Nullcon CTF 2015 Write up - Length Extension Attack [ Web 400 ]

Hi,

It was fun playing Nullcon CTF 2015 challenges, and learnt lot of things over 2 days!
One of the challenge consist of interesting crypto attack known as "Length Extension Attack"


Referring this diagram from Wikipedia  :  http://en.wikipedia.org/wiki/Message_authentication_code






1. Sender has "Hash" i.e MAC & Message which will be sent to server.
2. Receiver receives MAC and Message
3. Receiver passes Message + Secret Key to algorithm = MAC
4. Receiver Compares new generated MAC with MAC received from Sender if matches message is authentic.


Nullcon pass at 10999 Rs

If you observe source code it has information  - Hash + Message + Length of Secrete key (19)

Pass above information to Hashpum tool which will perform Length Extension Attack to generate new hash to buy our product in 0 Rs. by appending |0

Message Format = Nullcon2015|Corporate|10999 i.e price

URL Encode new generated message from Hashpump and remove unnecessary characters "5cx"

Tamper data will show original Message & Hash

Tamper original Message and Hash with updated Hash and URL Encoded message

Forward HTTP request and That's It!.. You bought Nullcon Pass for 0 Rs.

This was interesting challenge and thought to post here on blog although CTF writ up is being published on official NullCon Site..


It was fun playing this CTF...and wish to learn more things going ahead!.

Regards,
eXpl0i13r

Malware Analysis of very basic EXE file

Hi,

Going one step ahead we will start with analyzing simple EXE file and lets figure out what this is all about.


For the moment, very basic thing to understand about compiling, linking you can refer below diagram:

1. Source code written in computer language [ C,C++ ] is present in Source Code file which we save it as .c, .cpp
2. Compiler job is to take this file as input and create Object Code file.
3. Linker job is to add references to external Library Files include those in code and create executable.


In order to reduce programmers work of wring code to get basic functionality, Library files are created.

Ex. You would not want to rewrite code in C programming language for creating a process, creating a file, creating a service etc. for which Microsoft has already created DLL files containing functions which can be imported by programmer and will be used to perform the same tasks.


Every executable contains multiple function call, library imports and we will shortly analyse those in order to conclude that file is performing some malicious activities.


Lets start with a sample .exe file "mfc7sys.exe" which I think is a suspicious file by looking at task manager.

By Looking at process explorer we will get path / registry locations

Lets go ahead and check what's there at registry location and directory path :

Looking at above screenshots its clear that this programs entry is present in registry "RUN" means this program will start at boot.

There are 2 files, exe and dll, it seems EXE is using "mfc7sys.dll" file for XYZ functionality which is yet to explorer.

Now its clear that program is trying to receive keyboard inputs, using "SetWindowsHookEx" and which is most popular way of keyloggers and spywares.

Looking at above screenshots you will see program is using create file, copy file, write file calls and now purpose of this program seems clear that its a type of Keylogger.


Taking closer look at process monitor you will observe txt file created with same process name.
"mfc7sys.txt"

Captured keystrokes are stored in this text file :

We can also perform simple string analysis of this "mfc7sys.dll" and result is same :

Hope this article is helpful.

Regards,
eXpl0i13r

Detecting Simple UPX Packed EXEs with PEiD

Hi,

Packed programs are obfuscated programs containing malicious programs compressed inside it.
There are lot of programs out but lets start with basic where we can pack a program and how we can go ahead with detecting such packers with very basic tools available.

So simply I have packed string.exe program wit UPX packer which is very famous and freely available, and on right side with PEiD we can detect that program is packed which is helpful in malware analysis.

Regards,
eXpl0i13r

CM Security App Lock Bypass on Samsung Galaxy Grand Prime

Hi,

In Samsung galaxy grand prime, there is setting called "Ultra Power Saving Mode"
which will save your battery by utilizing minimum application on your android phones.

This option is specific to Samsung new smartphones.

If you have installed CM Security App Lock to lock your Whats-app/Facebook messages you are at Risk!


1. Samsung Phone with Ultra Power Saving Mode
2. CM Security APP lock must be installed on android device
3. Open Ultra Power Saving Mode from Settings and Enable this functionality.
4. As soon as you enable this functionality Android device will only start selected applications Ex. Browser/Call/SMS
5. There is option to add WhatsApp/Facebook App, you can add WhatsApp and thats it!, you can access private messages locked with CM Security App Lock

This is because when you put your android device in Ultra Power Saving Mode, all processes apart from selected once are closed, and CM Security App Lock process is one of them :)













Access to Whats App Messages

Regards,
eXpl0i13r

From XSS to Domain Admin

Hi,

Recently attended elearning security Webinar, it was quite interesting, where researcher demonstrated way to Domain admin from simple stored XSS attack.

Inspired by that, I thought to create my own scenario and landed up creating this video of around
41 Min 15 Seconds!

My Setup :

Active Directory - Windows 2008 Server
Domain Machine - XP Machine [ With limited User Access ]
Web Server - Apache hosted with vulnerable application [ Ruubikcms ]
Pentester's Machine - Kali Linux


It was fun to create this scenario, setting up Active Directory, Web server and much more!

For reference I have created small PPT which depicts overall scenario.

Download It Here



From XSS to Domain Admin :

1. Stored XSS Malicious script injection.
2. Get access to Victim Computer [ Shell Access ]
3. Privilege Escalation
4. Domain Access


From XSS to Domain Admin - Part 1

From XSS to Domain Admin - Part 2

From XSS to Domain Admin - Part 3

Hope this will be helpful....

I will really appreciate if you can comment on this video and will be helpful for me to work on those areas.


Regards,
eXpl0i13r

Android Meterpreter Shell Hack

It is fun to hack android phones, Its not new but still interesting and thought to put it here...
Metasploit framework has different Android Payloads mentioned below :

I have my HTC One V phone and its rooted , first thing we going to do is create Evil.apk file which will be deployed in android phone, once installed and executed by user we get reverse shell !!

Creating "evil.apk" file and uploaded to HTTP root directory :

evil.apk downloaded in my android phone :

evil.apk download location :

Installing Malicious APK containing reverse shell ;)

Its interesting my CM Security real time protection not detecting any malicious activity! 

After executin "MainActivity" application here is our reverse shell :

Interesting commands from Anroid Meterpreter shell :

Capturing screenshot through meterpreter shell :

Regards,
eXpl0i13r

Wlan Password through Metasploit post exploitation module

In Scenario based hacking, if we get meterpreter session of Victim, we can quickly Enumerate Wlan profiles and their passwords through Metasploit modules present under  : "post/windows/wlan/"


Wlan modules available inside Metasploit framework :