Video illustrations on the way...

I know some of the demo's my leave you a bit puzzled at times but some of the concepts cant be adopted overnight. And as you would have noticed, most of the demo's use linux quite heavily adding to the frustration to most windows users. The good news today is i just got an account with www.vimeo.com so now i can add video illustrations to some of my blogs. I'm gonna go back to some of my previous post and add some video illustrations to them. If there is any request for any visual illustration on any previous post, just leave a comment or shoot me an email.

How you can steal log-on credentials from forum based websites using Paros and ngrep

As you can imagine, ngrep would be our sniffer that would parse out the necessary information that we would be looking for. But what is Paros and what is it gonna be used for? Paros is a proxy, but unlike traditional proxies, it allows you to modify certain parameters in http request and reply packets. How we are gonna use it in our demo is to modify the password field of a http POST to input the appropriate password. Confused? Well just follow my demo and hopefully all will be clear.

First we use ngrep (look back at my earlier post for info on using ngrep) to sniff out the important information when the user logs in. Note that sometimes the passwords may be in cleartext or in a md5hash. If the password is in MD5 hash form, we can use online resources to crack them or dont even bother cracking them. Why not just use the hash to login? Is it possible? Yes.. and thats what ill be showing you.

[Note, you would be required to perform some form of man in the middle attack in order to be able to sniff the packets]

Setting up ngrep to sniff:
# ngrep -W byline -d eth0 -q "POST" port 80 //we are sniffing of port 80 for the string 'POST', i.e when a user hits the login button a post would be send to the logon server. '-W byline' makes the output to standard out more readable.

On some other machine [victim machine], login to your favorite forum website and pay attention to ngrep's output. It should have captured the post packet with your username and password. Like i said earlier, sometimes the password is not in plain-text. Sometimes it would be and MD5 hash. Lets see how we can use this hash with Paros proxy.

Lets fire up Paros on the attacking machine.
# java -jar paros.jar

On the attacking machine, open up your web browser and change its network settings to use the proxy 127.0.0.1 on port 8080. Trying browseing to a website to confirm the proxy works. Paros should now have captured traffic.

In the "Trap" tab select "trap request". Now navigate to the same forum website that you've captured info from. On the login form, put in the username that you would have captured and some bogus password and hit the submit button. Notice that the web page is stuck loading and paros is blinking. Lets investigate. Paros has captured the request and is awaiting on some sort of feedback from you. At this point you can see that paros has captured the login request. The username is the right one u typed in and the password is in some encrypted md5 form. Its actually the md5sum to the bogus password you inputed. What we wanna do is take the md5 hash that we captured from the ngrep output, and input it in the paros parameter screen (easier to view it in tabular view). Note you gon need to enter it in two places, the "vb_login_md5password" and "vb_login_md5password_utf". After you've done this, deselct the trap request option and hit the continue button. Guess what has happend............... You've now logged into your victims account.

To help in my above illustration, here's a video illustrating the simplicity of the attack. Note that the user uses a different sniffer to sniff on the wire.

[video]: http://www.securitytube.net/How-Secure-is-your-Forum-Login-video.aspx

Resources/Good reading:
http://www.securitytube.net/How-Secure-is-your-Forum-Login-video.aspx

Using netcat to stream music with mpg123

Like my previos post, i used netcat as a simple one page webserver, basically having netcat listen on port 80 and anything that connects to port 80, send them an html file. Simple enough. This post shows how we can use the same concept and listen on a port and send an mp3 over the network to connecting clients. Mpg123 is a command line utility that basically play music on the command line. You can see how netcat and mpg123 is used together to stream music accross the network.

Demo:
[server]10.0.0.1
[client]10.0.0.2

[server] # cat music_file.mp3 | nc -l -p 4444 //listens on port 4444 and cats the contents of the mp3 file accross the network

[client] # nc 10.0.0.1 4444 | mpg123 - // connects to the server on port 4444 and plays what ever data comes through its connection


Resources/Good reading:
http://www.hak5.org/episodes/episode-514

Using netcat and ncat as simple webservers

Nothing too fancy here, but just an illustration of how versatile the netcat tool is/can be. We all know netcat to be a simple backdoor utility that can be used for simple chats and file transfers. Well to add to its long list of possibilities and features, i am going to set up a one page webserver. Useful if you got to set up a notification about your page being down for maintenance. In its basic form, we set up a netcat listener on port 80 then pipe or push a file into the connection when clients connect.

[for netcat] "# while true; do nc -l -p 80 -q 1 < index.html" ; done
[for ncat] "# while true; d0 ncat -l 80 --send-only < index.html ; done"

Note: we set up a while loop to keep the connection open to accept other requests. Using "-k" in ncat would not work in this instance as using the "--send-only" terminates the connection when all data has been sent to the client.

References/Good reading:
http://www.terminally-incoherent.com/blog/2007/08/07/few-useful-netcat-tricks/
http://www.stearns.org/doc/nc-intro.current.html

Another example where physical access always gets you in (using chntpw)

Chnypw is a small linux utilty that is used to (re)set the password of any valid local account on a windowsNT, 2000 and XP machine (have not tried on vista and 7). Knowledge of the old password for an account is not needed to set a new one. The tool works by modifying crypted data in the registry's SAM file. This utilty works with syskey and includes the option to turn it off.

The target Windows machine needs to be in offline mode which means that the installed OS should not be loaded. You're gonna need a bootable linux distrobution (CD or bootable usb works) with chntpw package installed.

Steps:

1. Mount the NTFS drive. Needs to be mounted for read/write and not read-only.
   # mount -t ntfs-3g /dev/sda1 /mnt/disk1 or # ntfsmount /dev/sda1 /mnt/disk1 -o default_permissions
2. Navigate to the location of the SAM file, typically located at \windows\system32\config
   # cd /mnt/disk1/WINDOWS/System32/Config
3. Make a back up of the SAM, security and system files.
   # cp SAM SAM.bak && cp security security.bak && cp system system.bak
4. Run chntpw in interactive mode with the SAM, system and security file as arguments.
   # chntpw -i SAM security system
5. You should be presented with an interactive screen where you can list the local users and change or reset their passwords.
   NOTE: It is known that changing the user's passwords here are less reliable to work than actually just resetting/blanking their passwords. I would suggest to just blank the passwords if applicable then when you get into windows, change the passwords their. Use an "*" to Blank passwords in the interactive screens in chntpw.
6. Remember to save your changes before you exit.
7. Reebot computer and login to windows to see if your hack worked (more than likely it did)

For more chntpw options (although you probably wont need nothing else), type:
# chntpw -h

#chntpw help and usage

chntpw version 0.99.3 040818, (c) Petter N Hagen
chntpw: change password of a user in a NT SAM file, or invoke registry editor.
chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...]
-h This message
-u Username to change, Administrator is default
-l list all users in SAM file
-i Interactive. List users (as -l) then ask for username to change
-e Registry editor. Now with full write support!
-d Enter buffer debugger instead (hex editor),
-t Trace. Show hexdump of structs/segments. (deprecated debug function)
-v Be a little more verbose (for debuging)
-L Write names of changed files to /tmp/changed
-N No allocation mode. Only (old style) same length overwrites possible
See readme file on how to extract/read/write the NT's SAM file
if it's on an NTFS partition!
Source/binary freely distributable. See README/COPYING for details
NOTE: This program is somewhat hackish! You are on your own!

Resources/Good reading:
http://home.eunet.no/~pnordahl/ntpasswd/index.html
http://linuxbasement.com/content/changing-nt-passwords-with-linux-and-chntpw
http://rhadimas.wordpress.com/2006/10/15/reset-windows-password-w-knoppix/

Sniffit, packet sniffer and monitoring tool

Sniffit is a nice little sniffer that gives you the ability to zoom in on already established connections and view the data. Its mainly useful in MITM situations. Picture being in the middle of a telnet session or in the middle of a netcat chat. With sniffit, you can watch the communications going back and forth and possible gaain the knowledge of confidential info.

To run sniffit:
# sniffit -i -F eth0 //opens up sniffit in [-i]nteractive mode and [-F]orces the program to listen on the specified interface

To listening in (zoom into) a connection just hit the Enter key. To get out of it, hit the "q" key. For some useful satatistics hit the "n" key. to completly close out of the program hit the "q" key again.

Steganography (using steghide)

Steganography is the ability to hide data in plain site. Hidden messages are hidden in such a way that no one other than the sender and the intended recipient should be aware of its existence. What that means is the picture that someone may have sent to you and a few other people could possible contain a hidden message and possibly only one or two of the recipients may know of its existence.

Steghide is a steganography program that has the ability to hide data in various image and audio file formats. The embeded data can be compressed and encrypted. Some supported file formats are JPEG, BMP, WAV and AU. There are no restrictions on the format of what the secret data should be. It runs on both Windows and linux OS's

Demo:
Create a text file and type something in it that you wish to hide[name it confidential.txt].

Next, locate a jpg or bmp file that you would like to use as the cover file to hide the text file into.
When you get your image file run this command to test its storage capacity:
# steghide info image_file.jpg

Next lets embed our confidental.txt in the image file. By default, the embeded data would be encrypted with rijindale(aes - 128 bit) encryption in cbc mode. Note you would have to enter a password.
# steghide embed -cf image_file.jpg -ef confidential.txt

To extract the file run the following command then enter the password:
# steghide extract -sf image_file.jpg

Thats all to it.

[options]
"-cf": cover file to use
"-ef": file we want to hide
"-sf": this is the name of the stego file that we have created
"-e": specify encryptionto use if the default doesnt suit you.

To find out about the other encryption algorithms that you can use type:
# steghide encinfo

Resources/Good reading:
http://steghide.sourceforge.net/
http://en.wikipedia.org/wiki/Steganography
http://linux.die.net/man/1/steghide