|
|
2020年4月14日星期二
November 2019 Connector
How To Install Metasploit In Termux
More information
- Hacker Search Tools
- Hacks And Tools
- Pentest Tools Nmap
- Growth Hacker Tools
- Hacking Tools Download
- World No 1 Hacker Software
- Install Pentest Tools Ubuntu
- Blackhat Hacker Tools
- Tools Used For Hacking
- Tools 4 Hack
- Pentest Tools Review
- Hack Tools
- Github Hacking Tools
- Pentest Tools For Mac
- Hack Tools Github
- Termux Hacking Tools 2019
- Hacker Tools 2019
- Hacking Tools Kit
- Pentest Tools Linux
- Hack Tools For Windows
- Hacking Tools For Beginners
- What Is Hacking Tools
- Hack Tool Apk No Root
Vsftpd Backdoor - Ekoparty Prectf - Amn3S1A Team
It's a 32bits elf binary of some version of vsftpd, where it have been added a backdoor, they don't specify is an authentication backdoor, a special command or other stuff.
I started looking for something weird on the authentication routines, but I didn't found anything significant in a brief period of time, so I decided to do a bindiff, that was the key for locating the backdoor quickly. I do a quick diff of the strings with the command "strings bin | sort -u" and "vimdiff" and noticed that the backdoored binary has the symbol "execl" which is weird because is a call for executing elfs, don't needed for a ftp service, and weird that the compiled binary doesn't has that symbol.
Looking the xrefs of "execl" on IDA I found that code that is a clear backdoor, it create a socket, bind a port and duplicate the stdin, stdout and stderr to the socket and use the execl:
There are one xrefs to this function, the function that decides when trigger that is that kind of systems equations decision:
The backdoor was not on the authentication, it was a special command to trigger the backdoor, which is obfuscated on that systems equation, it was no needed to use a z3 equation solver because is a simple one and I did it by hand.
The equation:
cmd[0] = 69
cmd[1] = 78
cmd[1] + cmd[2] = 154
cmd[2] + cmd[3] = 202
cmd[3] + cmd[4] = 241
cmd[4] + cmd[5] = 233
cmd[5] + cmd[6] = 217
cmd[6] + cmd[7] = 218
cmd[7] + cmd[8] = 228
cmd[8] + cmd[9] = 212
cmd[9] + cmd[10] = 195
cmd[10] + cmd[11] = 195
cmd[11] + cmd[12] = 201
cmd[12] + cmd[13] = 207
cmd[13] + cmd[14] = 203
cmd[14] + cmd[15] = 215
cmd[15] + cmd[16] = 235
cmd[16] + cmd[17] = 242
The solution:
cmd[0] = 69
cmd[1] = 75
cmd[2] = 79
cmd[3] = 123
cmd[4] = 118
cmd[5] = 115
cmd[6] = 102
cmd[7] = 116
cmd[8] = 112
cmd[9] = 100
cmd[10] = 95
cmd[11] = 100
cmd[12] = 101
cmd[13] = 106
cmd[14] = 97
cmd[15] = 118
cmd[16] = 117
cmd[17] = 125
The flag:
EKO{vsftpd_dejavu}
The binary:
https://ctf.ekoparty.org/static/pre-ekoparty/backdoor
The binary:
https://ctf.ekoparty.org/static/pre-ekoparty/backdoor
More articles
PKCE: What Can(Not) Be Protected
This post is about PKCE [RFC7636], a protection mechanism for OAuth and OpenIDConnect designed for public clients to detect the authorization code interception attack.
At the beginning of our research, we wrongly believed that PKCE protects mobile and native apps from the so called „App Impersonation" attacks. Considering our ideas and after a short discussion with the authors of the PKCE specification, we found out that PKCE does not address this issue.
In other words, the protection of PKCE can be bypassed on public clients (mobile and native apps) by using a maliciously acting app.
OAuth Code Flow
In Figure 1, we briefly introduce how the OAuth flow works on mobile apps and show show the reason why we do need PKCE.
In our example the user has two apps installed on the mobile phone: an Honest App and an Evil App. We assume that the Evil App is able to register the same handler as the Honest App and thus intercept messages sent to the Honest App. If you are more interested in this issue, you can find more information here [1].
 |
| Figure 1: An example of the "authorization code interception" attack on mobile devices. |
Step 1: A user starts the Honest App and initiates the authentication via OpenID Connect or the authorization via OAuth. Consequentially, the Honest App generates an Auth Request containing the OpenID Connect/OAuth parameters: client_id, state, redirect_uri, scope, authorization_grant, nonce, ….
Step 2: The Browser is called and the Auth Request is sent to the Authorization Server (usually Facebook, Google, …).
- The Honest App could use a Web View browser. However, the current specification clearly advice to use the operating system's default browser and avoid the usage of Web Views [2]. In addition, Google does not allow the usage of Web View browser since August 2016 [3].
Step 4: Now, the browser calls the Honest App registered handler. However, the Evil App is registered on this handler too and receives the code.
Step 5: The Evil App sends the stolen code to the Authorization Server and receives the corresponding access_token in step 6. Now, the Evil App can access the authorized ressources.
- Optionally, in step 5 the App can authenticate on the Authorization Server via client_id, client_secret. Since, Apps are public clients they do not have any protection mechanisms regarding the storage of this information. Thus, an attacker can easy get this information and add it to the Evil App.
Proof Key for Code Exchange - PKCE (RFC 7636)
Now, let's see how PKCE does prevent the attack. The basic idea of PKCE is to bind the Auth Request in Step 1 to the code redemption in Step 5. In other words, only the app generated the Auth Request is able to redeem the generated code.
Step 2: The Authorization Server receives the Auth Request and binds the code to the received code_challenge and challenge_method.
 |
| Figure 2: PKCE - RFC 7636 |
Step 1: The Auth Request is generated as previosly described. Additionally, two parameters are added:
- The Honest App generates a random string called code_verifier
- The Honest App computes the code_challenge=SHA-256(code_verifier)
- The Honest App specifies the challenge_method=SHA256
Step 2: The Authorization Server receives the Auth Request and binds the code to the received code_challenge and challenge_method.
- Later in Step 5, the Authorzation Server expects to receive the code_verifier. By comparing the SHA-256(code_verifier) value with the recieved code_challenge, the Authorization Server verifies that the sender of the Auth Request ist the same as the sender of the code.
Step 3-4: The code leaks again to the Evil App.
Step 5: Now, Evil App must send the code_verifier together with the code. Unfortunatelly, the App does not have it and is not able to compute it. Thus, it cannot redeem the code.
PKCE Bypass via App Impersonation
Again, PKCE binds the Auth Request to the coderedemption.
The question rises, if an Evil App can build its own Auth Request with its own code_verifier, code_challenge and challenge_method.The short answer is – yes, it can.
 |
| Figure 3: Bypassing PKCE via the App Impersonation attack |
Step 1: The Evil App generates an Auth Request. The Auth Request contains the client_id and redirect_uri of the Honest App. Thus, the User and the Authorization Server cannot recognize that the Evil App initiates this request.
Step 2-4: These steps do not deviate from the previous description in Figure 2.
Step 5: In Step 5 the Evil App sends the code_verifier used for the computation of the code_challenge. Thus, the stolen code can be successfully redeemed and the Evil App receives the access_token and id_token.
OAuth 2.0 for Native Apps
The attack cannot be prevented by PKCE. However, the IETF working group is currently working on a Draft describing recommendations for using OAuth 2.0 for native apps.
References
Vladislav Mladenov
Christian Mainka (@CheariX)
Christian Mainka (@CheariX)
Continue reading
- Hacking Tools Kit
- New Hack Tools
- Hacker Tools Free
- Hacking Tools Usb
- Best Pentesting Tools 2018
- Hacking Apps
- World No 1 Hacker Software
- Pentest Tools
- Hacker Search Tools
- Android Hack Tools Github
- Hacking Tools Software
- Physical Pentest Tools
- Pentest Tools For Ubuntu
- Hak5 Tools
- What Are Hacking Tools
- Hacks And Tools
- How To Hack
- Pentest Tools Windows
- Ethical Hacker Tools
- Ethical Hacker Tools
Ethical Hacking Platform For Penetration Testing | How To Hack The Invite Code: Join Hack The Box (HTB)
Hack The Box
Hack The Box (HTB) is a free platform available to ethical hackers to do a penetration testing for ethical hacking projects. It consist of different type of challenges that are updated constantly. Some of the challenges related to the real world scenarios and rest of the challenges related to learning towards a CTF style of challenges.Before joining to HTB, there is a simple task for you to prove your skills after that you'll able to create an account, and then you'll be able to access to your HTB Lab, where several challenges await for you to hack them. That's the beginning step for all of us to joining this. If you got success while hacking then you'll get points.
Task For Joining The HTB
Before joining the HTB, there is a task to hack invite code and paste that code in the code box for further registration to your account. You can complete a simple challenge to prove your skills, if you don't hack that then here is a short video below this content about hacking the invite code. Watch the video and hack the code!
In this Video you'll learn about How to join Hack the box (HTB) in Kali Linux and other Linux Distributions.
More information
- Hack App
- What Are Hacking Tools
- Hacker
- Install Pentest Tools Ubuntu
- Best Hacking Tools 2020
- Pentest Tools Apk
- Hack And Tools
- Hacking Tools Github
- Black Hat Hacker Tools
- Hacking Tools Mac
- Pentest Tools Framework
- Hacker Tools Hardware
- Hacker Tools 2020
- Pentest Tools Open Source
- Install Pentest Tools Ubuntu
- Hacking Tools Free Download
- Hackrf Tools
- Hacks And Tools
- Pentest Tools Alternative
- Underground Hacker Sites
- Hacker Tools Apk
- Hacking Tools For Mac
- Pentest Tools Website Vulnerability
- Hacking Tools Windows
Snmpcheck
"snmpcheck is a free open source utility to get information via SNMP protocols. It works fine against Windows, Linux, Cisco, HP-UX, SunOS systems and any devices with SNMP protocol support. It could be useful for penetration testing or systems monitoring. snmpcheck has been tested on GNU/Linux, *BSD, Windows systems and Cygwin. snmpcheck is distributed under GPL license and based on Athena-2k script by jshaw. " read more...Website: http://www.nothink.org/perl/snmpcheck
More articles
- Hacker Tools For Windows
- Game Hacking
- Hacker Tools Hardware
- Pentest Tools Tcp Port Scanner
- Hacking Tools Windows 10
- Hacking Tools Pc
- Hacker Tools Apk
- Blackhat Hacker Tools
- Tools Used For Hacking
- Hack Tools 2019
- Hacking Tools Hardware
- Hack Tools For Games
- Game Hacking
- Pentest Tools Open Source
- Hack Tools For Mac
- Hacking App
- What Is Hacking Tools
- Tools Used For Hacking
- Hacking Tools For Beginners
- Hacking Tools Software
- Hack Rom Tools
- Hack Tools Online
- Pentest Tools Find Subdomains
Fragroute
"fragroute intercepts, modifies, and rewrites egress traffic destined for a specified host, implementing most of the attacks described in the Secure Networks "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" paper of January 1998. It features a simple ruleset language to delay, duplicate, drop, fragment, overlap, print, reorder, segment, source-route, or otherwise monkey with all outbound packets destined for a target host, with minimal support for randomized or probabilistic behaviour. This tool was written in good faith to aid in the testing of network intrusion detection systems, firewalls, and basic TCP/IP stack behaviour." read more...
Website: http://monkey.org/~dugsong/fragroute
Related articles
- Hacking Tools 2019
- Hacking Tools Windows 10
- Blackhat Hacker Tools
- Hack Website Online Tool
- Pentest Tools Download
- Hacking Tools 2020
- Free Pentest Tools For Windows
- How To Hack
- Pentest Tools Website Vulnerability
- Hack App
- Hack Tools Online
- Hacking Tools Download
- Pentest Tools Linux
- Hack Tools For Ubuntu
- Hacking Apps
- Hacker Tools For Pc
- Pentest Tools Android
- Pentest Tools Apk
訂閱：
文章 (Atom)