HackEire 2009

http://www.hackeire.net @hackeire

HackEire 2009

by @markofu

Aim of this Presentation

Ø Provide overview of how we compromised this Environment.

Ø Note this is not the only way that you can

compromise this environment. Ø There may be a number of methods that could

result in the same compromise of Data.

HackEire -2009 19/11/2009 Copyright © 2009 IRISS www.irissie 2

The Scope

Ø The ‘Bhratach’ company has requested a full Black-Box test.

Ø This presence is hosted within the company and is connected to the company's internal corporate LAN.

Ø Testing consists of the external DMZ and Internal LAN.

Ø Use any tools that you legally own to test this network.

Ø Identify any vulnerabilities with this environment?


The Reconnaissance

Ø Identify the Network.

Ø The tools that we used for Reconnaissance:

§  NMAP §  Nessus


NMAP


Ø Use NMAP –sP 10.0.1.0/23

NMAP


Nmap –sT –vv –A 10.0.1.25

DNS Server

NMAP


Nmap –sT –vv –A 10.0.1.40

SMTP Server

NMAP


Nmap –sT –vv –A 10.0.1.50

Web Server

Nessus


Nessus Output

Web Server

10.0.1.25


DNS Server

Zone Transfer & then ‘nmap –vv –A –iL ips.txt’

10.0.1.25


DNS Server

Enum –u 10.0.1.25

10.0.1.25


Brute force the smb accounts

Hydra –t 1 –w 0 –l Lyray –p 1234 10.0.1.25 smbnt

10.0.1.25


Identify any potential Buffer Overflow

Server vulnerable to MS 08-067 exploit

10.0.1.25


Exploiting the Buffer Overflow

Server vulnerable to MS 08-067 exploit

10.0.1.25


Get shell & transfer netcat via ftp

10.0.1.25


Transfer ‘pwdump’

10.0.1.25


Extract new tools J

10.0.1.25


Setting up netcat persistent Listener

With a shell J

10.0.1.25


Connect via Netcat from Attacker system

10.0.1.25


Through netcat, now on 10.0.1.25 (see LHS)

10.0.1.25


Dumping the password file

10.0.1.25


Transferring the password dump

10.0.1.25


And the keyrings…..

10.0.1.25


Use ‘John’ on the Password Dump

10.0.1.40


Using compromised Lyray account

SSH to 3456 using username Lyray password 1234

10.0.1.40


Identify the Linux Kernel

Use this to identify if there are vulnerabilities with the Kernel

10.0.1.40


Look for the word exploit

These have been left lying around by a careless sysadmin who was testing a patch

10.0.1.40


Identify the exploit directory

These have been installed by a previous attacker via the FTP protocol.

10.0.1.40


Run the exploit

These have been installed by a previous attacker via the FTP protocol.

10.0.1.40


FTP to your attacker system

10.0.1.40


Upload the flags

Using FTP upload the Flags or you may use SCP over port 3456 (more secure)

10.0.1.40


Grab the Password Files

Using FTP upload the passwd and shadow file

10.0.1.40


Get the ‘willy’ password

Using John ‘unshadow’ the merged password file.

10.0.1.50


View the front page and source code

10.0.1.50


Nmap show ‘webadmin’ up…what’s there?

Look for the shell directory on port 10000

10.0.1.50


Connect to the Website

Enumerate the directories

10.0.1.50


Shell vulnerability….

Create a User & SSH on as that user

10.0.1.50


Or use Metatron to SSH

Cd & ‘ls -la’ the directories

10.0.1.50


Transfer the flags - e.g. Winscp

10.0.1.50


ifconfig -a

4th flag & ‘pii’ file must be on 10.0.2.75

10.0.1.50


Identify the fourth server

Use arp to get all connected servers

10.0.1.50


Port scan with netcat

SQL back-end? What’s 3333? SMB, netbios – transfer files?

10.0.1.50


Tcpdump shows something also….

10.0.1.50


As root - ‘crontab -l’

Looks interesting……

10.0.1.50


Ps auwx |grep asriel

Looks interesting……

10.0.2.75


Identify shares on 10.0.2.75

Use a ‘valid’ account to enumerate

10.0.2.75


Connecting via Asriel Share….

Transfer the keyrings to 10.0.1.50 & from there to system via scp

10.0.2.75


Asriel Share?


10.0.2.75


Temp Share…remember ‘Competitor Pack’


10.0.2.75


Transferring final flag to 10.0.1.50….

10.0.2.75

Scheduled Netcat Listener on Port 3333

Decryption

What am I?

Running pii.csv

Decode me?

Hydan…..

Who is Andrew Wiles?

x^n + y^n ≠ z^n where n is integer >2 & x,y,z Ε Ζ

Fermat’s Last Theorem

HackEire 2009

Technology

Transcript of HackEire 2009