By default iTunes installation does't come with dwmapi.dll but iTunes tries to load the DLL when started.
Create any malicious DLL and rename it to dwmapi.dll, copy to C:\Program Files (x86)\iTunes\
After copying the DLL if we start iTunes will execute the code part of malicious DLL leading to DLL Injection.
Location: C:\Program Files (x86)\iTunes\dwmapi.dll
Application:iTunes 12.0.1.26
OS: Windows 7 Ultimate N SP1
Apples response
After examining your report we do not see any actual security implications.
Writing a file to the C:\Program Files (x86)\iTunes directory requires local
administrative privileges.
Saturday, February 14, 2015
Acrobat Reader Insecure DLL Loading Code Execution
Rename any malicious DLL to
C:\Program Files\Adobe\Reader 11.0\Reader\ntmarta.dll
which will be loaded by Adobe Acrobat Reader.
PoC Code part of ntmarta.dll
Compile the above code into a Dynamic Loadable Library (DLL).
Tested on
Acrobat Reader 11.0.10
Windows 7 Ultimate N SP1
Refer
http://blog.disects.com/2014/08/dll-injection-executing-and-testing-dlls.html
http://blog.disects.com/2015/02/google-chrome-insecure-dll-loading-code.html
C:\Program Files\Adobe\Reader 11.0\Reader\ntmarta.dll
which will be loaded by Adobe Acrobat Reader.
PoC Code part of ntmarta.dll
#include <windows.h>
BOOL WINAPI DllMain (
HANDLE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved)
{
MessageBox(NULL, L"DLL Injection by Disects!", L"Developed by Praveen Darshanam",
MB_ICONWARNING|MB_CANCELTRYCONTINUE|MB_DEFBUTTON2);
}
Compile the above code into a Dynamic Loadable Library (DLL).
Tested on
Acrobat Reader 11.0.10
Windows 7 Ultimate N SP1
Refer
http://blog.disects.com/2014/08/dll-injection-executing-and-testing-dlls.html
http://blog.disects.com/2015/02/google-chrome-insecure-dll-loading-code.html
Google Chrome Insecure DLL Loading Code Execution
Google Chrome tries to load cryptbase.dll by default from
C:\Program Files\Google\Chrome\Application\ but the dll is not part of the installation.
Chrome fails with DLL Not Found error.
If we copy any malicious DLL renamed as cryptbase.dll to C:\Program Files\Google\Chrome\Application\
Chrome will load and execute the DLL controlled by malicious user.
The source code which I used for building the DLL is at
http://blog.disects.com/2014/08/dll-injection-executing-and-testing-dlls.html
Tested on
Chrome 39.0.2171.95m (latest is also vulnerable)
Windows 7 Ultimate N SP1
Reported to Google but they didn't consider it stating as Local exploit.
C:\Program Files\Google\Chrome\Application\ but the dll is not part of the installation.
Chrome fails with DLL Not Found error.
If we copy any malicious DLL renamed as cryptbase.dll to C:\Program Files\Google\Chrome\Application\
Chrome will load and execute the DLL controlled by malicious user.
The source code which I used for building the DLL is at
http://blog.disects.com/2014/08/dll-injection-executing-and-testing-dlls.html
Tested on
Chrome 39.0.2171.95m (latest is also vulnerable)
Windows 7 Ultimate N SP1
Reported to Google but they didn't consider it stating as Local exploit.
Counter Terrorism: Every Revolver with an IP Address
Crazy Idea or a Fantasy!
There are many terrorist attacks, terrorist groups across the world , below proposal might be one of the was to counter terrorism.
With the onset of huge data centers there is no dearth for storage and unlike IPv4, IPv6 can be used to assign IP address to any device on planet earth.
From ipv6.com
"IPv6 provides nearly 600 quadrillion addresses for every square millimeter
on earth. That's 6x1023 addresses for every square meter of the earth's surface."
Internet of Things, what wiki says about IoT
"The Internet of Things (IoT) is the interconnection of uniquely identifiable
embedded computing devices within the existing Internet infrastructure.
Typically, IoT is expected to offer advanced connectivity of devices, systems
and services that goes beyond machine-to-machine communications (M2M)
and covers a variety of protocols, domains, and applications."
Requirement
IP Address and Camera
Why should a citizen of any country maintain secrecy of holding licensed Revolver.
Detection
Now a days every phone/tab has two cameras, say, front Camera and back camera.
Lets apply same concept for gun/revolver, whenever someone fires a bullet it should take photograph of person who fired the bullet and the target where bullet was fired at. Upload the taken photographs immediately to the Data Center.
Apart from Photographs we can save other information like
Make/model of Gun/Revolver
Make/model of the Bullet
Location
If someone tried to modify the firmware on the Gun, it should send an Event to Data Center, so wa know something malicious is happening.
Why will terrorist buy a gun with Camera?
Nation states/Governments should make it mandatory for every Gun/Revolver manufacturer should have an inbuilt Camera and an IP Address.
Evasion
Terrorist wearing a mask.
Covering the Camera slot with opaque stuff.
Limitations
No Internet, no signal.
Covering Camera
Tampering
Assumptions
Vendor cooperation
No illegal selling and vendor is accountable
Fantasy!!!
There are many terrorist attacks, terrorist groups across the world , below proposal might be one of the was to counter terrorism.
With the onset of huge data centers there is no dearth for storage and unlike IPv4, IPv6 can be used to assign IP address to any device on planet earth.
From ipv6.com
"IPv6 provides nearly 600 quadrillion addresses for every square millimeter
on earth. That's 6x1023 addresses for every square meter of the earth's surface."
Internet of Things, what wiki says about IoT
"The Internet of Things (IoT) is the interconnection of uniquely identifiable
embedded computing devices within the existing Internet infrastructure.
Typically, IoT is expected to offer advanced connectivity of devices, systems
and services that goes beyond machine-to-machine communications (M2M)
and covers a variety of protocols, domains, and applications."
Requirement
IP Address and Camera
Why should a citizen of any country maintain secrecy of holding licensed Revolver.
Detection
Now a days every phone/tab has two cameras, say, front Camera and back camera.
Lets apply same concept for gun/revolver, whenever someone fires a bullet it should take photograph of person who fired the bullet and the target where bullet was fired at. Upload the taken photographs immediately to the Data Center.
Apart from Photographs we can save other information like
Make/model of Gun/Revolver
Make/model of the Bullet
Location
If someone tried to modify the firmware on the Gun, it should send an Event to Data Center, so wa know something malicious is happening.
Why will terrorist buy a gun with Camera?
Nation states/Governments should make it mandatory for every Gun/Revolver manufacturer should have an inbuilt Camera and an IP Address.
Evasion
Terrorist wearing a mask.
Covering the Camera slot with opaque stuff.
Limitations
No Internet, no signal.
Covering Camera
Tampering
Assumptions
Vendor cooperation
No illegal selling and vendor is accountable
Fantasy!!!
Sunday, February 8, 2015
Vulnerability Scanning using Nessus
Nessus is a vulnerability Scanner developed by Tenable Network Security.
After downloading nessus, it can be installed using below command
#dpkg -i nessus_package_name.deb
Start nessus using below command
#/etc/init.d/nessusd start
You can access nessus on TCP port 8834 using localhost or hostname in the place of ip address, say localhost:8834. Login to nessus using the credentials you configured while installation.
After successful logging, you will see below screen.
To start Assessment click on Scans on top of the window, which will show you below screen.
Select the scan which interests you, will take you to below page where you need to configure IP Address, on your left you can customize Reporting info, Scan info etc. Don't click on save if you are not done with customization, once you click save Nessus will start the Assessment you have selected, in my case it was "Basic Network Scan".
To create custom policy we can click on Policies tab on top of the page.
To configure credentials for SMB, SSH, FTP, HTTP etc you can click on Policies on top of the page once you successfully login, then click on Credentials.
After downloading nessus, it can be installed using below command
#dpkg -i nessus_package_name.deb
Start nessus using below command
#/etc/init.d/nessusd start
You can access nessus on TCP port 8834 using localhost or hostname in the place of ip address, say localhost:8834. Login to nessus using the credentials you configured while installation.
After successful logging, you will see below screen.
Select the scan which interests you, will take you to below page where you need to configure IP Address, on your left you can customize Reporting info, Scan info etc. Don't click on save if you are not done with customization, once you click save Nessus will start the Assessment you have selected, in my case it was "Basic Network Scan".
To create custom policy we can click on Policies tab on top of the page.
To configure credentials for SMB, SSH, FTP, HTTP etc you can click on Policies on top of the page once you successfully login, then click on Credentials.
Thursday, February 5, 2015
Kali: Configure and Fix OpenVAS issues, start Vulnerability Scanning
OpenVAS is a tool used for Vulnerability Scanning, it comes pre-installed on Kali/Backtrack OS but need to configure to make it working.
root@kali-praveend:~# openvas-check-setup
........
........
OK: At least one admin user exists.
WARNING: Your password policy is empty.
SUGGEST: Edit the /etc/openvas/pwpolicy.conf file to set a password policy.
Step 4: Checking Greenbone Security Assistant (GSA) ...
OK: Greenbone Security Assistant is present in version 4.0.0.
Step 5: Checking OpenVAS CLI ...
OK: OpenVAS CLI version 1.2.0.
Step 6: Checking Greenbone Security Desktop (GSD) ...
OK: Greenbone Security Desktop is present in Version 1.2.2.
Step 7: Checking if OpenVAS services are up and running ...
OK: netstat found, extended checks of the OpenVAS services enabled.
ERROR: OpenVAS Scanner is NOT running!
FIX: Start OpenVAS Scanner (openvassd).
ERROR: OpenVAS Manager is NOT running!
FIX: Start OpenVAS Manager (openvasmd).
ERROR: OpenVAS Administrator is NOT running!
FIX: Start OpenVAS Administrator (openvasad).
ERROR: Greenbone Security Assistant is NOT running!
FIX: Start Greenbone Security Assistant (gsad).
ERROR: Your OpenVAS-6 installation is not yet complete!
Please follow the instructions marked with FIX above and run this
script again.
Start OpenVAS Scanner
#/etc/init.d/openvas-scanner start
Start OpenVAS Manager
#openvasmd --rebuild take around 10 minutes, you can execute below command
#openvasmd
Start OpenVAS Administrator
#openvasad -c add_user -n praveend --role=Admin
if the username is already created just execute openvasad
Start Greenbone Security Assistant
#gsad
Once the configuration is done execute
root@kali-praveend:~# openvas-check-setup
........
........
Step 5: Checking OpenVAS CLI ...
OK: OpenVAS CLI version 1.2.0.
Step 6: Checking Greenbone Security Desktop (GSD) ...
OK: Greenbone Security Desktop is present in Version 1.2.2.
Step 7: Checking if OpenVAS services are up and running ...
OK: netstat found, extended checks of the OpenVAS services enabled.
OK: OpenVAS Scanner is running and listening only on the local interface.
OK: OpenVAS Scanner is listening on port 9391, which is the default port.
OK: OpenVAS Manager is running and listening on all interfaces.
OK: OpenVAS Manager is listening on port 9390, which is the default port.
OK: OpenVAS Administrator is running and listening on all interfaces.
OK: OpenVAS Administrator is listening on port 9393, which is the default port.
OK: Greenbone Security Assistant is running and listening on all interfaces.
OK: Greenbone Security Assistant is listening on port 443, which is the default port.
Step 8: Checking nmap installation ...
WARNING: Your version of nmap is not fully supported: 6.47
SUGGEST: You should install nmap 5.51.
Step 9: Checking presence of optional tools ...
OK: pdflatex found.
OK: PDF generation successful. The PDF report format is likely to work.
OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work.
OK: rpm found, LSC credential package generation for RPM based targets is likely to work.
OK: alien found, LSC credential package generation for DEB based targets is likely to work.
OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work.
It seems like your OpenVAS-6 installation is OK.
Start OpenVAS Greenbone Security Desktop (GSD)
Once we click on openvas-gsd, we get a window where we need to enter login credentials and localhost in the place of IP address.
After successful login to GSD we get below Window where we need to configure Targets, Tasks etc.
To start Vulnerability Assessment we need to configure Targets, Tasks etc., tabs on the lower part of the above window.
Click on Extras->Start Greenbone Security Assistant. Will open URL in browser connecting to 127.0.0.1:443
Once the Vulnerability Scanning is done, we can download Report in supported format (PDF, HTML etc).
root@kali-praveend:~# openvas-check-setup
........
........
OK: At least one admin user exists.
WARNING: Your password policy is empty.
SUGGEST: Edit the /etc/openvas/pwpolicy.conf file to set a password policy.
Step 4: Checking Greenbone Security Assistant (GSA) ...
OK: Greenbone Security Assistant is present in version 4.0.0.
Step 5: Checking OpenVAS CLI ...
OK: OpenVAS CLI version 1.2.0.
Step 6: Checking Greenbone Security Desktop (GSD) ...
OK: Greenbone Security Desktop is present in Version 1.2.2.
Step 7: Checking if OpenVAS services are up and running ...
OK: netstat found, extended checks of the OpenVAS services enabled.
ERROR: OpenVAS Scanner is NOT running!
FIX: Start OpenVAS Scanner (openvassd).
ERROR: OpenVAS Manager is NOT running!
FIX: Start OpenVAS Manager (openvasmd).
ERROR: OpenVAS Administrator is NOT running!
FIX: Start OpenVAS Administrator (openvasad).
ERROR: Greenbone Security Assistant is NOT running!
FIX: Start Greenbone Security Assistant (gsad).
ERROR: Your OpenVAS-6 installation is not yet complete!
Please follow the instructions marked with FIX above and run this
script again.
Start OpenVAS Scanner
#/etc/init.d/openvas-scanner start
Start OpenVAS Manager
#openvasmd --rebuild take around 10 minutes, you can execute below command
#openvasmd
Start OpenVAS Administrator
#openvasad -c add_user -n praveend --role=Admin
if the username is already created just execute openvasad
Start Greenbone Security Assistant
#gsad
Once the configuration is done execute
root@kali-praveend:~# openvas-check-setup
........
........
Step 5: Checking OpenVAS CLI ...
OK: OpenVAS CLI version 1.2.0.
Step 6: Checking Greenbone Security Desktop (GSD) ...
OK: Greenbone Security Desktop is present in Version 1.2.2.
Step 7: Checking if OpenVAS services are up and running ...
OK: netstat found, extended checks of the OpenVAS services enabled.
OK: OpenVAS Scanner is running and listening only on the local interface.
OK: OpenVAS Scanner is listening on port 9391, which is the default port.
OK: OpenVAS Manager is running and listening on all interfaces.
OK: OpenVAS Manager is listening on port 9390, which is the default port.
OK: OpenVAS Administrator is running and listening on all interfaces.
OK: OpenVAS Administrator is listening on port 9393, which is the default port.
OK: Greenbone Security Assistant is running and listening on all interfaces.
OK: Greenbone Security Assistant is listening on port 443, which is the default port.
Step 8: Checking nmap installation ...
WARNING: Your version of nmap is not fully supported: 6.47
SUGGEST: You should install nmap 5.51.
Step 9: Checking presence of optional tools ...
OK: pdflatex found.
OK: PDF generation successful. The PDF report format is likely to work.
OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work.
OK: rpm found, LSC credential package generation for RPM based targets is likely to work.
OK: alien found, LSC credential package generation for DEB based targets is likely to work.
OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work.
It seems like your OpenVAS-6 installation is OK.
Start OpenVAS Greenbone Security Desktop (GSD)
Once we click on openvas-gsd, we get a window where we need to enter login credentials and localhost in the place of IP address.
After successful login to GSD we get below Window where we need to configure Targets, Tasks etc.
To start Vulnerability Assessment we need to configure Targets, Tasks etc., tabs on the lower part of the above window.
Click on Extras->Start Greenbone Security Assistant. Will open URL in browser connecting to 127.0.0.1:443
Once the Vulnerability Scanning is done, we can download Report in supported format (PDF, HTML etc).
Subscribe to:
Posts (Atom)