Follow:

Latest articles in ‘Cookbook’


  1. Drupageddon revisited: a new path from SQL injection to remote command execution (CVE-2014-3704)

    Published: Thu 16 November 2017 in Cookbook.
    Background explanations and a more efficient way to exploit Drupageddon, aka. CVE-2014-3704, Drupal SA-CORE-2014-005.

    Usually Drupal teams do a great job into ensuring a reasonable security level to their users. Most of the Drupal critical vulnerabilities come from community modules, modules which are hosted on a central place where the ones not conforming with Drupal security requirement get a specific red banner (“This module is unsupported due to a security issue the maintainer didn’t fix.”) and are tagged as abandoned.

    However, mistakes still happen, as Stefan Horst discovered in 2014 when he found out the Drupageddon vulnerability, also known as CVE-2014-3704 and Drupal SA-CORE-2014-005.

    I find this vulnerability quite interesting as it is an SQL injection vulnerability affecting Drupal core which relies on PDO for its database accesses which, in theory, should make it immune to such vulnerability.

    Moreover, we will see that Drupal’s features allow to extend this vulnerability way further than a simple SQL injection. We will …


  2. How to (more) safely use the Firefox password manager

    Published: Fri 03 November 2017 in Cookbook.
    Firefox built-in password manager remains a good alternative where standalone password managers are overkill.

    Security professionals often recommend to use a dedicated password manager software, such as KeePass1, which allows to easily prevent password reuse while ensuring a safe storage of the passwords.

    Did I just say… “easily”? For the wide public, this “easiness” may not be so obvious. The fact alone to have to install, learn and use a new software just to store the password which allows to access the website which, in turn, allows you to do your things: end-users often consider this over-killing…

    And they may be right.

    Their usual reaction is therefore either to rely on a single “well thought and complex password” to secure their whole digital life, or build an over-engineered mental algorithm to create unique (but easily guessable, even when they don’t think so) passwords, loosing data because of a forgotten password or being stuck because they are currently at their office while their …


  3. DHCP exploitation guide

    Published: Mon 30 October 2017 in Cookbook.
    A step-by-step guide to practical DHCP exploitation and protection.

    DHCP allows devices to automatically get their network configuration when bringing up a network interface (typically when booting).

    This configuration usually includes, among other thing, the IP address attributed to the device, the DNS domain name and the IP address of the default router, of the DNS server and of the NetBIOS name server.

    This configuration, is allocated to the device only for a given time: the lease time. Lease time may vary largely depending on the environment requirements. It is typical to find values ranging from a few dozen of minutes to a few weeks. When half of the lease time expired, the device starts to try get in touch with the DHCP server to renew the lease.

    Clients initially asking for the attribution of an IP address start by broadcasting a DHCP DISCOVER message.

    A typical DHCP exchange is as follow:

    Typical DHCP exchange

    1. DISCOVER: The client without IP address configured …


  4. MAC address table overflow

    Published: Wed 25 October 2017 in Cookbook.
    A step-by-step guide to practical MAC address table overflow exploitation and protection.

    The main practical difference between a legacy hub and a switch is that the switch will do its best to forward ethernet frames only on the port allowing to reach the recipient, it won’t blindly forward everything everywhere as as a dumb hub would do.

    To achieve this, upon reception of a frame the switch stores the senders MAC address associated to its input port in an internal memory, usually implemented as a CAM table. Thanks to this information, would a packet have the same address as recipient, the switch will now forward this packet only to this port and not the other ones.

    I already wrote a more focused article on MAC table overflow within the context of GNS3 simulated environments, which resulted in patch being submitted upstream and initiated the development of the macof.py tool. The original article is available here.

    In this article I detailed …


  5. Spanning Tree Protocol exploitation

    Published: Mon 16 October 2017 in Cookbook.
    How an attacker can take advantage of STP, and how to prevent this.

    As we saw in the previous post, Wireshark revealed us the presence of STP messages.

    The Spanning Tree Protocol is used to detect topology loops and build the most efficient forwarding path between interconnected switches. Topology loops are not a mistake but a way to add redundancy to a topology. Would a link break, the STP protocol detects it and recalculate a new most efficient tree.

    In sane networks, access ports should not deliver STP messages to end-devices, but this is not the default and, as Wireshark told us, not the case in our lab. This lets the attacker the possibility to simulate a topology change by sending maliciously crafted STP messages.

    For this lab we will need at least the User_1 and Server_1 devices to be available:

    STP lab topology

    Warning

    The support of STP in the IOU images I tested was very buggy, STP port state was ignored and frames systematically …


  6. Practical network layer 2 exploitation: passive reconnaissance

    Published: Thu 12 October 2017 in Cookbook.
    Network layer 2 practical offensive and defensive security: listen and learn from network's white noise.

    This post is part of a series about practical network layer 2 exploitation.

    Now is the time to change your network administrator hat for the attacker one. Your own, known network now becomes an unfamiliar target.

    Before rushing and banging against the nearest devices, it may wiser to just stand back and listen.

    On switched networks, users are somewhat isolated from each other thanks to the separation of collision domains. All that remain is some kind white noise… but this white noise in itself can bring invaluable information to an attacker!

    In particular we will see how, simply by passively listening to this white noise, an attacker will be able to detect several weaknesses affecting the network and plan his next steps.

    In this lab no interaction will occur with either the Admins or the Servers VLANs, the User_1 workstation will be required only for the DHCP Discover messages part …


  7. Practical network layer 2 exploitation: introduction

    Published: Tue 10 October 2017 in Cookbook.
    Network layer 2 practical offensive and defensive security: setting-up the lab.

    This post initiates a series demonstrating network layer 2 exploitation and protection techniques from practical point-of-view.

    This series will rely on the following topology (click to enlarge):

    Layer 2 exploitation lab topology

    This topology is composed of three VLANs:

    • Users (VLAN 1) and Admins (VLAN 2) both contain end-user workstations, they are isolated from each other.
    • Both can access machines located in Servers (VLAN 3).

    The attacker is connected to the Users VLAN.

    In this series we will see how the attacker can leverage various layer 2 configuration weaknesses to disrupt the network, hop from one VLAN to another, and intercept users communication, independently of their location in the topology.

    We will limit ourselves to basic techniques as an attempt to demonstrate that pwning a insufficiently secured network doesn’t involve any high technology or knowledge. When appropriate we will also see how the attacks can be generalized to other real-life scenarios.

    Creating the topology …


  8. How to configure Windows as a NTP server & enable IOS NTP client

    Published: Fri 06 October 2017 in Cookbook.
    A step-by-step guide to setup and troubleshoot NTP on Windows and Cisco IOS-based devices.

    NTP allows to synchronize the clock of various devices to a common reference.

    In this how-to, we will configure a Windows Server as a NTP server and a Cisco IOS-based router to act as a NTP client. We will also see how to configure the router so it can itself serve as server to other devices, thus acting as an NTP relay.

    NTP how-to topology

    Windows (NTP server)

    Windows does not ship with any NTP server by default. In fact, Windows’ W32Time service implements SNTP instead, which is not compatible with NTP clients (see here).

    Meinberg NTP is a commonly used alternative to get a proper NTP server on Windows, and is the one we will use in this how-to.

    Before installing it, check that the following settings are correct:

    • The IP configuration (192.168.0.100 in my case)
    • Check the current time (08h15 in my case, but who cares?)

    Once …


  9. How to configure Windows as a SCEP server & Cisco ASA enrollment

    Published: Thu 05 October 2017 in Cookbook.
    A step-by-step guide to configure SCEP on Windows and Cisco ASA appliances.

    SCEP is a protocol supported by several manufacturers, including Microsoft and Cisco, and designed to make certificate issuance easier in particular in large-scale environments.

    It proceeds in a few steps:

    1. The SCEP server issues a one-time password (the “challenge password”), transmitted out-of-band to the client.
    2. The client generates a key pair, and sends the certificate signing request to the SCEP server along with the one-time password.
    3. The SCEP server validates the client certificate data (in this how-to the validation will be manual), signs it and makes the signed certificate available to the client.
    4. The client regularly pull the SCEP server until its signed certificate becomes available. The client can then fetch the signed certificate and install it.

    Here we will setup a Windows Server as SCEP server, and use a Cisco ASA as SCEP client.

    SCEP how-to topology

    The topology above mentions Windows 2016, but any other Windows server will do. This how-to …


  10. Common issues when using virtual machines

    Published: Tue 26 September 2017 in Cookbook.
    A collection of the most common pitfalls and their solutions.

    Qemu issues

    Send the Ctrl-Alt-Del key sequence to the guest

    The Ctrl-Alt-Del is a special key sequence intercepted by he operating system. Windows use it as a security1 measure to unlock its screen, but in the case of virtualized system an alternative is necessary as the key sequence would be intercepted by the host instead of being sent to the guest.

    • If you are using VNC display, press F8, you should get a menu proposing to send the Ctrl-Alt-Del sequence to the guest.

    • If accessibility tools are available, enable the on-screen keyboard, press Ctrl-Alt on your physical keyboard and click Del on the on-screen keyboard.

    • If accessibility tools are not available, on Windows systems press the Shift key at least five times in a row, you should get a pop-up allowing to enable sticky keys. Now successively press the Ctrl, the Alt …


Pages: 1 2 3

Popular tags see all

Website

Author

Follow