Re: Hacking to Xp box

From: Marco Monicelli (marco.monicelli_at_marcegaglia.com)
Date: 09/08/05

  • Next message: secure_hack_at_hotmail.com: "Nmap Strange Read Error (Anyone Seen this Before?)"
    To: Kelly Scroggins <kelly@cliffhanger.com>
    Date: 07-Sep-2005 09:05:17 CEDT
    
    

    Here is some name to google for:

    - Asylum Binder v1.0
    - BigJack Joiner
    - Binding Suite
    - Blade-Bogart Joiner
    - BladeJoiner 1.0 - 1.55
    - Blade-Stoner Joiner
    - Concealer
    - EES Deception Binder v1.0 - 3.0
    - EliteWrap
    - Embedder 1.50
    - Exe Bind 1.0
    - Exe Maker
    - FC Binder
    - Fearless Joiner
    - FInjector Binder
    - FreshBind v1.0 - 2.0
    - Frusion v1.0
    - GoBind
    - GoboWrap 1.0b
    - Hammer Binder v1.0 - 3.0
    - HelioS- Binder v1.0 - 2.0
    - iA- Binder
    - Infector v2.0 - 9.0
    - Interlaced II v1.00
    - Juntador Beta
    - kBind
    - Lace
    - MicroJoiner v1.0 - 1.7
    - Multibinder v1.4.1
    - MVM v1.0
    - Oblivion Joiner
    - PE-intro adder
    - Powermerger v1.41
    - Rat Packer
    - RNS Exe Joiner
    - SaranWrap
    - Senna Spy One Exe Maker 2000 v1.0 - 2.0a
    - SilkRope2k (v1.0 - 2.0)
    - Tess Binder
    - TOP 4.0 by DaRaT (GUI & cmd- line glaub ich)
    - TrojanMan
    - WeirdBinder
    - X-Exejoiner and Icon- changer
    - Yab v1.0 - 2.02
    - Zyon 1.0

    And here's a nice link for you:

    http://www.trojanfrance.com/

    Enjoy!

    Marco

                                                                                                                                           
                          Kelly Scroggins
                          <kelly@cliffhange To: Marco Monicelli <marco.monicelli@marcegaglia.com>
                          r.com> cc: Eduardo Suzuki <eduardo.ac.suzuki@gmail.com>, "'Juan B'"
                                                    <juanbabi@yahoo.com>, pen-test@securityfocus.com
                          06/09/2005 04.48 Subject: Re: Hacking to Xp box
                                                                                                                                           

    I keep seeing refernces to a "joiner". I 'spose
    this is the same thing as "silkrope" or
    "elitewrap". I've not had much luck in finding
    these things. Where would do you find them?

    --
    kelly
    http://home1.gte.net/res0psau/index.html#Hang-Gliding-Stuff
                    --    --
                      \  /
                       \/
                       /\
                      /  \
                    --    --
    Quoting Marco Monicelli <marco.monicelli@marcegaglia.com>:
            Good afternoon Eduardo/List (here's 15.14)
            I think there was a misunderstanding in the firewall point:
            juan is operating INSIDE the network and I thought he might want to
    show
            the fact that, once an intruder gets in, he can bypass the OUTGOING
    packet
            filter of the SP2 firewall. I didn't think he wanted to show how
    insecure
            is SP2 firewall from the outside. Here explained the
    misunderstanding.
            Regarding ICMP backdoors, this technique was first use by some
    skilled guy
            3/4 years ago. Of course u needed "root" privilegies and was
    operated on
            *nix boxes only. You could have install this ICMP backdoor instead
    of a
            much more invasive rootkit. Nowadays I came across some ICMP
    backdoor for
            Win32 platform. Never went deeper into this matter but I know it
    works
            pretty good, if the firewall does not block ICMP packets.
            As per the JPG problem, form what you say I assume you never tried
    it so I
            suggest you to give a try. Download a good joiner, merge your
    favourite
            auto-installing R.A.T. with a simple JPG and then run it. You'll
    see the
            .exe will be runned and it will install itself. Better than 1000
            theories....1 practice! ;)
            HXdef is not the only rootkit for windows around. There are several
    ones
            which are still undetected but of course not published. I've read
    some
            comments on some underground forums but never had the chance to get
    my
            hands on. Bytheway, rather than a rootkit, I would suggest for a
    windows
            machine to simply add an hidden user to the admin group and do some
    other
            "old fashioned" DOS trick, exploiting new DOS commands available in
            Windows. If you want to see some nice/nasty BATCH file, just let me
    know.
            ;)
            Curiosity engeneering rules. Believe me. ;)
            Hope these lines can help anyone.
            > -----Original Message-----
            > From: Marco Monicelli [mailto:marco.monicelli@marcegaglia.com]
            > Sent: Monday, September 05, 2005 6:24 AM
            > To: Eduardo Suzuki
            > Cc: 'Juan B'; pen-test@securityfocus.com
            > Subject: RE: Hacking to Xp box
            > Importance: High
            >
            > Dear Eduardo/list,
            >
            > I didn't discuss the fact that a server is much more juicy to hit
    for an
            > hacker than the simple workstation, even if it is the CEO box.
    Once
            stated
            > this, we can proceed with the next point.
            >
            > First, SP2's firewall can by easily bypass as mostly firewalls
    with
            > injection techinque. Infact they normally tend to allow HTTP
    traffic for
            > example. If the firewall doesn't block ICMP, you can use some
    ICMP
            > backdoor
            > which replies to a special crafted packet ICMP ping with a
    reverse
            connect
            > shell. If you get admin privilegies on that box, you can even
    think to
            > stop
            > the firewall service on that machine. If the RAW sockets limit is
    your
            > problem, you can easily ENABLE back the raw sockets with some
    right
            > command
            > lines (google is your best friend once again).
                         Could you please point me any article/POC/tool that
            demonstrates
            this injection technique? AFAIK by default XP SP2 firewall blocks
    incoming
            packets if they don't match an existing outbound session. Even if
    some port
            is open, you need to find some vulnerability that could be
    exploited to run
            arbitrary code.
                         What do you mean by ICMP backdoor? Is it something
    related to
            covert
            channels? If so, you need to have admin privileges to be able to
    install
            such a tool.
            > Regarding the JPG/GIF question, there are many joiner/merger on
    the net
            > which are not recognized by AV and they can hide an EXE file
    inside the
            > Picture. Once the guy opens the pic, then the EXE is excecuted
    hiddenly
            > and
            > secretly. I'm not taking into consideration the buffer overflow
            > vulnerability as it is now a bit too old to be exploited
    (expecially on a
            > fully patched machine). So the trick is just that a "not really
    expert"
            > guy
            > will prolly open a picture (curiosity helps hackers a lot) and
    get
            > infected
            > easily without exploiting any vulnerability. I call this
    "curiosity
            > engeneering".... ehehehhehe....
                         I'm curious about it. When you open an image, you
    don't
            execute it
            (not in the same way as you execute a PE-format file). If you join
    the
            executable with an image and keep it as an image, for the operating
    system
            the added bytes are considered part of the image, not a code in
    machine
            language.
            > HXDEF is correctly a rootkit which means you first have to get
    admin
            > rights
            > on the target box. I've suggested that in order to mention
    rootkits which
            > can be useful to an hacker, once he got admin privilegies. Did
    you ever
            > see
            > this file "hxdef defeating modern detectors.rar"? It is a movie
    which
            > shows
            > how it is NOT detected by most of the rootkit's hunters. But
    maybe that
            > movie is not updated and you're right (I couldn't test it
    unfortunately).
                         Give RootkitRevealer a try. :-) You'll see that it
    finds hxdef
            without any problem. It even tells you what string hxdef is hiding
    and
            where
            its executable is. By default the executable reads its
    configuration from a
            file with the same name, so you can easily find it. Then you can
    "clean"
            the
            configuration file (because it can be scrambled by filling it with
    extra
            characters in some of the sections) and see what it's hiding on the
            infected
            machine.
                         Another way to detect hxdef is by comparing the file
    list of
            the
            infected machine in two different ways. First you get the file list
            locally,
            then you get it remotely (using an administrative share, for
    example).
            Hxdef
            isn't able to hide its files if you list them through a network. So
    you can
            find the hidden files by comparing the two lists. If you see a
    pattern (for
            example, remotely you can see files that match "tohide*"), then you
    can be
            almost sure this is the string hxdef is using to hide its evidence.
                         After you find out the string you can do a little
    test. Create
            a
            directory that starts with the string, then see if it's listed
    using "dir".
            Even when it's hidden you can enter into it without any problem.
            >
            > Anyway, the main point to show the CEO the insecurity of the box
    is to
            get
            > ADMIN privilegies over there. Then you can choose the game you
    wanna play
            > on that computer.
            >
            > I'm opened to any further suggestion, tnx for yours Eduardo.
                         Thanks for your opinion as well, Marco!
            > Cheers
            >
            > Marco
            >
            >
            >
            >
            >
            >
            >              Hi, Marco!
            >
            >              IMO, I think it's harder to attack a workstation
    compared to
            > a
            > server through a network, since servers must have some open port
    in
            > listening state. On a workstation the user is the weakest point
    most of
            > the
            > time, while on a server there are many other parts to take into
    account.
            > If
            > there is a firewall in place (for example, the one that comes
    with XP
            > SP2),
            > which attacks are possible through a network? AFAIK just a few.
    Windows
            XP
            > restricts most of the attacks that use anonymous connections.
    Service
            Pack
            > 2
            > restricts even more. If you are a domain admin, there are many
            > possibilities, but that's not the case here.
            >              What do you mean by "executing a jpg or a gif file"?
    I know
            > there
            > are buffer overflow vulnerabilities that can be exploited when
    opening an
            > image, but it's not a trivial attack. I'm not sure (because I
    didn't try
            > it), but I think it's even harder to do it when you need to merge
    an
            > executable into an image using a joiner. I'd like to know what
    you think
            > about it.
            >              Regarding the hxdef rootkit, you can find it out by
    using
            > RootKitRevealer from SysInternals. It's available at
            > http://www.sysinternals.com/Utilities/RootkitRevealer.html. BTW,
    hxdef
            > isn't
            > considered an attack tool. It's used after you successfully got
    access to
            > a
            > computer, when you want to hide files, open ports and so on.
            >              Just my $0.02.
            >              Regards,
            >
            >              Eduardo Suzuki
            >              esuzuki_br@pop.com.br
            >              Eduardo.AC.Suzuki@gmail.com
            >
            > "The essential is invisible to the eyes."
            >
            > -----Original Message-----
            > From: Marco Monicelli [mailto:marco.monicelli@marcegaglia.com]
            > Sent: Friday, September 02, 2005 6:12 AM
            > To: Juan B
            > Cc: pen-test@securityfocus.com
            > Subject: Re: Hacking to Xp box
            > Importance: High
            >
            > Ciao juan!
            >
            > If the CEO box is fully patched and FW is enabled, then your
    mission is a
            > little bit more difficult to accomplish. Besides, there are
    thousands of
            > recent exploits for windows which you can try. For example, did
    you try
            > the
            > Universal exploit for the Plug and Play vulnerability? It is
    published
            > everywhere. You can try with more recent exploits than the DCOM
    exploit
            > which is at least 3 years old.
            >
            > If you want to try with the trojan, I would suggest you to google
    for
            > Bifrost, which is a Remote Administration Tool (you can call it
    trojan if
            > you prefer) that is completely UNDETECTED by any AV (at the
    moment it is
            > still 100% undetected). You can pack it inside any file (exe,
    jpg,
            > gif....)
            > and it will be executed silently and hiddenly. Moreover, Bifrost
    can
            > bypass
            > firewalls injecting itself into Explorer.exe process. Another
    good
            > UNDETECTED tool is hxdef rootkit.
            >
            > Arp poisoning could do the job but why not trying to steal the
    SAM file
            > and
            > to crack it? You can do that remotely if the machine has the
    ports you
            > mentioned opened. I bet you know some tool to steal the SAM and
    to crack
            > it. I love SAMDUMP for example. ;)
            >
            > Last but not least, you can try with a Denial of Service to show
    your CEO
            > how easily a kid can prevent you from working with a simple DoS.
            >
            > Why not sniffing the network? There are many undetected sniffers
    around
            > the
            > Web.
            >
            > Just my 2 cents ;)
            >
            > Marco
            >
            >
            >
            >
            >
            >
            > Hi Guys
            >
            > Please give me a hend here.
            >
            > Im trying to penetrate the CEO box to show him why we
            > need better security in our company, he told me to
            > show me how it can be done. he has xp pro sp 2
            > with all the pathches installed and FW enbled but I
            > cant ! I tried to use metasploit with the ms rpc dcom
            > exploit but it didnt worked. nessus found port 135 139
            > 2000 and ntp are opened and also he can read some smb
            > shares and also outputed that this host doesnt disgard
            > SYN packets that have the FIN flag set. and port 2000
            > (callback is open).
            > what I can try more to  break this box? any ideas? I
            > know I
            > allways can try to arp poison his arp table and pass
            > all the machines traffic throw my laptop to capture
            > some passwords but this is enough. or send him a
            > trojan but we have a good anti virus protection  .
            >
            >
            > Does some of you have Ideas ?
            >
            > Thanks a lot !
            >
            > Juan
            >
            >
            >
            > __________________________________________________
            > Do You Yahoo!?
            > Tired of spam?  Yahoo! Mail has the best spam protection around
            > http://mail.yahoo.com
            >
            >
    --------------------------------------------------------------------------
            > --
            >
            > --
            >
            > Audit your website security with Acunetix Web Vulnerability
    Scanner:
            >
            > Hackers are concentrating their efforts on attacking applications
    on your
            > website. Up to 75% of cyber attacks are launched on shopping
    carts,
            forms,
            > login pages, dynamic content etc. Firewalls, SSL and locked-down
    servers
            > are
            > futile against web application hacking. Check your website for
            > vulnerabilities
            > to SQL injection, Cross site scripting and other web attacks
    before
            > hackers
            > do!
            > Download Trial at:
            >
            > http://www.securityfocus.com/sponsor/pen-test_050831
            >
    --------------------------------------------------------------------------
            > --
            >
            > ---
            >
            >
            >
            >
            >
            >
    --------------------------------------------------------------------------
            > --
            >
            > --
            > Audit your website security with Acunetix Web Vulnerability
    Scanner:
            >
            > Hackers are concentrating their efforts on attacking applications
    on your
            > website. Up to 75% of cyber attacks are launched on shopping
    carts,
            forms,
            > login pages, dynamic content etc. Firewalls, SSL and locked-down
    servers
            > are
            >
            > futile against web application hacking. Check your website for
            > vulnerabilities
            > to SQL injection, Cross site scripting and other web attacks
    before
            > hackers
            > do!
            > Download Trial at:
            >
            > http://www.securityfocus.com/sponsor/pen-test_050831
            >
    --------------------------------------------------------------------------
            > --
            >
            > ---
            >
    ------------------------------------------------------------------------------
            Audit your website security with Acunetix Web Vulnerability
    Scanner:
            Hackers are concentrating their efforts on attacking applications
    on your
            website. Up to 75% of cyber attacks are launched on shopping carts,
    forms,
            login pages, dynamic content etc. Firewalls, SSL and locked-down
    servers are
            futile against web application hacking. Check your website for
    vulnerabilities
            to SQL injection, Cross site scripting and other web attacks before
    hackers do!
            Download Trial at:
            http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------
    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:
    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers
    are
    futile against web application hacking. Check your website for
    vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers
    do!
    Download Trial at:
    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------
    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner: 
    Hackers are concentrating their efforts on attacking applications on your 
    website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
    futile against web application hacking. Check your website for vulnerabilities 
    to SQL injection, Cross site scripting and other web attacks before hackers do! 
    Download Trial at:
    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------
    

  • Next message: secure_hack_at_hotmail.com: "Nmap Strange Read Error (Anyone Seen this Before?)"

    Relevant Pages

    • Re: Hacking to Xp box
      ... I think there was a misunderstanding in the firewall point: ... you need to find some vulnerability that could be exploited to run ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • RE: Hacking to Xp box
      ... I think there was a misunderstanding in the firewall point: ... Regarding ICMP backdoors, this technique was first use by some skilled guy ... you need to find some vulnerability that could be exploited to run ... > restricts most of the attacks that use anonymous connections. ...
      (Pen-Test)
    • RE: 3rd party vuln assesment firms
      ... > "We use the same tools hackers bring to bear against your systems. ... >> I'm looking for a firm to conduct annual 3rd party vulnerability ... Up to 75% of cyber attacks are launched on shopping ... >> your website for vulnerabilities to SQL injection, ...
      (Pen-Test)
    • RE: PT Activity duration/time
      ... Vulnerability Assessment ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • Re: Hacking to Xp box
      ... I think there was a misunderstanding in the firewall point: ... you need to find some vulnerability that could be exploited to run ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)