Episode297

From Paul's Security Weekly
Jump to: navigation, search
Palo Alto Networks
Tenable Network Security
The SANS Institute
Pwnie Express
Black Hills Information Security
BlackSquirrel
Onapsis

SANS Las Vegas from October 26-27th will debut a new course titled "Embedded Device Security Assessments for the Rest of Us" which will teach students how to assess embedded systems of all varieties on pen tests and in your duties as a security professional. Register Here


Episode Media

MP3

Announcements & Shameless Plugs

PaulDotCom Security Weekly - Episode 297 for Thursday July 31st, 2012

  • Episode 300 of PaulDotCom Security Weekly will be recorded and streamed live on Friday August 31st in support of of a cure for Breast Cancer. We will broadcast live from 10am until 6PM Eastern time and the show will feature tech segments, round table discussions and special guests. Mark it on your calendars today!
  • In other admin related news, we're leaving Ning and moving onwards. Ning was cool, but now its a haven for SPAM. I want to thank everyone for participating. In the meantime please follow us on Twitter (@pauldotcom), Facebook (https://www.facebook.com/therealpauldotcom), and add me on Google+ (Paul Asadoorian, I will have a good email account for that soon). Don't forget to join our mailing list http://mail.pauldotcom.com and look for a newsletter in the not-too-distant future.

Blackhat and DefCon news and wrap up

Teasers & Plugs


Tech Segment

Recenntly I have been working more and more on my pentest plugin for Metasploit doing bug fixes and trying to improve some of the current areas of it. I added the Auto Exploit plugin to it for exploit automation and added some commands to aid in doing enumeration and discovery thru a pivot.

I was talking with the guys in Defensive Intuition and Black Hills Defensive Security and one of the areas they wanted to see me cover in the plugin was being able to quickly move enumerating and scanning other targets when they got a Meterpreter session on a clients network. So I added 2 commands to help with this to the plugin.

Lets start with a session that is connected to a host that is behind NAT:

msf > sessions

Active sessions
===============

  Id  Type                   Information                            Connection
  --  ----                   -----------                            ----------
  1   meterpreter x86/win32  VICTIMLAB\Administrator @ WIN2K3LAB01  192.168.1.100:4444 -> 192.168.1.138:49323 (10.10.10.2)

msf > 

lets start by loading the plugin

msf >  load pentest

       ___         _          _     ___ _           _
      | _ \___ _ _| |_ ___ __| |_  | _ \ |_  _ __ _(_)_ _
      |  _/ -_) ' \  _/ -_|_-<  _| |  _/ | || / _` | | ' \ 
      |_| \___|_||_\__\___/__/\__| |_| |_|\_,_\__, |_|_||_|
                                              |___/
			
Version 1.2
Pentest plugin loaded.
by Carlos Perez (carlos_perez[at]darkoperator.com)
[*] Successfully loaded plugin: pentest
msf  exploit(handler) > back
msf > 

As shown in my others post about the plugin it will add commands to the list of commands available in the console to look at the command available we can just enter the help command or ? :

msf > help
. . . .
Discovery Commands
==================

    Command                 Description
    -------                 -----------
    discover_db             Run discovery modules against current hosts in the database.
    network_discover        Performs a portscan and enumeration of services found for non pivot networks.
    pivot_network_discover  Performs enumeration of networks available to a specified Meterpreter session.
    show_session_networks   Enumerate the networks one could pivot thru Meterpreter in the active sessions.
. . . .

The commands we have available are:

  • discover_db - this command will go thru the hosts that are present in the database and will run a set of modules to enumerate and gather information from the services that have been detected on those host. One can provide a range of host to limit the discovery and SMB settings for the SMB modules that will be ran against hosts.
  • network_discovery - will run the nmap scanner against a given CIDR, it will determine the ports that are used by Metasploit auxiliary and exploit modules and use those if none are specified and after running the scan it will run additional discovery modules to further enumerate and gather information from those services.
  • pivot_network_discover - This command will enumerate all interfaces and routes on a given Windows Meterpreter session, it will create routes to the found networks thru the session specified, it will determine which of the enumerated networks are directly connected to the host or are remote so as to determine the best way to run detection of hosts, it will do a ARP Sweep if the network is directly connected since this provides the most accuracy and if the network is a remote one it will execute a ping scan against it, it will execute if specified a TCP and UDP port scan against the hosts it discovered, if a port list is not provided it will auto generate one from the existing auxiliary and exploit modules currently available in addition to adding some additional common ones, if specified it will launch discovery modules to further enumerate the services found.
  • show_session_networks - will list the networks available thru Windows Meterpreter Sessions.

Lets start by listing the networks available thru a session. Lets first look at the options available for the show_session_networks command:

msf > show_session_networks -h
This command will show the networks that can be routed thru a Meterpreter session.

OPTIONS:

    -h        Help Message.
    -s <opt>  Sessions to enumerate networks against. Example <all> or <1,2,3,4>.


Now lets list the networks available:

msf > show_session_networks -s all
Network     Netmask        Session
-------     -------        -------
10.10.10.0  255.255.255.0  1

Now that we know the networks connected to the session we can check the options we have available to the command pivot_network_discover :

msf > pivot_network_discover -h

OPTIONS:

    -D <opt>  SMB Domain for discovery(optional).
    -P <opt>  SMB Password for discovery(optional).
    -U <opt>  SMB Username for discovery(optional).
    -d        Run Framework discovery modules against found hosts.
    -h        Help Message.
    -p <opt>  Port list. Provide a comma separated list of port and/or ranges to TCP scan.
    -s <opt>  Session to do discovery of networks and hosts.
    -t        Perform TCP port scan of hosts discovered.
    -u        Perform UDP scan of hosts discovered.
    -v        Be verbose and show pending actions.


Lets see what information we have in our current workspace for hosts, services and notes:

msf > hosts

Hosts
=====

address  mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------  ---  ----  -------  ---------  -----  -------  ----  --------

msf > services 

Services
========

host  port  proto  name  state  info
----  ----  -----  ----  -----  ----

msf > notes 
msf > 

Lets run a discovery thru the current session we have:

 msf > pivot_network_discover -t -u -d -s 1
[*] Identifying networks to discover
[*] Routing new subnet 10.10.10.0/255.255.255.0 through session 1
[*] Running windows/gather/arp_scanner against 1

[*] Running module against WIN2K3LAB01
[*] ARP Scanning 10.10.10.0/24
[*] 	IP: 10.10.10.2 MAC 00:0c:29:5e:e3:bd
[*] 	IP: 10.10.10.1 MAC 00:0c:29:4d:e7:5a
[*] 	IP: 10.10.10.200 MAC 00:0c:29:45:73:cb
[*] 	IP: 10.10.10.201 MAC 00:0c:29:c9:15:98
[*] 	IP: 10.10.10.239 MAC 00:0c:29:1e:8d:30
[*] 	IP: 10.10.10.238 MAC 00:0c:29:10:5c:d7
[*] 	IP: 10.10.10.243 MAC 00:0c:29:2e:97:ff
[*] Generating list of ports used by Auxiliary Modules
[*] Generating list of ports used by Exploit Modules
[*] Discovering 10.10.10.0/24 Network
[+] Running TCP Portscan against 10.10.10.2
[+] Running TCP Portscan against 10.10.10.1
[+] Running TCP Portscan against 10.10.10.200
[+] Running TCP Portscan against 10.10.10.201
[+] Running TCP Portscan against 10.10.10.239
[+] Running TCP Portscan against 10.10.10.238
[+] Running TCP Portscan against 10.10.10.243
[+] Running UDP Portscan against 10.10.10.2
[+] Running UDP Portscan against 10.10.10.1
[+] Running UDP Portscan against 10.10.10.200
[*] 10.10.10.1:80 - TCP OPEN
[*] 10.10.10.243:514 - TCP OPEN
[*] 10.10.10.2:445 - TCP OPEN
[*] 10.10.10.243:111 - TCP OPEN
[*] 10.10.10.243:445 - TCP OPEN
[*] 10.10.10.239:23 - TCP OPEN
[*] 10.10.10.243:23 - TCP OPEN
[*] 10.10.10.243:21 - TCP OPEN
[*] 10.10.10.2:135 - TCP OPEN
[*] 10.10.10.243:1099 - TCP OPEN
[*] 10.10.10.243:80 - TCP OPEN
[*] 10.10.10.243:22 - TCP OPEN
[*] 10.10.10.243:513 - TCP OPEN
[*] 10.10.10.2:389 - TCP OPEN
[*] 10.10.10.239:135 - TCP OPEN
[*] 10.10.10.243:25 - TCP OPEN
[*] 10.10.10.201:135 - TCP OPEN
[*] 10.10.10.200:445 - TCP OPEN
[*] 10.10.10.200:135 - TCP OPEN
[*] 10.10.10.243:512 - TCP OPEN
[*] 10.10.10.239:445 - TCP OPEN
[*] 10.10.10.238:445 - TCP OPEN
[*] 10.10.10.238:135 - TCP OPEN
[*] Discovered NTP on 10.10.10.2:123 (1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e)
[*] Discovered DNS on 10.10.10.1:53 (403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435)
[*] Discovered NetBIOS on 10.10.10.200:137 (WINXPLAB01:<00>:U :VICTIMLAB:<00>:G :WINXPLAB01:<20>:U :VICTIMLAB:<1e>:G :00:0c:29:45:73:cb)

. . . . 

[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:23 TELNET _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
[*] Scanned 1 of 1 hosts (100% complete)
[-] File doesn't seem to exist. The upload probably failed.
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243 (Apache/2.2.8 (Ubuntu) DAV/2) WebDAV disabled.
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
[*] Scanned 1 of 1 hosts (100% complete)
[*] Scanned 1 of 1 hosts (100% complete)
[*] waiting for some modules to finish
msf > 
[*] 10.10.10.243:3306 is running MySQL 5.0.51a-3ubuntu5 (protocol 10)
[*] 10.10.10.243:5900, VNC server protocol version : 3.3
[*] Scanned 1 of 1 hosts (100% complete)
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:5900, VNC server security types supported : VNC
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:5432 Postgres - Version 8.3.8 (Pre-Auth)
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.239:23 Does not support encryption: Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin: 
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:23 Does not support encryption: _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login: 
[*] Scanned 1 of 1 hosts (100% complete)

msf >

One thing that we have to keep in mind scanning thru a pivot is slow, that is why I decided to go with the list of generated ports since these will provide me the best chances to leverage the tools and modules in the framework. For large networks I recommend also using the -v option to see how many scanner jobs are pending.

Now that we finished the discovery lets look at the hosts, services and notes we now have:

msf > hosts 

Hosts
=====

address       mac                name             os_name            os_flavor        os_sp  purpose  info  comments
-------       ---                ----             -------            ---------        -----  -------  ----  --------
10.10.10.1    00:0c:29:4d:e7:5a  10.10.10.1       Unknown                                    device         
10.10.10.2    00:0c:29:5e:e3:bd  win2k3lab01      Microsoft Windows  2003             SP2    server         
10.10.10.200  00:0c:29:45:73:cb  winxplab01       Microsoft Windows  XP               SP2    client         
10.10.10.201  00:0c:29:c9:15:98                   Unknown                                    device         
10.10.10.238  00:0c:29:10:5c:d7  win-yr4v852v71y  Microsoft Windows  2008 Enterprise  SP1    server         
10.10.10.239  00:0c:29:1e:8d:30  test-01bcdaf47c  Microsoft Windows  XP               SP2    client         
10.10.10.243  00:0c:29:2e:97:ff  metasploitable   Linux              Debian                  server         

msf > services 

Services
========

host          port   proto  name      state  info
----          ----   -----  ----      -----  ----
10.10.10.1    53     udp    dns       open   403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435
10.10.10.1    80     tcp    http      open   lighttpd/1.4.23
10.10.10.2    135    tcp              open   
10.10.10.2    123    udp    ntp       open   1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e
10.10.10.2    53     udp    dns       open   Microsoft DNS
10.10.10.2    137    udp    netbios   open   WIN2K3LAB01:<00>:U :VICTIMLAB:<00>:G :VICTIMLAB:<1c>:G :WIN2K3LAB01:<20>:U :VICTIMLAB:<1b>:U :VICTIMLAB:<1e>:G :VICTIMLAB:<1d>:U :__MSBROWSE__:<01>:G :00:0c:29:5e:e3:bd
10.10.10.2    3389   tcp              open   
10.10.10.2    445    tcp    smb       open   Windows 2003 Service Pack 2 (language: Unknown) (name:WIN2K3LAB01) (domain:VICTIMLAB)
10.10.10.2    389    tcp              open   
10.10.10.200  123    udp    ntp       open   1c020efa00000000001000000a0a0a02d3b17b6e0454d46dc54f234b71b152f3d3b1e2508240cefdd3b1e2508240cefd
10.10.10.200  135    tcp              open   
10.10.10.200  3389   tcp              open   
10.10.10.200  445    tcp    smb       open   Windows XP Service Pack 2 (language: English) (name:WINXPLAB01) (domain:VICTIMLAB)
10.10.10.200  137    udp    netbios   open   WINXPLAB01:<00>:U :VICTIMLAB:<00>:G :WINXPLAB01:<20>:U :VICTIMLAB:<1e>:G :00:0c:29:45:73:cb
10.10.10.201  135    tcp              open   
10.10.10.238  137    udp    netbios   open   WIN-YR4V852V71Y:<00>:U :WORKGROUP:<00>:G :WIN-YR4V852V71Y:<20>:U :00:0c:29:10:5c:d7
10.10.10.238  135    tcp              open   
10.10.10.238  445    tcp    smb       open   Windows 2008 Enterprise Service Pack 1 (language: Unknown) (name:WIN-YR4V852V71Y) (domain:WORKGROUP)
10.10.10.239  23     tcp    telnet    open   Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
10.10.10.239  123    udp    ntp       open   Microsoft NTP
10.10.10.239  135    tcp              open   
10.10.10.239  137    udp    netbios   open   TEST-01BCDAF47C:<00>:U :WORKGROUP:<00>:G :TEST-01BCDAF47C:<20>:U :WORKGROUP:<1e>:G :WORKGROUP:<1d>:U :__MSBROWSE__:<01>:G :00:0c:29:1e:8d:30
10.10.10.239  445    tcp    smb       open   Windows XP Service Pack 2 (language: English) (name:TEST-01BCDAF47C) (domain:WORKGROUP)
10.10.10.243  80     tcp    http      open   Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
10.10.10.243  22     tcp    ssh       open   SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
10.10.10.243  23     tcp    telnet    open   _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
10.10.10.243  25     tcp    smtp      open   220 metasploitable.localdomain ESMTP Postfix (Ubuntu)

10.10.10.243  21     tcp    ftp       open   220 (vsFTPd 2.3.4)\x0d\x0a
10.10.10.243  111    udp    portmap   open   100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(55600), 100024 v1 TCP(53257), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(58825), 100021 v3 UDP(58825), 100021 v4 UDP(58825), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(47361), 100021 v3 TCP(47361), 100021 v4 TCP(47361), 100005 v1 UDP(40587), 100005 v1 TCP(42089), 100005 v2 UDP(40587), 100005 v2 TCP(42089), 100005 v3 UDP(40587), 100005 v3 TCP(42089)
10.10.10.243  111    tcp    sunrpc    open   100000 v2
10.10.10.243  137    udp    netbios   open   METASPLOITABLE:<00>:U :METASPLOITABLE:<03>:U :METASPLOITABLE:<20>:U :WORKGROUP:<00>:G :WORKGROUP:<1e>:G :00:00:00:00:00:00
10.10.10.243  139    tcp              open   
10.10.10.243  445    tcp    smb       open   Unix Samba 3.0.20-Debian (language: Unknown) (domain:WORKGROUP)
10.10.10.243  512    tcp              open   
10.10.10.243  513    tcp              open   
10.10.10.243  514    tcp              open   
10.10.10.243  1099   tcp              open   
10.10.10.243  1524   tcp              open   
10.10.10.243  2049   udp    sunrpc    open   100003 v4
10.10.10.243  2049   tcp    sunrpc    open   100003 v4
10.10.10.243  3306   tcp    mysql     open   5.0.51a-3ubuntu5
10.10.10.243  3632   tcp              open   
10.10.10.243  5432   tcp    postgres  open   8.3.8
10.10.10.243  5900   tcp    vnc       open   VNC protocol version 3.3
10.10.10.243  6000   tcp              open   
10.10.10.243  6667   tcp              open   
10.10.10.243  6697   tcp              open   
10.10.10.243  8180   tcp              open   
10.10.10.243  8787   tcp              open   
10.10.10.243  40587  udp    sunrpc    open   100005 v3
10.10.10.243  42089  tcp    sunrpc    open   100005 v3
10.10.10.243  47361  tcp    sunrpc    open   100021 v4
10.10.10.243  53257  tcp    sunrpc    open   100024 v1
10.10.10.243  55600  udp    sunrpc    open   100024 v1
10.10.10.243  58825  udp    sunrpc    open   100021 v4

msf > notes 
[*] Time: 2012-07-19 01:35:46 UTC Note: host=10.10.10.2 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:35:47 UTC Note: host=10.10.10.200 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:03 UTC Note: host=10.10.10.239 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:05 UTC Note: host=10.10.10.200 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:16 UTC Note: host=10.10.10.238 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2008 Enterprise", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 1", :os_lang=>"Unknown"}
[*] Time: 2012-07-19 01:36:22 UTC Note: host=10.10.10.239 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:28 UTC Note: host=10.10.10.243 service=smb type=smb.fingerprint data={:os_flavor=>"Unix", :os_name=>"Unknown", :os_sp=>"Samba 3.0.20-Debian"}
[*] Time: 2012-07-19 01:36:33 UTC Note: host=10.10.10.238 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:34 UTC Note: host=10.10.10.243 service=139/tcp type=smb.domain.enumusers data={:sid_txt=>"5-21-1042354039-2475377354-766472396", :pass_min=>5, :pass_min_history=>0, :server_role=>3, :lockout_threshold=>0, :lockout_duration=>1480786430454, :lockout_window=>1480786430454, :users=>{1010=>"games", 501=>"nobody", 1210=>"bind", 1026=>"proxy", 1204=>"syslog", 3002=>"user", 1066=>"www-data", 1000=>"root", 1018=>"news", 1216=>"postgres", 1004=>"bin", 1016=>"mail", 1222=>"distccd", 1226=>"proftpd", 1202=>"dhcp", 1002=>"daemon", 1208=>"sshd", 1012=>"man", 1014=>"lp", 1218=>"mysql", 1082=>"gnats", 1200=>"libuuid", 1068=>"backup", 3000=>"msfadmin", 1224=>"telnetd", 1006=>"sys", 1206=>"klog", 1212=>"postfix", 3004=>"service", 1076=>"list", 1078=>"irc", 1214=>"ftp", 1220=>"tomcat55", 1008=>"sync", 1020=>"uucp"}, :name=>"METASPLOITABLE"}
[*] Time: 2012-07-19 01:36:36 UTC Note: host=10.10.10.243 service=139/tcp type=smb.shares data={:shares=>[["print$", "DISK", "Printer Drivers"], ["tmp", "DISK", "oh noes!"], ["opt", "DISK", ""], ["IPC$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"], ["ADMIN$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"]]}
[*] Time: 2012-07-19 01:35:33 UTC Note: host=10.10.10.2 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2003", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"Unknown"}

I hope you find these new commands useful.

Stories

Teasers & Plugs

  • DerbyCon Call for Papers and Ticket Registration is: available online. If you have not yet registered or submitted a talk, please do so now.
  • Security BSides everywhere: Cleveland, Las Vegas, Los Angeles more. http://www.securitybsides.com/ - We have 5 BSides tickets (only 3 left) to give away! Listen to the instructions at the end of Episode 282 for complete details, or submit a technical segement!

Paul's Stories

  1. Divide and Conquer: Cracking MS-CHAPv2 with a 100% success rate - Seems to be getting a lot of press, did not have time to fully digest. I remember discouraging PPTP long ago...
  2. Hacker Will Expose Potential Security Flaw In Four Million Hotel Room Keycard Locks - Forbes - Pretty neat usage of Arduino to crack the locks on hotel doors. Still doesn't get around the latch locking mechanism though. However, if you are not in your room, you can be pwned. Note: Never leave laptop in room (tough to do).
  3. BlackHat USA 2012: Day One - Nice write-up, Ian' work is solid, brings up several outstanding points. Awesome to see a defense talk at Blackhat!
  4. Black Hat 2012 - My write-u p from BH.
  5. Top 10 Things I Learned at Blackhat 2012 & Defcon 20 and Vegas - My other write-up from BH and Defcon.

Allison's St0ri3s

  1. [1] Last week, users noticed they were receiving spam e-mails in accounts associated with their Dropbox accounts. They suspected there was a compromise, but Dropbox denied it. It turns out Dropbox left some data lying around and it was being abused.
  1. [2] At Defcon, it was revealed that the Las Vegas airport had a massive security hole on their network- exposed documents on their content management system, accessible via the Internet.
  1. [3] Black Hat slides
  1. [4] Bsides videos

Jack's Stories of bare knuckled brawling

  1. Never ask strangers about DEFCON Chief Monkey asked "normals" "What is this DefCon thing and all the weird people walking around?", the answers are informative and occasionally hilarious.
  2. Time to play offense? According to Art Coviello, it is. Although he has a pretty passive idea of defense. I'm sure the fact that he's promoting Big Data has nothing to do with EMC's storage sales.
  3. TSA and nudie scanners Not an infosec story, but so many of us travel frequently that it is interesting. The U.S. Circuit Court of Appeals for the District of Columbia has ordered the TSA to explain its failure to comply with a court order issued over a year ago- an order which required public hearings on the scanners.
  4. ONE TRILLION DOLLARS Or not. Yeah, probably not.
  5. Huawei Vulns? Who needs backdoors in Chinese-made networking gear when you have vulns which let you take over the box?