Aggregator

Security is an ever-escalating arms race. The good guys have gotten better about monitoring the file system for artifacts of advanced threat actors. They in turn are avoiding the file system and burrowing deeper into Windows to find places to store their malware code and dependably trigger its execution in order to gain persistence between reboots.

For decades the Run and RunOnce keys in the registry have been favorite bad guy locations for persistence but we know to monitor them using Windows auditing for sysmon. So, attackers in the know have moved on to WMI.

WMI is such a powerful area of Windows for good or evil. Indeed, the bad guys have found effective ways to hide and persist malware in WMI. In this article I’ll show you a particularly sophisticated way to persist malware with WMI Event Filters and Consumers.

WMI allows you to link these 2 objects in order to execute a custom action whenever specified things happen in Windows. WMI events are related to but more general than the events we all know and love in the event log. WMI events include system startup, time intervals, program execution and many, many other things. You can define a __EventFilter which is basically a WQL query that specifies what events you want to catch in WMI. This is a permanent object saved in the WMI repository. It’s passive until you create a consumer and link them with a binding. The WMI event consumer defines what the system should do with any events caught by the filter. There are different kinds of event consumers for action like running a script, executing a command line, sending an email or writing to a log file. Finally, you link the filter and consumer with a __FilterToConsumerBinding. After saving the binding, everything is now active and whenever events matching the filter occur, they are fed to the consumer. 

So how would an attacker cause his malware to start up each time Windows reboots? Just create a filter that catches some event that happens shortly after startup. Here’s what PowerSploit uses for that purpose:

SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 200 AND TargetInstance.SystemUpTime < 320

Then you create a WMI Event Consumer which is another permanent object stored in the WMI Repository. Here’s some VB code adapted from mgeeky’s WMIPersistence.vbs script on Github. It’s incomplete, but edited for clarity. If you want to play with this functionality refer to https://gist.github.com/mgeeky/d00ba855d2af73fd8d7446df0f64c25a:

Set objInstances2 = objService1.Get("CommandLineEventConsumer") 
Set consumer = objInstances2.Spawninstance_
consumer.name = “MyConsumer”
consumer.CommandLineTemplate = “c:\bad\malware.exe”
consumer.Put_

So now you have a filter that looks for when the system has recently started up and a consumer which runs c:\bad\malware.exe but nothing’s going to happen until they are linked like this:

Set objInstances3 = objService1.Get("__FilterToConsumerBinding")
Set binding = objInstances3.Spawninstance_
binding.Filter = "__EventFilter.Name=""MyFilter"""
binding.Consumer = "CommandLineEventConsumer.Name=""MyConsumer"""
binding.Put_

So now you have a filter that looks for when the system has recently started up and a consumer which runs c:\bad\malware.exe.

As a good guy (or girl) how do you catch something like this? There are no events in the Windows Security Log, but thankfully Sysmon 6.10 added 3 new events for catching WMI Filter and Consumer Activity as well as the binding which makes them active.

Sysmon Event ID

Example

19 - WmiEventFilter activity detected

WmiEventFilter activity detected:

EventType: WmiFilterEvent

UtcTime: 2018-04-11 16:26:16.327

Operation: Created

User: LAB\rsmith

EventNamespace:  "root\\cimv2"

Name:  "MyFilter"

Query:  "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 200 AND TargetInstance.SystemUpTime < 320"

20 - WmiEventConsumer activity detected

WmiEventConsumer activity detected:

EventType: WmiConsumerEvent

UtcTime: 2018-04-11 16:26:16.360

Operation: Created

User: LAB\rsmith

Name:  "MyConsumer"

Type: Command Line

Destination:  "c:\\bad\\malware.exe "

21 - WmiEventConsumerToFilter activity detected

WmiEventConsumerToFilter activity detected:

EventType: WmiBindingEvent

UtcTime: 2018-04-11 16:27:02.565

Operation: Created

User: LAB\rsmith

Consumer:  "CommandLineEventConsumer.Name=\"MyConsumer\""

Filter:  "__EventFilter.Name=\"MyFilter\""

As you can see, the events provide full details so that you can analyze the WMI operations to determine if they are legitimate or malicious. From event ID 19 I can see that the filter is looking for system startup. Event Id 20 shows me the name of the program that executes and I can see from event ID 21 that they are linked.

If you add these events to your monitoring you’ll want to analyze activity for a while in order whitelist the regular, legitimate producers of these events in your particular environment. 

Sidebar:

That’s persistence via WMI for you, but you might have noted that we are not file-less at this point; my malware is just a conventional exe in c:\bad. To stay off the file system, bad guys have resorted to creating new WMI classes and storing their logic in a PowerShell script in a property on that class. Then they set up a filter that kicks off a short PowerShell command that retrieves their larger code from the custom WMI Class and calls. Usually this is combined with some obfuscation like base64 encoding and maybe encryption too.

“This article by Randy Smith was originally published by EventTracker”https://www.eventtracker.com/tech-articles/catch-malware-hiding-in-wmi-with-sysmon/

Does the name “Fortnite” ring any bells? It should, because it’s probably the most popular video game in the world...

The post Heads Up Gamers! Fake Fortnite Android Apps Are Being Spread via YouTube Videos appeared first on McAfee Blog.

本文总结一下漫长的渗透测试过程，想尽了各种方法，终于找到了突破口。so没有绝对的安全，所谓的安全性其实都是相对的～

在这里其实没办法去做一些有价值的收集，只能踩点，踩坑。

要做渗透的目标是一个APP，根据抓到的请求包发现这个APP是经过某产品加固过的，所以HTTP的POST请求正文部分(Data)是神奇的密文～

分析：

• 信息踩点其实也是解决难点的过程，在这里我们尝试对APP进行逆向，发现并没有什么东西，因为被加固了。
• 对APP进行功能的整理，逐个功能点进行抓包分析：
  • 请求正文(data)虽然是密文，但是请求的URI还是真正按照对应的功能去请求的（参考URI的命名和功能的相对应性）

在这里请教了师傅，说可能GET请求参数并没有经过加密，而后台很有可能是这样写的：

• 一点即通，首先我可以去测试是否是真的这样的后端处理接收。
• 为了满足第一步的验证，我需要想办法找到一个GET请求的包并且有带有GET参数，这样我才能判断规则，不然就是大海捞针。

其实对APP做渗透测试，大部分情况下还是对网站做渗透测试。

所以在这里抓包获取到的HOST，直接对其进行了前期的常规信息刺探（端口、目录、指纹…）

中间件：Tomcat

目录开放：/fileUpload/

端口开放：8001 1444

APP三个功能点：个人用户、资金管理、生活栏目

一开始粗略的对整个APP进行抓包，然后做一些简单的测试，发现并没有那种明面上的漏洞（SQL注入、XSS等等…），但是获取了这几条URI：

1. /userCenter/getUser [获取用户信息URI POST]
2. /userCenter/pay/getSign?userSign= [获取Sign POST]
3. /userCenter/life/showShop?pId= [获取商品信息 GET]
4. /userCenter/showQRcode [获取二维码图片 POST]

仔细的对每个功能点进行测试的时候，抓到了一些”逃出加固命运”的明文报文。

• 发现了S2-005这个历史悠久的Struts2框架远程代码执行问题：

执行了whoami：

• 发现了SQL注入，这里需要做一些简单的绕过(e.g. AandND 1 like 1)：

然而没看清楚，一下次给日错地方了…很尴尬。

日偏后我分析了一下两者的特征，发现应该出自同一个程序员之手，并且这个程序员很喜欢使用驼峰命名法…

在这里我尝试根据每个URI功能点生成GET请求参数的dict：

• /userCenter/getUser [获取用户信息URI POST]

  dict: [uId, userId, uName, userName …]

• /userCenter/showQRcode [获取二维码图片 POST]

  dict: [uId, userId, uName, userName, imagePath, filePath, codePath, fileName …]

生成请求：

现实残酷，打败了设想。

就在想放弃的时候，决定打算”垂死挣扎”一下，重新开始”审视”了各个功能模块，眼光又转到了这个二维码地方。（因为二维码的”皮相”，所以很多人都会忽略它）

这里我去解析了二维码的地址：

失算…失算…，当去访问这个地址的时候，响应报文中会多出这样的头：

这时候我就知道是时候修改uId了，然而修改了没用，根据多年的经验（吹牛）我认为是uSign参数起了作用，这时候对uSign进行删除发现不行，会提示uSign参数不存在，当我置空这个参数，发现居然成功了又返回了用户的Cookie凭证…好吧，说明这里有一个逻辑问题…

到这下去就很简单了，获取管理员权限有上传点，测试使用jhtml的后缀可以直接绕过上传，但是上传上去之后，直接访问就给你download下来了（很多次遇到这种问题…）

好吧，管理员也没啥能危害到服务器的东西了…不过回过头再来看看，二维码这个点还没啃完呢，fileName这个参数还没去测试，fuzzdb了解一下，先怼lfi的字典进去跑（有个坑这里一定要填写完整[uId, uSign]），然后再进行Fuzz：

从intruder模块(BurpSuite)的测试结果发现这里是可以读取文件的，并且判断这个web服务是root权限运行的因为我修改fileName参数的值为../../../etc/shadow时我直接可以获取到文件的内容，从而获取root账号权限的密码：

(解密不了)，怎么通过这个本地文件读取漏洞拿到shell？我的思路是通过读取tomcat的密码配置文件然后进入tomcat的Web管理部署war包进行getwebshell，但是这里做了一圈的目录猜解，死活没找到tomcat的应用目录…

读取/root/.bash_history啊(这个文件是记录root用户输入过的命令-老师傅提醒到)，突然间我茅塞顿开，是啊，一般运维人员会通过命令行进行管理，那么肯定会有目录出现啊。

我修改fileName参数的值为../../../root/.bash_history，搜索下关键词tomcat就发现了：

成功的发现了root用户的命令历史并且找到了Tomat的应用安装路径，那么我只需要修改fileName的参数值为../../../../home/apache-tomcat-7.0.67/conf/tomcat-users.xml，直接就可以读取到Tomcat的管理员账号权限，从而直接通过外部访问的形式进入Tomcat的管理界面进行控制。

登录进来之后直接到WAR file to deploy功能点，进行war包的部署（在这里使用压缩的方式将网站后门压缩成zip格式然后修改后缀名.zip为.war即可），点击Browser选择war包然后点击Deploy：

这里部署上去之后回到Applications功能点，可以看到部署的情况，点击你的命名链接然后加上你压缩的文件名（这里我的是 /vulkey/vulkey.jsp）使用Webshell管理工具进行管理，看见了我久违的界面，久违的root权限：

因为后渗透可能会影响正常业务的运行，所以没有继续进行下去，很遗憾，希望下次有机会。 END: 送给大家一句话：心细则挖天下。

每次复制域名时都会被 Chrome 复制地址时的 https:// 烦到, 所以干脆自己写个拓展来解决这个问题. Chrome 拓展其实就是一个小网页, 也就是 HTML, 所以我们可以用 JavaScript 来实现获取域名和复制的操作. 具体实现如下.

Digital assistants help us look up the weather, play our favorite music, and allow us to quickly access a lot...

The post New Cortana Vulnerability Could Allow Cybercriminals to Bypass Lock Screen On Windows 10 appeared first on McAfee Blog.

It doesn’t rhyme and it’s not what Whittier said but it’s true. If you don’t log it when it happens, the evidence is gone forever. I know personally of many times where the decision was made not to enable logging and was later regretted when something happened that could have been explained, attributed or proven had the logs been there. On the bright-side there’re plenty of opposite situations where thankfully the logs were there when needed. In fact, in a recent investigation we happened to enable a certain type of logging hours before the offender sent a crucial email that became the smoking gun in the case thanks to our ability to correlate key identifying information between the email and log.

Why don’t we always enable auditing everywhere? Sometimes it’s simple oversight but more often the justification is:

• We can’t afford to analyze it with our SIEM
• We don’t have a way to collect it
• It will bog down our system

Let’s deal with each of those in turn and show why they aren’t valid.

We can’t afford to analyze it with our SIEM

Either because of hardware resources, scalability constraints or volume-based licensing organizations limit what logging they enable. Let’s just assume you really can’t upgrade your SIEM for whatever reason. That doesn’t stop you from at least enabling the logging. Maybe it doesn’t get analyzed for intrusion detection. But at least it’s there (the most recent activity anyway) when you need it. Sure, audit logs aren’t safe and shouldn’t be left on the system where they are generated but I’d still rather have logging turned on even if it just sits there being overwritten. Many times, that’s been enough to explain/attribute/prove what happened. But here’s something else to consider, even if you can’t analyze it “live” in your SIEM, doesn’t mean you have to leave it on the system where it’s generated – where’s it’s vulnerable to deletion or overwriting as it ages out. At least collect the logs into a central, searchable archive like open-source Elastic.

We don’t have a way to collect it

That just doesn’t work either. If your server admins or workstation admins push back against installing an agent, you don’t have to resort to remote polling-based log collection. On Windows use native Windows Event Forwarding and on Linux use syslog. Both technologies are agentless and efficient. And Windows Event Forwarding is resilient. You can even define noise filters so that you don’t clog your network and other resources with junk events.

Logging will bog down our system

This bogey-man is still active. But it’s just not based on fact. I’ve never encountered a technology or installation where properly configured auditing made a material impact on performance. And today storage is cheap and you only need to worry about scheduling and compression on the tiniest of network pipes – like maybe a ship with a satellite IP link. Windows auditing is highly configurable and as noted earlier you can further reduce volume by filtering noise at the source. SQL Server auditing introduced in 2008 is even more configurable and efficient. If management is serious they will require this push-back be proven in tests and – if you carefully configure your audit policy and output destination - likely the tests will show auditing has negligible impact. 

When it comes down to it, you can’t afford not to log. Even if today you can’t collect and analyze all your logs in real-time at least turn on logging in each system and application. And keep working to expand collection and analysis. You won’t regret it.

“This article by Randy Smith was originally published by EventTracker”https://www.eventtracker.com/tech-articles/for-of-all-sad-words-of-tongue-or-pen-the-saddest-are-these-we-werent-logging/