Quick note regarding my last demo

Ok, my last demo the reason the LFI-RCE failed was very simple: I messed up the Apache/PHP config in LAMPP while fuzzing earlier and forgot to reset it :/

Don't worry, my next demo will be on leveraging SQLi vulns in order to gain RCE, and I have to setup a better testbox anyway.

I will be showing the manual method + SQLMap methods of doing it all, and might even get a chance to video it!

WebApp Haxploitation with Weevely, Introducing InterSect.

Ok. This is a fairly pointless demo I made to demonstrate how a web-application bug (in this case LFI + Command Injection) can be leveraged to gain complete root access over a server. I simply took a bunch of screencaps during the demo I made to show a friend "Why web app bugs are dangerous".

So. Here goes!

The web app we used here was THIS: Mutillidae - IronGeek

Part One: The Buggy Page.
This shows the buggy applications vulnerable page. It is a simple "Do a DNS lookup" page that just by looking at we can discern certainly has a Local File Inclusion vulnerability, and more than likely a Command Injection vulnerability.

Part Two: Lets Look for LFI
So. I knew there was LFI, and decided I would let fimap check for me, to see could I pull off any LFI-RCE stuff.

So. Now we know Fimap no canhaz RCE on the site, however there IS LFI. I want RCE, so I move swiftly along to the second vulnerability - Command injection.

Part Three: Command Injection
I decided to inject a Weevely Webshell into the app, so I put it up on my webserver and used wget to "inject" it.
Here is a screencap...

Ok. Shell seems injected, so we move on and try connect to it using the Weevely Client.

Part Four: There are Weevils In Your WWWROOT
Connecting to Weevely's PHP backdoor with the client. This is too easy...

So, lets see what it looks like in there...

SO! Got remote code execution and a "shell" like session. Let's see does Weevely's reverse shell work for us and try become uid=0 :D

Part Five: Netcat Sais Meow
First off, we start Weevely's reverse shell plugin and tell it to phone home to us... We will be listening for it...

Ok. Now for the listener end of things...

w00t! We haz a shell :D
... Moving Swiftly along...

We decide to check kernel version and randomly see what commands work. I decided to lsusb for some arbitrary reason. Don't ask.

Ok. So we move on to escalating/exploring!

Part Six: Enter InterSect.
So I decide to test out InterSect, a wonderful post-exploitation tool developed by ohdae of BindShell Labs.

Here is a screencap of wgetting Intersect to the target box...

Aaaaand now to RUN Intersect ......

Ok. Intersect does not want to run as NON root, so it tells me how to get root on the box... Seeing as I like root... lets go get some!

Part Seven: We Are uid=0, + Harvest Some Infodox
So. I simply run a hypothetical root-exploit I had left in /tmp and getr00t! (It was actually a SUID shell I dropped earlier, as my kernel doesnt like localroots and panics!)

So. Got root. What next? Lets try see does InterSect want to run this time...

It Works! Sadly my battery promptly /quit a moment later but I think you get the idea of what you can do!

LINKS:
BindShell Labs
Intersect 2 - GitHub
Weevely - GoogleCode
Fimap - GoogleCode
And Finally
Insecurety Research

Installing Nemesis on Ubuntu/BackTrack

Ok. Simple Post to explain how to go about installing Nemesis on Ubuntu/BackTrack.

What is nemesis?
Nemesis is a packet crafting/sending utility. It, much like hping3, allows you to craft and send packets of a few different protocols. I mainly use it for crafting/sending ARP packets for ARP poisoning, and my tool "arptoxin" uses it.


This post is also available HERE

Step One: Sudo Bash
i.e. you must be root.

Step Two: Install Dependancies
apt-get install libdnet-dev
apt-get install libpcap-dev

Step Three: Install libnet
cd /usr
mkdir nembuild
cd nembuild
wget http://ips-builder.googlecode.com/files/libnet-1.0.2a.tar.gz
tar -xf libnet-1.0.2a.tar.gz
cd Libnet-1.0.2a
./configure
make && make install

Step Four: Install Nemesis
cd /usr/nembuild (if not still there!)
wget http://heanet.dl.sourceforge.net/project/nemesis/nemesis/1.4/nemesis-1.4.tar.gz
tar -xf nemesis-1.4.tar.gz
cd nemesis-1.4
./configure --with-libnet-includes=/usr/nembuild/Libnet-1.0.2a/include --with-libnet-libraries=/usr/nembuild/Libnet-1.0.2a/lib
make && make install

Done! Nemesis SHOULD look like this...

New Project - ShellCode Collection/Repository

So. After getting sick of having to search all the time for shellcode, I decided it would be a nice idea to just create a nice repo of shellcode so people can just svn up and have a searchable repo of organized shellcode.

Hence I started this project.

It is a slow thing to start, and I seriously need people to help me. I can add people as committers if they want to help out, and the idea is to collect a wide variety of shellcode for various OS/Architectures/systems and have it searchable.

I eventually hope to clean up existing shellcode and add a python script for searching the repo, compiling, objdumping and encoding the shellcode.

Anyways, without further ado..

Project Homepage: Insecurety Research - Shellcode Repository
GoogleCode Page: Shellcode Repository at Google Code

Web Malware Collection - more Updates!

So, I have been grepping and searching through logs and google searches, hunting for malware to add. And oh lord, I am finding a LOT!

Lately I started hunting through pastebin for "more malware" and such, and am slowly amassing a fairly epic amount to sort. Also have to handle submissions, Honeypot logs, etc.

So, check out the project page! Web Malware Collection

Web Malware Collection Updated

Ok, quick post. The Web Malware Collection has had some updates done, and I am *Still* busy sorting samples to commit.

Currently it has 443 samples (according to this "find . -type f | wc -l" command)

Project Page: http://insecurety.net/projects/web-malware/
GoogleCode: http://code.google.com/p/web-malware-collection/

SVN repo is on googlecode so SVN up :D

POST-it DoS

So. Got bored waiting for a lecturer who showed up late, and decided to add some shit to POST-it DoS while working on code for RailGun.

I added a massive list of Useragents (like 70k of em or something, its big...), randomize-useragent-from-list function, and a rather epic random junk generator for the POST data instead of using just a big load of X's.

So now it hits a bit harder (actual random junk) and may even defeat some failures of IDS/IPS... until the target box dies, that is.

It KIND OF implements a SlowLoris attack of kinds too, just to make it even more awesome.

Check it out here --> POST-it DoS and as always, use SVN to get it :)