Impersonate your “Friends”

My previous post showed you what you can do after you’ve compromised a host.  In this post we will explore how you can use impersonation tokens to do potentially evil things.  In my example I will be using a single host, but imagine what could be done if your compromised machine was joined to a domain.  Even better, what if a user  used the “Run As” option to launch Active Directory Users and Computers with their Domain Admin credentials?

In this example I will show you how you can steal a token and impersonate a user.

Again, enter Metasploit and the Meterpreter.

Step 1 – Compromise the host

Step 2 – load the incognito extension

Step 3 – Lets see what tokens are available.  As you can see, there are two users on the system we could impersonate.

Step 4 - But lets look at another options, and see if any processes are running we could use to impersonate.

As you can see, there is an FTP server running under putz.  What if this was actually ADUC? or some other sensitive process?  Lets steal the token for this process.  First we’ll see who we are on the box and then who we can be.

Now that we are Putz, lets start something as him.  Assume this account is a Domain Admin so what kind of mischief could we get into? for this example, lets just calculate something.

 

I am currently logged on as user Neal. Do you notice anything suspicious?

Step 5 – Lets return to ourselves.

I hope you enjoyed this and please leave comments.

After the Exploit….. Part 1

You’ve just exploited your target. Now what?  Lets walk through a few few tricks with the meterpreter.  The Stdapi includes some interesting commands:

• download & upload
• clearev – clear event log
• getuid – get the current user id
• steal_token – steal and impersonation token from a  process
• keyscan_start, keyscan_dump, keyscan_stop – key logger
• screenshot
• webcab_snap – take a snapshot from webcam

Here are a few screenshots of demos of this in action

Exploit your target:

Download juicy info:

Grab A Screeshot:

Log some keys:

Throw a wrench into the recipe:

Before

Upload

The compromised recipe

Evidence it has been tampered with

Falsify the time stamps


As you can see, there are a number of interesting options after you’ve exploited your target.  I will be adding additional entries showing what else you can do with this tool.  More to come!!!!

Burp ‘Em if got ‘Em!!

 

Burp Your Network Devices

 

Purpose

The purpose of this tutorial is to show you how to automate an attack on a network device that uses a web login. This tutorial is for educational purposes ONLY. Do not attempt this on devices you do not have EXPLICIT permission.

 

Setup

You will need a device to test the attack against. I am using a wireless camera. You will also need a copy of Burp Suite. There is a free and professional version. I will be using Backtrack 5 R3 which includes a copy of Burp Suite.

The first step will be to configure Burp Suite to act as a proxy. Choose the proxy tab and ensure that “intercept is on” under the intercept tab.

Next, you’ll need to configure the proxy listeners. Choose the options tab and configure the proxy listeners for port 8080 and that the “Generate CA-signed per-host certificates” is checked.

The last step is to configure your browser to use Burp Suite as a proxy. I am using Firefox so your setup may be different.

 

Authentication Analysis

We will use Burp Suite to capture the http requests to determine the type of authentication used by your network device. Some of the authentication types include HTTP-Basic, HTTP-Digest, and Form Based Authentication. In this example, we’ll be looking at HTTP-Basic which is easily compromised due to the simplicity of its encoding. Let’s see what type of authentication my wireless camera uses and I will illustrate how easy it is to decode the password used in the transmission.

 

Demo

With Burp Suite open, navigate to your network device using the browser configured with the proxy settings. You will need to click the forward button for each HTTP request that occurs. Attempt to login to the device. I generally look up the default administrator account online for the device manufacture and any password. Remember at this point the goal is to determine the type of authentication used.

Navigate to the History tab under Proxy. Walk through the steps. You should see a Request referencing Authorization. I this example, you can see the device is using HTTP-Basic Authentication.

Notice the encoded characters after Basic. This uses Base 64 encoding which combines the username and password. Once it is decoded, it will be represented as username:password. Notice the colon, this separates the two. Decoding is trivial. Highlight the characters and right-click and select Send to Decoder. Navigate to the decoder tab and choose decode as – Base64. Notice, the characters are decoded to show the username and password I used in the web popup.

Now that we know the type of authentication, we can send this to the Intruder to configure our attack.

Navigate to the Intruder tab. Under the Positions tab, we need to locate and highlight the Base64 string and chose “Clear” and “Add” from the right side of the screen.

Click on the Payloads tab. Under the Payload Options [Simple list] section we’ll add the passwords we want to use in our attack. You can use a password dictionary if you’d like, but for this example, we’ll use a simple set of passwords.

Under Payload Processing, we’ll specify a prefix (admin:) and Base64-encode. Do not forget the colon.

Under Payload Encoding, uncheck the URL-encode these characters box.

The last step is to launch the attack. Select Intruder and Start attack. A window will pop-up showing the login attempts. Look for a status code of 200. Select the line. You should see the Base64 characters which you can send to the decoder. They should match up with your password list. Again, decode as Base64 as done above.

 

Conclusion

I’ve just touched the surface of using the Burp Suite and HTTP authentication types. Give it a try for yourself. The best way to defend your router against these type of attacks is to use a complex password which is unlikely to be in a password dictionary, enabled https if possible, and change your password regularly. Please provide comments and any suggestions.