Magic Unicorn – PowerShell Downgrade Attack and Exploitation tool

Magic Unicorn is a simple tool for using a PowerShell downgrade attack and injects shellcode straight into memory. Based on Matthew Graeber’s powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.

Table of Content

  • Powershell Attack Instruction
  • HTA Attack Instruction
  • Macro Attack Instruction

 Download the unicorn from git repository:

Once downloaded, go in the directory and run unicorn with the following command to see all the possible methods.

 

Powershell Attack Instructions

First we will try the reverse_tcp payload. As we can see in the main menu all the commands are already written. We just need to replace the IP with our IP.

 

Now this will give us two files. One is a text file named “powershell_attack.txt” which has the powershell code that will be run in the victim’s machine using social engineering and the other is “unicorn.rc” which is a custom metasploit file that will automatically set all the parameters and start a listener.

These files will be saved in the directory where unicorn was cloned. Powershell_attack.txt holds the malicious code and when the victim will execute that code in his command prompt, the attacker will get reverse connection of his machine.

Now let’s set up a listener first. We need to run the metasploit “unicorn.rc” file using the following command:

We see a session was obtained in the meterpreter. It was because the powershell code was executed in the victim’s command shell. It would have looked something like this:

HTA Attack Instructions

For our next attack, we will be using an hta payload.

Now convert your IP in bitly URL form and send to victim and then wait for the user to click on the “launcher.hta” file which could be done using social engineering easily.

So, we set up a metasploit listener next using the RC file and wait for user to click on the hta payload.

As soon as he hit the file, we received a meterpreter session. We checked the system info using sysinfo command.

 

Macro Attack Instructions

Now for the third and final payload for this tutorial, we set hands on our beloved macros.

 

This again creates a text file and an rc file with the same name and on the same destination.

To enable developed mode there are various methods depending upon your version of MS office.

As for a generic approach, let’s say you enabled it like:

File->properties->ribbons->developer mode

You will see an extra tab labeled developer once it gets enabled.

As for the attack, go to developer->macros and create a new macro named “Auto_Open”

Simply paste the contents from “powershell_attack.txt” to this xlsx module and save it.

As soon as you click run (little green icon on the top), it will give you an error! Don’t worry! You want that error. It is supposed to happen.

Soon after the error on the user screen, we would have obtained a session successfully in meterpreter!

Use sysinfo double check our successful exploitation using unicorn!

Author: Harshit Rajpal is an InfoSec researcher and a left and right brain thinker. contact here

Hacking with Empire – PowerShell Post-Exploitation Agent

Hello everyone and welcome to this beginner’s guide to Empire. According to their official website:

“Empire is a pure PowerShell post-exploitation agent” built on cryptologically-secure communications and a flexible architecture.

Empire – PowerShell post-exploitation agent

Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.”

In this tutorial we will be covering everything you need to know about this software, straight from installation to getting a shell and even getting admin access without letting the antivirus know!

Before starting with the action you need to know these four things:

Listener: listener is a process which listens for a connection from the machine we are attacking. This helps Empire send the loot back to the attacker’s computer.

Stager: A stager is a snippet of code that allows our malicious code to be run via the agent on the compromised host.

Agent: An agent is a program that maintains a connection between your computer and the compromised host.

Module: These are what execute our malicious commands, which can harvest credentials and escalate our privileges as mentioned above.

Methodology:

  1. Creating a listener.
  2. Starting a listener.
  3. Launching a PowerShell code using launcher.
  4. Executing code on victim’s machine.
  5. Interacting with agent.
  6. Executing various modules.
  7. Bypassing UAC to get admin access.

To get started, clone the following git repo using git clone:

Now move into the installed directory and run install.sh file.

Wait for it to complete installation. This might take a few seconds. It will prompt you for a password, enter anything.

In my case, my password was toor.

Once the installation is done, move back a directory and run empire using ./empire

Help command opens up all the essential options required initially.

As our methodology states, we will be creating a listener for our local machine first.

It will say that “no listeners are currently active” but don’t worry, we are into the listener interface now.

Creates a listener on the local port 80. If port 80 is already busy by a service like apache, please make sure you stop that service.

Note: Whenever you double click on tab, all the available options will appear, just like in all of Linux.

Hence, uselistener <tab><tab> shows me all the listenersand so on like that.

Above command will execute the listener. Then go back and use powsershell listener as shown in the below image.

All we have to do now is copy this powershell code into victim’s command prompt using social engineering. Let’s assume we have access of victim’s command prompt and we copied our code into his cmd.

As soon as you hit enter you will see an agent being active on your empire screen. After executing the malicious powershell code, go back again to the main menu with the command:

Here you will see 1 agent active.

You can also rename the agent’s name to a rather simple one using the rename command.

Now, to get an admin shell, run bypassuac command with help of following command.

List command can be used anywhere to see the list in current interface. Here it displayed a list of agents in agent’s interface.

Let’s rename the agent’s name to a rather simpler one, once again.

Now you can see that we got a new admin shell using bypassuac and we renamed it to adminraj

Let’s interact with adminraj now.

<tab><tab>helps us view all the options in the shell. There are several options which is quite helpful to for post exploitation. Such as info, job, list and etc as shown in the image.

Info: for all the basic details like IP, nonce, jitter, integrity etc.

Let’s try and run mimikatz to get the password of the user. Since, mimikatz won’t run on a normal guest user shell and will only run on admin shell; this also proves that we have to achieve admin access so that we can use mimikatz.

Hmmmm!! And the password is “123”for user raj.

Above command will dump the credentials or password of any user in both plaintext and its hash as well.

Another important command is the shell command.

To use the shell of the victim to run proper microsoft windows commands, we use this feature.

Eg: one such window’s cmd only command is netstat

As expected, it showed us all the ports in work currently on the machine!

 Now, since the default shell directory in windows is “C:/windows/system32”; let’s try and move into another directory and try to download some file from there and also we can upload something at that location, for example we can upload a backdoor.!

Above command will download an image called 6.png from the window’s desktop to the “downloads directory of Empire”

Here we can upload any backdoor, with help of above command we are uploading a php backdoor from Kali’s desktop to victim’s desktop and we can even invoke this file since we have the shell access!

This is where the downloaded files will go:

Above command proves that we indeed have uploaded revshell.php

And there it is! Revshell.php on the desktop of victim’s machine which our backdoor file.

Happy Hacking!!!

Author: Harshit Rajpal is an InfoSec researcher and a left and right brain thinker. contact here

Multiple Ways to Exploiting PUT Method

Hi Friends, today’s article is related to exploiting the HTTP PUT method vulnerability through various techniques. First we will determine if the HTTP PUT method is enabled on the target victim machine, post which we will utilize several different methods to upload a Meterpreter reverse shell on the target and compromise the same.

Table of Content 

  • Introduction to HTTP PUT Method
  • Scanning HTTP PUT Method (Nikto)
  • Exploiting PUT Method Using Cadaver
  • Exploiting PUT Method Using Nmap
  • Exploiting PUT Method Using Poster
  • Exploiting PUT Method Using Metasploit
  • Exploiting PUT Method Using Burpsuite
  • Exploiting PUT Method Using Curl

Introduction to HTTP PUT Method

PUT method was originally intended as one of the HTTP method used for file management operations. If the HTTP PUT method is enabled on the webserver it can be used to upload a malicious resource to the target server, such as a web shell , and execute it

As this method is used to change or delete the files from the target server’s file system , it often results in arise in various File upload vulnerabilities , leading the way for critical and dangerous attacks .As a best practice , the file access permissions of the organizations’ critical servers should be strictly limited with restricted access to authorized users, if in case the organization absolutely MUST have these methods enabled.

Note : In this tutorial we are using a Vulnerable target machine for Pentesting purposes and to illustrate the use of various tools . This is purely meant for educational purposes in the testing environment and should not be used in Production environment without the authorized permissions from the relevant authorities/management.

Requirements 

Target: Metasploitable 2

Attacker: Kali Linux machine

Let’s Begin!!!!

Boot your Kali Linux machine (IP : 192.168.1.105) and in parallel, type victim IP as 192.168.1.103 in the Firefox browser and click on WEBDAV. As we can see from the screenshot it is listing only the parent directory. 

First of all we need to ensure that the vulnerable target machine has the HTTP PUT method allowed for us to upload malicious backdoors.In order to confirm the same , we need to scan the target using Nikto .

Nikto is a popular Web server scanner that tests Web servers for dangerous files/CGIs, outdated server software and other issues. It also performs generic and server type specific checks.Below is the command to scan the URL:

Upon running the above command , we can observe that the highlighted part in below screenshot displays that HTTP PUT method is allowed. Now let’s hack the vulnerable target machine by uploading the PHP malicious file ,using the various techniques shown in upcoming sections.

Prepare the malicious file to be uploaded with msfvenom :

Msfvenom can be used to create PHP meterpreter payload that gives us a reverse shell. Execute the following command to perform the same

Copy the code from <?php to die() and save it in a file with .php extension as shell.php file , on the desktop .This will be utilized later in the upcoming sections , to upload the file on web server.

In parallel, load the metasploit framework by typing msfconsole on a new terminal and start multi/handler.This will be utilized in the later part of the section

Cadaver

Cadaver is a command line tool pre-installed in the Kali machine that enables the uploading and downloading of a file on webdav.

Type the target host URL to upload the malicious file , using the command given below.

Now once we are inside the victim’s directory, upload the file shell.php from the Desktop to the target machine’s path, by executing the below command :

To verify whether the file is uploaded or not, run the URL: 192.168.1.103/dav/ on the browser. Awesome!!! As we can see , the malicious file shell.php has been uploaded on the web server.

Now, let’s launch Metasploit framework and start a handler using the exploit/multi/handler module. Assign the other values like the LHOST and LPORT values to the Kali machine’s IP and port to listen on , respectively. Once done, execute by running the command exploit to start listening for the incoming connections.

Press Enter and we will observe that the reverse TCP handler has been started on Kali IP 192.168.1.105:4444.

Now go back to the previously uploaded shell.php file and click on the same.Once run , we will get TCP reverse connection automatically on the meterpreter shell. Further run the sysinfo command on the meterpreter session to get machine OS / architecture details.

 

Nmap

Nmap is an opensource port scanner and network exploitation tool.If PUT Method is enabled on any webserver, then we can also upload malicious file to a remote web server with the help of NMAP.Below is the command to configure the same . We must specify the filename and URL path with NSE arguments .In parallel , prepare the malicious file nmap.php to upload to target server.

As seen from the below screenshot , nmap.php file has been uploaded successfully.

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot , the file nmap.php has been uploaded on the web server.

Simultaneously, open metasploit MSF console and use multi/handler; then go back to previously uploaded nmap.php file and run it. As can be seen below, this will give us a meterpreter session.

Poster

Poster is a Firefox Add-on and a developer tool for interacting with web services to let the end user trigger the HTTP requests with parameters like: GET, POST, PUT and DELETE and also enables to set the entity body, and content type

Prepare the malicious file poster.php that you would like to upload to the target machine. Install the Poster plug-in from Firefox Add-on. Click on the tools from the menu bar. And then click on Poster from the dropdown menu. A following dialog box will open. Type the URL as mentioned in the screenshot and provide the path of the malicious file to be uploaded via Browse option and finally click on PUT action.

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot , the file poster.php has been uploaded on the web server.

Simultaneously, open metasploit MSF console and use multi/handler; then go back to previously uploaded poster.php file and run it. This will give us a meterpreter session.

Burpsuite

Burpsuite is one of the most popular proxy interception tool whose graphical interface can be effectively utilized to analyze all kind of GET and POST requests.

Configure the manual proxy settings of end users’ browser so as to intercept the GET request Browse the URL http://192.168.1.103 but don’t hit ENTER yet . In parallel , let us navigate to the Burpsuite Proxy tab and click Intercept is on option under the Intercept sub-option , to capture the request. As soon we hit ENTER in the users’ browser , we will be able to fetch the data under the intercept window.

Now right click on the same window and a list of multiple options will get displayed. Further click on Send to repeater.

 

In the below highlighted screenshot , we will observe two panels – left and right for the HTTP Request and HTTP Response respectively . The GET method can be observed in the HTTP request and we will now replace GET with the PUT method in order to upload the file with name burp.php comprising of malicious content/code.

Type PUT /dav/burp.php HTTP/1.1 in the header and then paste the php malicious code starting from <?php to die() at the end of the request, as shown below .This will upload the burp.php file under the dav directory through PUT request.

Verify and confirm the file upload by browsing the same URL 192.168.1.103/dav in the end users’ browser and we can see burp.php file has been uploaded in the /dav directory of the web server.

Simultaneously, open metasploit MSF console and use multi/handler; then go back to previously uploaded burp.php file and run it. This will give us a meterpreter session.

Metasploit

Metasploit Framework is a well known platform for developing, testing, and executing exploits. It is an open source tool for performing various exploits against the target machines. This module can abuse misconfigured web servers to upload and delete web content via PUT and DELETE HTTP requests. Set ACTION to either PUT or DELETE. PUT is the default.

Metasploit has in-built auxiliary modules dedicated to scan HTTP methods and gives us the ability to PUT a file with auxiliary/scanner/http/http_put.Below are the commands to accomplish same

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot , the file meter.php has been uploaded on the web server.

 

Simultaneously, open metasploit MSF console and use multi/handler; then go back to previously uploaded meter.php file and run it. This will give us a meterpreter session.

 cURL

cURL is a well-known command line tool to send or receive the data using the URL syntax and is compatible with various well-known protocols (HTTPS, FTP, SCP, LDAP, Telnet etc.)

To exploit PUT method with cURL, the command is:

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot , the file curl.php has been uploaded on the web server.

 

Simultaneously, open metasploit MSF console and use multi/handler; then go back to previously uploaded curl.php file and run it. This will give us a meterpreter session.

Author: Ankur Sachdev is Information Security consultant and researcher in the field of Network & WebApp Penetration Testing . Contact Here

Multiple Ways to Detect HTTP Options

Hi Friends, today we will walkthrough various HTTP Protocol methods and the tools used to extract those available HTTP methods in a web server. As we are already aware that the HTTP protocol comprises of number of methods that can be utilized to not only gather the information from the web server, but can also perform specific actions on the web server. These techniques and methods are helpful for the web application developers in the deployment and testing stage of the web applications.

GET and POST are the most well-known methods that are used to access and submit information provided by a web server, respectively. HTTP Protocol allows various other methods as well, like PUT , CONNECT , TRACE, HEAD, DELETE .These methods can be used for malicious purposes , if the web server is left misconfigured and hence poses a major security risk for the web application, as this could allow an attacker to modify the files stored on the web server.

OPTIONS : The OPTIONS method is used to request the available HTTP methods on a web server.

GET : GET request is the most common and widely used methods for the websites. This method is used to retrieve the data from the web server for a specific resource. As the GET method only requests for the data and doesnot modify the content of any resources, it’s considered to be safe.

POST : POST requests are used to send (or submit) the data to the web server so as to create or update a resource. The information sent is stored in the request body of the HTTP request and processed further. An example illustrating the same is “Contact us” form page on a website. When we fill a form and submit it, the input data is then stored in the response body of the request and sent across to the server.

PUT : The PUT method allows the end user (client) to upload new files on the web server. An attacker can exploit it by uploading malicious files or by using the victim’s server as a file repository.

CONNECT : The CONNECT method could allow a client to use the web server as a proxy.

TRACE: This method echoes back to the client, the same string which has been sent across to the server, and is used mainly for debugging purposes.

HEAD: The HEAD method is almost similar to GET, however without the message-body in the response. In other words, if the HTTP request GET /products returns a list of products, then the HEAD /products will trigger a similar HTTP request however, won’t retrieve the list of products.

DELETE: This method enables a client to delete a file on the web server. An attacker can exploit it as a very simple and direct way to deface a web site or to perform a DoS attack.

Now let us use some tools to identify the HTTP methods enabled or supported by the web server

Metasploit

Metasploit Framework is a well-known platform for developing, testing, and executing exploits. It is an open source tool for performing various exploits against the target machines.

Metasploit has in-built auxiliary modules dedicated to scan HTTP methods. Through the Metasploit framework command line (CLI), we can identify the HTTP Options available on the target URL as follows:

cURL

cURL is a command line tool to get or send the data using the URL syntax and is compatible with various well-known protocols (HTTPS, FTP, SCP, LDAP, Telnet etc.) along with command line (CLI) options for performing various tasks (Eg: User authentication , FTP uploading , SSL connections etc). The cURL utility by default comes installed in most of the distributions. However if in case , cURL is not installed, then we can install the same via apt-get install curl command . For more details refer the below URL

http://www.hackingarticles.in/web-application-penetration-testing-curl/

Through the cURL command we can identify the HTTP Options available on the target URL as follows :

The screenshot displays the various types of allowed HTTP methods (GET, HEAD ,POST,OPTIONS, TRACE), apart from other server specific information (Server response , version details etc)

Nikto

Nikto is a Web server scanner that tests Web servers for dangerous files/CGIs, outdated server software and other issues. It performs generic and server type specific checks.

Through the Nikto command we can identify the HTTP Options available on the target URL as follows :

The screenshot displays the various types of allowed HTTP methods (GET, HEAD ,POST,OPTIONS, TRACE), apart from other detailed server specific information (Server response , version details etc)

Nmap

Nmap is a free and open-source security scanner, used to discover hosts and services on the network. This is another method of checking which HTTP methods are enabled by using an NMAP script called http-methods.nse, which can be obtained from https://nmap.org/nsedoc/scripts/http-methods.html .

Let us use NMAP command to enumerate all of the HTTP methods supported by a web server on the target URL as follows :

The screenshot displays the various types of allowed HTTP methods (GET, HEAD, POST,OPTIONS, TRACE) along with highlighting the potentially risk methods (i.e TRACE) out of them .

Netcat

Netcat is a utility tool having the capability to write and read data across TCP and UDP network connections, along with features like in-built port scanning , network debugging and file transfer etc.

Through the Netcat command we can identify the HTTP Options available on the target URL as follows :

Press enter and the following options appear in the command line . Enter the server details as follows (and as highlighted in red )

The screenshot displays the various types of allowed HTTP methods (GET, HEAD ,POST,OPTIONS, TRACE), apart from other server specific information (Server response , version details etc)

 

Burpsuite

Burp Suite is a platform for performing various security testing for the web applications , from initial mapping and analysis to identifying and exploiting application vulnerabilities.

As we aware that the HTTP OPTIONS method provides us the most effective way to discover the different methods allowed on a HTTP server. So , let us capture the URL request in Burpsuite GUI and change the HTTP method type in the Request section to OPTIONS , as seen below.

As shown , the RESPONSE from the web server not only displays the list of HTTP methods allowed ,however also highlights the server version details (Eg: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL 1.0.0/k DAV/2 PHP/5.4.3)

Author: Ankur Sachdev is Information Security consultant and researcher in the field of Network & WebApp Penetration Testing . Contact Here

Related Posts Plugin for WordPress, Blogger...