[MUSIC PLAYING]
Welcome to the Hacker House Hands
On Hacking VPN Module Theory.
We're now going to explain all of the necessary theoretical
backgrounds to explore the VPN module.
So, so far, we're still back on the external perspective
of an attacker, who is sitting out on the internet.
So most companies will find information
from open source intel.
They'll have a DNS server.
They'll be using domain names for something.
They'll have a web server.
They'll be using web servers to publish information
about the company or for some other purposes.
They'll have email services.
And another thing that a lot of companies today have
will be a VPN.
They'll have some remote access or some capability
for teleworkers to be able to access the organization.
So this whole module is around VPNs.
It's a topic which I find hasn't been as thoroughly
explored online.
But I will explain now the methodologies and processes
we use for targeting VPN networks
and doing VPN assessments.
So here, you see a virtual private networking.
Hopefully, you know what a virtual private network is.
A VPN is a private network over one medium to another.
So it's, for instance, connecting your London office
with your Manchester office through the internet
via an encrypted link.
You might use a VPN or an encrypted tunnel to do that.
So they're often used to link different offices together,
often used for personal purposes-- people trying
to evade high court enforcement orders
or try to circumvent surveillance platforms,
or indeed just so they can torrent without getting a fine.
So they can be used for any other kinds of reasons as well.
And they come in all different shapes and sizes.
So as an example, you might have a head office linking up
to different regional offices.
And they might be using a number of protocols or standards
to build that network.
But we're talking here about VPNs
and some of the common configurations that we'll see.
And one of those common configurations
is a technology known as IP SEC, or IPsec.
And this uses a thing called internet key exchange
through ISAKMP.
This internet key exchange defined this IPsec
in RFC-2407, 2408, 2409.
The internet key exchanges usually run on UDP port 500.
And the way that this works is it
uses something known as Security Association material,
or SA material, which negotiates between the server
and the client how to connect that tunnel,
how to do that IPsec communication,
how to encrypt that tunnel.
And then it can use internet key exchange
version 1, which could be run in Main mode or Aggressive mode.
And if it's really Main mode, it's
a more complete six-way handshake.
So it doesn't expose additional information.
However, if it's running in Aggressive mode,
it only does three packets to the handshake.
And subsequently, it may leak information,
because it's trying to do things much quicker.
And the reason people do that is they don't necessarily
want the overhead with building up
a full, secured, encrypted tunnel each time.
If the connection is unstable, it might drop out.
So they do it in an Aggressive mode
to try and get the connection to respond
more quickly, so that latency and issues are not
so much of a problem.
So you have different modes that it can run in--
IKE Main mode and Aggressive mode.
And it usually uses Security Association
material to negotiate how a client and server can
communicate with each other for the purposes of building
an encrypted tunnel with IPsec.
So an Aggressive mode leak can occur
when an IKE, Internet Key Exchange,
is being used with pre-shared keys.
If you have pre-shared keys being used through the service,
those pre-shared keys could potentially
be extracted by an attacker and then
subject to password-cracking attacks in an offline mode.
And then once cracked, it would be possible for the attacker
to authenticate to that IPsec endpoint,
to authenticate so that VPN.
And what they would then learn is
that this may in fact be the first stage authentication
or the first stage authentication process,
and they may need to do more hacking beyond just accessing
an IPsec total.
They may find that there's a second stage,
such as an extranet portal or a partner portal
or something like that.
So another characteristic of IPsec is that it's used UDP.
And so if it's using UDP, you can actually
measure the retransmission rate.
So when a packet is sent, how long it waits between sending
the next packet will allow you to measure
what the responses are.
And based on that timing, you can actually try to identify,
is this a Cisco device, is this a NetScreen device, is this
a checkpoint device.
You can actually use that to identify what kind of device
you're communicating with based on how quickly it retransmits
UDP packets.
And there's also fingerprint tools included in IKE scan.
And there's also sometimes vendor ID variables
that can be exposed the platforms as well.
So there's also SSL VPNs.
SSL VPNs have gained a lot more prominence these days.
And they make use of Transport Layer Security or Secure
Sockets Layer protocol to encrypt
to use a tunnel effectively the same way that you communicate
with a HTTPS website.
And they might be implemented by things like Cisco ASA
appliances, OpenVPN, and various other network vendors as well.
And you also have Datagram TLS, which
is a TLS within UDP, which is used by OpenVPN on ports UDP
port 1194.
So you can actually use this Datagram TLS
to build an encrypted SSL tunnel through UDP.
And it's using that to effectively build
a VPN, an encrypted link through the internet.
And a VPN is very useful to you, because you
can tunnel your traffic through one site
and make it appear as though you're somewhere else.
And indeed, if you breach a VPN, it's
often going to give you access to a private network
or some private area that you shouldn't be in.
When you think about a VPN and you
think about you get to a VPN login page
or you get to a VPN login client,
you type the username and password in,
that username and password, it's going to a device.
It's going to a server, a VPN server or a VPN appliance.
And then it's going to authenticate against something.
It's going to take that username and password,
and it's going to say, OK, this is the username and password.
That might authenticate against the device.
It might just have 10 users listed in that appliance,
and that's how it does it.
However, typically it might well link into a SQL database,
a RADIUS server.
It may even link into Active Directory
through things like LDAP.
Or indeed, it could use something
like TACACS or some other proprietary, Cisco-related
database or data store.
So I need you to think, when you're
trying usernames and passwords, they're
actually being trying against the data store.
Similar to that three tier architecture,
you need to really think of the lay of the land
when you're looking at VPNs.
Think about how that might be structured in a network.
You'll have an endpoint there that's got a connection to it.
But that doesn't necessarily mean
that's where the story ends.
And there'll be some backend data
store which is being used to test your usernames
and passwords.
So it's important to remember that you
can try to target those back-end data stores as well.
The National Security Agency love hacking VPNs.
They really like hacking VPNs.
And we know this because in 2016 some souls leaked the NSA
exploits onto the internet.
And in particular, there's a blog here from Cisco
referencing a group calling themselves
The Shadow Brokers, where they disclose several exploits
from the National Security Agency, which include
BENIGNCERTAIN and EXTRABACON.
And these two exploits are exploits
that can be used against VPN appliances.
One of them, the EXTRABACON exploit,
requires you to have SNMP on the Cisco ASA device.
But they're very, very slick exploits,
very well-written in terms of that they overflow memory
and then they effectively change the password
and disable the password, let you access the server
and then reset it back on later on-- so very cool exploits.
And indeed, one of them, BENIGNCERTAIN,
is an information leak against recent ASAs
but is just a exploit for PIX 6.0,
a legacy version of Cisco PIX, which I would hope
today you wouldn't find online.
But they are still around.
So yeah, NSA love hacking exploits.
And I'm pretty sure you'll love hacking VPNs too.
Another thing to be aware of, VPN clients, VPN privilege
escalation attacks, there's lots of VPN clients
that have been found vulnerable to privilege escalation
attacks.
Things like Pwnnel-blicker for TunnelBlick, if you use OS-X,
you might use an application called TunnelBlick.
And there's been privilege escalation attacks
against things like Cisco Any Connect clients and OpenVPN.
And the reason for that is if you use a VPN client,
VPN client is going to run with usually high privileges
in the system.
So it's going to need to create virtual network adapters.
It's going to need to create lots of technology that's
going to allow it to intercept traffic.
So it's going to need high privileges.
So if you've got a VPN client, it's
probably a good place to look for privilege escalation
opportunities, because it will have
high privileges in the system.
So it would been running with system
or it would be running with admin rights.
And any vulnerability or bug you might find
will, obviously, hopefully result in the same privileges.
So VPN clients are a brilliant source of privilege escalation
potential.
So what goes in a VPN hacker's toolbox?
Well, much like our other modules,
here we've got various tools.
And they're fairly standard tools, in fact.
You would have a ipsec-tools for building
an IPsec tunnel, things like Raccoon or various other tools.
ike-scan is a tool for probing internet key exchange
to actually do the handshaking with these endpoints
and try to enumerate the security association material
and identify vulnerabilities on that endpoint.
psk-crack is another tool that you could use.
I believe that these psk-crack and ike-scan
were written by a company called NCA monitor in the UK.
So ike-scan and psk-crack, they're very useful tools,
stood the test of time, still being used today.
openssl, client/server negotiations, this is a--
maybe you'll use openssl directly
to interrogate an SSL VPN.
And also as well, you might want to use a different VPN client.
You might need a web browser, or a piece of software,
or something to interact with it.
So how do we hack a VPN?
VPN hacking methodology, you need
to identify the VPN technology in use.
So we need to do our port scans, our reconnaissance.
And we need to find, is this IPsec?
Is it SSL?
Is it something else?
So once we've identified the VPN technology in use--
let's say it's SSL--
then what you need to do is identify
the encryption negotiations and algorithms that are in use.
So you actually need to talk to it in the same language it's
expecting.
And if you think about this like, if you're a Hungarian
and you meet a Polish individual and you all
speak to each other in Swahili or Afrikaans,
you're going to have a hard time understanding each other,
if you're all talking different languages.
And VPNs are a little bit like that.
When you're trying to authenticate with a VPN,
you need to make sure that you've got the right encryption
negotiations, you're choosing the right algorithms,
you're offering the right kind of authentication,
or the VPN might not know how to talk back to you.
Or it might not see that you've got the supported options.
Or it might not be the right configuration.
And therefore, it won't actually communicate with you,
because you're speaking French to a Japanese man.
So once handshakes and authentication mechanisms
are known, what you will then do is,
when you know that you can handshake and authenticate
to a VPN--
and you'll know you can handshake and communicate
with a VPN because you'll be able to try and authenticate
to it.
If you can't try to authenticate it,
if it can't give you a bad password error
or you can't actually try to log in, you're talking Hungarian
and you need to change up the language
and find out what the right handshakes are.
Because once you get those right,
you should be able to try to log in.
And then once you've got to that stage,
try and look for information leaks.
Can you use this new configuration
to get extra data?
Can you probe that VPN service to get any other information
that you shouldn't have access to?
And then you can, using these information leaks, knowledge
of the service, then attempt to identify vulnerabilities
for exploitation purposes.
So this is the methodology that we approach.
We identify the technology.
We identify the languages, or the negotiations
or the handshaking that it's using,
what kind of authentication it might need, certificate-based.
We make sure we get all of these parameters
right so that we can try and authenticate to the VPN.
And then once we've got to that point, then information leaks
and vulnerabilities and exploitation.
So this, we're going to introduce another privilege
escalation module now.
So it'd be a bit boring if every time you
got onto a Linux server we just told you to run Dirty COW,
even though so many services seem to consistently
be vulnerable to it.
What you would find is, instead, there
are other privilege escalation attacks.
And we're going to explore a few in this module.
So we're going to look at mempodipper, which
is another awesome kernel vulnerability from 2012 that
allows you to read and write setuid binaries.
And we'll talk about file permissions in a later module.
But you can basically use this exploit
to gain root privileges as well.
And it's a different alternative exploit.
Another alternative explain is perhaps
the screen exploit from screen less than 4.5.0.
There was a local root vulnerability
that allowed you to create a root-owned file anywhere
on the system.
And you could effectively make an exploit
to write files as roots.
And then you could leverage this vulnerability
to effectively gain root privileges.
So we could look at this vulnerability as well.
It's another kind of privilege escalation attack.
This one's from 2017, CVE-2017-5618.
So what you see here, we've got Hands On Hacking Lab.
There's various resource reference guides and things
that you'll need.
You'll need to make sure you download that ISO.
And we'll set up our lab like we've
set up for the other modules.
And we'll get going through on the practical
and show you now how you can identify a VPN endpoint,
try to enumerate some of that technology,
and trying to breach that server,
breach that first stage authentication,
and then look at second stage authentication as well
and try to breach that too.
So we'll demonstrate these attacks now.
So thank you very much for following through this module.
And I'll look forward to seeing you later on.