Today's endevours

It wasn't until I'd posted the earlier item that I discovered that today is a work holiday too.


A few days ago I received a LiFePO4wered device for a Raspberry Pi 3. It seemed like a good idea, though the price tag is a bit high. To play with it, and also to follow up on something else I'd wanted to try, I installed the ARM image of Kali Linux on the Pi. This worked fine and was snappy, but the kali-linux-full package I would like to have had was too big for the 8 GB microSD card on the Pi. Additionally, the LiFePO4wered battery software is tested only for Raspbian Jessie, and didn't quite work for Kali ARM. So Kali was replaced with Raspbian Jessie with Pixel. In what can be considered slight overkill, I downloaded and installed this package of pentesting tools, leaving me with about 500 MB of spare space. A better idea might have been to add the Kali repository and install a kali metapackage such as kali-linux-wireless, which was the target goal.

The LiFePO4wered battery on the left, with an Alfa card attached.

The primary benefit of the LiFePO4wered battery so far is that it includes a touchpad on/off button, which is great for keeping the pi running while you switch from external battery pack to plug power. It also means that the pi won't accidentally turn off if you're performing a wireless audit and the cable to the external battery pack comes unplugged. In fact, with the setup above the Pi could probably run over 2 hours with a small adapter like this, albeit with reduced range. The time could be extended with a solar panel, which the LiFePO4wered battery is designed to work with.

Next, I plugged in an Alfa 052NH and walked around the apartment complex, got stopped by a neighbor, installed a spare cloud camera for him to monitor his car outside the window, all for about 1.5 hours, during which time kismet was running. It produced a 127 MB pcapdump file, plus some extra for the nettxt and netxml files. With that benchmark, it's probably safe to stick with the current tools list rather than start over with a Kali metapackage. (Interesting ESSIDs include a Thermostat with an open network, nepeta, and 2cups_1girl and 2cups_1girl_the_sequel for 2.4 and 5 GHz respectively).

Today, I spent too much time trying to connect the Pi to my PirateBox so it could communicate with my laptop on a local wireless LAN. Turns out the PirateBox is designed to be private, which means that cross-router communication is not possible. (Missing routes in the routing table? Maybe client isolation is enabled in OpenWRT?) Either way, it's a feature, so instead I did some research and decided to purchase a different model of TP Link travel router, one which hopefully doesn't have an app that needs to be connected to be used. This one I can eventually use to follow this great guide to make myself a private VPN for work travel.

Next I reflected on the lack of backup solutions in my network. It would be great to have a copy of the music on the Plex device USB to transfer around in case I'm travelling and want to have my latest downloaded music with me. It would be good for backups too. Or how about if I could use youtube-dl to download very large playlists of youtube videos? With enough storage that becomes feasible.

So here are my requirements (thinking out loud):

1. Ideally it should be accessible via SSH. Alternatively, as long as it's network attached and there's a web interface of some sorts, just make sure attaching it works fine.

It would be great to have a script on the backup device that uses SFTP or SCP to ssh into all my devices and backup data or generate traffic stat data to visualize on an internal monitoring page, separate from the munin installation. Alternatively, I could split the job, putting the scripts on a VM to pull the visualization data, and also have scripts to perform backups to the storage device.

2. I need to be convinced to bother with RAID 6. The easier the setup the better, as my primary homelab focus is learning basic network infrastructure in support, or pursuit, of primarily application security and also penetration testing. That is, the majority of my projects so far have involved setting up web servers or products that include web servers. Plug and play with minimum amount of fuss is my goal, not spending days getting a backup solution to work.

3. The faster the better. Network cabling is entirely Cat6, and most of the PCs have gigabit NICs. The raspberry PIs do not, and would be the primary bottlenecks.

4. The quieter the better. I sleep in the same room as the nascent home lab, meaning silence is golden.

5. Smaller form factor is preferable, but not mandatory.

6. Low power requirements would be nice.

I'm looking at Synology devices, but am open to other solutions, such as NUCs with FreeNAS.

Tomorrow I hope to practice two items:

1. Practising with iptables on the pentesting Pi.
2. Setting up a simple captive portal on the Ubiquiti AP AC Lite to try to get the EvilAuth modules for the Pineapple Wifi to work.

BlackHat and Defcon Talks to look forward to (and why)

Some talks are being presented at both. 

BlackHat: 

Must See:

Breaking the Laws of Robotics: Attacking Industrial Robots

Practical attacks against industrial robots with real hard data? Sign me on

 

Don't Trust the DOM: Bypassing XSS Mitigations via Script Gadgets

For making me think deeply

 

Escalating Insider Threats Using VMware's API

Could be useful when encountering VMware products on the network, once potential for other low-hanging fruit has been exhausted

 

Exploiting Network Printers

Following in the vein of previous publications

 

Fighting the Previous War (aka: Attacking and Defending in the Era of the Cloud)

I had an engagement where Google products were used almost exclusively, e.g. GMail, Docs, Drive. This meant: most communication was via HTTPS; there was limited chatter visible just by plugging in; and no AD environment, no Outlook, etc. Short of ARP spoofing on a limited segment, I ran out of ideas.

 

Ichthyology: Phishing as a Science

I want to learn more about phishing.

Practical Tips for Defending Web Applications in the Age of DevOps

Yup, dynamic analysis just doesn't cut it when the focus is on integrating security earlier into the SDLC. See also SecDevOps

The Industrial Revolution of Lateral Movement

I'd like to know how this is presented (industrial revolution?)

They're Coming for Your Tools: Exploiting Design Flaws for Active Intrusion Prevention

You can never stay in one spot, relying on a few tools. Even in the glacial world of enterprise security, NBNS/LLMNR will stop working eventually.

Why Most Cyber Security Training Fails and What We Can Do About it

Introduces a framework for comparing cyber security training. Useful for anyone in a corporate environment where testing against frameworks and standards is a trusted baseline.

For Fun:

Tracking Ransomware End to End

Ties into phishing. Big picture of ransomware should be great as a high- and low- level overview.

 

What's on the Wireless? Automating RF Signal Identification

Anything from Michael Ossmann is a must-see.

 

Splunking Dark Tools - A Pentesters Guide to Pwnage Visualization
I'd like to see how the presenters deal with large quantities of data, having encountered increasing amounts of files and logs with each engagement, and not just as a CYA measure.

The Active Directory Botnet
AD and botnets are unfamiliar territory. 

Defcon: https://www.defcon.org/html/defcon-25/dc-25-speakers.html

(P.S. Check out the bios of the EFF panel speakers, intensely qualified each and every one)

Must See:

Game of Drones: Putting the Emerging "Drone Defense" Market to the Test 

Last year's presentation is fantastic, this year should be great ( a new DangerDrone???)

Introducing HUNT: Data Driven Web Hacking & Manual Testing

Another burp plugin, to make my life easier? Yes please

I Know What You Are by the Smell of Your Wifi

Can I find more vulnerabilities with it?

D0 No H4RM: A Healthcare Security Conversation (Panel)

Medical industry security is a hot topic. I've had one engagement in the industry and the mindset of health-care professionals is one to come to grips with before you start working.

Radio Exploitation 101: Characterizing, Contextualizing, and Applying Wireless Attack Methods

101 indeed.

Dark Data

 

Wiping out CSRF

CSRF has always been a weak point for me.

Game of Chromes: Owning the Web with Zombie Chrome Extensions

Owning stuff with new attack vectors? Yes please

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

I click blindly on anything that has SSRF in it.

There's no place like 127.0.0.1 - Achieving reliable DNS rebinding in modern browsers

Could be dry, or not

For Fun: 

Popping a Smart Gun

 

Hacking travel routers like it's 1999

Given my habit of using a PirateBox on the plane, this could be fun.

Breaking Wind: Adventures in Hacking Wind Farm Control Networks

One of several presentations at either Defcon or Blackhat about hacking esoteric ICS stuff (there's another one about vulnerabilities in radiation monitoring devices).  

Little work interlude

Monday night I flew to LA. Tuesday evening I flew to Detroit, arriving early Wednesday morning. Wednesday I'm spending onsite, and this evening if TS Cindy doesn't delay the flight Houston will be all around me again. Very busy, and there wasn't much sleep to be had on the plane from LA. On the plus side I've seen some impressive oil&gas structures, unbelievably complex piping and all.

Remember, it's GPX files that you need to format in SublimeText, because it has the best alignment of times to latitude/longitude items.

Exciting upcoming BlackHat talk

James Kettle of PortSwigger will talk about bug bounties for DoD and back-end web services:

https://www.darkreading.com/threat-intelligence/major-websites-vulnerable-to-their-own-back-end-servers/d/d-id/1329166

https://www.blackhat.com/us-17/briefings/schedule/#cracking-the-lens-targeting-https-hidden-attack-surface-6387

EyeWitness is an invaluable tool that takes nmap results and scans/screenshots web services found in those results. Since integrating it into my pentests it's come in handy to report services that have HTTP content of some sort exposed internally.  It's intriguing to see how much content is available, and how often it uses default passwords. The next step in my testing will be to learn how to increase the severity of other issues by changing settings through the web interfaces.

Parsing .Nessus Files Part 2

A short update on improving Melcara's parse_nessus perl script:

My primary issue with the original, which took the most time, was sorting outputted IP addresses in the "Vulnerability to IP summary" sheet. A couple hours of investigation found that sorting those in the perl script was easier said than done.

my $ip = join "\n", keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};e>

That's the line that creates a scalar string of IPs, separated by (invisible) newlines in the Excel cells. Turns out you can't easily sort that string. You might ask, ok, how about $ip_vuln_data:

# store data in the %ip_vuln_data hash
        $ip_vuln_data{$host->{file}}->{$h_report->{-severity}}->{$h_report->{-pluginID}}->{pluginName} = $h_report->{-pluginName};
        if ($host->{'host-ip'} eq "") {$ip_vuln_data{$host->{file}}->{$h_report->{-severity}}->{$h_report->{-pluginID}}->{ip}->{$host->{'name'}}++;}
        else{$ip_vuln_data{$host->{file}}->{$h_report->{-severity}}->{$h_report->{-pluginID}}->{ip}->{$host->{'host-ip'}}++;}
     

Looks like it's searching a $h_report string to create a 'name','host-ip' hash (forgive my phrasing, Perl is not native tongue).

What if we go even earlier in the process? How does it get the string data?

Somewhere in here, it's parsing the .Nessus file. Later I realized that you can't control the order of IP addresses in the export of the .nessus file from Nessus, so it was back to the original location.

Then I found a solution here, and adjusted it thus:

                #convert unsorted string to array  
                my @ip2 = split("\n",$ip);
                #print @ip2;

                my @sorted_ips =
                    map  { $_->[0] }
                    sort { $a->[1] <=> $b->[1] }
                    map  { [ $_, eval { Net::IP->new( $_ )->intip } ] }
                    @ip2;

                #convert back to newline-seperated string
                my $ip2 = join "\n", @sorted_ips;


Now, the contents of the cells is invisibly new-line separated, and in order. Now to pack it into a new executable:

pp -M JSON -M PAR::Dist -M URI::Escape -M LWP::UserAgent -M HTTP::Cookies -M Data::Dump -M Data::Dumper -M XML::Hash::XS -M XML::TreePP -M MIME::Base64 -M Math::Round -M Excel::Writer::XLSX  -M Excel::Writer::XLSX::Chart -M Excel::Writer::XLSX::Chart::Pie -M Data::Table -M Getopt::Std -M Net::IP parse_nessus_xml.v22.pl

And we are good to go! Get it here.

Next steps: Add the ability to merge Nessus files to this script.

Update 5-22-18: I'm adjusting the original post to help anyone who's actually trying to re-create this.

To get this to work:

1. Add "use Net::IP" at the top of the perl file.
2. Where the original file has:
my $ip = join ";", keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};

mine has the following (changes in bold):

         my $ip = join "\n", keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};  
         #convert unsorted string to array  
         my @ip2 = split("\n",$ip);  
         my @sorted_ips =  
           map { $_->[0] }  
           sort { $a->[1] <=> $b->[1] }  
           map { [ $_, eval { Net::IP->new( $_ )->intip } ] }  
           @ip2;  
         print @sorted_ips;  
         #convert back to newline-seperated string  
         my $ip2 = join "\n", @sorted_ips;  
         my $ip_cnt = keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 0, $file,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 1, $severity,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 2, $plugin,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 3, $ip_vuln_data{$file}->{$sev}->{$plugin}->{pluginName},$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 4, $ip_cnt,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 5, $ip2,$cell_format);  
         ++$ip_vuln_data_ctr;  
       }  

For reference, here is the perl file with my additional formatting changes.