Defend against Brute Force Attack with Fail2ban

Daily we hear some news related to cybercrime just, like, some malicious users or bots have successfully defaced some publicly accessible websites or some services. As we always try to explain through our articles, how such types of activities are possible when the system is weakly configured or misconfigured. It is therefore important to build some security measures, such as IDS / IPS in the firewall, to defend your server and clients while configuring it.

In this article, we will show how you can protect your network from brute force attacks and running network services?

The answer is: Using IPS in your network.

Table of Content

  • What is an IPS?
  • Introduction to fail2ban
  • Lab Setup Requirement
  • Brute Force Attack in Absence of IPS
  • Intrusion Prevention Lab Set-Up
  • Configure Fail2Ban
  • Protect SSH Against Brute Force Attack
  • Testing Fail2ban
  • How to unban IP in fail2ban for SSH
  • Protect FTP against Brute Force Attack
  • Testing Fail2ban for VSFTP
  • Unban IP for VSFTPD

What is an IPS?

Intrusion Prevention System is short-term as IPS, it networks security measures to examine the incoming traffic to perform intrusion detection and then block the detected incidents. For example, IPS can drop malicious packets, ban the traffic coming from an offending IP address.

Introduction to fail2ban

Fail2ban scans log files (e.g. /var/log/apache/error_log) and ban IPs that show the malicious signs — too many password failures, seeking for exploits, etc. Generally, Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time.

In this article, I will discuss how to prevent your running services against brute force attack using fail2ban.

Source: //www.fail2ban.org/wiki/index.php/Main_Page

Lab Setup Requirement

Victim’s Machine: Ubuntu 14.04  (192.168.0.105)

Pentester’s Machine: Kali Linux (192.168.0.105)

Brute Force Attack in Absence of IPS

Now let’s try to launch a brute force attack when on port 22 which is open in the target’s network to make unauthorized login. With the help hydra, we will try to guess SSH login credential.

As you can observe in the above image that it has successfully found aarti:123 for ssh login. Similarly, let’s try to launch a brute force attack when on port 21 which is open in the target’s network to make unauthorized login. With the help hydra, we will try to guess FTP login credential.

And from the given below image, you can observe, how badly these services are configured. Even the network administrator has not followed the password complexity rules as a result, it is so easy to launch a brute force against such type of network.

Intrusion Prevention Lab Set-Up

Therefore, I decided to set up the Intrusion Prevention system in this network which will monitor the incoming packets and detects the malicious activities and blocks that traffic coming from wicked IP. It is very easy to install fail2ban as Ubuntu already has a package for fail2ban in apt-repositories.

First of all, let me show you, the iptables rule list, which is empty as shown in the below image and then executes the installation command. Once it gets completed, then copy the configuration of jail.conf file inside jail.local file.

NOTE: While configuring fail2ban in your local machine, you must have root access or can use a non-root user with sudo rights.

Configure Fail2Ban

The service fail2ban has its default configuration files “jail.local” in the /etc/fail2ban directory, therefore, you should not edit this file, but you can override this into jail.local file with the help of below command and then open that file for configuring it as per your requirement.

Above you have seen that we had successfully launched brute force attack on SSH and FTP, therefore I will configure fail2ban to stop brute force attack in the network.

Once the file gets opened you need to focus a few things such as “ignoreip, bantime, maxretry” and then modify their value as per your requirement. Set the IPs you want fail2ban to ignore as ignoreip, set the ban time (in seconds) for a particular time period and maximum number for the user attempts.

Protect SSH Against Brute Force Attack

Ultimately, we come towards that portion of the configuration file which deals with specific services. These are identified by the section headers, such as [ssh].

To enable each of these sections to uncomment header [ssh] and modify the enabled value into “true” as shown in the below image, and then save the jail.local file and restart the fail2ban service:

Testing Fail2ban for SSH

Fail2ban offers a command “fail2ban-client” that can be used to execute Fail2ban from the command line, to check that the Fail2Ban is running and the SSH jail is enabled you can follow the given syntax to confirm its status.

Syntax: fail2ban-client COMMAND

As you can observe, the current filter list and action list is set as 0 or all I can say, it is empty. These values will get change if someone tries to cross the limit of maxretry.

As said above fail2ban will update iptables rules to reject the IP addresses for a specified amount of time and from the given below image you can observe, last 3 policies are automatically created by fail2ban.

Now let’s test host machine against brute force attack for ssh login once again:

And as you can obverse, this time we got “Connection refused” error while brute forcing attack on port 22.

Hmm!! Not bad, let’s also check the status for ssh jail status after this attack.

Now you can observe that in the given below image, it has shown 1 ban IP: 192.168.0.104 and anybody can explore log file too for more details.

How to unban IP in fail2ban for SSH

If you wish to unban the IP then again, you can go with fail2ban-client commands and do the same as done here:

And when you will check ssh jail status one more time, this time it won’t be showing any IP in the IP list.

Protect FTP against Brute Force Attack

Similarly, to enable FTP sections to uncomment [vsftpd] header and change the enabled line to be “true” as shown in the below image and even you can modify maxretry or log file path as per your requirement.

[vsftpd]

enabled = true

maxretry = 3

Testing Fail2ban for VSFTPD

Now save jail.local file and restart the fail2ban service and then you can check fail2ban and its Jail status including iptables rules.

With the help of the above command, we concluded that now there are two jails: ssh and vsftpd and also some new fail2ban policies have been created within iptables.

Now let’s test host machine against brute force attack for FTP login:

And as you can obverse, this time we got connection refused error while brute force attack and let’s check status for vsftpd jail status once again.

Yet again you can observe that in the given below image, it has shown 1 ban IP: 192.168.0.104 and anybody can check log file too for more details.

And look at the vsftpd log file, contains all detailed related to login attempt.

Unban IP in fail2ban for VSFTPD

If you wish to unban or unblock the IP then again, you can go with fail2ban-client commands and do the same as done here:

And when you will check vsftpd jail status once again, this time it won’t be showing any IP in the IP list.

Hope! You people will enjoy the article and find helpful in your network penetration testing and you can do more with fail2ban for securing your network.

Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

Magic Unicorn – PowerShell Downgrade Attack and Exploitation tool

Magic Unicorn is a simple tool for using a PowerShell downgrade attack that injects shellcode straight into memory. It is based on Matthew Graeber’s PowerShell attacks and the PowerShell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.

Table of Contents

  • Powershell Attack Instruction
  • HTA Attack Instruction
  • Macro Attack Instruction

 Download the unicorn tool from the git repository:

Once downloaded, go in the directory and run unicorn with the following command to see all the possible methods.

 

Powershell Attack Instructions

First, we will try the reverse_tcp payload. As we can see in the main menu all the commands are already written. We just need to replace the IP with our IP.

 

Now this will give us two files. One is a text file named “powershell_attack.txt” which has the PowerShell code that will be run in the victim’s machine using social engineering and the other is “unicorn.rc” which is a custom Metasploit file that will automatically set all the parameters and start a listener.

These files will be saved in the directory where unicorn was cloned. Powershell_attack.txt holds the malicious code and when the victim will execute that code in his command prompt, the attacker will get a reverse connection of his machine.

Now let’s set up a listener first. We need to run the Metasploit “unicorn.rc” file using the following command:

We see a session was obtained in the meterpreter. It was because the PowerShell code was executed in the victim’s command shell. It would have looked something like this:

HTA Attack Instructions

For our next attack, we will be using an HTA payload.

Now convert your IP in bit.ly URL form and send to the victim and then wait for the user to click on the “launcher.hta” file which could be done using social engineering easily.

So, we set up a Metasploit listener next using the RC file and wait for the user to click on the hta payload.

As soon as he ran the file, we received a meterpreter session. We checked the system info using the sysinfo command.

 

Macro Attack Instructions

Now for the third and final payload for this tutorial, we set hands on our beloved macros.

This again creates a text file and a “.rc” file with the same name and on the same destination.

To enable developer mode there are various methods depending upon your version of MS office.

As for a generic approach, let’s say you enabled it like:

File->properties->ribbons->developer mode

You will see an extra tab labeled developer once it gets enabled.

As for the attack, go to developer->macros and create a new macro named “Auto_Open”

Simply paste the contents from “powershell_attack.txt” to this xlsx module and save it.

As soon as you click run (little green icon on the top), it will give you an error! Don’t worry! You want that error. It is supposed to happen.

Soon after the error on the user screen, we would have obtained a session successfully in meterpreter!

Use sysinfo double check our successful exploitation using unicorn!

Author: Harshit Rajpal is an InfoSec researcher and a left and right brain thinker. contact here

Hacking with Empire – PowerShell Post-Exploitation Agent

Our today’s article is the first post of our Empire series. In this, we will cover every basic you need to know about the PowerShell Empire Framework. And with the eventually, we study advance exploits of Empire.

Table of Content:

  • Introduction
  • Installation
  • Importance
  • Terminology
  • Demo
  • Conclusion

Introduction

Empire is a post-exploitation framework. It’s a pure PowerShell agent, focused solely on python with cryptographically-secure communications with the add-on of a flexible architecture. Empire has the means to execute PowerShell agents without the requirement of PowerShell.exe. It can promptly employ post-exploitable modules, which covers a vast range from ranging from keyloggers to mimikatz, etc. This framework is a combination of the PowerShell Empire and Python Empire projects; which makes it user-friendly and convenient. PowerShell Empire came out in 2015 and Python Empire came out in 2016. It is similar to Metasploit and Meterpreter. But as it is command and control tool, it allows you to control a PC much more efficiently.

Importance

PowerShell provides abundant offensive advantages which further includes the whole access of .NET, applock whitelisting, and straight access to Win32. It also constructs malicious binaries in memory. It provides C2 functionality and allows you to implant the second stage after the first one. It can also be used for lateral movement. And it comes handy as it develops rapidly in comparison to other frameworks. Also, as it does not requires PowerShell.exe, it lets you bypass anti-viruses. Hence, it is best to use the PowerShell Empire.

Terminology

Before starting with the action you need to know these four things:

  • Listener: the listener is a process which listens for a connection from the machine we are attacking. This helps Empire send the loot back to the attacker’s computer.
  • Stager: A stager is a snippet of code that allows our malicious code to be run via the agent on the compromised host.
  • Agent: An agent is a program that maintains a connection between your computer and the compromised host.
  • Module: These are what execute our malicious commands, which can harvest credentials and escalate our privileges as mentioned above.

Installation

You can download Empire from here. Clone the command from the hyperlink provided for GitHub or simply use google.

Use the following command to download it:

Once the downloaded is initiated and completed, follow steps given directly below in order to install it :

Wait for it to complete the installation. This might take a few seconds. It will prompt you for a password.

In my case, my password was toor.

Once the installation is done, move back a directory and run empire using ./empire.

Now use Help command as it opens up all the essential options required initially.

According to the workflow, firstly, we have to create a listener on our local machine. Type the following command:

After running the above command, it will say that “no listeners are currently active” but don’t worry, we are into the listener interface now.  So in this listener interface, type :

 

The above command will list all the listeners that one can use, such as dbx, http, http_com, etc. The most popular and commonly used listener is http and we will use the same in our practice. For that type :

This command creates a listener on the local port 80. If port 80 is already busy by a service like Apache, please make sure you stop that service as this listener being http listener will only work on port 80. Now to see all the settings that you ought to provide in this listener type :

As you can see in the image that there are a variety of settings you can use to modify or customize your listener. Let’s try changing the name of our listener as it helps to remember all the listeners that are activated; if activated in bulk. So for this, type :

The above command will change the listeners’ name from http to test.

Usually, this listener automatically takes up the local host IP but, just in case, you can use the following command to set your IP :

Above command will execute the listener. Then go back and use PowerShell listener as shown in the image.

Now type ‘back’ to go back from the listener interface so that we can execute our modules. Use the following command to see all the modules that the empire provides:

As you can see in the image below that there are a lot of modules for both windows and IOS along with some multi ones that can be used on any platforms. We will use launcher_bat to create malware and exploit our victims’ PC in our tutorial. And for that type:

Then again type ‘info’ in order to see all the settings required by the exploit. After examining you will see that we only need to provide listener. Therefore, type :

The above two commands will execute our exploit after setting the listener test and create /tmp/launcher.bat. Use the python server to execute this file in victims’ PC. As the file will execute, you will have a session. To check your session type:

With the above command, you can see that you have a session activated. You can change the name of your session as the name given by default is pretty complicated and difficult to remember. To do so type:

Use the following to access the session:

Once you have gained access to the session, try and get admin session by using the following command:

bypassuac http

After executing the bypassuac command another session will open. Rename that session too by typing :

Let’s

<tab><tab>helps us view all the options in the shell. There are several options which is quite helpful to for post exploitation. Such as info, job, list and etc as shown in the image.

Info: for all the basic details like IP, nonce, jitter, integrity etc.

Now if you use ‘help’ command, you will be able to see all the executable commands. 

Let’s try and run mimikatz to get the password of the user. Since mimikatz won’t run on a normal guest user shell and will only run on the admin shell; this also proves that we have to achieve admin access so that we can use mimikatz.

Hmmmm!! And the password is “123” for user raj.

creds

Above command will dump the credentials or password of any user in both plaintext and its hash as well.

Another important command is the shell command.

To use the shell of the victim to run proper Microsoft windows commands, we use this feature.

Eg: one such window’s cmd only command is netstat

And as expected, the above command showed us all the ports in work currently on the machine!

Now, since the default shell directory in windows is “C:/windows/system32”; let’s try and move into another directory and try to download some file from there and also we can upload something at that location, for example, we can upload a backdoor! Now, use the following commands for it :

Above command will download an image called 6.png from the window’s desktop to the “downloads directory of Empire”

Here we can upload any backdoor, with help of above command we are uploading a php backdoor from Kali’s desktop to victim’s desktop and we can even invoke this file since we have the shell access!

This is where the downloaded files will go:

Empire directory/downloads/<agent name>/<agent shell location>

Above command proves that we indeed have uploaded revshell.php

And there it is! Revshell.php on the desktop of victim’s machine which our backdoor file.

Previously shown were the basic demo of empire and its different terms used and how to use them. There is another term too, i.e. usemodule. Lastly, let’s see how to use it.

The command will show you all the modules available and ready to use as shown in the image below:

Following is a small demo of how to use usemodule. Type :

Using the above module will display a message on victims’ PC as shown image below :

Conclusion

Malware in the form of .exe/dll/hta etc. allows an attacker to construct any desirable attack as this framework has access to Win32. Although anti-virus companies are becoming aware day by day, these ones are still valid. It’s a great tool due to its vast, authentic and efficient collection of post-exploits. Ultimately, the goal is to be undetected and successful in your attack and this tool allows us to do so. And this article covered all the basics you need to know about this framework.

Happy Hacking!!

Author: Harshit Rajpal is an InfoSec researcher and a left and right brain thinker. contact here

Multiple Ways to Exploiting PUT Method

Hi Friends, today’s article is related to exploiting the HTTP PUT method vulnerability through various techniques. First, we will determine if the HTTP PUT method is enabled on the target victim machine, a post which we will utilize several different methods to upload a Meterpreter reverse shell on the target and compromise the same.

Table of Content 

  • Introduction to HTTP PUT Method
  • Scanning HTTP PUT Method (Nikto)
  • Exploiting PUT Method Using Cadaver
  • Exploiting PUT Method Using Nmap
  • Exploiting PUT Method Using Poster
  • Exploiting PUT Method Using Metasploit
  • Exploiting PUT Method Using Burpsuite
  • Exploiting PUT Method Using Curl

Introduction to HTTP PUT Method

PUT method was originally intended as one of the HTTP method used for file management operations. If the HTTP PUT method is enabled on the webserver it can be used to upload a malicious resource to the target server, such as a web shell, and execute it

As this method is used to change or delete the files from the target server’s file system, it often results in arising in various File upload vulnerabilities, leading the way for critical and dangerous attacks. As a best practice, the file access permissions of the organizations’ critical servers should be strictly limited with restricted access to authorized users, if in case the organization absolutely MUST have these methods enabled.

Note: In this tutorial, we are using a Vulnerable target machine for Pentesting purposes and to illustrate the use of various tools. This is purely meant for educational purposes in the testing environment and should not be used in a Production environment without the authorized permissions from the relevant authorities/management.

Requirements 

Target: Metasploitable 2

Attacker: Kali Linux machine

Let’s Begin!!!!

Boot your Kali Linux machine (IP: 192.168.1.105) and in parallel, type victim IP as 192.168.1.103 in the Firefox browser and click on WebDAV. As we can see from the screenshot it is listing only the parent directory. 

First of all, we need to ensure that the vulnerable target machine has the HTTP PUT method allowed us to upload malicious backdoors. In order to confirm the same, we need to scan the target using Nikto.

Nikto is a popular Web server scanner that tests Web servers for dangerous files/CGIs, outdated server software and other issues. It also performs generic and server type specific checks. Below is the command to scan the URL:

Upon running the above command, we can observe that the highlighted part in below screenshot displays that the HTTP PUT method is allowed. Now let’s hack the vulnerable target machine by uploading the PHP malicious file, using the various techniques shown in upcoming sections.

Prepare the malicious file to be uploaded with msfvenom :

Msfvenom can be used to create PHP meterpreter payload that gives us a reverse shell. Execute the following command to perform the same

Copy the code from <?php to die() and save it in a file with .php extension as shell.php file , on the desktop .This will be utilized later in the upcoming sections, to upload the file on the web server.

In parallel, load the Metasploit framework by typing msfconsole on a new terminal and start multi/handler. This will be utilized in the later part of the section

Cadaver

Cadaver is a command line tool pre-installed in the Kali machine that enables the uploading and downloading of a file on WebDAV.

Type the target host URL to upload the malicious file, using the command given below.

Now once we are inside the victim’s directory, upload the file shell.php from the Desktop to the target machine’s path, by executing the below command :

To verify whether the file is uploaded or not, run the URL: 192.168.1.103/dav/ on the browser. Awesome!!! As we can see, the malicious file shell.php has been uploaded on the web server.

Now, let’s launch the Metasploit framework and start a handler using the exploit/multi/handler module. Assign the other values like the LHOST and LPORT values to the Kali machine’s IP and port to listen on, respectively. Once done, execute by running the command exploit to start listening for the incoming connections.

Press Enter and we will observe that the reverse TCP handler has been started on Kali IP 192.168.1.105:4444.

Now go back to the previously uploaded shell.php file and click on the same. Once run, we will get the TCP reverse connection automatically on the meterpreter shell. Further, run the sysinfo command on the meterpreter session to get machine OS/architecture details.

 

Nmap

Nmap is an opensource port scanner and network exploitation tool. If PUT Method is enabled on any web server, then we can also upload a malicious file to a remote web server with the help of NMAP. Below is the command to configure the same. We must specify the filename and URL path with NSE arguments. in parallel, prepare the malicious file nmap.php to upload to the target server.

As seen from the below screenshot, the nmap.php file has been uploaded successfully.

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot, the file nmap.php has been uploaded on the web server.

Simultaneously, open Metasploit MSF console and use multi/handler; then go back to previously uploaded nmap.php file and run it. As can be seen below, this will give us a meterpreter session.

Poster

The poster is a Firefox Add-on and a developer tool for interacting with web services to let the end-user trigger the HTTP requests with parameters like GET, POST, PUT and DELETE and also enables to set the entity body, and content type

Prepare the malicious file poster.php that you would like to upload to the target machine. Install the Poster plug-in from Firefox Add-on. Click on the tools from the menu bar. And then click on Poster from the drop-down menu. The following dialog box will open. Type the URL as mentioned in the screenshot and provide the path of the malicious file to be uploaded via Browse option and finally click on PUT action.

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot, the file poster.php has been uploaded on the web server.

Simultaneously, open Metasploit MSF console and use multi/handler; then go back to previously uploaded poster.php file and run it. This will give us a meterpreter session.

Burpsuite

Burpsuite is one of the most popular proxy interception tools whose graphical interface can be effectively utilized to analyze all kind of GET and POST requests.

Configure the manual proxy settings of end users’ browser so as to intercept the GET request Browse the URL //192.168.1.103 but don’t hit ENTER yet. In parallel, let us navigate to the Burpsuite Proxy tab and click Intercept is on the option under the Intercept sub-option, to capture the request. As soon as we hit ENTER in the users’ browser, we will be able to fetch the data under the intercept window.

Now right-click on the same window and a list of multiple options will get displayed. A further click on Send to the repeater.

 

In the below-highlighted screenshot, we will observe two panels – left and right for the HTTP Request and HTTP Response respectively. The GET method can be observed in the HTTP request and we will now replace GET with the PUT method in order to upload the file with name burp.php comprising of malicious content/code.

Type PUT /dav/burp.php HTTP/1.1 in the header and then paste the php malicious code starting from dav directory through PUT request.

Verify and confirm the file upload by browsing the same URL 192.168.1.103/dav in the end users’ browser and we can see the burp.php file has been uploaded in the /dav directory of the web server.

Simultaneously, open Metasploit MSF console and use multi/handler; then go back to previously uploaded burp.php file and run it. This will give us a meterpreter session.

Metasploit

Metasploit Framework is a well-known platform for developing, testing, and executing exploits. It is an open source tool for performing various exploits against the target machines. This module can abuse misconfigured web servers to upload and delete web content via PUT and DELETE HTTP requests. Set ACTION to either PUT or DELETE. PUT is the default.

Metasploit has in-built auxiliary modules dedicated to scanning HTTP methods and gives us the ability to PUT a file with auxiliary/scanner/http/http_put. Below are the commands to accomplish the same

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot, the file meter.php has been uploaded on the web server.

 

Simultaneously, open Metasploit MSF console and use multi/handler; then go back to previously uploaded meter.php file and run it. This will give us a meterpreter session.

 cURL

cURL is a well-known command line tool to send or receive the data using the URL syntax and is compatible with various well-known protocols (HTTPS, FTP, SCP, LDAP, Telnet etc.)

To exploit the PUT method with cURL, the command is:

Type the same URL in browser 192.168.1.103/dav and execute the same. As evident from the screenshot, the file curl.php has been uploaded on the web server.

 

Simultaneously, open Metasploit MSF console and use multi/handler; then go back to previously uploaded curl.php file and run it. This will give us a meterpreter session.

Author: Ankur Sachdev is an Information Security consultant and researcher in the field of Network & WebApp Penetration Testing. Contact Here