    •
    Trigger SMTP bounces
    •
    Brute force HTTP vhosts
    •
    Watch outbound DNS
    •
    Just email the users!
    

    View Slide

19. Las Vegas – August 2007
    network discovery
    network discovery
    CASE STUDY
    

    View Slide

20. Las Vegas – August 2007
    network discovery
    network discovery
    DEMO
    

    View Slide

21. Las Vegas – August 2007
    firewalls and ips
    firewalls and ips
    •
    Firewalls have gotten snobby
    •
    Content filtering is now common
    •
    Intrusion prevention is annoying
    •
    Identify and fingerprint
    •
    Increase your stealthiness
    •
    Customize your exploits
    

    View Slide

22. Las Vegas – August 2007
    firewalls and ips
    firewalls and ips
    •
    Firewall identification
    •
    NAT device source port ranges
    •
    Handling of interesting TCP
    •
    IPS identification
    •
    Use “drop with no alert” sigs
    •
    Traverse sig tree to find vendor
    

    View Slide

23. Las Vegas – August 2007
    firewall and ips
    firewall and ips
    CASE STUDY
    

    View Slide

24. Las Vegas – August 2007
    firewall and ips
    firewall and ips
    DEMO
    

    View Slide

25. Las Vegas – August 2007
    application discovery
    application discovery
    •
    If the network is the toast...
    •
    Applications are the butter.
    •
    Each app is an entry point
    •
    Finding these apps is the trick
    

    View Slide

26. Las Vegas – August 2007
    application discovery
    application discovery
    •
    Tons of great tools
    •
    Nmap, Amap, Nikto, Nessus
    •
    Commercial tools
    

    View Slide

27. Las Vegas – August 2007
    application discovery
    application discovery
    •
    Slow and steady wins the deface
    •
    Scan for specific port, one port only
    •
    IDS/IPS can't handle slow scans
    •
    Ex. nmap -sS -P0 -T 0 -p 1433 ips
    

    View Slide

28. Las Vegas – August 2007
    application discovery
    application discovery
    •
    Example target had custom IDS to
    detect large # of host connections
    •
    Standard nmap lit up IDS like XMAS
    •
    One port slow scan never detected
    •
    Know OS based on 1 port (139/22)
    

    View Slide

29. Las Vegas – August 2007
    application discovery
    application discovery
    •
    Some new tools
    •
    W3AF for locating web apps
    •
    Metasploit 3 includes scanners
    

    View Slide

30. Las Vegas – August 2007
    application discovery
    application discovery
    CASE STUDY
    

    View Slide

31. Las Vegas – August 2007
    application discovery
    application discovery
    DEMO
    

    View Slide

32. Las Vegas – August 2007
    client app discovery
    client app discovery
    •
    Client applications are fun!
    •
    Almost always exploitable
    •
    Easy to fingerprint remotely
    •
    Your last-chance entrance
    

    View Slide

33. Las Vegas – August 2007
    client app discovery
    client app discovery
    •
    Common probe methods
    •
    Mail links to the targets
    •
    Review exposed web logs
    •
    Send MDNs to specific victims
    •
    Abuse all, everyone, team aliases
    

    View Slide

34. Las Vegas – August 2007
    client app discovery
    client app discovery
    •
    Existing tools
    •
    BEEF for browser fun
    •
    Not much else...
    

    View Slide

35. Las Vegas – August 2007
    client app discovery
    client app discovery
    •
    Shiny new tools
    •
    Metasploit 3 SMTP / HTTP
    •
    Metasploit 3 SMB services
    

    View Slide

36. Las Vegas – August 2007
    client app discovery
    client app discovery
    CASE STUDY
    

    View Slide

37. Las Vegas – August 2007
    client app discovery
    client app discovery
    DEMO
    

    View Slide

38. Las Vegas – August 2007
    process discovery
    process discovery
    •
    Track what your target does
    •
    Activity via IP ID counters
    •
    Last-modified headers
    •
    FTP server statistics
    

    View Slide

39. Las Vegas – August 2007
    process discovery
    process discovery
    •
    Look for patterns of activity
    •
    Large IP ID increments at night
    •
    FTP stats at certain times
    •
    Web pages being uploaded
    

    View Slide

40. Las Vegas – August 2007
    process discovery
    process discovery
    •
    Existing tools?
    •
    None :-(
    •
    New tools
    •
    Metasploit 3 profiling modules
    •
    More on exploiting this later...
    

    View Slide

41. Las Vegas – August 2007
    process discovery
    process discovery
    CASE STUDY
    

    View Slide

42. Las Vegas – August 2007
    process discovery
    process discovery
    DEMO
    

    View Slide

43. Las Vegas – August 2007
    15 Minute Break
    15 Minute Break
    •
    Come back for the exploits!
    

    View Slide

44. Las Vegas – August 2007
    re-introduction
    re-introduction
    •
    In our last session...
    •
    Discovery techniques and tools
    •
    In this session...
    •
    Compromising systems!
    

    View Slide

45. Las Vegas – August 2007
    external network
    external network
    •
    The crunchy candy shell
    •
    Exposed hosts and services
    •
    VPN and proxy services
    •
    Client-initiated sessions
    

    View Slide

46. Las Vegas – August 2007
    attacking file transfers
    attacking file transfers
    •
    FTP transfers
    •
    Active FTP source ports
    •
    Passive FTP servers
    •
    NFS transfers
    •
    TFTP transfers
    

    View Slide

47. Las Vegas – August 2007
    attacking mail services
    attacking mail services
    •
    Four different attack points
    •
    The mail relay servers
    •
    The antivirus gateways
    •
    The real mail server
    •
    The users mail client
    •
    File name clobbering...
    

    View Slide

48. Las Vegas – August 2007
    attacking web servers
    attacking web servers
    •
    Brute force files and directories
    •
    Brute force virtual hosts
    •
    Standard application flaws
    •
    Load balancer fun...
    •
    Clueless users cgi-bin's are often
    the Achilles heel
    

    View Slide

49. Las Vegas – August 2007
    attacking dns servers
    attacking dns servers
    •
    Brute force host name entries
    •
    Brute force internal hosts
    •
    XID sequence analysis
    •
    Return extra answers...
    

    View Slide

50. Las Vegas – August 2007
    attacking db servers
    attacking db servers
    •
    Well-known user/pass combos
    •
    Business apps hardcode auth
    •
    Features available to anonymous
    •
    No-patch bugs (DB2, Ingres, etc)
    

    View Slide

51. Las Vegas – August 2007
    authentication relays
    authentication relays
    •
    SMB/CIFS clients are fun!
    •
    Steal hashes, redirect, MITM
    •
    Remote shell, no vuln needed
    •
    NTLM relay between protocols
    •
    SMB/HTTP/SMTP/POP3/IMAP
    

    View Slide

52. Las Vegas – August 2007
    social engineering
    social engineering
    •
    Give away free toys
    •
    CDROMs, USB keys, N800s
    •
    Replace UPS with OpenWRT
    •
    Cheap and easy to make
    

    View Slide

53. Las Vegas – August 2007
    internal network
    internal network
    •
    The soft chewy center
    •
    This is the fun part :)
    •
    Easy to trick clients
    

    View Slide

54. Las Vegas – August 2007
    file services
    file services
    •
    SMB is awesome
    •
    Look for AFP exports of SMB data
    •
    NAS storage devices
    •
    Rarely, if ever, patch Samba :-)
    

    View Slide

55. Las Vegas – August 2007
    file services
    file services
    •
    NFS is your friend
    •
    Dont forget its easy cousin NIS
    •
    Scan for port 111 / 2049
    •
    showmount -e / showmount -a
    •
    Whats exported, whose mounting?
    

    View Slide

56. Las Vegas – August 2007
    file services
    file services
    •
    Exported NFS home directories
    •
    Important target!
    •
    If you get control
    •
    Own every node that mounts it
    

    View Slide

57. Las Vegas – August 2007
    file services
    file services
    •
    If you are root on home server
    •
    Become anyone (NIS/su)
    •
    Harvest known_hosts files
    •
    Harvest allowed_keys
    •
    Modify .login, etc. + insert trojans
    

    View Slide

58. Las Vegas – August 2007
    file services
    file services
    •
    Software distro servers are fun!
    •
    All nodes access over NFS
    •
    Write to software distro directories
    •
    Trojan every node at once
    •
    No exploits needed!
    

    View Slide

59. Las Vegas – August 2007
    file services
    file services
    CASE STUDY
    

    View Slide

60. Las Vegas – August 2007
    netbios services
    netbios services
    •
    NetBIOS names are magic
    •
    WPAD
    •
    CALICENSE
    

    View Slide

61. Las Vegas – August 2007
    dns services
    dns services
    •
    Microsoft DNS + DHCP = fun
    •
    Inject host names into DNS
    •
    Hijack the entire network
    •
    dhcpcd -h WPAD -i eth0
    

    View Slide

62. Las Vegas – August 2007
    wins services
    wins services
    •
    Advertise your WINS service
    •
    Control name lookups
    •
    Attack other client apps
    

    View Slide

63. Las Vegas – August 2007
    license servers
    license servers
    •
    A soft spot in desktop apps
    •
    Computer Associates
    •
    Bugs and simple to spoof
    •
    FlexLM network services
    

    View Slide

64. Las Vegas – August 2007
    remote desktops
    remote desktops
    •
    RDP
    •
    Great for gathering other targets
    •
    Domain lists available pre-auth
    •
    If not available, start your own:
    •
    net start “terminal services”
    

    View Slide

65. Las Vegas – August 2007
    remote desktops
    remote desktops
    •
    VNC
    •
    The authentication bug is great :)
    •
    MITM attacks are still viable
    •
    Install your own with Metasploit 3
    •
    vncinject payloads
    

    View Slide

66. Las Vegas – August 2007
    trust relationships
    trust relationships
    •
    The target is unavailable to YOU
    •
    Not to another host you can reach...
    •
    Networks may not trust everyone
    •
    But they often trust each other :)
    •
    

    View Slide

67. Las Vegas – August 2007
    trust relationships
    trust relationships
    CASE STUDY
    

    View Slide

68. Las Vegas – August 2007
    Hijacking SSH
    Hijacking SSH
    CASE STUDY
    

    View Slide

69. Las Vegas – August 2007
    Hijacking Kerberos
    Hijacking Kerberos
    CASE STUDY
    

    View Slide

70. Las Vegas – August 2007
    Hijacking NTLM
    Hijacking NTLM
    CASE STUDY
    

    View Slide

71. Las Vegas – August 2007
    Conclusion
    Conclusion
    •
    Compromise a “secure” network
    •
    Determination + creativity wins
    •
    Tools cannot replace talent.
    

    View Slide