Hacking while you're asleep

Last 22-24 October 2013 hack.lu was celebrated in Luxemburgo. Hack.lu is an open a security convention where usually there is a CTF (capture the flag) competition.

This year the competitors need to get two passwords of a program called RoboAuth.exe which can be downloaded here:

http://shell-storm.org/repo/CTF/Hacklu-2013/Reversing/RoboAuth-150/RoboAuth.exe

The flag to pass the test is: password1_password2

Ok. Let's go to try to get the first one. To achieve this purpose, we are going to use OllyDbg. Just open the file with this program and click on the play button to run the program.

We can see a MS-DOS windows which requests us the first Password.

One of the first things I usually do in these cases is to look at "All referenced test strings" in order to find something which draws my attention.

In this case, we can see the string "You passed level1!". We can suppose that just before that, the assemble code will compare our password with the real one.

To go to this string in the assemble code, we right-click on this line and select "Follow in Disassembler".

Now we can see the string mentioned above in the assemble code. Two lines before that, we can see the function "TEST EAX, EAX" wich will make a comparison between our password and the real one. Depending on the result, the program will make a decision. If the password is correct, we will pass the test, if not, the program will be closed.

We can set a breaking point at this point in order to stop the program just when the program is comparing the passwords in order to see the good one in the Stack. To do that, just right click on the line which contains "TEST EAX, EAX", select Breakpoint and select for example, "Memory, on access".

The next step is to write a password and wait until the program stops in the breakpoint.

In the end, we just need to see the Stack window which shows the state of the stack in memory for the thread being debugged. This window is at the bottom right. In the picture below you can see our password "COMPARE..." followed by other string "r0b0RUlez!". It seems to be the password.

If we go to our program and type the password "r0b0RUlez!" on the program, you can check that "You passed level1!".

I've spent some time trying to resolve the second Password but it is more complicated than the previous one. When I have some spare time, I will try it again and I will write a post with the solution.

This post is the continuation of the last one: http://www.behindthefirewalls.com/2013/11/hacklu-capturing-flag-v10.html

I remind you the file is available here: http://shell-storm.org/repo/CTF/Hacklu-2013/Reversing/RoboAuth-150/RoboAuth.exe

Remember that in the last post, we obtained the first password "r0b0RUlez!" for the challenge offered by Hack.lu. In this post, I am going to show you how to get the first and the second password using IDA Pro instead of OllyDbg. Ok, let's go...

In order to get the first password we can do a similar thing to we did in the previous post. (I am going to explain this swiftly because it was explained in the previous one).

If we set a breakpoint at "call strcnp" at 0x00401B6C, when the program is being debugged it will be stopped when it is comparing two strings, our password and the real one. After setting the breakpoint, press F9 in order to debug the program.

The program is open and we just need to type a password. In this case, "behindthefirewalls".

If we go to the Stack...

... we can see the the picture below.

Our attempt to figure out the password
The real password which the first one is being compared to.
We are not sure about this string... Could it be the second password?
String which will ask for the second password...

It seems too easy... We type the first password "r0b0RUlez!" which we already know is correct, and we try "u1nnf2lg" as second password...

But it does not work... The next step we can take is to set a breakpoint at "u1nnf2lg""0x0023FDFC" in the stack, in order to stop the program at this address when it is being debugged and look at the code there... Just press F2 over the string to set the breakpoint.

After pressing OK, you will see a red line where the program will be stoped.

We debug the program again by pressing F9. It is necessary to type the first password again and then, the program will be stopped. But...

... the program has been debugged at, "0x0040161F" instead of "0x0023FDFC" where we set a breakpoint... What is happening? If we look at the assemble code in the picture below, we can see "int 3"... It seems that the software developer is trying to thwart our attempts to make a reverse engineer setting a breakpoint in its executable code source...

Don't worry, the pop up below appears. We need to click on "Change exception definition"...

... tick the "Pass to application"...

... and press OK and Yes and press F9 again.

After that the second password is required. We type for example "behindthefirewalls" and press F9 one more time.

Now, the program is stops at the right address, "0x0023FDFC".

If we look at the assemble code of the stack in a graphic, we can see the picture below where we can check that the program has been stopped at "cmp al, 2". We can see that there is a loop and a "xor eax, 2" instruction...

We can check that the EAX value is equal at 75 in hexadecimal which in ASCII is equal to "u" (the first character of "u1nnf2lg") and then it will be XOR with 0x02. 75 + 2 = 77 in hexadecimal is "w"... We can suppose the first character of the password could be "w"...

What would happen if we XORED with 0x02 the string "u1nnf2lg" which was found at the beginning of our post?

python -c "print ''.join([chr(ord(c) ^ 0x2) for c in 'u1nnf2lg'])"

We have the string "w3lld0ne" which seems to be the second password...

... and Yes!! We win!!!

If we analyze the loop we can say that it XOR with 0x02 character by character the string "u1nnf2lg" and the result is compared character by character with the typed password. If the first XORed character is the same as the first character typed by the user, then continue with the second one and so on... If not, the game is over...

The RFC 1945 says in the 10.15 section:

"The User-Agent request-header field contains information about the user agent originating the request. This is for statistical purposes, the tracing of protocol violations, and automated recognition of user agents for the sake of tailoring responses to avoid particular user agent limitations. Although it is not required, user agents should include this field with requests."

We know that the infected hosts which belong to a botnet make callbacks to the command and control (C&C) server usually through the port 80 which is commonly open in the majority of the networks. Currently the network security administrators have "next generation firewalls" which are able to detect if a connection crossing by this port is an standard HTTP connection or not (like a shell on tcp/80 port) in order to allow or drop it. For this reason, some malware developers create malicious binaries with HTTP capabilities and sometimes they use the User-Agent field to send information to the C&C server to achieve their goals. (Notice that if the malware is implementing SSL the next generation firewall administrator would need to configure a SSL decryption in their firewalls if they want to look into these connections)

In this post, I am going to show you some examples which use the User-Agent to transmit information in this HTTP field.

Malware Sample 1

In this example, the malware creates a visual basic script which will be running to connect with the C&C server. We talked about it in the last post Decoding the code encoded. In this case, I could edit the the visual basic in order to change the C&C domain name by the localhost 127.0.0.1 address where I have a netcat listening in the port 80. Netcat will receive the malware connections instead of the C&C server. In the picture below, we can see the result.

This line corresponds to Netcat running in the computer where the malware is being analyzed. It is listening "-l" in the 80/tcp port "-p 80".
We can see the connection executes a POST request.
The malware is sending information about the compromised host in the User-Agent field with no more data in the HTTP body. This is the information which is being send to the C&C server:

User-Agent: {DiskVolumeSerial}<|>{Hostname}<|>{Username}<|>{OS}<|>underworld final<|>{AVProductInstalled or nan-av}<|>{USBSpread: true or false}

Malware Sample 2

I sent a malware sample to my Cuckoo Sandbox to analyze its behavior and I got a traffic capture. If we use Wireshark to see the connections in the traffic capture, we can filter by "http.user_agent" to show only the information about the requests made by the malware which contains this field in the HTTP connections. You can see these connections in the picture below.

Right-clicking in each HTTP request, we can select "Follow TCP Stream" in order to see the data in like the application layer sees it. In the picture below, we can see the Follow TCP Stream of the first connection.

A GET petition including the MAC address of the infected host has been made. Normally the malware sends information with POST connections, but in this case, the malware request a URL with contains the infected computer's MAC address to send this information to the C&C server in a different way... The MAC address will be register in the remote HTTP server logs.
The User-Agent its the same that the name of the malicious executable. Maybe the malware developer has the same malmare hosted in different servers and he wants to trace them or maybe wants to know the malicious program version.
In the GET connection, the infected host receives three codes: 1,1,0. We would need to dig on it making a reversing engineer to try to figure out what the malware exactly does with these codes.

The next petition the compromised host does, is to make another GET request to the C&C server.

We can see another GET request including the MAC address. Now, the HTTP petition has tree fields: "v1", "v2" and "v3".
The connection continues using the same User-Agent.
Now, the the host receive the "0" code.

In the picture below, we can see that in the next request made by the malware, the User-Agent has changed.

The malware visit "/version" path.
The User-Agent has changed. With this name, we can figure out that the malware is trying to check if it has connection to the Internet but it does not make sense, because the malware has received two codes before in two different petitions...
We can see four different executables separated by @date| . Maybe it is the date when they were compiled.

The next connections are related with the last request which I have described above. We can see how the malware request the same executables it received before. The question here is why it download them twice each binary.

The malware downloads the four executables and changes its User-Agent again when it is requesting them.

The URL path where the malware is hosted.
User-Agent is changed to "installer-agent".
The executable download.

The last connection the malware does is the same that the second one.

This malware seems to use the User-Agent like it were a radio announcer.

Malware Sample 3

This example came from the Fireye blog and belongs to the well-know Flamer malware.

In the picture below, which has been taken from the blog mentioned above, we can see that the .NET version used by this malware is NET CLR 1.1.2150. This version has not been released by Microsoft ever. It is really difficult to know what these numbers want to say... It may be the malware version...

Malware Sample 4

This example came from the Fireye blog too.

In the picture below (taken from the Fireye blog) we can see that the User-Agent contains the strings "sleep 300000" and a date"ct:Mon Feb 25 23:11:58 2013". It could be possible that the zombie computer is telling the C&C how much time the malware has been sleeping and from what day or maybe it informs to the C&C sever that it received the sleep command.

Conclusion

In this post we have seen how the malware exchanges information with the command and control servers using the User-Agent and the importance of this HTTP field. Many of them do not modify its User-Agent or implements a well-known User-Agent to try to be undetectable, but if it changes you can create a custom signature for you IDS (Snort, Suricata...) in order to locate more infected hosts in your network which are making connections with the User-Agent customized by the malware.

We usually need to create an executive report when we are involved in an incident handling. In these cases, a good option could be to include in it a world map with the connections which were established in the incident. Maybe we are interested in showing on a map where the command an control servers are hosted or for example to show which countries the distributed denial of service came from...

To achieve this purpose I am going to show you how to create a map using Wireshark. The last Wireshark version 1.10.2 will be used in this guide.

The first thing we need to do is to download the GeoIP database: GeoLite City, Country, and ASNum from the link below: http://geolite.maxmind.com/download/geoip/database/ (free download).

Then, we need to put into a folder the files contained in the downloads above, for example "C:\Geoip".

Now, we need to tell Wireshark where the GeoIP files are. To achieve this, we need to open Wireshark and go to Edit -> Preferences - > Name Resolution and click on Edit in the "GeoIP database directories" section...

... and create a New path where the files were saved, in this case "C:\Geoip".

It is necessary to restart Wireshark in order to apply the changes. Now, we only need to load a PCAP file or create a new traffic capture. When we have all the traffic captured and we want to create the map with the connection involved in the incident, we need to go to Statistics -> Endpoints...

... select the IPv4 tab and click on the map bottom. Notice that if for example you have set a filter in Wireshark only with the UDP connections which are related to the malware, you can select "Limit to display filter" in order to only print these connections on the map. Then you click on map.

Finally, we have a dynamic map complete connections on the map. In this case, I've used the PCAP file related to the attack to php.net which can be downloaded from the Barracuda website here.

You already know that the malware developers create packed executables in order to try to thwart the security analyst job and make alighterfile easier to download... If the executable is packed we cannot examine the original program which obstructs us from employing a static analysis to know what the malware does...

In this post we have a malware sample called DEMO.exe which we will work with.

If we open the file with PEiD we can check that it has been compressed with UPX. You already know that it is a common compression...

The majority of times we are able to unpack this type of compression automatically with the UPX program. But this time, we haven't been lucky...

If we want to make a static analysis, first we need to unpack the file. To achieve this purpose, we need to follow the next steps:

To unpack the original file into memory.
To resolve all of the imports of the original file.
To find and transfer execution to the original entry point (OEP).

The key to this technique is to run the packed file until it is decompressed by itself, setting a breakpoint, dumping it and setting the OEP and rebuilding their imports.

To follow these steps we will use OllyDbg v1.10 and the plugin OllyDump.

The first thing we need to do is to load the executable in OllyDbg. We can see that an advertisement appears telling us what we already know: "...reports that its code section is either compressed, encrypted ,or contains large amount of embedded data..."

Ok, let's go. Just loaded the file we can see the program stop at PUSHAD. Press F7 or click on the button to Step into.

Right click at the ESP value and select Follow in Dump...

... select the first four characters and set a Breakpoint.

Press the play button and wait until the program stops at the breakpoint. Now we can see the tail jump at 00ACD7BD. The tail jump is the last instruction of the uncompressing action and in this type of compression is usually followed by a lot of 0x00 bytes. These 0x00 bytes are filling to ensure that the section is properly byte-aligned. Notice that function jumps to a site which is very far away, 004090E8. Just in that instruction, the original program will start.

We can set a breakpoint at the tail jump.

We resume the program again and it is stopped at the tail jump. We need to press F7 or click on the Step Into bottom.

Now we are in the OEP. Right-clik on this line and click on Dump debugged process in order to dump the process to a disk.

Notice that the OEP (004090E8) is the same that the last address in the "Modify" field, 90E8 . You can press the "Get EIP as OEP". Untick the "Rebuild import" because the import will be rebuilt using Import REConstructor. It is a good idea to copy the value "90E8" for the future...

Save the dump where you want. I have saved the file as "Dumped.exe". Notice if you want to run the program it will fail because it doesn't have the imports. To fix that, just open Import REConstructor and select the file which is being debugged with OllyDbg. In this case "demo.exe"

The next window will appear.

Just paste the value which was copied before in the OPE section and click on IAT AutoSearch.

Click on the Get Imports first and then click on the Fix Dump buttom.

Just pressed "Fix Dump" select the file which was dumped.

Now, we have two files, the first one which was dumped with OllyDbg and the last one, Dumped_.exe which has the imports rebuilt.

If you look at the strings in OllyDbg you can see the differences. In the picture below you can see on the left the strings detected in the packed file and on the right, you can see the strings of the unpacked file.

Now, if we open the unpacked file we can detect that is was developed in Visual basic and we can start with the static analysis.

With VB Decompiler we could try to decompiler it...

When I was writing Using robots.txt to locate your targets, I felt the necessity of developing a tool to make automatic the task of auditing the Robots.txt file of the web servers.

Now, I am really proud of introducing you my first tool called Parsero. I hope you enjoy it...

Introductions

One of the things you need to do when you are auditing a website is to look at the Robots.txt file, for example: http://www.behindthefirewalls.com/robots.txt. The web administrators write this file to tell the crawlers like Google, Bing, Yahoo... what content they are allowed to index or what directories mustn't be indexed.

But... Why the administrators want to hide some web directories to the crawlers?

Sometimes they want to hide the web portal login, management directories, private info, sensitive data, page with vulnerabilities, documents, etc... If they hide these directories from the crawlers, then they can't be found making Google Hacking or just searching in the search engines...

Why do you need Parsero?

We've said that the administrators tell the crawlers what directories or files hosted on the web server are not allowed to be indexed. They achieve this purpose by writing so much "Disallow: /URL_Path" as they want in the Robots.txt file pointing to these directories. Sometimes these paths typed in the Disallows entries are directly accessible by the users (without using a search engine) just visiting the URL and the Path even sometimes they are not available to be visited by anybody... Because it is really common that the administrators write a lot of Disallows and some of them are available and some of them are not, you can use Parsero in order to check the HTTP status code of each Disallow entry in order to check automatically if these directories are available or not.

When we execute Parsero, we can see the HTTP status codes. For example, the codes bellow:

200 OK The request has succeeded.
403 Forbidden The server understood the request, but is refusing to fulfill it.
404 Not Found The server hasn't found anything matching the Request-URI.
302 Found The requested resource resides temporarily under a different URI
...

Installation

Parsero needs at least Python3 and can be executed in all Operating Systems which support this language development. Also it needs Urllib3.

sudo apt-get install python3

sudo apt-get install python-pip

sudo pip install urllib3

When you have installed these software, just download the project from:

https://github.com/behindthefirewalls/Parsero

https://github.com/behindthefirewalls/Parsero/archive/master.zip

In Linux you can use the command bellow.

git clone https://github.com/behindthefirewalls/Parsero.git

When you download Parsero, you will see a folder with three files.

Before start, you need to check that your default Python version is 3 or later. If you have already installed Python3 but is not your default version, you can run the script using the command "python3 parsero.py" instead of "python parsero.py".

If you don't type any argument, you will see the help bellow.

Example 1

In the picture below you can see the Robots.txt file of a web server in one of my environments. If you are a web security auditor, you should check all the Disallows in order to try to get some valuable information. The security auditor should want to know what directories or files are hosted in the web servers which the administrators don't want to be published on the search engines.

You can do this task automatically using Parsero with the command:

python parsero.py -u www.example.com

Notice in the picture below that the green links are the links which are available in the web server. You don't need to waste your time checking the other links, just clicking on the green links.

If we visit the www.example.com/server-status/ we can see the Apache logs which are public but hidden for the crawlers...

Example 2

In the picture below you can see another robots.txt. The picture has been cut because this server has a lot of Disallow. Can you imagine checking all of them manually?

If you use Parsero, you will audit all the Robots.txt file in just a seconds...

... and discover for example, the portal login for this site.

The future of Parsero

I am working on developing new features of this tool which will be delivered in the next months... I would be really grateful if you decide to give me your feedback about this tool.

I want to give the thanks to cor3dump3d for his support and help!!! He has saved me a lot of time thanks to sharing his knwoledge of Python with me!!

Stuxnet could be the first advanced malware. It is thought that it was developed by the United States and Israel to attack Iran's nuclear facilities. It attacked Windows systems using a zero-day exploit and It was focused on SCADA systems in order to affect critical infrastructures... Also, it may be spread from USB drivers. It is necessary a squad of highly capable programmers with depth of knowledge of industrial processes and an interest in attacking industrial infrastructure to develop this malware.

Kaspersky Lab concluded that the sophisticated attack could only have been conducted "with nation-state support" and a study of the spread of Stuxnet by Symantec says that it was spread to Iran (58.85%), Indonesia (18.22%), India (8.31%), Azerbaijan (2.57%)....

Thanks to Malware Cookbook we can download a memory dump from an infected host with this malware in the URL below:

http://malwarecookbook.googlecode.com/svn/trunk/stuxnet.vmem.zip

Ok, let’s go. We are going to analyze it with Volatility.

STUXNET IMAGE INFO

First of all we want to get more info of the memory image. With the command below we can see the volatility suggested profile and when the image was dumped. In this case it was in 2011-06-03.

python2 vol.py -f stuxnet.vmem imageinfo

It is a good practice to export the profile WinXPSP3x86 in order not to specify more this profile in the Volatility commands.

export VOLATILITY_PROFILE=WinXPSP3x86

DETECTING MALICIOUS PROCESS

First of all, I usually want to know what process was running the computer when the memory was dumped.

Notice you will see that three lsass.exe processes were running… It draws our attention.

lsass.exe Pid 680
lsass.exe Pid 868
lsass.exe Pid 1928

python2 vol.py -f stuxnet.vmem pslist

We know that lsass.exe is one of the first processes to start when Windows boots. Because of this, it’s normal that “lsass.exe” has a lower Pid. You can see when the three lsass.exe process started in the picture above:

Pid 680 started at 2010-10-29 17:08:54
Pid 868 started at 2011-06-03 04:26:55
Pid 1928 started at 2011-06-03 04:26:55

You can see the “lsass.exe” with lower Pid (680) started in 2010 and the other ones with higher Pid (868 and 1928) started in 2011. It isn’t a normal behavior.

In the picture below we can notice that Winlogon.exe (Pid 624) started one of the “lsass.exe” process (Pid 680). This is a really good indication of which “lsass.exe” isn’t malicious, because Winlogon.exe always starts the real “lsass.exe”. The “lsass.exe” with Pid 868 and 1928 was started by the “services.exe” process. It isn’t a normal behavior. They could be malicious processes.

python2 vol.py -f stuxnet.vmem pstree | egrep '(services.exe|lsass.exe|winlogon.exe)'

We have just discovered two suspicious processes.

DETECTING MALICIOUS CONNECTIONS

It is really important to indentify if theses suspicious processes were making connections. With the command below we can check it.

python2 vol.py -f stuxnet.vmem connections

No connections were establishing when the memory was dumped. Now, we are going to see the ports that were listening in the computer.

In the picture bellow you will see a “lsass.exe” with Pid 680 is bound to Port 500 and 4500, while “lsass.exe” with Pid 868 and the another one with Pid 1928 are not listening in these ports. It seems again that the “lsass.exe” with the PID 680 has a normal behavior because this process usually listens on these ports.

python2 vol.py -f stuxnet.vmem sockets

DETECTING DLL

The “lsass.exe” process with PID 680 appears to be a normal process… What’s happened with the other ones?

With the command below, we can check that “lsass.exe” with Pid 868 and Pid 1928 have a load lower DLLs.

python2 vol.py -f stuxnet.vmem dlllist –p 680 | wc –l

python2 vol.py -f stuxnet.vmem dlllist –p 868 | wc –l

python2 vol.py -f stuxnet.vmem dlllist –p 1928 | wc –l

Also, we can detect that the process with Pid 1928 has unlinked DLLs.

python2 vol.py -f stuxnet.vmem ldrmoudles –p 1928

We can get more information about it with this command.

python2 vol.py -f stuxnet.vmem ldrmoudles –p 1928 -v

These kernel calls are directly related with stuxnet worm. See the URL below:

http://www.f-secure.com/v-descs/trojan-dropper_w32_stuxnet.shtml

DETECTING INJECTED CODE

The malfind command helps us to find hidden or injected code/DLLs in the user mode memory. Then we are going to export these DLLs and we will upload them to www.virustotal.com in order to check if an anti-virus detects them.

We already know that the process with PID 680 is normal. For this reason we will continue with the other ones.

python2 vol.py -f stuxnet.vmem malfind –p 868 –dump-dir evidences/

We can see two files have been created. We continue doing the same with the “lsass.exe” process with Pid 1928.

python2 vol.py -f stuxnet.vmem malfind –p 1928 –dump-dir evidences/

The next step will be to upload to www.virustotal.com these files in order to check if some anti-virus vendor detects them as malicious files. In order to not upload the files, we will obtain the sha256 checksum of the files and then we will search on the Virustotal website.

sha256sum *.dmp

Here, you have the links to Virustotal with the report of the files which have been analyzed:

https://www.virustotal.com/en/file/e97d61f7393ac5838a1800f3e9aa22c6205f4d7e2bde494573d35c57bc9b7819/analysis/

https://www.virustotal.com/en/file/163b7da37df4ae6dafbfb5bf88b319dabf7846cee73d4192c6a7593e835857a8/analysis/

https://www.virustotal.com/en/file/abce3e79e26b5116fe7f3d40d21eaa4c8563e433b6086f9ec07c2925593f69dc/analysis/

https://www.virustotal.com/en/file/2b2945f7cc7cf5b30ccdf37e2adbb236594208e409133bcd56f57f7c009ffe6d/analysis/

https://www.virustotal.com/en/file/10f07b9fbbc6a8c6dc4abf7a3d31a01e478accd115b33ec94fe885cb296a3586/analysis/

https://www.virustotal.com/en/file/a4b4b29f0df45283b629203b080c09ddb5bc6eb4cd8e9b725f75121a8b7e728e/analysis/

https://www.virustotal.com/en/file/2b2945f7cc7cf5b30ccdf37e2adbb236594208e409133bcd56f57f7c009ffe6d/analysis/

Notice that the majority of them have been detected as Stuxnet Worm

Stuxnet Trojan - Memory Forensics with Volatility | Part II

Continue reading the second part here:
http://www.behindthefirewalls.com/2014/01/stuxnet-memory-forensics-volatility-II.html

You can read the first part of this post here:

http://www.behindthefirewalls.com/2013/12/stuxnet-trojan-memory-forensics-with_16.html

DETECTING API CALLS

If we use the command below, we can see the strings of these exported files in order to try to locate some interesting words...

strings evidences/process.*

Thank to Volatility we can find the apihooks of this memory dump. In the picture below, you will see the apihooks related with the malicious process 1928.

python2 vol.py -f stuxnet.vmem malfind apihooks –p 1928

These calls are directly linked to the Stuxnet worm. You can read the article below from Symantec.

http://www.symantec.com/connect/blogs/w32stuxnet-installation-details

DETECTING MALICIOUS DRIVERS

With modscan we can pick up previously unloaded drivers and drivers that have been hidden/unlinked by rootkits.

python2 vol.py -f stuxnet.vmem modscan

The first driver draws our attention… Please, take notes of the “Base” value (0xb21d08000) because we will export it with the command bellow.

python2 vol.py -f stuxnet.vmem moddump --dump-dir evidences/ --base 0xb21d8000

We get the sha256 hash of this driver...

sha256sum evidences/driver.b21d8000.sys

...and we upload it to www.virustotal.com

Here you have the report where you will see that this drivers has been recognized as malicious.

https://www.virustotal.com/en/file/6aa1f54fbd8c79a3109bfc3e7274f212e5bf9c92f740d5a194167ea940c3d06c/analysis/

We have just detected a malicious driver but I think that it’s necessary to look for more drivers with a similar name in order to try to find a new ones...

python2 vol.py -f stuxnet.vmem modscan | grep mrx

Ok. Let’s go to export the second suspicious driver. We will follow the same steps as described above.

python2 vol.py -f stuxnet.vmem moddump --dump-dir evidences/ --base 0xf895a000

https://www.virustotal.com/en/file/6bc86d3bd3ec0333087141215559aec5b11b050cc49e42fc28c2ff6c9c119dbd/analysis/

We have just found two malicious drivers: mrxcls.sys and mrxnet.sys.

I checked with the same commands the other two drivers and they aren’t categorized as malicious files. This is the reason I haven't show you.

DETECTING REGISTER KEYS

In this section, we will detect the register keys that have been added to the computer. With the command below, we will see a lot of them.

strings stuxnet.vmem | grep –i mrx | grep -i Services

We can obtain valuable information about some of them with the next commands.

python2 vol.py -f stuxnet.vmem printkey -K 'ControlSet001\Services\MrxNet'

python2 vol.py stuxnet .vmem printkey -K 'ControlSet001\Services\MrxCls'

With these key registers, Stuxnet will be started in each computer restart.

When we are involved in an incident handling and we are in charge of analyzing a traffic capture in a pcap format related to an attack, one of the things we usually need to do is get the files which were downloaded. The reason is that we need to have a copy of the malware or the exploit to analyze it by reversing engineer or similar...

We usually detect the original sources where these files were downloaded from just analyzing the pcap file, but they disappear in a short period of time from they were originally hosted. Because of that, we will need to extract them directly from the pcap file.

In this post, I will show you three different ways to achieve this goal using the the pcap hosted in Barracuda related to the www.php.net compromise which can be downloaded here:
http://barracudalabs.com/downloads/5f810408ddbbd6d349b4be4766f41a37.pcap

Wireshark

As you know, Wireshark is the most popular network protocol analyzer. It is capable of extracting all the files which were downloaded and captured.

If you load the pcap file in you Wireshark and use the command below...

http contains "in DOS mode"

... you can check that some executables were downloaded.

We are able to download all files which were downloaded like executables, pictures, javascripts, etc... by clicking File --> Export Objects --> HTTP and clicking on "Save all".

In the picture below shows you the files which are been recovered.

We use the command below to filter only the executables.

If we upload these files to Virustotal, we check that all of them have been categorized as malicious.

https://www.virustotal.com/en/file/d78fb2c23422471657a077ff68906d6f6b639d7b7b00ef269fa3a2ce1b38710a/analysis/

https://www.virustotal.com/en/file/816b21df749b17029af83f94273fe0fe480d25ee2f84fb25bf97d06a8fadefe4/analysis/

https://www.virustotal.com/en/file/3483a7264a3bef074d0c2715e90350ca1aa7387dee937679702d5ad79b0c84ca/analysis/

https://www.virustotal.com/en/file/5d651f449d12e6bc75a0c875b4dae19d8b3ec8b3933b6c744942b5763d5df08d/analysis/

https://www.virustotal.com/en/file/bd56609c386a6b5bc18254c7327d221af182193eee5008f6e405ab5c1215b070/analysis/

NetworkMinner

NetworkMiner is another Network Forensic Analysis Tool (NFAT) for Windows. Also, it can be installed on Linux using Mono. This tool is a great alternative to Wireshark if you just want to extract the files which were downloaded, look at the sessions, discover the DNS queries or get details about the mails detected from a pcap file.

Just loaded the traffic capture file, Network Minner downloads all files from it. Because of that, if you are using an Antivirus, It is possible it warns you if some file is detected as malicious.

You can find the folder where files have been recovered by right-clicking on a file and selecting "Open Folder". In the Picture below you can see this folder.

If we get the SHA256 checksum of the PE files, we can see that the results are exactly the same than using Wireshark. We have got the sames files.

Foremost

Foremost is a well known file carving tool. It was developed by the United States Air Force Office of Special Investigations and The Centre for Information Systems Security Studies and Research and now, it has been opened to the general public.

This tool has been designed to work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive...

Although I usually use Wireshark or NetworkMinner I have read some blogs where they describe how to use Foremost to extract files from a pcap file. For this, I have decided to use it in our example.

Just downloaded we extract all files from the pcap file, we execute the command in the picture below to extract all the files.

We can check that a "/output/exe" folder has been created containing six files.

But the checksum is different than we got with Wireshark or NetworkMinner. It seems like Foremost hasn't work well with the pcap file... For this reason I don't usually use it with a pcap file...

I've uploaded these files to my Cuckoo Sandbox and it seems to be corrupted because the files couldn't run properly...

The VirusTotal links below redirect you to the reports of the corrupted executables:

https://www.virustotal.com/en/file/2bcc5f03e1d63c5fab4aa362f6aecd43def44cc3c246effc13accb7b27b1bd45/analysis/

https://www.virustotal.com/en/file/647e4bbed78346eccc7c2d12826da5f17414110e52fb200ee55f2b8c5df533f1/analysis/

https://www.virustotal.com/en/file/38bc430e9d8656ee227e48236157e716b1d5038e83e53937cb534a5920d28c28/analysis/

https://www.virustotal.com/en/file/15964d7dd9644c8ce29fbcc4585b85394af10545ac2a2ba2315befe8e93b2a4d/analysis/

https://www.virustotal.com/en/file/32159b706d1addf63cdb1978291fc7222558d8fb7a3044775e242fba9661838d/analysis/

Kippo features

A few months ago I could get access to a SSH Honeypot called Kippo. Kippo is designed to log SSH brute force attacks and the entire shell interaction performed by an attacker when the attack is successful.

The main features of this software are:

To record the usernames and password which the attacker is trying to perform a brute-force attack.
To create a valid username/password like "root/root" to offer the attacker a fake filesystem (resembling a Debian 5.0) with the ability to add or remove files and save the command executed by the attacker.
To save suspicious files downloaded (via wget) by the attacker.
Possibility of adding a /etc/passwd file so the attacker can 'cat' it.

Installing Kali Linux in a Raspberry-PI

I decided to install Kippo at home. A HoneyNet should be available 24x7x365 because the longer it is available, the more events will be captured.

You already know that a Raspberry-PI is really cheap (around 50$ all included) and it has a lower power consumption. Because of that I will show you how to install it on your device.

Currently, Kali Linux is available for Raspberry-PI. I think is a good idea to install our HoneyNet on it. We will have the opportunity to use all tools hosted in this distribution at the same time our Kippo is running.

You can download Kali Linux for Raspberry-PI here: kali-linux-1.0.5-armel-rpi.img.xz

To install the Kali Linux version connect the SD card to your computer. In my case I have a 8gb SD card and I can detect where it is mounted by using the command below.

sudo fdisk -l

When you already know where your SD card is mounted, execute this command to copy Kali Linux to the card and wait for a while (the time estimated to copy it will depend on how speedy your card is).

sudo dd if=kali-linux-1.0.5-armel-rpi.img of=/dev/sdb bs=512k

How to install Kippo

We won't only install Kippo, we will also install a MySQL database to save the events and Kippo-Graph to look at these events in a Web interface.

Please, follow the next steps to install Kippo.

sudo apt-get install subversion python-twisted python-mysqldb apache2

1. Install MySQL

root@kali:/# apt-get install mysql-server
root@kali:/# apt-get install mysql-client

2. Allow to MySQL to accept connections. Edit the file below:

root@kali:/# vim /etc/mysql/my.cnf

And set a "#" to this line:

#bind-address           = 127.0.0.1

3. Restart MySQL to apply the changes

root@kali:/# /etc/init.d/mysql restart

4. Create the database and a user named Kippo with all privileges.

root@kali:/# mysql -h localhost -u root -p
mysql> create database kippo;
mysql> GRANT ALL ON kippo.* TO 'kippo'@'localhost' IDENTIFIED BY 'Kippo-password';
exit

5. Download Kippo from http://kippo.googlecode.com/files/kippo-0.8.tar.gz and uncompress it at /usr/local/src/.

6. Create the tables using the user just created.

root@kali:/# cd /usr/local/src/kippo-0.8/doc/sql/
mysql> mysql -u kippo -p
mysql> use kippo;
mysql> source mysql.sql;
mysql> show tables;
exit

6. Add to kippo.cfg the lines bellow.

[database_mysql]
host = localhost
database = kippo
username = kippo
password = Kippo-password

7. Create an unprivileged user to start Kippo and give him access to the folder.

root@kali: useradd -d /home/kippo -s /bin/bash -m kippo -g sudo
root@kali:/usr/local/src# chown -R kippo kippo-0.8/

8. Install the packages required for Kippo-Graph.

sudo apt-get update
sudo apt-get install libapache2-mod-php5 php5-cli php5-common php5-cgi php5-mysql php5-gd

9. Download Kippo-Graph

root@kali:/# wget http://bruteforce.gr/wp-content/uploads/kippo-graph-0.8.tar
root@kali:/# mv kippo-graph-0.8.tar /var/www/
root@kali:/var/www# tar xvf kippo-graph-0.8.tar --no-same-permissions
sudo /etc/init.d/apache2 restart

10. Start Kippo

root@kali:/usr/local/src/kippo-0.8# su kippo
kippo@kali:/usr/local/src/kippo-0.8# ./start.sh

With Kippo just installed, you need to publish the service in the Internet. By default, Kippo listens in the port 2222. You can publish it by setting a PAT, I mean, redirecting in your router the port 22 from the external IP to the port 2222 of the Kippo's internal (private) IP.

Looking at the graphs

To see the graphics, just get access to http://Raspberry-Pi_IP_Address/kippo-graph/

You will see these graphics:

Top 10 passwords
Top 10 usernames
Top 10 user-pass combos
Success ratio
Successes per day/week
Connections per IP for previous month
Successful logins from the same IP
Probes per day/week
Top 10 SSH clients
Human activity inside the honeypot
Top 10 input (overall)
Top 10 successful input
Top 10 failed input
passwd commands
wget commands
Executed scripts
Interesting commands
apt-get commands
Top 10 IP addresses probing the system for previous month
Total IP addresses probing the system per top 10 countries

Some examples here:

The best feature

In my opinion, the best Kippo feature is the capability of offering the attacker a fake filesystem and saving the commands which were executed by the intrusor just allowed to get access to the system when the "successful" attack was produced.

Here you can get several malware samples and new scripts created by hackers. You will have a great opportunity to learn new hacker trends!!!

In the file "/usr/local/src/kippo-0.8/data/userdb.txt" you can set the username/password "allowed" to get access to the fake system. You could set the password "root:0:root" or whatever you want to allow the hacker get access to.

As you already know, Parsero is a free script written in Python which helps you to automatically audit the Robots.txt file of a web server. In just a few seconds, you are able to get a lot of valuable information which is needed when you are auditing a website.

This tool is available for download here:

https://github.com/behindthefirewalls/Parsero

And here you can learn what Parsero already did.

http://www.behindthefirewalls.com/2013/12/parsero-tool-to-audit-robotstxt.html

How to install Parsero v0.6

Parsero is really easy to install. You can install it for example, in Kali Linux. You only need to run the commands below.

apt-get install python3
apt-get install python3-pip
pip-3.2 install urllib3
pip-3.2 install beautifulsoup4
git clone https://github.com/behindthefirewalls/Parsero.git

What's new?

If you look at the Parsero help, you will see two new features:

"-o" : To only show the available Disallow entries.
"-sb" : To search in Bing indexed Dissallows.

Showing only the available Disallows

In the picture below you will see the difference between using the "-o" option and not using it.

If the robots.txt file has a few entries, I recommend you don't use the "-o" option because you will be able to figure out what type of content the administrator wanted to hide looking if you get all the results. But if the file is bigger, you have a lot of information to analyze and it is easer perform the audit getting only the links which are allowed to be visited.

Searching the Disallows entries in Bing

The fact that the administrator wrote a robots.txt to try to hide the crawlers part of his content doesn't mean that the search engines don't index these Disallow entries.

For example, in the picture below, Parsero will find content indexed by Bing which it mustn't have been indexed. Parsero will show you the first 10 Bing results for the indexed Disallows.

By doing CTRL+ click on the links, your browser will be redirected to:

White links: the search page in Bing.
Green links: directly to the result found in Bing (the content is not always available and sometimes you will get a 404 HTTP code error).

Cuckoo v1.0 was published some months ago but some time has passed since I've had time to install it with my friend cor3dump3d, who has saved me a lot of time...

I have seen some new valuables features in this release. Maybe I will write a post in the future about it but for now, I am going to show you how to avoid to Cuckoo being detected by malware.

It is a trend that the malware uses anti-virtualization techniques in order to avoid being analyzed by Sandboxes like Cuckoo. I've noticed a rise in the malware techniques which use this capability. The modern malware could change their behaviour if it detects that it is being executed in a virtual environment. If you already use Cuckoo to analyze your samples, you also can appreciate other techniques like the detection of debuggers and forensics tools.

We want to maintain our virtual machine hidden from the malware samples, for this reason, we will modify our Sandbox to achieve our goal.

Detecting Virutal Machines with Pafish

A year ago I read here: Hardening Cuckoo Sandbox against VM aware malware that Alberto Ortega had developed a new tool named Pafish. This tool can be executed in a Windows OS and it will detect if it is running in a virtual machine. Some months ago, it was published in the same blog that this tool had been used by some malware developers to add it to their malware in order to detect if the malicious program was running in a virtual environment to change its behaviour. In the link below you have a great post about it: How public tools are used by malware developers, the antivm tale

So we are going to use this free tool to check if our virtual machine could be detected by some anti-virtualization techniques. The tool is available in the link below.

https://github.com/a0rtega/pafish/tree/master/pafish

After executing Pafish, we can see the picture below which shows us that Pafish detected that the hard drive has less than 50GB storage. It is just a recommendation that if you are able to give more storage to your virtual machine, just do it!!! Do you know someone who has a computer with less than 50gb? I don't and for this reason, the malware could suspect that it is being run in a virtual environment.

In the picture below you will see how Pafish has detected the Register Keys related with VirtualBox.

This tool creates a pafish.log which contain these lines.

[pafish] Start
[pafish] Windows version: 5.1 build 2600
[pafish] Sandbox traced using mouse activity
[pafish] Sandbox traced by checking disk size <= 50GB
[pafish] Hooks traced using DeleteFileW method 1
[pafish] VirtualBox traced using Reg key HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 "Identifier"
[pafish] VirtualBox traced using Reg key HKLM\HARDWARE\Description\System "SystemBiosVersion"
[pafish] VirtualBox traced using Reg key HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions
[pafish] VirtualBox traced using Reg key HKLM\HARDWARE\Description\System "VideoBiosVersion"
[pafish] VirtualBox traced using file C:\WINDOWS\system32\drivers\VBoxMouse.sys
[pafish] End

Hinding our Virtual Machine

I was reading some interesting blogs when I discovered this entry: Installing and hardening the latest Cuckoo Sandbox on Gentoo Linux which saved me a lot of time.

Hubert Kromer has created a modified cuckoomon.dll to avoid being detected by the malware and he shares it with us here.

https://github.com/markedoe/cuckoo-sandbox

You only need to replace the original one by the modified DLL in this path:

/path/to/cuckoo/analyzer/windows/dll/cuckoomon.dll

When this DLL is replaced (you don't need to restart Cuckoo) just send to Cuckoo Pafish.exe again. You can see the differences between using this DLL and using the other one.

We can see in the Pafish.log file that our Sandbox is still be traced but as you can see, we will be able to avoid detection in the majority of traces that we were detected before.

[pafish] Start
[pafish] Windows version: 5.1 build 2600
[pafish] Sandbox traced using mouse activity
[pafish] Sandbox traced by checking disk size <= 50GB
[pafish] Hooks traced using DeleteFileW method 1
[pafish] End

Now, we need to figure out how we can avoid being detected by malware by not using the mouse in our automatic analysis. If you have some info about that, just let us know!!!

Introduction

It is well known that packers are commonly used by malware developers. Do you want to know why?

They help malware hide from antivirus systems.
A packed software complicates the malware analysis.
It shrinks the size of malicious program.
Most packers are free and can be used by anyone.

When a program is packed, the executable is transformed to a new executable that stores the original one as data. The new executable contains an unpacking stub that is called by the OS to unpack the original one. The unpacking stub performs three tasks:

To unpack the original executable into memory
To resolve the imports from the original executable
To transfer execution to the original entry point (OEP)

Roughly, it is really similar to when you packed a file into a RAR file.

When you are performing a Basic Static Analysis, a packed malware thwarts your attempts of analyzing it. In a Basic Static Analysis you need to look at the Strings and the Imports to try to figure out what the program does. In the picture bellow, you will see the differences between a malware sample packed and the same one which has been unpacked.

There is a lot of packers software. These are some of them:

UPX
Petite
PECompact
WinUpack
Themida
ASPack
...

Analysing +1000 malware samples

As I said, packers are commonly used by malware developers but... how often are packers being used? For this post, I've analyzed more than 1.000 random malware samples to try to detect how many samples have been packed and what the most common packer is.

To achieve this puporse, I have used packerid.py and the Panda signatures which can be downloaded from the link bellow:

http://research.pandasecurity.com/blogs/images/userdb.txt

There are more signatures to detect packed software but I chose that, because comparing the results with the other ones, Panda signatures have more ratio detection. However, it is your choice to choose whatever you want. In the links bellow, you can find more signatures to perform a packer detection.

http://www.sysreveal.com/tag/userdb-txt/
http://handlers.sans.org/jclausing/userdb.txt
https://github.com/cuckoobox/cuckoo/blob/master/data/peutils/UserDB.TXT

I've uploaded a file to Pastebin where you can find the results of the malware analyzed that was obtained by packerid:

http://pastebin.com/j4k2idSN

After analyzing the samples, these are the results. Obviously, it draws our attention.

Conclusion

After analyzing more than 1000 malware samples, we could think that it is not so usual for malware developers the fact of packing their malicious software. Maybe +1000 samples analyzed aren't enough to obtain a conclusion, maybe the Panda signatures aren't good enough or maybe, the malware developers are changing their techniques to go unnoticed.... I invited you to draw your own conclusions... What is your opinion?

In the list below, you can find the accurate data about this research.

953 No packer detected
38 Microsoft Visual C++
35 UPX
29 .NET executable
17 Microsoft Visual Basic
8 BobSoft Mini Delphi
4 ASPack
2 Wise Installer Stub
2 WinRAR
2 InstallAnywhere
2 PeCompact
2 ASProtect
1 Themida
1 WinZip

Introduction

A few weeks ago Trend Micro published in their blog the post below: The Siesta Campaign: A New Targeted Attack Awakens. Here they share their research about a targeted attack suffered by all kinds of industries: Energy, Finance, Health care, Public administration... Some days after that, FireEye published in their blog a post called A Detailed Examination of the Siesta Campaign where they accuse APT1 group or another group that uses the same tactics and tools as the guilty party of these attacks.

Thanks to Trend Micro has shared the malware sample's checksum of one variant, I've been able to get a copy of it to get deep into this issue.

SHA1: 014542eafb792b98196954373b3fd13e60cb94fe

Spear-Phishing and Social Engineer Techniques

It is said (in both posts) that this campaign began with an spear-phishing email with links to archives. The file was named "Questionaire Concerning the Spread of Superbugs February 2014.exe"and it was compressed in a ZIP file hosted in a remote server.

I guess that the attackers used the same technique described in APT1 report written by Mandiant. The file could have a PDF extension but the file name actually includes serveral spaces after “.pdf” followed by “.exe”, the real file extension. In the picture bellow you will see the file that looks like a PDF file.

If we change to detail view we will see a PDF file...

... but it actually is not a PDF file... It looks like a PDF but it is an executable file...

That is the way this file will be showed in the Desktop. That really seems a PDF file for a untrained eye.

When we run what appears tobe a PDF file, the executable drop a real PDF file and it is opened... The normal user could thing that nothing weird has happened... The user received and e-mail with a PDF and now it is already opened...

... but it drops another executable in the background called UIODesrvr.exe. This file is the real malware.

SHA1: 56bcdac7bbf5f99a496c78e2fff0d9bed96c458e

If we look at all process running in our machine, we will see that this malware is being executed.

Brief Malware Analysis

That file was compiled at 2014/02/19.

The first thing the malware does is to connect to www[.]skyslisten[.]com which seems to be the C&C server. This server isn't currently available.

The User-Agent used by the malware is "Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0)".

We can see in our IDA that the first thing the malware does is to check if that code ">SC<" is written within HTML code at the domain mentioned above. If it exists, then it tries to locate some commands written in the web server to be executed. According toTrend Micro, these are the commands used in by this malware.

HTTP code
prefix: “>SC<”

Commands
“run1” open a remote shell
“run2” pipe shell commands from URL1
“run3” pipe shell commands from URL2
“http” pipe shell commands from C2
“x_” sleep for specified number of minutes

This is the typical behavior of a backdoor to begin to start with a lateral movement.

Tracking the attacker

As we said before, the domain www[.]skyslisten[.]com seems to be the C&C server. The picture bellow will show you who registered this domain.

This guy registered microsofthomes[.] com. FireEye says in their report that this domain is directly connected with the last one mentioned above.

The picture bellow will show you some domains registered by this guy. Only five domains from more than a total of roughly 17,000 domains registered with this same email address said by Trend Micro.

Conclusion

When we talk about APT or Targeted attacks, examples of well-known sophisticated Malware like Stuxnet, Flame, Careto and security breaches suffered by companies like Google, RSA, Adobe, Apple came to my mind ... But as we have seen, it is not necessary to develop a sophisticated malware to perform a Targeted Attack. Obviously, the most sophisticated attack will be most successful...

Introduction

After 12 years, support for Windows XP ends today, April 8, 2014. That means there will be no more security updates or technical support for Windows XP. So XP has officially died but millions of computers with this operating system installed are still "alive" and will be unprotected against new threats from right now, these are the Zombies-XP. Even thousands of ATM's and other critical infrastructures will be using this OS for a while, nobody knows how long...

And what is the advice from Microsoft? We have two options.

1. To upgrade to a newer Windows operating system like Windows 7 or Windows 8.1.

2. "If your current PC can't run Windows 8.1, it might be time to consider shopping for a new one."

Sure, we should upgrade to the lastest Windows OS. If our hardware doesn't support it, we should buy a new computer or hundreds in the case of some companies and install Windows 8.1, working hard to transfer all data from one computer to the another, teach the users to use Windows 8.1, etc... Or maybe it is a great opportunity to move to a free Linux operating system, but that is another issue...

This post is focused on users or companies who are not allowed to upgrade to the lastest Windows OS for different reasons like not being able not afford to buy new computers, to have old software which is not capable of runnig in other OS, to not have staff enough to perform the upgrade, etc...

The main threats we need to deal with

First of all we need to keep in mind the attack vectors we need to fight with.

Browser-based attacks. I think these attacks could be the most common attacks at this moment. A website could take advantage of a web browser vulnerability just by visiting it. Also, a website could exploit a plugin enabled in the web browser, like Java or Adobe plugins, in the same way.

Network Exploits. New worms could be designed to exploit the Windows XP services running in a computer. Now, they are unprotected so the same worm could work in the future after being discovered.

Social Engineering techniques. These techniques try to trick a user into opening a link in an email or open an attachment supposed to be a PDF file or whatever "legitimate" file to infect a machine. Look at the case of the Siesta Campaign.

These attacks vectors are common to other OS, but in this case it is really dangerous if we use one which will not have security updates in the future. We will be vulnerable against ZeroDay threats (that is common to all OS) and known threats. Without having security updated we can't fix the previosly mentioned.

What is new?

Some problems have been fixed in the current version which have three new features that I would like to talk about.

In the last version, Parsero was able to detect if the content in the Disallow entries had been indexed by Bing by doing searches in this crawler. Now, we are able to check if these links indexed are actually available or not. Notice that Parsero only checks the links of the first Bing results page. It means the first 10 results are analyzed.

Now Parsero is able to detect if there are Disallows entries repeated in the robots.txt file in order to check each one once to save time. The picture bellow shows you a robots.txt file with the same links repeated.

And how Parsero is able to detect it and check each Dissallow entrie only once.

In the last version, Parsero downloaded the robots.txt to the machine in order to parse it. Now, Parsero performs this task by doing the same task on the fly.

You can download Parsero here: https://github.com/behindthefirewalls/Parsero

More info here: http://www.behindthefirewalls.com/search/label/Parsero

As Google say, "Cross-site scripting (XSS) bugs are one of the most common and dangerous types of vulnerabilities in Web applications. These nasty buggers can allow your enemies to steal or modify user data in your apps..."

So they have decided to help us to learn how to exploit these kinds of vulnerabilities by creating a vulnerable web site at:

https://xss-game.appspot.com/

There are 6 exercises to resolve. Before starting to resolve these issues... Why should I know how to exploit a XSS vulnerability?

To be more qualified in the security field.
To make money.

Currently, Google is paying up to $7,500 for dangerous XSS bugs discovered in their most sensitive products.

But Google is not the only one who is paying a bounty for disclosing vulnerabilities. Others like Yahoo, Facebook or Paypal have the same policy of rewards for discovering bugs.

In this post, we are going to resolve 3 issues proposed by Google. In the next post, we will resolve the latest ones.

Exercise 1

That is the easiest exercise. Our input will be directly included in the page without proper escaping.

By inserting the code below, we will be successful.

<script>alert('BehindTheFirewalls')</script>

Exercise 2

This exercise is an example of how to perform a persistent or stored Cross-Site Scripting attack in a simple way.

Exercise3

This exercise is a little complex because the user doesn't have an input to try to exploit the XSS.

But what happen if we rewrite the URI? If we change "#1" by "#11111"...

... we will see that "1111" has been added to the source code.

So, if we add #11111'onerror=alert('BehindTheFirewalls')> at the end of the URL, the code will be:

<img src='/static/level3/cloud#11111'onerror=alert('BehindTheFirewalls')>'.jpg' />

And the alert will appear.

These are the three posible options to exploit this vulnerability.

/frame#1'onerror=alert('BehindTheFirewalls')>

/frame#1.jpg'onload=alert('BehindTheFirewalls')>

/frame#1jpg'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

In the previous post we talked about how to resolve the exercises 1, 2 and 3 of the XSS-game proposed by Google. Now, we are going to resolve the latest ones.

Exercise 4

This exercise is similar to the previous one (Exercise 3). The main difference is that now, we have an input.

It is expected that a number will be typed into the box, but... what will happen if we write a name instead of typing a number?

What happens is that our string has been included into the "img" tag...

So, if we use: 3');alert('Behindthefirewalls the result would be...

And the alert appears...

Exercise 5

I don't know what the reason for looking at "next=confirm" was at first because logic would dictate that the first attempt would be to try to exploit a XSS vulnerability in the input field...

But the first thing that I did was to replace "confirm" by "http://www.behindthefirewalls", reload the page, type my mail and click on "Next" and the result was that I was redirected to my blog...

https://xss-game.appspot.com/level5/frame/signup?next=http://www.behindthefirewalls.com

We have discovered another security issue but what we want to do is locate a XSS vulnerability.

I was trying different options with no success so I decided to read the hints offered by Google. "If you want to make clicking a link execute Javascript (without using the onclick handler), how can you do it?"

So I tried to use:

next=javascript:alert("behindthefirewalls")

And the alert appeared.

Exercise 6

The fourth hit says: "If you can't easily host your own evil JS file, see if google.com/jsapi?callback=foo will help you here."

If we change "foo" for "alert"www.google.com/jsapi?callback=alert will have included in its code:

So, if we use the link bellow, we can exploit the vulnerability.

frame#//www.google.com/jsapi?callback=alert

I spent some time trying to solve this exercise in a different way. I tried a lot of possibilities to exploit a XSS vulnerability...

... until I remembered a post I read some months ago...

#data:text/javascript,alert('behindthefirewalls')

Malware Sample 1

Malware Sample 2

Malware Sample 3

Malware Sample 4

Conclusion

Introductions

Installation

Example 1

Example 2

The future of Parsero

STUXNET IMAGE INFO

DETECTING MALICIOUS PROCESS

DETECTING MALICIOUS CONNECTIONS

DETECTING DLL

DETECTING INJECTED CODE

Stuxnet Trojan - Memory Forensics with Volatility | Part II

DETECTING API CALLS

DETECTING MALICIOUS DRIVERS

DETECTING REGISTER KEYS

Wireshark

NetworkMinner

Foremost

Kippo features

Installing Kali Linux in a Raspberry-PI

How to install Kippo

Looking at the graphs

The best feature

How to install Parsero v0.6

What's new?

Showing only the available Disallows

Searching the Disallows entries in Bing

Detecting Virutal Machines with Pafish

Hinding our Virtual Machine

Introduction

Analysing +1000 malware samples

Conclusion

Introduction

Spear-Phishing and Social Engineer Techniques

Brief Malware Analysis

Tracking the attacker

Conclusion

Introduction

The main threats we need to deal with

Suggested solutions

The BUG description

POC in the server side

POC in the client side

Affected versions

What should I do?

The OpenSSL Bug timeline

What is new?

Exercise 1

Exercise 2

Exercise3

Exercise 4

Exercise 5

Exercise 6