Bold Statements
I’m currently involved in a “DMZ Redesign” effort in a sufficiently large enterprise (800+ hosts in “the DMZ”) and I thought this might be an opportunity to reflect on some aspects of “DMZ networks” in a series of posts.
Continue reading “Considerations on DMZ Design in 2016, Part 1”
Continue readingThis is a guest post from Jed Kafetz.
After seeing Christopher’s post I decided to create a proof using GNS3 and Virtualbox.
The aim is to perform the exact attacking using Antonios Atlasis’ Chiron tools and run a Wireshark packet capture to prove the hop limit drops below 255.
Continue reading “Follow-Up on CVE-2016-1409 – IPv6 NDP DoS Vulnerability”
Continue readingToday we started publishing several of our hardening documents to a dedicated GitHub repository — and we’re quite excited about it! It took a while to develop a suitable markdown template to support all the requirements you have when you write a hardening guide, but we’re online now!
At the moment, only a few hardening guides are online, but that should continuously increase in the future.
Click here for the GitHub ERNW Hardening Repository!
Cheers,
Matthias
Continue readingWelcome back to the radare2 reversing tutorials. If you’ve missed the intro, you can find it here.
The last time you got the challenge01 binary and your goal was to find the password for the login. Let’s see how the application looks like:
Continue reading “Reverse Engineering With Radare2 – Part 1”
Continue readingJust a few days ago I had a blast again at this year’s Black Hat. Some of the talks were really worth listening to, so I wanted to point them out and give a short summary.
USING UNDOCUMENTED CPU BEHAVIOR TO SEE INTO KERNEL MODE AND BREAK KASLR IN THE PROCESS – Anders Fogh & Daniel Gruss
They had the last slot at the last day of Black Hat which resulted in a kind of empty room, but in my opinion it was an awesome talk and I even had the pleasure to meet these two guys at our ERNW dinner.
The talk was about a very weirdly documented Intel instruction which does not check for privileges or throw exceptions:
Continue reading “Black Hat 2016 Summary”
Continue readingIn a recent assessment, we had to evaluate how Microsoft’s System Management Server (SMS) certificate management solution (CMS) stores and handles certificates. This question came up because sensitive, encrypted user certificates were to be stored in the SMS CMS. Due to the sensitivity of the handled certificates, we assessed the protection capabilities of the certificate management solution against extraction attempts from a local attacker with administrative privileges.
Continue reading “PFX Profiles in Microsoft’s System Management Server”
Continue readingAs some of you may know, there is a “new” reverse engineering toolkit out there which tries to compete with IDA Pro in terms of reverse engineering. I’m talking about radare2, a framework for reversing, patching, debugging and exploiting.
It has large scripting capabilities, runs on all major plattforms (Android, GNU/Linux, [Net|Free|Open]BSD, iOS, OSX, QNX, w32, w64, Solaris, Haiku, FirefoxOS and even on your pebble smartwatch 😉 ) and is free.
Sadly, I had some problems finding good tutorials on how to use it, as the interface is currently a bit cumbersome. After fiddling around, I’ve decided to create a little tutorial series where we can learn together ;). Continue reading “Reverse Engineering With Radare2 – Intro”
Continue readingHi all,
Most of you that are pentesters may have already tested plenty of webservices using SOAP (Simple Object Access Protocol) for communication. Typically, such SOAP messages are transferred over HTTP (Hypertext Transfer Protocol) and are encapsulated in XML (Extensible Markup Language). Microsoft has developed different representations of this protocols to reduce the network load. As these representations/protocols aren’t really covered by typical tools out there, this post will show you some of them, and a proxy which can be used to simplify the testing.
Continue reading “Pentesting Webservices with Net.TCP Binding”
Continue readingHi,
I won’t be in Vegas for Black Hat this year as there’s a direct conflict with one of my kids’ birthdays, but I thought one or another reader might find it helpful to get some inspiration as for selecting the talks to catch (not least as there’s so many interesting ones). I hence decided to quickly write this post.
Continue reading “Not Sure Which Talks to Attend at BHUSA?”
Continue readingEver got a backdoor installed on your computer by your beloved mouse? Here’s the story of a poor mouse that got really, really sick.
Do you remember the times where people put Teensy-boards and USB hubs in their mouses? [Chris? ;)] Their aim was to attach an additional Human Interface Device (HID, like keyboards or mouses) with some payload in kind of e.g. keystrokes or mouse movements. Also, there are devices available like the USB Rubber Ducky in the housing of a USB thumb drive.
The principle is easy: The tools are using a programmable microcontroller with the capability to emulate USB HID. That’s it. Just program your board of choice with the payload fitting your needs and plug it in at the target computer. The latter will recognize it as a keyboard/mouse and the payload-keystrokes will be entered.
But why should external hardware be used? Many modern gaming peripherals provide functions to store macros on them, including enough onboard memory for little payloads.
While we were working on the layout of this years’ Troopers-Badge, I felt uncomfortable using my touchpad, so I switched over to a Logitech G-series gaming mouse. This one worked like a charm – many buttons and the feature to store personal profiles on the mouse itself, which is perfect when you work on more than one machine.
But wait – macros and profiles stored on the mouse? Recall the lines above concerning the HID story.
Could it be possible to store a macro big enough to drop a reverse shell on a Windows target?
Actually – it could.
It’s just as simple as using the Logitech Gaming Software’s Command Editor. Choose a button, put a macro on it, fit the timings and go!
The only thing you should consider, that you’re limited to about 100 keystrokes. If there should be something dropped on the target, like an executable or a script, you should think about using FTP or Powershell to download it externally, like I did here.
In this Proof of Concept the marco opens the Windows Command Line and downloads Netcat via Windows’ own ftp.exe from an external FTP server. Afterwards, it launches Netcat in background mode, while a Netcat listener already is waiting on the remote machine.
I think this kind of attack is dangerous due to its minimal effort and people trusting their mouses. Who would be afraid of a manipulated mouse, while being away for just 2 minutes to grab a cold Mate drink in the kitchen? The mouse’s software in this example offers the option to delay the keystrokes. Consider, the mouse acts like usual and after 30 or 60 seconds the bad magic happens, and it would take only a few seconds, so you might even miss the chance to see the windows popping up.
Live long and prosper,
Stefan
Continue reading