Generally speaking, I’m more of a Cat type of guy, but I have to say I really
love BloodHound. And if you do too, you are in for a treat…
Last week, the ERNW InsightActive
Directory Security Summit took place in Heidelberg.
(More Info)
For
this occasion, @Enno_Insinuator asked me
if I would like to deliver a BloodHound Workshop, and of course I accepted
the challenge…
We had a full class, I had a blast training it, and I hope the trainees enjoyed
it as much as I did.
But that’s not all…
Another part of the deal was that I had to write a Training Guide that we
would then share with the Community (aka you).
So here it is, fresh from the Heidelberg press and available for download:
This is a write-up about how to use Frida to dump
documents from a process after they have been loaded and decrypted. It’s a
generic and very effective approach demonstrated on a piece of software from
North Korea.
Some time ago we received an ISO file which was a dump of a CD-ROM from North
Korea. The only information we got was that it included a document viewer and
various PDF documents. I started to dump the content of the ISO in order to
analyze what the reader was actually doing by mounting it:
Recently, we identified security issues in the Nexus Repository Manager software
developed by Sonatype. The tested versions were OSS 3.12.1-01 and OSS 3.13.1-01.
We identified a Java Expression Language Injection in the role and user creation
function. In order to exploit this issue, the attacker needs to be authenticated
with high privileges, the standard anonymous user is not sufficient.
If a conference feels like a great vacation, then the organizers are doing it
absolutely right! Hack.lu took place for the 14th time in
Luxembourg. From the 16th – 18th October, the Alvisse Parc Hotel hosted the
Hack.lu conference. Those three days were full of talks, workshops and
“discussions about computer security, privacy, information technology and its
cultural/technical implication on society“. Some members of the ERNW crew had
the chance to attend Hack.lu this year and we all enjoyed it a lot!
I was at the hack.lu conference in Luxembourg this year and attended the fuzzing
workshop, held by René Freingruber from
SEC Consult. I have been curious about this topic
for some years now, but besides doing some manual fuzzing and web-fuzzing, I
never looked into the whole topic that much.
The workshop lasted for around four hours. Before the workshop started each
student got two VMs (Linux/Windows) where everything necessary was already set
up. The VMs included 23 exercises, with step-by-step explanations, source code
and exploits. René started out with an introduction to fuzzing, listing popular
fuzzers and showing an example on how to fuzz with
afl.
Matthias and I
had the pleasure to give a talk at the H2HC2018 in
São Paulo, Brazil about attacking VMware NSX. The talk is an introduction to
VMware NSX for security researchers, and it discusses possible attack vectors
including the management, controlling, and data exchange planes. We demonstrated
how to prepare a fuzzing and debugging setup for the ESXi kernel and the kernel
modules. It should be noted that Olli was also
supporting the research.
The slides can be found
here.
First day at hack.lu. Three of us kicked the conference
off with the ARM IoT Firmware Emulation workshop by
Saumil. The goal of this workshop was not
so much to write exploits or to pwn boxes but to learn how to build a beneficial
research environment by emulating the hardware of a Linux based IoT device to
run its firmware in order to run analysis and tests.
First step is to obtain the firmware. This could be done by dumping it directly
from the device or by downloading firmware images from the vendor. In order to
dump the firmware from the device one has to obtain access to the underlying
system which is usually done by finding the serial console on the hardware since
this one often exposes an unauthenticated root shell. I think there is enough
documentation online on how to identify and connect to a serial console so I
won’t cover the details here. It’s also covered in Saumil’s
slides
in detail. Having the bootup logs from this console will be helpful later
though. While talking about baud rates for the serial console Saumil made a
great pun I don’t want to withhold: “Most common is baud rate 115200. If you
find a console with baud rate 9600 you are in fact talking to an acoustic
coupler. That’s not an IoT device, it rather belongs to a museum.”
At this years ARES conference, Jonas Plum (Siemens) and me (Andreas Dewald, ERNW
Research GmbH) published a paper
about the forensic analysis of APFS, file system internals and presented
different methodologies for file recovery. We also publicly released a tool
implementing our presented approaches, called
afro (APFS file recovery).
APFS is the file system for Apple devices that is used by default on all current
iOS mobile devices, as well as macOS since High Sierra, and is thus currently
rolled out on a large number of devices. By using afro, we evaluated and
compared the different approaches amongst each other and identified the method
that so far delivers the best results and compared it to photorec. This showed
that AFRO outperforms photorec on the evaluated APFS dataset. In the
presentations of this research we were often asked if other tools like Blackbags
Blacklight do not already support this recovery process. So, we decided to
compare the file recovery capabilities of BlackLight and afro. We wanted to
compare afro to the sleuth kit as well, as at the DFRWS conference it was
discussed about
adding APFS Support to The Sleuthkit Framework,
but no implementations are public yet.
We recently identified security issues in the UNIFY OpenScape Desk Phone CP600
HFA software. We disclosed the vulnerabilities to Unify, as a fix is now
provided we want to give a brief overview of the vulnerability affecting the web
interface.
We were able to identify the following vulnerabilities in the Web interface of
the telephone:
Command Injection in Picture Delete function of OpenScape Desk Phone Webportal
Unauthenticated Arbitrary File Access in the OpenScape Desk Phone Webportal
Memory Corruption in the OpenScape Desk Phone Webservice
Missing Hardening of the OpenScape Desk Phone Webservice Binary
Cross Site Request Forgery Missing in the OpenScape Desk Phone Webservice