Re: Hacking to Xp box

From: Marco Monicelli (marco.monicelli_at_marcegaglia.com)
Date: 09/06/05

  • Next message: bryan allott: "Whitespace in passwords"
    To: "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
    Date: 06-Sep-2005 11:08:36 CEDT
    
    

    As far as claimed by the author, this patch should enable back the RAW
    sockets sending. Never tested though.

    http://mitglied.lycos.de/lvllord/download-mirror.htm

    You can use it by command line or in a batch file....

    Cheers

    Marco

    Inside of a firm ICMP probably can't be be blocked as it's needed for
    Group policy.

    If XP SP2 with 05-019... Raw sockets can't be reenabled via command
    line... at least not the one that worked pre 05-019. You know of a new
    one?

    -------- Original Message --------
    Subject: Raw sockets, MS05-019 and Windows Firewall -- Summary
    Date: Mon, 25 Apr 2005 14:33:01 -0700
    From: Robin Keir <robin@KEIR.NET>
    Reply-To: Windows NTBugtraq Mailing List
    <NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM>
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    With the advent of XP SP2 and the recent MS05-019 patch, using raw
    sockets for scanning from a Windows platform has proven to be very
    problematic. I thought I would summarize the situation.

    Based upon the presence of MS05-019 and the state of the Windows
    Firewall service(s) we have to decide whether we need to stop or start
    the firewall service(s). Even then there may still be issues. The logic
    is as follows:

    Windows 2000 is unaffected. It fully supports all raw socket actions and
     since it doesn't have the Windows Firewall/ICF we don't have any of
    those associated issues.

    XP SP0 should have the firewall stopped ("net stop sharedaccess"). Even
    though TCP raw sockets are unaffected by the firewall the ALG service,
    which is intimately tied to the firewall service on XP, prevents
    discovery of several ports such as 21, 389, 1002 and 1720 when using TCP
    raw sockets. Stopping the sharedaccess service thus automatically stops
    the ALG service and we're good to go.

    XP SP1 *without* MS05-019 functions the same as XP SP0.

    XP SP1 *with* MS05-019 needs to have the sharedaccess firewall service
    *running* (see http://support.microsoft.com/kb/897656) otherwise TCP raw
    sockets are blocked. Because the sharedaccess service needs to be
    running to enable sending of TCP packets using raw sockets we have the
    problem with the ALG service blocking sending to certain ports, but it's
    better than nothing.

    XP SP2 *without* MS05-019 functions the same as XP SP1 without the patch
    apart from a driver-level restriction on the number of
    in-the-process-of-connecting TCP connections. This can affect regular
    socket style scanning. The only known workaround to the driver issue is
    a TCPIP.SYS hack.

    XP SP2 *with* MS05-019 is unusable for raw-socket TCP scanning. It
    totally blocks TCP raw sockets with or without the firewall enabled.

    Windows Server 2003 acts like XP SP0. The ALG service, which is now no
    longer tied to the sharedaccess (Windows Firewall) service, should be
    stopped ("net stop alg").

    What a mess :-)

    --
    Robin
    Marco Monicelli wrote:
    >Dear Eduardo/list,
    >
    >I didn't discuss the fact that a server is much more juicy to hit for an
    >hacker than the simple workstation, even if it is the CEO box. Once stated
    >this, we can proceed with the next point.
    >
    >First, SP2's firewall can by easily bypass as mostly firewalls with
    >injection techinque. Infact they normally tend to allow HTTP traffic for
    >example. If the firewall doesn't block ICMP, you can use some ICMP
    backdoor
    >which replies to a special crafted packet ICMP ping with a reverse connect
    >shell. If you get admin privilegies on that box, you can even think to
    stop
    >the firewall service on that machine. If the RAW sockets limit is your
    >problem, you can easily ENABLE back the raw sockets with some right
    command
    >lines (google is your best friend once again).
    >
    >Regarding the JPG/GIF question, there are many joiner/merger on the net
    >which are not recognized by AV and they can hide an EXE file inside the
    >Picture. Once the guy opens the pic, then the EXE is excecuted hiddenly
    and
    >secretly. I'm not taking into consideration the buffer overflow
    >vulnerability as it is now a bit too old to be exploited (expecially on a
    >fully patched machine). So the trick is just that a "not really expert"
    guy
    >will prolly open a picture (curiosity helps hackers a lot) and get
    infected
    >easily without exploiting any vulnerability. I call this "curiosity
    >engeneering".... ehehehhehe....
    >
    >HXDEF is correctly a rootkit which means you first have to get admin
    rights
    >on the target box. I've suggested that in order to mention rootkits which
    >can be useful to an hacker, once he got admin privilegies. Did you ever
    see
    >this file "hxdef defeating modern detectors.rar"? It is a movie which
    shows
    >how it is NOT detected by most of the rootkit's hunters. But maybe that
    >movie is not updated and you're right (I couldn't test it unfortunately).
    >
    >Anyway, the main point to show the CEO the insecurity of the box is to get
    >ADMIN privilegies over there. Then you can choose the game you wanna play
    >on that computer.
    >
    >I'm opened to any further suggestion, tnx for yours Eduardo.
    >
    >Cheers
    >
    >Marco
    >
    >
    >
    >
    >
    >
    >             Hi, Marco!
    >
    >             IMO, I think it's harder to attack a workstation compared to
    a
    >server through a network, since servers must have some open port in
    >listening state. On a workstation the user is the weakest point most of
    the
    >time, while on a server there are many other parts to take into account.
    If
    >there is a firewall in place (for example, the one that comes with XP
    SP2),
    >which attacks are possible through a network? AFAIK just a few. Windows XP
    >restricts most of the attacks that use anonymous connections. Service Pack
    >2
    >restricts even more. If you are a domain admin, there are many
    >possibilities, but that's not the case here.
    >             What do you mean by "executing a jpg or a gif file"? I know
    >there
    >are buffer overflow vulnerabilities that can be exploited when opening an
    >image, but it's not a trivial attack. I'm not sure (because I didn't try
    >it), but I think it's even harder to do it when you need to merge an
    >executable into an image using a joiner. I'd like to know what you think
    >about it.
    >             Regarding the hxdef rootkit, you can find it out by using
    >RootKitRevealer from SysInternals. It's available at
    >http://www.sysinternals.com/Utilities/RootkitRevealer.html. BTW, hxdef
    >isn't
    >considered an attack tool. It's used after you successfully got access to
    a
    >computer, when you want to hide files, open ports and so on.
    >             Just my $0.02.
    >             Regards,
    >
    >             Eduardo Suzuki
    >             esuzuki_br@pop.com.br
    >             Eduardo.AC.Suzuki@gmail.com
    >
    >"The essential is invisible to the eyes."
    >
    >-----Original Message-----
    >From: Marco Monicelli [mailto:marco.monicelli@marcegaglia.com]
    >Sent: Friday, September 02, 2005 6:12 AM
    >To: Juan B
    >Cc: pen-test@securityfocus.com
    >Subject: Re: Hacking to Xp box
    >Importance: High
    >
    >Ciao juan!
    >
    >If the CEO box is fully patched and FW is enabled, then your mission is a
    >little bit more difficult to accomplish. Besides, there are thousands of
    >recent exploits for windows which you can try. For example, did you try
    the
    >Universal exploit for the Plug and Play vulnerability? It is published
    >everywhere. You can try with more recent exploits than the DCOM exploit
    >which is at least 3 years old.
    >
    >If you want to try with the trojan, I would suggest you to google for
    >Bifrost, which is a Remote Administration Tool (you can call it trojan if
    >you prefer) that is completely UNDETECTED by any AV (at the moment it is
    >still 100% undetected). You can pack it inside any file (exe, jpg,
    gif....)
    >and it will be executed silently and hiddenly. Moreover, Bifrost can
    bypass
    >firewalls injecting itself into Explorer.exe process. Another good
    >UNDETECTED tool is hxdef rootkit.
    >
    >Arp poisoning could do the job but why not trying to steal the SAM file
    and
    >to crack it? You can do that remotely if the machine has the ports you
    >mentioned opened. I bet you know some tool to steal the SAM and to crack
    >it. I love SAMDUMP for example. ;)
    >
    >Last but not least, you can try with a Denial of Service to show your CEO
    >how easily a kid can prevent you from working with a simple DoS.
    >
    >Why not sniffing the network? There are many undetected sniffers around
    the
    >Web.
    >
    >Just my 2 cents ;)
    >
    >Marco
    >
    >
    >
    >
    >
    >
    >Hi Guys
    >
    >Please give me a hend here.
    >
    >Im trying to penetrate the CEO box to show him why we
    >need better security in our company, he told me to
    >show me how it can be done. he has xp pro sp 2
    >with all the pathches installed and FW enbled but I
    >cant ! I tried to use metasploit with the ms rpc dcom
    >exploit but it didnt worked. nessus found port 135 139
    >2000 and ntp are opened and also he can read some smb
    >shares and also outputed that this host doesnt disgard
    >SYN packets that have the FIN flag set. and port 2000
    >(callback is open).
    >what I can try more to  break this box? any ideas? I
    >know I
    >allways can try to arp poison his arp table and pass
    >all the machines traffic throw my laptop to capture
    >some passwords but this is enough. or send him a
    >trojan but we have a good anti virus protection  .
    >
    >
    >Does some of you have Ideas ?
    >
    >Thanks a lot !
    >
    >Juan
    >
    >
    >
    >__________________________________________________
    >Do You Yahoo!?
    >Tired of spam?  Yahoo! Mail has the best spam protection around
    >http://mail.yahoo.com
    >
    >----------------------------------------------------------------------------
    >
    >--
    >
    >Audit your website security with Acunetix Web Vulnerability Scanner:
    >
    >Hackers are concentrating their efforts on attacking applications on your
    >website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    >login pages, dynamic content etc. Firewalls, SSL and locked-down servers
    >are
    >futile against web application hacking. Check your website for
    >vulnerabilities
    >to SQL injection, Cross site scripting and other web attacks before
    hackers
    >do!
    >Download Trial at:
    >
    >http://www.securityfocus.com/sponsor/pen-test_050831
    >----------------------------------------------------------------------------
    >
    >---
    >
    >
    >
    >
    >
    >----------------------------------------------------------------------------
    >
    >--
    >Audit your website security with Acunetix Web Vulnerability Scanner:
    >
    >Hackers are concentrating their efforts on attacking applications on your
    >website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    >login pages, dynamic content etc. Firewalls, SSL and locked-down servers
    >are
    >
    >futile against web application hacking. Check your website for
    >vulnerabilities
    >to SQL injection, Cross site scripting and other web attacks before
    hackers
    >do!
    >Download Trial at:
    >
    >http://www.securityfocus.com/sponsor/pen-test_050831
    >----------------------------------------------------------------------------
    >
    >---
    >
    >
    >
    >
    >------------------------------------------------------------------------------
    >Audit your website security with Acunetix Web Vulnerability Scanner:
    >
    >Hackers are concentrating their efforts on attacking applications on your
    >website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    >login pages, dynamic content etc. Firewalls, SSL and locked-down servers
    are
    >futile against web application hacking. Check your website for
    vulnerabilities
    >to SQL injection, Cross site scripting and other web attacks before
    hackers do!
    >Download Trial at:
    >
    >http://www.securityfocus.com/sponsor/pen-test_050831
    >-------------------------------------------------------------------------------
    >
    >
    >
    >
    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner: 
    Hackers are concentrating their efforts on attacking applications on your 
    website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
    futile against web application hacking. Check your website for vulnerabilities 
    to SQL injection, Cross site scripting and other web attacks before hackers do! 
    Download Trial at:
    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------
    

  • Next message: bryan allott: "Whitespace in passwords"

    Relevant Pages

    • Re: Hacking to Xp box
      ... Raw sockets, MS05-019 and Windows Firewall -- Summary ... If>there is a firewall in place,>which attacks are possible through a network? ... >>-->>Audit your website security with Acunetix Web Vulnerability Scanner:>>Hackers are concentrating their efforts on attacking applications on your>website. ...
      (Pen-Test)
    • Re: How hard is socket programming?
      ... You got raw sockets and raw packets. ... am guessing that I could cut out a lot of the HTTP bandwidth overhead by doing this, and have more control over the connection. ... Your "socket program" become "HTTP Program" only because of the agreement between what data you will be sending and the remote server will be receiving - the HTTP formatted data. ...
      (microsoft.public.vc.mfc)
    • Re: DoS/DDoS Attack
      ... > coming in from what seemed to be a gazillion IPs. ... The best way to combat spoofed IP-based DDoS attacks is not something ... writing ethernet frames and skipping sockets all together. ...
      (Pen-Test)
    • Raw sockets, MS05-019 and Windows Firewall -- Summary
      ... Based upon the presence of MS05-019 and the state of the Windows ... though TCP raw sockets are unaffected by the firewall the ALG service, ... the ALG service and we're good to go. ...
      (NT-Bugtraq)
    • Re: RAW Sockets and Posibilities
      ... the sockets well enough to be able to help me. ... Using RAW sockets can I somehow capture all packets addressed to an IP ... Visual Studio package compleatly and look elsewhere for a programming ...
      (microsoft.public.dotnet.languages.vb)