Misc

Other

Robot hacking research

Stefan Sabin Nicula3 Comments

Later this past month, our lab welcomed a very important individual: Robi the robot (it has a camera and speakers!). We also received the honors to assemble it and make it dance. And so the journey to the fields of the unknown started. While playing with the command and control software, I could not help but wonder how secure this really is.

First of all, from the start I expected some kind of bluetooth link (blueborne *cough cough*) but I was actually greeted with it’s very own WiFi network board . It has the capability to join an existing network but by default it also comes with an open AP with a suggestive SSID. From the start, I also encountered a defense mechanism which is defined by allowing only a single C&C connection to be established with another machine.

By further inspecting the C&C mobile software, I saw the IP address which confirmed to be the gateway/WiFi manager interface. After a quick scan, the identified number of open ports:

Continue reading →

Phishy Basic Authentication prompts

Daniel Tomescu3 Comments

confused-idea-lightbulbIn one of our previous posts, we noted that a popular tool – Responder – uses Basic Authentication prompts to harvest user credentials when they accidentally enter invalid domains in web browsers.

Responder’s approach is pretty good and it does some “magic” to catch and respond to DNS requests for in-existing domais,  however I think that there is way more potential in using Basic Authentication for phishing purposes.

What I like (or dislike) most about basic authentication is that it is NEVER clear who is asking for your credentials and where they will end up. This type of confusion often tricks users into falling for simple phishing tricks, allowing attackers to easily gather user credentials.

Continue reading →

Going further with Responder’s Basic Authentication

Stefan Sabin NiculaLeave a comment

There are a good number of situations when we find ourselves abusing the LLMNR and NBT-NS protocols on an infrastructure penetration test, more specifically on an Active Directory setup. These 2 protocols are enabled by default on most of the Windows operating systems. What are they doing is they facilitate the communication between network machines when searching for a DNS hostname regardless if it’s a share, a server or a web hostname.

The overview picture of the attack vector:

  • the victim is looking for a non-existing hostname
  • the DNS server cannot resolve the request
  • we reply and resolve the hostname resolution query
  • we ask the victim for authentication

Continue reading →

Exploiting Timed Based RCE

Pobereznicenco Dan19 Comments

Checking the timeIn a recent penetration testing project we encountered a situation where in order to prove exploitability and possible damage we had to exfiltrate data from an isolated server using an OS command injection time based attack.

The scope of the project was an API. During the testing process we identified an interesting GET request that received 2 parameters: the first  a string and the other one ID number.

By fuzzing the string parameter, at first, it looked like we had a potential SQL injection, based on the way it handled single quotes. Trying this attack vector didn’t seem successful, but when we sent the ` sleep  10` command and the HTTP response returned 10 seconds later, we knew we had something.  Our first thought was that this was game over for the application, we managed to get a Remote Code Execution on the API server.

Continue reading →

Penetration Testing in IT/ Security Assurance Projects

Mihai Gabriel TanaseLeave a comment

There are various cases when during an IT/ security assurance projects there are specific requirements to rely on penetration testing projects/ reports completed by a third party.

However, not always, the IT security auditors have the necessary information to assess the quality of the penetration testing projects (focusing on planning, projects delivery and reporting).

And I address here the IT security assurance projects having in scope IT systems and finalizing with an Independent Auditor Report (IT Audit Opinion) and not audits focused on processes (like ISO audits) or on specific IT controls relevant for specific objectives (like ISAE 3402 IT/ Security assurance projects).

IT/ Security auditing standards

In order to have a consistent and objective assessment of third party reports, an IT security auditor must refer to the auditing standards he is using for performing his engagement.

And if we consider the IT audit standards available on the it-audit-activitymarket, we must look at ISACA framework. There are also other standards applicable to various industries or specific objectives, focused on management systems, like ISO standards, but ISACA’s are the only ones of general nature which can be used cross-platforms, industries, etc. And as support for this, I performed some quick Internet searches and found mostly the same views.

For example, in one of its papers, NIST recognizes the entities enumerated below as addressing the IT auditing within their standards, further states that all of them taken essentially the same position concerning audits involving information systems and continues focusing on ISACA’s CobIT.

  • The American Institute of Certified Public Accountants (AICPA) in several Statements on Auditing Standards (SASs);
  • Institute of Internal Auditors Association (IIA) in its Standards for the Professional Practice of Internal Auditing;
  • Information Systems Audit and Control Association (ISACA) in its “ITAF™: A Professional Practices Framework for IS Audit/Assurance”
  • S. General Accounting Office (GAO) in its Government Auditing Standards and Title 2, Accounting.

Continue reading →