From: Marco Monicelli (marco.monicelli@marcegaglia.com)
Date: Mon Sep 05 2005 - 13:46:15 EDT
Dear Eduardo/list,
I didn't discuss the fact that a server is much more juicy to hit for an
hacker than the simple workstation, even if it is the CEO box. Once stated
this, we can proceed with the next point.
First, SP2's firewall can by easily bypass as mostly firewalls with
injection techinque. Infact they normally tend to allow HTTP traffic for
example. If the firewall doesn't block ICMP, you can use some ICMP backdoor
which replies to a special crafted packet ICMP ping with a reverse connect
shell. If you get admin privilegies on that box, you can even think to stop
the firewall service on that machine. If the RAW sockets limit is your
problem, you can easily ENABLE back the raw sockets with some right command
lines (google is your best friend once again).
Regarding the JPG/GIF question, there are many joiner/merger on the net
which are not recognized by AV and they can hide an EXE file inside the
Picture. Once the guy opens the pic, then the EXE is excecuted hiddenly and
secretly. I'm not taking into consideration the buffer overflow
vulnerability as it is now a bit too old to be exploited (expecially on a
fully patched machine). So the trick is just that a "not really expert" guy
will prolly open a picture (curiosity helps hackers a lot) and get infected
easily without exploiting any vulnerability. I call this "curiosity
engeneering".... ehehehhehe....
HXDEF is correctly a rootkit which means you first have to get admin rights
on the target box. I've suggested that in order to mention rootkits which
can be useful to an hacker, once he got admin privilegies. Did you ever see
this file "hxdef defeating modern detectors.rar"? It is a movie which shows
how it is NOT detected by most of the rootkit's hunters. But maybe that
movie is not updated and you're right (I couldn't test it unfortunately).
Anyway, the main point to show the CEO the insecurity of the box is to get
ADMIN privilegies over there. Then you can choose the game you wanna play
on that computer.
I'm opened to any further suggestion, tnx for yours Eduardo.
Cheers
Marco
Hi, Marco!
IMO, I think it's harder to attack a workstation compared to a
server through a network, since servers must have some open port in
listening state. On a workstation the user is the weakest point most of the
time, while on a server there are many other parts to take into account. If
there is a firewall in place (for example, the one that comes with XP SP2),
which attacks are possible through a network? AFAIK just a few. Windows XP
restricts most of the attacks that use anonymous connections. Service Pack
2
restricts even more. If you are a domain admin, there are many
possibilities, but that's not the case here.
What do you mean by "executing a jpg or a gif file"? I know
there
are buffer overflow vulnerabilities that can be exploited when opening an
image, but it's not a trivial attack. I'm not sure (because I didn't try
it), but I think it's even harder to do it when you need to merge an
executable into an image using a joiner. I'd like to know what you think
about it.
Regarding the hxdef rootkit, you can find it out by using
RootKitRevealer from SysInternals. It's available at
http://www.sysinternals.com/Utilities/RootkitRevealer.html. BTW, hxdef
isn't
considered an attack tool. It's used after you successfully got access to a
computer, when you want to hide files, open ports and so on.
Just my $0.02.
Regards,
Eduardo Suzuki
esuzuki_br@pop.com.br
Eduardo.AC.Suzuki@gmail.com
"The essential is invisible to the eyes."
-----Original Message-----
From: Marco Monicelli [mailto:marco.monicelli@marcegaglia.com]
Sent: Friday, September 02, 2005 6:12 AM
To: Juan B
Cc: pen-test@securityfocus.com
Subject: Re: Hacking to Xp box
Importance: High
Ciao juan!
If the CEO box is fully patched and FW is enabled, then your mission is a
little bit more difficult to accomplish. Besides, there are thousands of
recent exploits for windows which you can try. For example, did you try the
Universal exploit for the Plug and Play vulnerability? It is published
everywhere. You can try with more recent exploits than the DCOM exploit
which is at least 3 years old.
If you want to try with the trojan, I would suggest you to google for
Bifrost, which is a Remote Administration Tool (you can call it trojan if
you prefer) that is completely UNDETECTED by any AV (at the moment it is
still 100% undetected). You can pack it inside any file (exe, jpg, gif....)
and it will be executed silently and hiddenly. Moreover, Bifrost can bypass
firewalls injecting itself into Explorer.exe process. Another good
UNDETECTED tool is hxdef rootkit.
Arp poisoning could do the job but why not trying to steal the SAM file and
to crack it? You can do that remotely if the machine has the ports you
mentioned opened. I bet you know some tool to steal the SAM and to crack
it. I love SAMDUMP for example. ;)
Last but not least, you can try with a Denial of Service to show your CEO
how easily a kid can prevent you from working with a simple DoS.
Why not sniffing the network? There are many undetected sniffers around the
Web.
Just my 2 cents ;)
Marco
Hi Guys
Please give me a hend here.
Im trying to penetrate the CEO box to show him why we
need better security in our company, he told me to
show me how it can be done. he has xp pro sp 2
with all the pathches installed and FW enbled but I
cant ! I tried to use metasploit with the ms rpc dcom
exploit but it didnt worked. nessus found port 135 139
2000 and ntp are opened and also he can read some smb
shares and also outputed that this host doesnt disgard
SYN packets that have the FIN flag set. and port 2000
(callback is open).
what I can try more to break this box? any ideas? I
know I
allways can try to arp poison his arp table and pass
all the machines traffic throw my laptop to capture
some passwords but this is enough. or send him a
trojan but we have a good anti virus protection .
Does some of you have Ideas ?
Thanks a lot !
Juan
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
----------------------------------------------------------------------------
-- Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ---------------------------------------------------------------------------- --- ---------------------------------------------------------------------------- -- Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ---------------------------------------------------------------------------- --- ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:49 EDT