Raesene's Ramblings

After encountering some SNMPv3 servers recently and looking into the differences from a pen. test perspective, I thought it may be worth a quick write-up.
SNMPv1 and v2 do not respond when traffic is sent their way unless there is a valid community string in the message, a fact used by scanners like onesixtyone . So traditionally the theory is unless there's a known community string, the service running has a vulnerability or you can get in-line to sniff traffic, there's not a lot to get from SNMP services.
Turns out that SNMPv3 behaves differently from v1 and v2. Firstly the notion of using community strings for authentication is gone, replaced by username/passwords. Second the traffic can be encrypted to limit sniffing opportunites.
However it's not all bad from a testers perspective! unlike earlier versions SNMPv3 will respond to correctly formatted requests and provide some information about itself as part of the reply. This allows confirmation of the servers existence.
To get these responses there's a couple of different tools we can use. Nmap with version detection will confirm that a SNMPv3 service is running and looking at the traffic in wireshark
From this there's a couple of interesting pieces of information. The Engine Enterprise ID field seems to identify the server type that's running, net-snmp in this case and the msgAuthoritativeEngineTime parameter shows the time in seconds since the service was started (according to this page ).
In addition to using nmap, it's possible to use the inbuilt snmp tools to get some information out of the service including possible username enumeration and brute-force password attacks.
Issuing the snmpwalk command with an invalid username like so:
snmpwalk -v 3 -n '' -l noAuthNoPriv -u "invaliduser" 192.168.207.142 IF-MIB::ifName
provides the response snmpwalk: Unknown user name
but if we use a valid username and no password like so:
snmpwalk -v 3 -n '' -l noAuthNoPriv -u "snmpUser" 192.168.207.142 IF-MIB::ifName
we get Error in packet. Reason: authorizationError (access denied to that object)
So it's possible by parsing responses to figure out valid usernames for the service.
Update : Here's a ruby script (should work on linux with snmp tools and ruby installed) which iterates over a list of usernames and a list of IPs and attempts to guess whether the username is valid or not snmpv3enum.rb
A similar technique works with specification of passwords which would allow for brute-forcing those as well, (although that said the snmp tools try to stop people choosing passwords less than 8 characters, so unless a dictionary word is used it isn't too likely to be successful.
Additionally for people who're fond of metasploit, I've knocked up a very basic SNMPv3 scanner. At the moment all it does it take a range of IP addresses and say whether a valid SNMPv3 packet provokes a response from the server, but could be handy. it's here.
There's some good references on setting up and using SNMPv3 here, here and here.

So I got across to Defcon this year (and of course security Bsides)
There were several interesting presentations , here's some notes on some of the ones that I got along to. The CD is up at defcon.org, and you can get the slides for most of the presentations there.
SSL Talks - There were several presentations on ways to bypass or subvert SSL. From my point of view the drive was around 2 themes. The difficulty in correctly parsing SSL certs due to the complexity of the relevant RFCs and also the weaknesses in the issuing processes of some CAs (which is exacerbated by the fact that any CA can issue a "valid" cert. for any domain). Dan Kaminsky's white paper on the subject is here, Moxie's blackhat presentation is here and Michael Zusmans' blackhat presentation is here (the defcon presentations are on the CD linked above).
Metasploit - The Metasploit team had a whole track to themselves on Saturday and there's a load of interesting stuff in there, basically looks like Metasploit will have some coverage for most types of assessment eventually, which is very handy!
Egypts presentation on client-side attacks with Metasploit had some great content on browser fingerprinting (not just relying on User-Agent) and client side attacks with Metasploit.
The Oracle presentation from mc and Chris Gates had some good content on going through the steps of an Oracle attack purely using Metasploit (more information on this on CG's blog
Druid had a good talk on the war-dialer that he's added to the framework (unfortunately the slides for that one aren't on the CD, but I'd guess that they'll be around soon). Another interesting thing in the Metasploit track was the demos of the Mac OSX and POSIX versions of meterpreter which are both in active development.
Other Ruby Tools - There was a bit of a theme of ruby tools across some of the presentations. In addition to all the Metasploit stuff, there was a mobile device fuzzer (although the website for it, www.fuzzit.com isn't up yet). Also there was a good presentation on Dradis from etd , which is a Pen test management and reporting tool written in Ruby and Rails.
Password Cracking - There was a good presentation, from Matt Weir, on approaches to password cracking, speeding up brute-force attacks and picking good dictionary files . There's more informaton on this one on his blog as well as on the presentation slides.
Router Hacking - FX had some more information on how to create reliable exploits on Cisco devices and the difficulties in doing so (amazing to think that Cisco Maintain thousands of discreete monolithic router builds!). Slides from the Blackhat presentation are here and White paper here
USB Hacking - Interesting presentation from a guy from MWR on how they approached an assignment to assess the security of a USB device and the approaches to fuzzing that they took. Slides are up on their site here

So I'm off to Defcon and security BSides next week, and I thought a couple of precautions were in order before I go...
1. Tunnel all traffic through SSH to a trusted host, instructions here
2. Set iptables up to explicitly deny any traffic not travelling through the tunnel
3. Turn off any vaguely network related features on my iPhone!

The oracle mix-in is now in metasploit trunk so should be a snap to get working. Installation instructions are up here.
Especially note the requirements for specific versions of the dbi and oci8 gems, later versions don't always work as expected with some of the oracle exploit plugins.

All the Scotland on Rails videos are now online here courtesy of the nice folks at Engine Yard.
The video for my presentation is here , slides are on slideshare over here

--- layout: post title: Some Metasploit and Oracle Notes - Part 2 date: 2009-05-12 20:41:55.000000000 +01:00 categories: - Metasploit - Penetration Testing tags: [] status: publish type: post published: true ---
SCOTT CONNECT NO YES NO
SCOTT DBA NO YES NO
SCOTT RESOURCE NO YES NO

It's worth noting that some of these Oracle modules (there's 9 in the current Metasploit svn versions) have required privilege levels (dbms_cdc_publish for example in a vanilla 10GR2 setup needs EXECUTE_CATALOG_ROLE to run which only SYS and users with the DBA role have...), so it's worth trying out several to fit different scenarios...
So here we are with DBA, which to be honest for a lot attackers is all that's needed. The data in the database is likely to be the "crown jewels" which the attackers looking for, but hey we can go further with the wonders of Metasploit and execute code on the underlying operating system...

5. Leverage Oracles functionality to get access to the underlying operating system
So at the moment I don't see a metasploit option for doing this in *nix (there's a win32 command execution module on mc's page), however that's not a serious problem as it turns out the nice guys at Oracle provide ways to do this easily.

A quick google around revealed this paper from Oracle on command execution from a database user and from my running of it, it works fine (although requires creation of new database objects so best suited to an environment that can be rolled back easily...).
So there you go, from nothing to OS access in 5 easy steps, courtesy of Metasploit...

Todays fun with Metasploit is exploiting Oracle... There's lots of good information on this on the Carnal 0wnage blog and the metasploit page for mc.
First things first, we'll need the relevant ruby modules (dbi and oci8) installed and working for some of this.
dbi can be installed using the usual 'sudo gem install dbi' but oci8 has some more prerequisites and steps to get working. The best thing to do is follow the instructions here . As a note you'll probably want to add the LD_LIBRARY_PATH to your bash profile to avoid setting it manually every time you want to use it (in Ubuntu this can be done system wide in /etc/bash.bashrc)
Once you've done that it should be possible to make basic connections to oracle from ruby ok...
So on to what Metasploit can do for you in a test with Oracle systems.. This walkthrough is heavily based on this video here from shmoocon this year.
One set of rough steps for converting "hmm there's an oracle system here" to "w00t I've got admin access to the server" might be

1. Discover the version of Oracle Running
2. Find out what the SID of the database is
3. Get valid credentials to the database
4. Escalate those credentials to DBA level access
5. Leverage Oracles functionality to get access to the underlying operating system
6. ...
7. Profit!!

Luckily Metasploit can help us with pretty much all of this....

1. Discover the version of Oracle running on the server
This is very useful as it allows for targeting of exploits (no point in trying use an exploit for something that's been patched on the target).

From msfconsole

use auxiliary/scanner/oracle/tnslsnr_version 

set RHOSTS [your_target_ip_here]
run 

from this you should see something like

[*] Host 192.168.1.203 is running: Linux: Version 10.2.0.1.0 - Production
[*] Auxiliary module execution completed

which tells us we've got 10gR2 on Linux running.

2. Find out what the SID of the database is
In order to connect to the database we're going to need to know what the SID is. Pre 10GR2 we could just use the metasploit sid_enum module (in auxiliary/scanner/oracle) to find this but after that we'll need to brute-force it. Not to worry there's a module for that too :)

As of 3.3-dev 6537 the sid_brute module doesn't appear to be included, but it can be downloaded from mc's page. For this module you'll also need a list of common SIDs for Oracle. One of those can be found on the Red Database Security site.
so once you've put the sid_brute module in the right place (I used modules/auxiliary/scanner/oracle) and your sid.txt file somewhere (I used the default from the module of data/exploits) you can do the following...

 use auxiliary/scanner/oracle/sid_brute

 set RHOST [your_target_ip_here]

and hopefully you'll get some output like

[*] Found SID 'ORCL' for host 192.168.1.203.

So we've now got the SID of the database, on to usernames and passwords.

3. Get valid credentials to the database
Now Oracle databases are pretty notorious for having a wide range of default usernames and passwords installed on them. This isn't so true for modern releases but if your're running against older releases, it's well worth checking.

So to do this we'll need the brute_login metasploit module and a list of usernames and passwords. The module again can be found on mc's page and the canonical list of Oracle usernames and passwords is on Pete Finnigans site.

Also we'll need to get the oracle mixin at this point from here and copy that to lib/msf/core/exploit/ . Now at this point I was getting a module loading error but reading this and this led me to the idea of modifying the brute_login.rb file adding

require 'msf/core/exploit/oracle'

to the top of the file (just under the other requires) to get it all loaded up ok (also found out that a lot of this ground's been covered before but hey :) ! )

So with those saved in appropriate places (same as last time) we can see what's there

use auxiliary/scanner/oracle/brute_login 

 set RHOST [your_target_ip_here]
run

Now wtih any luck you'll get a file called oracle_success.log popping up in the data/exploits directory which will contain some entries like this

Found user/pass of: SCOTT/TIGER on 192.168.1.203...

which tells us the creds we need to make a valid connection and move on to the next stage.
So now we've got a valid account on the database, but it's not got that magic DBA level of privilege
Next time I'll follow-up on using metasploit to get down the OS

Been taking a look at another one of the newer Metasploit features tonight. WMAP is looking to integrate web application scanning functionality into Metasploit. There's a couple of good overviews Here, Here and Here
Getting it up and running is a little bit finicky at the moment, as you need to used a patched copy of ratproxy to collect the base URLs for the scanner (quick note is that my fairly new Ubuntu Intrepid install was missing libssl-dev which is a pre-requisite for compiling ratproxy so worth checking for if you get make errors when setting it up).
Once you've gathered URLs and fed them in to the database getting the scanner to start running is straightforward (examples in the links at the top so I won't go into it). From an initial look, some of the plugins seem to do some directory/file brute-forcing which can take ages to run, but if it's going on too long you can use CTRL-C to interrupt just that plug-in and Metasploit will catch the interrupt gracefully and move on to the next directory or plugin...

So another night of metasploitage, and some good additional info
Pivoting

• Good write-up on some of the challenges with pivoting
• Greate Demo video of using pivoting to attack a host indirectly
• Another good video demo of pivoting, but without the cool tunes :)

So I've been playing a bit with Metasploit over the holiday weekend (hey what are days off for..), and as usual when researching stuff, I've come across a load of links I don't want to lose track of, so I'll put them up here, may be useful to someone else as well..
I'll refrain from the really obvious linking to the project homepage, as if you're looking for metasploit links, I'd guess you've found it already :)
Pre-Exploitation Information

• Good set of examples for using msfpayload to create executable payloads
• More msfpayload information
• Interesting worked example of msfpayload setup on osx
• Interesting write-up on eval_php for for webserver compromise

Post-Exploitation (meterpreter and the like) Information

• Post on meterpreter usage. Has some interesting points on what can be done with Meterpreter.
• Interesting post on using meterpreter again Some information on using meterpreter scripts like killav to stop exploits being detected, and timestomp to make discovery harder.
• Article from the Metasploit wikibook on post-exploitation activities