Home page logo
/

pen-test logo Penetration Testing mailing list archives

RE: Hacking to Xp box
From: <Steve.Cummings () barclayscapital com>
Date: Tue, 6 Sep 2005 09:16:15 +0100

Ok cool, as I thought

But this doesn't really make the user invisible more hides the tracks,
and an admin with knowledge of their environment (small ) would be able
to spot this in the admin group

But sort of agree that this makes the user less visible but would
disagree that they are invisible 


Regards

Steve Cummings


-----Original Message-----
From: Marco Monicelli [mailto:marco.monicelli () marcegaglia com] 
Sent: 06 September 2005 10:56
To: Cummings, Steve: IT (LDN)
Cc: pen-test () securityfocus com
Subject: Re: Hacking to Xp box
Importance: High

First you create an user with a name which looks like the default
Microsoft support user. Here's an example:

net user SUPPORT_3569a74r h4x0r /add /active:yes /expires:never
/passwordchg:yes /passwordreq:yes

This will create a "not really suspect" user with passowrd set to
"h4x0r", in an active mode, never expires, can change the pass and
required password authentication.

net localgroup Administrators SUPPORT_3569a74r /add

This will add the just created h4x0r account to the local admin group.
If you own a Server you can even do it for the Domain Group.

Here's some reg tricks:

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Under this reg key you can create your h4x0r account and set the DWORD
value to "0". This will not show your account in the Login
screen.Beside, default folders will be created in the "Document and
Settings" section.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network

Here you create a DWORD value named "NoWorkgroupContents" setting it to
"1". This will hide the other workgroup's users.

There are other way to create an hidden user (see rootkits for win32
platform) but they use other technique rather than registry settings.
API and dll injection are their best friends in this case.

Just my 2 cents.

Marco


Hidden user in admin group? Could you let me know how you do this?


-----Original Message-----
From: Marco Monicelli <marco.monicelli () marcegaglia com>
To: Eduardo Suzuki <eduardo.ac.suzuki () gmail com>
CC: 'Juan B' <juanbabi () yahoo com>; pen-test () securityfocus com
<pen-test () securityfocus com>
Sent: Mon Sep 05 16:25:43 2005
Subject: RE: Hacking to Xp box

Good afternoon Eduardo/List (here's 15.14)

I think there was a misunderstanding in the firewall point:

juan is operating INSIDE the network and I thought he might want to show
the fact that, once an intruder gets in, he can bypass the OUTGOING
packet filter of the SP2 firewall. I didn't think he wanted to show how
insecure is SP2 firewall from the outside. Here explained the
misunderstanding.

Regarding ICMP backdoors, this technique was first use by some skilled
guy
3/4 years ago. Of course u needed "root" privilegies and was operated on
*nix boxes only. You could have install this ICMP backdoor instead of a
much more invasive rootkit. Nowadays I came across some ICMP backdoor
for
Win32 platform. Never went deeper into this matter but I know it works
pretty good, if the firewall does not block ICMP packets.

As per the JPG problem, form what you say I assume you never tried it so
I suggest you to give a try. Download a good joiner, merge your
favourite auto-installing R.A.T. with a simple JPG and then run it.
You'll see the .exe will be runned and it will install itself. Better
than 1000
theories....1 practice! ;)

HXdef is not the only rootkit for windows around. There are several ones
which are still undetected but of course not published. I've read some
comments on some underground forums but never had the chance to get my
hands on. Bytheway, rather than a rootkit, I would suggest for a windows
machine to simply add an hidden user to the admin group and do some
other "old fashioned" DOS trick, exploiting new DOS commands available
in Windows. If you want to see some nice/nasty BATCH file, just let me
know.
;)

Curiosity engeneering rules. Believe me. ;)

Hope these lines can help anyone.




-----Original Message-----
From: Marco Monicelli [mailto:marco.monicelli () marcegaglia com]
Sent: Monday, September 05, 2005 6:24 AM
To: Eduardo Suzuki
Cc: 'Juan B'; pen-test () securityfocus com
Subject: RE: Hacking to Xp box
Importance: High

Dear Eduardo/list,

I didn't discuss the fact that a server is much more juicy to hit for 
an hacker than the simple workstation, even if it is the CEO box. Once
stated
this, we can proceed with the next point.

First, SP2's firewall can by easily bypass as mostly firewalls with 
injection techinque. Infact they normally tend to allow HTTP traffic 
for example. If the firewall doesn't block ICMP, you can use some ICMP

backdoor which replies to a special crafted packet ICMP ping with a 
reverse
connect
shell. If you get admin privilegies on that box, you can even think to

stop the firewall service on that machine. If the RAW sockets limit is

your problem, you can easily ENABLE back the raw sockets with some 
right command lines (google is your best friend once again).

             Could you please point me any article/POC/tool that
demonstrates this injection technique? AFAIK by default XP SP2 firewall
blocks incoming packets if they don't match an existing outbound
session. Even if some port is open, you need to find some vulnerability
that could be exploited to run arbitrary code.
             What do you mean by ICMP backdoor? Is it something related
to covert channels? If so, you need to have admin privileges to be able
to install such a tool.

Regarding the JPG/GIF question, there are many joiner/merger on the 
net which are not recognized by AV and they can hide an EXE file 
inside the Picture. Once the guy opens the pic, then the EXE is 
excecuted hiddenly and secretly. I'm not taking into consideration the

buffer overflow vulnerability as it is now a bit too old to be 
exploited (expecially on a fully patched machine). So the trick is 
just that a "not really expert"
guy
will prolly open a picture (curiosity helps hackers a lot) and get 
infected easily without exploiting any vulnerability. I call this 
"curiosity engeneering".... ehehehhehe....

             I'm curious about it. When you open an image, you don't
execute it (not in the same way as you execute a PE-format file). If you
join the executable with an image and keep it as an image, for the
operating system the added bytes are considered part of the image, not a
code in machine language.

HXDEF is correctly a rootkit which means you first have to get admin 
rights on the target box. I've suggested that in order to mention 
rootkits which can be useful to an hacker, once he got admin 
privilegies. Did you ever see this file "hxdef defeating modern 
detectors.rar"? It is a movie which shows how it is NOT detected by 
most of the rootkit's hunters. But maybe that movie is not updated and

you're right (I couldn't test it unfortunately).

             Give RootkitRevealer a try. :-) You'll see that it finds
hxdef without any problem. It even tells you what string hxdef is hiding
and where its executable is. By default the executable reads its
configuration from a file with the same name, so you can easily find it.
Then you can "clean"
the
configuration file (because it can be scrambled by filling it with extra
characters in some of the sections) and see what it's hiding on the
infected machine.
             Another way to detect hxdef is by comparing the file list
of the infected machine in two different ways. First you get the file
list locally, then you get it remotely (using an administrative share,
for example).
Hxdef
isn't able to hide its files if you list them through a network. So you
can find the hidden files by comparing the two lists. If you see a
pattern (for example, remotely you can see files that match "tohide*"),
then you can be almost sure this is the string hxdef is using to hide
its evidence.
             After you find out the string you can do a little test.
Create a directory that starts with the string, then see if it's listed
using "dir".
Even when it's hidden you can enter into it without any problem.


Anyway, the main point to show the CEO the insecurity of the box is to
get
ADMIN privilegies over there. Then you can choose the game you wanna 
play on that computer.

I'm opened to any further suggestion, tnx for yours Eduardo.

             Thanks for your opinion as well, Marco!

Cheers

Marco






             Hi, Marco!

             IMO, I think it's harder to attack a workstation compared

to a server through a network, since servers must have some open port 
in listening state. On a workstation the user is the weakest point 
most of the time, while on a server there are many other parts to take

into account.
If
there is a firewall in place (for example, the one that comes with XP 
SP2), which attacks are possible through a network? AFAIK just a few. 
Windows
XP
restricts most of the attacks that use anonymous connections. Service
Pack
2
restricts even more. If you are a domain admin, there are many 
possibilities, but that's not the case here.
             What do you mean by "executing a jpg or a gif file"? I 
know there are buffer overflow vulnerabilities that can be exploited 
when opening an image, but it's not a trivial attack. I'm not sure 
(because I didn't try it), but I think it's even harder to do it when 
you need to merge an executable into an image using a joiner. I'd like

to know what you think about it.
             Regarding the hxdef rootkit, you can find it out by using

RootKitRevealer from SysInternals. It's available at 
http://www.sysinternals.com/Utilities/RootkitRevealer.html. BTW, hxdef

isn't considered an attack tool. It's used after you successfully got 
access to a computer, when you want to hide files, open ports and so 
on.
             Just my $0.02.
             Regards,

             Eduardo Suzuki
             esuzuki_br () pop com br
             Eduardo.AC.Suzuki () gmail com

"The essential is invisible to the eyes."

-----Original Message-----
From: Marco Monicelli [mailto:marco.monicelli () marcegaglia com]
Sent: Friday, September 02, 2005 6:12 AM
To: Juan B
Cc: pen-test () securityfocus com
Subject: Re: Hacking to Xp box
Importance: High

Ciao juan!

If the CEO box is fully patched and FW is enabled, then your mission 
is a little bit more difficult to accomplish. Besides, there are 
thousands of recent exploits for windows which you can try. For 
example, did you try the Universal exploit for the Plug and Play 
vulnerability? It is published everywhere. You can try with more 
recent exploits than the DCOM exploit which is at least 3 years old.

If you want to try with the trojan, I would suggest you to google for 
Bifrost, which is a Remote Administration Tool (you can call it trojan

if you prefer) that is completely UNDETECTED by any AV (at the moment 
it is still 100% undetected). You can pack it inside any file (exe, 
jpg,
gif....)
and it will be executed silently and hiddenly. Moreover, Bifrost can 
bypass firewalls injecting itself into Explorer.exe process. Another 
good UNDETECTED tool is hxdef rootkit.

Arp poisoning could do the job but why not trying to steal the SAM 
file and to crack it? You can do that remotely if the machine has the 
ports you mentioned opened. I bet you know some tool to steal the SAM 
and to crack it. I love SAMDUMP for example. ;)

Last but not least, you can try with a Denial of Service to show your 
CEO how easily a kid can prevent you from working with a simple DoS.

Why not sniffing the network? There are many undetected sniffers 
around the Web.

Just my 2 cents ;)

Marco






Hi Guys

Please give me a hend here.

Im trying to penetrate the CEO box to show him why we need better 
security in our company, he told me to show me how it can be done. he 
has xp pro sp 2 with all the pathches installed and FW enbled but I 
cant ! I tried to use metasploit with the ms rpc dcom exploit but it 
didnt worked. nessus found port 135 139 2000 and ntp are opened and 
also he can read some smb shares and also outputed that this host 
doesnt disgard SYN packets that have the FIN flag set. and port 2000 
(callback is open).
what I can try more to  break this box? any ideas? I know I allways 
can try to arp poison his arp table and pass all the machines traffic 
throw my laptop to capture some passwords but this is enough. or send 
him a trojan but we have a good anti virus protection  .


Does some of you have Ideas ?

Thanks a lot !

Juan



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com


------------------------------------------------------------------------
--
--

--

Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on 
your website. Up to 75% of cyber attacks are launched on shopping 
carts,
forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down 
servers are futile against web application hacking. Check your website

for vulnerabilities to SQL injection, Cross site scripting and other 
web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831

------------------------------------------------------------------------
--
--

---






------------------------------------------------------------------------
--
--

--
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on 
your website. Up to 75% of cyber attacks are launched on shopping 
carts,
forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down 
servers are

futile against web application hacking. Check your website for 
vulnerabilities to SQL injection, Cross site scripting and other web 
attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831

------------------------------------------------------------------------
--
--

---






------------------------------------------------------------------------
------

Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on
your website. Up to 75% of cyber attacks are launched on shopping carts,
forms, login pages, dynamic content etc. Firewalls, SSL and locked-down
servers are futile against web application hacking. Check your website
for vulnerabilities to SQL injection, Cross site scripting and other web
attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
------------------------------------------------------------------------
-------





------------------------------------------------------------------------
For more information about Barclays Capital, please visit our web site
at http://www.barcap.com.


Internet communications are not secure and therefore the Barclays Group
does not accept legal responsibility for the contents of this message.
Although the Barclays Group operates anti-virus programmes, it does not
accept responsibility for any damage whatsoever that is caused by
viruses being passed.  Any views or opinions presented are solely those
of the author and do not necessarily represent those of the Barclays
Group.  Replies to this email may be monitored by the Barclays Group for
operational or business reasons.

------------------------------------------------------------------------





------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault