[802.11] Wireless Jamming

Ok. Infodox BRIEFLY touched upon 802.11 jamming in his talk at CampusCon (their site seems to be down at the moment).

For those interested, the talk can be downloaded here: Insecurety Research

Anyways, onward to "The Good Stuff". I (x41) am simply posting the parts he wrote so far, and when he comes back he says he will finish the job.

Wireless Jamming. Sometimes one wants to disable all 802.11 stuff within range (i.e. WiFi) for some reason (perhaps deauth everyone so a KARMA style attack will work better?) and often this can be a bit of a challenge.

Challenge accepted.

First off, let's get to grips with some software called "mdk3".

MDK3 is a 802.11 flooding tool, and comes preinstalled on BackTrack and several other Pentest distros.

However, let's assume you are running a standard Ubuntu box and have not got it installed... So start by installing aircrack.

apt-get install aircrack-ng (ubuntu)
yum install aircrack-ng (fedora)
...Or, compile from sauce...
http://www.aircrack-ng.org/

Now. MDK3.

http://homepages.tu-darmstadt.de/~p_larbig/wlan/

Grab the source from here, untar, ./configure, make && make install (as root).

Then to run (as root):

PUT CARD INTO MONITOR MODE BEFORE CONTINUING!
sudo airmon-ng start wlan0 (where wlan0 is your wifi card)

mdk3 (arguements)

Some samples... (assumes mon0 is your monitor mode interface)

1. mdk3 mon0 x 1 -c (target client MAC) -t (target AP MAC)
This one simply deauths the victim client. Good for targetted jamming.

2. mdk3 mon0 d -b /root/blacklist
assuming you have a list of MAC addresses you DONT wish to have online, you put em in a list and blacklist em. This jams them.

3. mdk3 mon0" d -w (and the path to your whitelist file)
This kills everyones WiFi EXCEPT the devices in the whitelist.

Now. On to more fun things... Killing AP's.

Introducing "ap fucker".

AP Fucker is a python script that automates these DoS attacks. My preferred mode is "Destruction Mode". For obvious reasons.

Grab AP fucker here.. ApFucker - Pastebin

Running this is very simple. Just sudo bash (must be root), start the interface in monitor mode, and run it.

More to come - this was just an introduction!

WebApp Haxploitation with Weevely, Introducing InterSect.

Ok. This is a fairly pointless demo I made to demonstrate how a web-application bug (in this case LFI + Command Injection) can be leveraged to gain complete root access over a server. I simply took a bunch of screencaps during the demo I made to show a friend "Why web app bugs are dangerous".

So. Here goes!

The web app we used here was THIS: Mutillidae - IronGeek

Part One: The Buggy Page.
This shows the buggy applications vulnerable page. It is a simple "Do a DNS lookup" page that just by looking at we can discern certainly has a Local File Inclusion vulnerability, and more than likely a Command Injection vulnerability.

Part Two: Lets Look for LFI
So. I knew there was LFI, and decided I would let fimap check for me, to see could I pull off any LFI-RCE stuff.

So. Now we know Fimap no canhaz RCE on the site, however there IS LFI. I want RCE, so I move swiftly along to the second vulnerability - Command injection.

Part Three: Command Injection
I decided to inject a Weevely Webshell into the app, so I put it up on my webserver and used wget to "inject" it.
Here is a screencap...

Ok. Shell seems injected, so we move on and try connect to it using the Weevely Client.

Part Four: There are Weevils In Your WWWROOT
Connecting to Weevely's PHP backdoor with the client. This is too easy...

So, lets see what it looks like in there...

SO! Got remote code execution and a "shell" like session. Let's see does Weevely's reverse shell work for us and try become uid=0 :D

Part Five: Netcat Sais Meow
First off, we start Weevely's reverse shell plugin and tell it to phone home to us... We will be listening for it...

Ok. Now for the listener end of things...

w00t! We haz a shell :D
... Moving Swiftly along...

We decide to check kernel version and randomly see what commands work. I decided to lsusb for some arbitrary reason. Don't ask.

Ok. So we move on to escalating/exploring!

Part Six: Enter InterSect.
So I decide to test out InterSect, a wonderful post-exploitation tool developed by ohdae of BindShell Labs.

Here is a screencap of wgetting Intersect to the target box...

Aaaaand now to RUN Intersect ......

Ok. Intersect does not want to run as NON root, so it tells me how to get root on the box... Seeing as I like root... lets go get some!

Part Seven: We Are uid=0, + Harvest Some Infodox
So. I simply run a hypothetical root-exploit I had left in /tmp and getr00t! (It was actually a SUID shell I dropped earlier, as my kernel doesnt like localroots and panics!)

So. Got root. What next? Lets try see does InterSect want to run this time...

It Works! Sadly my battery promptly /quit a moment later but I think you get the idea of what you can do!

LINKS:
BindShell Labs
Intersect 2 - GitHub
Weevely - GoogleCode
Fimap - GoogleCode
And Finally
Insecurety Research

Web Malware Collection - more Updates!

So, I have been grepping and searching through logs and google searches, hunting for malware to add. And oh lord, I am finding a LOT!

Lately I started hunting through pastebin for "more malware" and such, and am slowly amassing a fairly epic amount to sort. Also have to handle submissions, Honeypot logs, etc.

So, check out the project page! Web Malware Collection

802.11 Race Condition Exploitation

802.11 Race Condition Exploitation

This post is about the Race Condition Exploitation method for "hijacking" WiFi clients.

Basically how it works is, the client sends a GET request for whatever. You respond with a 301 redirect to your content.

How you do this is by sniffing the traffic, and when you see a GET you inject a 301 to the client and a FIN or RST to the AP. You essentially pretend to be the access point for a second.

SO far there are several variants out there, including a Metasploit module. It can be found in auxiliary/spoof/wifi/airpwn

The technique was originally demoed by "toast" at DEFCON 12, and used to replace images with shock porn like Goatse or Tubgirl.

Some links of interest...

http://evilscheme.org/defcon/
http://airpwn.sourceforge.net/Airpwn.html
http://sourceforge.net/projects/airpwn/
http://securitysumo.wordpress.com/2008/04/22/running-airpwn/

Aaaaand some video...

So naturally, I wondered. I can inject images and javascript... So what about executables? (you see where I am going...)

Then I found someone else was doing this exact thing with updates. Hijacking them ala airpwn. Their tool is named "IPPON", and is very interesting, albeit buggy as fuck. If you can make it work, please god message me!

Here be their presentation from DEFCON 17, and their code!
http://www.slideshare.net/itzikk/ippondefcon17
http://code.google.com/p/ippon-mitm/

Now on to the best of the bunch (IMO). RCX. Developed by Melchi Salins, it allows you to do *anything*, is written in Python using SCAPY, and generally is fucking BADASS! With it, you can redirect ANYTHING to ANYTHING.

http://rcx.sourceforge.net/rcx.html

Coming Soon... The RCX config file for mass update hijacking!

##

Ok. Comments were asking for how to install AirPwn in Ubuntu 10.04/Back Track 5.

Here is how it is SUGGESTED to do it...

http://www.timashley.me/node/718


Now I found the second part of that (install lorcon + airpwn) did not work for me. So... I did things a bit differently.

Check out this LaunchPad: https://launchpad.net/~nagos/+archive/ppa?field.series_filter= 

Now, I simply grabbed the .deb files for Airpwn and Liblorcon from there.
Install Liblorcon FIRST. Then Airpwn.

However, this PPA should work fine also: ppa:nagos/ppa

It just didn't work for me :P

MITM w/ ARP Toxin and Driftnet - Video + Tool

Quick into video about using ARP Toxin to preform MITM attacks, with extra fun involvin' using Driftnet to sniff images sent across the network.



Code is here -- Sauce Code

Bug reports and suggestions welcome!
Video made for CampusCon :D

Collection of web app backdoors (v1)

This is a collection of the common PHP (and ASP if I find them) backdoors used by malicious hackers to take over servers.
I am NOT responsible for your use of this!


Warning: There is every possibility these backdoors may be backdoored. I am going to eventually sort them into two folders - backdoored backdoors and clean backdoors. Then I can sit back and watch y'all go apeshit at some skiddies who backdoor their backdoors :D


Download the list here...Web Backdoors