Updating the HackRF One’s firmware

Instructions might be a bit unclear on how to ugrade the HackRF’s firmware, so here’s a short step-by-step guide.

  1. Download your appropriate HackRF release: https://github.com/mossmann/hackrf/releases/
  2. Extract: tar -xfv hackrf-2017.02.1.tar.xz
  3. Open up the folder containing the firmware: cd hackrf-2017.02.1/firmware-bin/ 
  4. Update the SPI flash: hackrf_spiflash -w hackrf_one_usb.bin
  5. Update the CPLD: hackrf_cpldjtag -x hackrf_cpld_default.xsvf
  6. Press the reset button and let it boot. Verify firmware version: hackrf_info

Audio reminder for when computer is back online

This handy little command reminds me by audio when my computer is back online. I just had a 30 minute Internett outage, and it was nice to get right back to my seat when my computer started bleeping out alarms.

for /l %i in (1,0,2) do @ping -n 2 8.8.8.8 2>1>nul && @powershell -command [System.console]::Beep(300,1000)

The for loop defines basically a while(true) loop in Windows. It will run for ever.

If the ping command runs successfully, the powershell command will run a small beep over 1 second.

Detecting if Volume Shadow Copies has been explicitly disabled through registry

Ransomware is very fond of disabling Volume Shadow Copies when infecting targets. Here is a script to remotely detect if Volume Shadow Copies has been disabled.

First, we use PSExec from Microsoft Sysinternals and a local reg query command. This is useful if you only have a list of IP addresses, not hostnames of the different machines:

psexec @systems.txt -u domain\ADMINISTRATOR reg query “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore” /v DisableSR

Remember to change the domain and username you want to use for the query.

We can also use only built in commands to query for the information. In this example we use the reg command remotely, providing it with a list of hostnames to query from the file dns.txt: 

for /F %i in (dns.txt) do @reg query “\\%i\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /s >> %i.txt

This command will use your credentials to query for the information, meaning you would likely have to be a domain administrator running this command.

WannaCry

The ransomware dubbed WannaCry disables Volume Shadow Copies like this (warning: running this command will delete your local backups) :

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

This leaves no good marks in the registry for us to audit, and I think the best way to detect this is to query machines where you know you have Volume Shadow Copies enabled, to see if they have any backups stored. To query for this information we can use wmic, another built in command which supports reaching network attached machines: 

wmic /node:@ip.txt shadowcopy list brief

This little command will run off every IP address in the file ip.txt and return the respective backup volumes.

Mapping attack surface for Ransomware / Cryptolocker

With all the ransomware hitting everyone, everywhere, I decided to share my scripts on how I map the attack surface of internal threats, and subsequently ransomware / cryptolocker. It is not fully automated yet, but hopefully sharing this will give people the right ideas, and perhaps some might even automate it. For now, this only works for file sharing using Windows default file sharing. PS: I realize this is far from perfect, and probably should all be doable with a simple nmap script, however this is what I use in conjunction with some other work.

A typical scenario for using these scripts and commands are for users that should not have access to a bunch of files on your file-servers. Close down those shares and permissions before the inevitable happens, and the files are stolen and encrypted.

We start off with scanning every host who has port 445 open (Microsoft SMB):

    nmap -p 445 -T4 -oG 445.txt 192.168.1.1-254 

Replace the IP address range with whatever suits your network. Next, we grep out the hosts which are relevant for checking which file shares they expose.

    cat tmp/445.txt  | grep “445/open” | cut -d ” ” -f 2 > hosts.txt

With the relevant hosts in a separate file, lets use enum4linux to enumerate all the potential shares on these servers. Remember to add the username and password of the account you want to use for the mapping.

    cat hosts.txt | while read in; do enum4linux -S -u <username> -p <PW> “$in”;done > shares.txt

This produces a file shares.txt containing potential shares we want to investigate and close down. Now we’ll edit the following script and put it in a bat file, and then let it work. Remember to add the necessary credentials and domain information.

    @echo off
    for /f “tokens=*” %%a in (input.txt) do (
    echo Mapping Disk:%%a
    net use Z: %%a /USER:DOMAIN\account password
    echo %%a >> log.txt
    dir /s /b /o:gn Z: >> log.txt
    net use Z: /DELETE
    echo. >> log.txt
    echo. >> log.txt
    echo. >> log.txt
    )
    pause

The log.txt file should then slowly but surely accumulate file paths and and the respective shares where those files are available, hopefully allowing you to know where to reduce and limit access.

Using Powershell to fetch file hashes with multiple algorithms

You might need to check file hashes across multiple directories and across multiple algorithms, e.g. verifying all files hashsums against both MD5 and SHA1. This is an example of how to accomplish such task using Powershell.

 

 

 

 

 

 

 

 

 

The command you run is:

gci -Recurse | select FullName | %{get-Filehash -Algorithm md5 -Path $_.FullName ; get-FileHash -Algorithm sha1 -Path $_.FullName} | format-list

Remotely lock a computer, and prevent them from logging back in

Sometimes you have to throw someone off a terminal, but at the same time preserve the evidence on the terminal. For example if someone is using a terminal to hack something, and you need to secure the running terminals to capture the commands that has been run. It is quite simple to accomplish this, as the process below demonstrates.

  1. First, change the target account’s AD password. This will prevent them from logging back in
  2. Next, target the terminal with psexec and use rundll32 to execute user32.dll with the LockWorkStation function. This will trigger the account lock. The following command can be tweaked for your purposes: PsExec.exe \\<ip> -d -u <domain>\Administrator -i cmd.exe /c “C:\windows\system32\rundll32.exe user32.dll, LockWorkStation”
  3. Now it’s time to sieze the terminal. Make sure you are standing by ready for this, as the victim could be distressed and shut down his workstation, essentially removing evidence.

This concept can be expanded further, as Darryl Griffiths pointed out to me on LinkedIn. Coupling the initial idea of locking the workstation with AD Group Policies to modify the Power settings on the target workstation, one can even prevent the machine from shutting down, e.g. when the power button is clicked or the laptop lid is turned off. The Power Management in Windows normally allows this type of overriding the functionality of the power button, and more can be read about this concept in the following TechNet article: https://blogs.technet.microsoft.com/askds/2008/03/21/managing-power-with-group-policy-part-3-of-3/

Get PSExec here: https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx?f=255&MSPPError=-2147217396

Here is a video demonstrating the remote terminal lockout.

SANS Holiday Hack Challenge 2016 write up

Brilliant CTF by Counter Hack team as usual. Tons of good fun, awesome challenges and a great story to go with it. Whats not to like?

Here’s a quick write-up on the answers I produced on the 2016 challenge.

1) What is the secret message in Santa’s tweets?

I wrote a simple Javscript to extract all the Tweets. All this script does is to concatinate all the tweet bodies into a single variable, then outputting the variable into the browsers console.

This produces the following output:

We can see that the output represents ASCII art character G. In total, the answer produced the string “BUG BOUNTY”.

2) What is inside the ZIP file distributed by Santa’s team?

The Instagram account of Santa had an image linking to a zip file. Simply download the ZIP file from the target webserver and inspect the file. The password was simply the string from the #1.

3) What username and password are embedded in the APK file?

Simply look through the resources files and configuration and you will see the credentials guest / busyreindeer78.

4) What is the name of the audible component (audio file) in the SantaGram APK file?

The audio file was in the resources\raw folder. It’s name was discombobulatedaudio1.

5) What is the password for the “cranpi” account on the Cranberry Pi system?

Procedure:

  1. Download the Cranberry PI image
  2. Use fdisk to review the partitions
  3. Mount the partitions
  4. Crack the passwords in the /etc/shadow file using JTR or Hashcat with the Rockyou dictionary file.
  5. This cracked into two different passwords:
    1. pi:thenorthpole07
    2. cranpi:yummycookies

6) How did you open each terminal door and where had the villain imprisoned Santa?

Door 1

We are presented with a shell and something to look for. Using the “find .” command.

This reveals several hidden files, one which is of our interest: elf@3030ec3eb5a9:~/.doormat/. / /\/\\/Don’t Look Here!/You are persistent, aren’t you?/’

From here we just had to cat the correct file, keeping in mind escaping the special characters such as “.!’\ “.

Door 2

Basically I just read the manual and defeated the wumpus by remembering the cave layout and the different options.

Door 3

The shell we’re in is less or more, and it supports command execution. By entering the command !/bin/bash , this gives us a proper shell, which we can now use to see all the files involved. One of the files was the source code to run the train, which also contained the password.

Door 4

We are in a shell with a pcap in the current directory. We don’t have read access to pcap, but sudo -l reveals that we can access it through the itchy user like this: sudo -u itchy strings out.pcap. This yields half of a flag, but not the rest. The rest of the flag is hidden in a transmission of an ELF file. Using strings -e l out.pcap revealed the second half of the flag.

Door 5

A dialog from the movie Wargames, between the main actor and the Wooper computer, was displayed, missing out the information from the actor. Simply typing what the actor would type in to the Wooper computer yielded the flag.

Door 6

With the 7 audio files in place, they were put into order, based on their track numbers. The speed of the audio was then sped up to about 700-800%, and the audio could then be understood. Removing the background noise also helped.

7) For each of the six items, which vulnerabilities did you discover and exploit?

The Mobile Analytics Server (via credentialed login access)

Simply log on to the solution using the guest / busyreindeer78 credentials, then click the Mp3 menu item.

The Dungeon Game

I googled walkthroughs for this game, and figured out a cheat command called the GDT, presumably named after the “Global Descriptor Table”. From here I could access all rooms, resources and what not. I identified the dialog and rooms necessary to get the password through the GDT.

The Debug Server

Activated the debug flag in the APK file, re-build and installed it onto my device. I then observed through Proxy the traffic going to the debug server. This traffic was then modified using the Burp Repeater. The JSON response revealed an interesting parameter called verbose, and this was set to false. Setting the verbose flag to true in the request makes the response suddenly give away a lot more information, among other things, a files array containing the mp3 we want.

The Banner Ad Server

The MeteorMiner Greasemonkey/Tampermoneky script by Tim Medin was used to browse what the Meteor application is exposing. The Home Quotes object had 5 records in them, while only 4 was shown as quotes on the front page. 1 quote was different and had an audio attribute on it. The HomeQuotes object was printed with the browsers console, and one could easily see the mp3 file hidden inside the object:

The Uncaught Exception Handler Server

The calls to the exceeption server was intercepted with burpsuite, revealing a JSON post request to exception.php. The request contained WriteCrashDump, and this was changed to ReadCrashDump to see what happened. From here, a simple tutorial of error messages gave us clues for the request we needed to create to make the script parse it properly. The request ended up like this, but it did not work for parsing other php files, such as index or exception:

{“operation”:”ReadCrashDump”, “data”:{“crashdump”:”crashdump-YhFSnH”}}

Instead, adding the stream handler convert.base64-encode, we could now read the contents of the files we wanted.

{“operation”:”ReadCrashDump”, “data”:{“crashdump”:”php://filter/convert.base64-encode/resource=exception”}}

This gave us an base64 result of the source code of exception.php, where the mp3 filepath was hidden in a php comment.

The Mobile Analytics Server (post authentication)

Running nmap with default scripts reveals a git repository hosted at this site. Downloading and repairing the repository lets us browse the source code of the page and also the database SQL build script.

Logging onto the analytics server as administrator with a password previously leaked, we could access more functionality. Specifically we could query for information, view and edit previously made queries. By first creating a simple query and specifying to save it, we could give the edit script the appropriate GUID to edit it. The log then tells us a hint, that it is checking for id, name, description, and finally, a query. The form only allows us to input id, name and description, but the script also parses the query parameter. Setting the query parameter to select * from audio allows us to see two audio files in this database, one which we already have. Using the query select to_base64(mp3) from audio where username = ‘administrator’ allowed us to copy the base64 encoded value of the mp3 data into a txt file. This was simply decoded using the command line: base64 –decode < mp3.txt > mp3.mp3

8) What are the names of the audio files you discovered from each system above? There are a total of SEVEN audio files (one from the original APK in Question 4, plus one for each of the six items in the bullet list above.)

  • discombobulatedaudio1.mp3
  • discombobulatedaudio2.mp3
  • discombobulatedaudio3.mp3
  • debug-20161224235959-0.mp3
  • discombobulatedaudio5.mp3
  • discombobulated-audio-6-XyzE3N9YqKNH.mp3
  • discombobulated-audio-7.mp3

9) Who is the villain behind the nefarious plot.

Apprently Doctor Who. LoL!

10) Why had the villain abducted Santa?

To prevent the movie “Star Wars Holiday Christmas” being released.

Finding files and grepping for information

Sometimes you have to find interesting files, then grep through those specific files dynamically. With Linux this is as easy as:

find . -name <file> -exec grep -i -H <match> {} \;

This will simply recursively look for files you want to find, e.g. *.txt, and for each file found, grep that file for whatever matching content you want to find. Additional interesting things to do with this is to grep with regex, or use the find command to further filter for specific types of files.

Slow DNS enumeration

Fierce is an excellent tool for doing DNS reconnaissance, i.e. querying the DNS server for potential domain names to be revealed. I’ve seen some setups where the enumeration has gone horrible slow.

If your DNS enumeration tool is going slow, fire up tcpdump and inspect the DNS traffic.

tcpdump -i <interface> -nn port 53 

Normally you should see tens and hundres of DNS queries flowing past the screen, but if the requests are slow, inspect the queries you are sending. Are you sending queries for .local domain as well?

This image shows 3 queries trying to resolve one name, but sends multiple queries

This is likely due to your DHCP settings are pushed out with a SearchDomain for <whatever>.local. Edit your /etc/resolv.conf and remove the line dictating the SearchDomain, and you should have a huge boost in speed!

Hassles and concerns upgrading from Windows 10 Home to Pro

Windows 10 Pro supports some features that are nice to have, especially if you like to take advantage of more features of your OS than the Home edition allows for.

Windows store changes my local account to an online account

The Window shop application requires you to sign in with your MSDN account. Once you’ve signed in and purchased the upgrade, your local Windows account is suddenly also converted to an MSDN account. This means, upon the next restart, you can’t log-on with your local accounts’ password anymore, you have to use your low security MSDN password. MSDN passwords are limited to 16 characters which I’ve blogged about earlier here: https://www.securesolutions.no/frustrations-with-microsoft-liveid-sign-on/

Is this a bug? Intended feature? I’ve got no idea.

Privacy settings reset

After the upgrade several of my privacy settings was suddenly reset. When I installed Windows Home a few days ago, I had all the privacy settings set to off, then all of the sudden, while updating my OS, the settings had reset into giving Microsoft my details:

privacy-issues

Not only is this rude, it’s a major disrespect to the users who expect privacy. Now onto some minor nuisances.

How to upgrade?

Furthermore, once you’ve purchased the upgrade, there’s no automation in activating the upgrade for your PC. I had to turn to Google (not Bing) in order to figure out how to activate the purchase. I believe I did not miss any vital information in the upgrade process, nor did the confirmation emails from Microsoft give me any information on how to actually use the upgrade I had purchased.

In order to facilitate the upgrade I had to re-enter the store and seek to purchase the upgrade again. This time the purchase button had been conveniently been replaced with an “Upgrade” button. I can see how this is useful if you are purchasing from one machine, and installing on another, however please give some instructions on how to go about this.

The upgrade itself cost about 1300 NOK, or about 150USD, which I consider is rather expensive considering you already bought the OS, and this is just a feature upgrade.

Hopefully Microsoft will A) don’t force users onto their online platform and B) don’t rip users privacy expectations in shreds when we’ve actively taken a choice to not participate.