[MUSIC PLAYING]
Welcome to the Hacker House Hands On Hacking mass theory
module.
We're now going to walk through some
of the theoretical background necessary to complete
the practical elements of this course module.
So this element of the course, now,
is the seventh module in our course.
And we're going to shift our perspective now.
Previously we've been dealing with network perimeter
technologies.
We've been dealing with web services, mail services, VPN
services, DNS services, and public internet footprints.
We're now going to switch our perspective and viewpoint
from the attacker as though we have breached a perimeter.
We've either gained access to an internal network.
Perhaps we've used a hardware implant,
something like Hostile or Pineapple
to install into the environment.
And we've gained some kind of remote shell.
And we're able to target systems internally.
So we're now thinking of an internal perspective.
We're plugged into a company.
We've gained access to a VPN.
We're somehow inside the company.
And these are the kinds of technologies
now that we will explore that we would see more likely
on an inside of a company.
Not exclusively, you do sometimes see them on the web.
However, things like network attached
storage, database servers, and Windows Enterprise
architecture, Unix server estates, and things like that.
Things of that nature that you might see more likely
on an internal network.
[MUSIC PLAYING]
So we've got hands on hacking NAS.
So this is network attached storage.
So this module is all about file sharing.
So most companies, most businesses,
will have a way for employees to share files.
They'll share information amongst each other
either through a network file share,
or through some kind of mapping, or some way to share
information.
And these network attached storages, or those storage area
networks, they can come in all kinds of different shapes,
sizes, different varieties.
And they have a number of commonly used file transfer
protocols.
And in fact, this lab module is based on commonly seen NAS
appliances.
In fact, one such appliance is on my desk over here,
which has been found to be vulnerable to these same kind
of attacks, as well.
So we're going to show you a number of common kinds
of attacks that you might try against different file services
and file storage solutions.
And these kinds of things are usually
connected to fast networks.
They usually in an organization, they
don't want to have a lot of bottlenecks.
They're usually in a good position.
They usually have strong--
they're usually well-connected, for instance, internally.
And may have some fast feed.
Therefore, they're a good target for all kinds
of nefarious activities.
Whether that's software piracy, video gaming,
fraudulent activity, data theft.
They're generally fairly well targeted
systems, because that's where all your data often is.
So network attached storage comes
in different shapes and sizes.
[MUSIC PLAYING]
File transfer protocol.
One of the very simplistic ways of transferring
files, operates over TCP port number 21.
Defined in RFC 959.
This can be configured for anonymous access.
So you can log into an FTP site for anonymous,
and then be able to browse through information and data.
And FTP is also a clear text protocol.
So it can be subject to man-in-the-middle attacks.
If you're into man-in-the-middle capabilities then you would be
able to see user names and passwords in clear text.
It's not really a common way.
It's kind of an annoying way.
Your receptionist at a company might not
want to share a file with Jim on the fifth floor
by sending it to him via FTP.
Seems a little bit of a headache.
So it's unlikely that this is going to be the main way.
But it is one way for people to transfer files.
A trivial file transfer protocol typically
used by network engineering for PXE boot, or PXE boot
configurations.
And it can be configured to allow
files to write files, as well.
However out of the box, see TFTP doesn't
support any authentication.
So you can effectively try to brute force file names.
If you know that there's a TFTP service open,
you can simply try to guess the file names.
So guessing things like configuration,
rom.bin, biosstop.bin, dupe.bin.
Things like that might expose things, and config.
And you often find that maybe there
might be stuff like running-config
or startup-config.
Files like that which might contain sensitive network
configuration information exposed on a TFTP service.
[MUSIC PLAYING]
So when we're dealing with files and operating files
on remote systems, we need to introduce something
called Remote Procedure Call.
RPC is a technology that's designed for computers
to run tasks on each other.
So RPC is often used for things like setting file locks
and providing information to network file services.
So for instance, if you're the receptionist, and you open
you know Claire's document from accounting on number two,
on the floor two.
You open her document, and Claire
goes to open the same document from the network,
and Claire gets the message, "Your document is locked.
It's currently in use by Sara."
Or Jennifer, whoever.
So this kind of thing is done via RPC.
So the RPC, when you've opened that document,
has sent a remote procedure call to say lock this document.
It's in use by you.
And the remote servers lock the document
so nobody else can do it.
So RPC is a way for computers to run task on other computers.
And those tasks can be anything.
They can be things like check the permissions of a file,
or lock a file, open a file, delete a file, mount a file.
So that these kind of remote procedure calls
are obviously an interesting attack vector.
As attackers, we have a way to run procedures
on remote computers.
So we're interested in those services.
[MUSIC PLAYING]
Another set of services is something called Server Message
Block.
And inside a Service Message Block
you can use something called Common Internet File
System or CIFS.
Common Internet File System operates over TCP
and UDP ports 445, 137, 138, and 139.
Widely used by Microsoft.
There's a commonly used Server Message Block
technology worked by Microsoft.
And because of Microsoft's dominance in the marketplace,
it has been adopted now by Apple.
And is also increasingly used by Samba open-source packages.
And various operating systems will build Server Message Block
and Common Internet File System into their OS's now
to be compatible with the market leader, Microsoft.
So you'll see these kinds of things.
And often these service ports are commonly
referred to as the Microsoft Windows service ports.
When in fact, they can also be related to other things.
But we're talking about Common Internet File System access
through the Server Message Block.
It's important to remember CIFS, Common Internet File System.
And that's how network shares are often mapped and supplied.
When you map a D drive, net use, whatever.
It's most likely using this Common Internet File System.
[MUSIC PLAYING]
So Simple Network Management Protocol is another technology.
SNMP is designed for probing a server,
and enumerating from a mid-table,
from a table, a tree that can give you some information.
Allows you to do diagnostics and do some remote maintenance.
Simple Network Management Protocol.
It's implied in the name.
Exists in three main versions.
SNMP version 1, version 2, version 3.
Newer versions start to add additional security.
The old Legacy Version 1 supports what's
known as a community name.
And community names are effectively
like a preseed here, or password that
needs to be specified to get information
from a tree for reading purposes.
And also, there might be a separate password
for writing purposes.
Typically common ones are public and private.
Also you might find the company name.
Or variations of the company name are used.
But there's a limit of seven characters on Legacy Version 1.
Newer versions of the protocols support
authentication, HMAC message integrity, and encryption.
Unfortunately, practically nobody uses them anywhere.
And if I was a betting man, I'd say
that SNMP is a lingering threat in many networks.
So SNMP can be used to configure remote hosts, as well.
So you can often overwrite things like ARP table entries,
and maybe tell important hosts that one server they think
should be over there is actually over there.
And do some nefarious tasks that way.
[MUSIC PLAYING]
The NSA kind of realized that SNMP is a good thing, as well.
So they made a tool called EWOK.
EWOK is a little SNMP probing utility.
I like it because it's got a cool Star Wars name.
But I also like the fact that it's
a little bit more detail than a standard SNMP probing utility.
It can be used to do some kind of cool stuff.
You can get process counts out of various Unix's.
You can dump the ARP cache, review
other bits of information.
There's another tool called ri, which is an RPC information
tool on steroids, effectively.
It does a lot more information gathering.
It will go on and access the calendar,
or pull out information, or look at the RPC services.
It's just a little bit more of a powerful RPC information tool,
that can gather a lot of data.
So EWOK and ri's, a couple of tools
from the National Security Agency
that we're going to borrow and use.
Because they're kind of useful.
We've done some reverse engineering.
And they're fairly OK, and fairly good to use.
[MUSIC PLAYING]
Common Unix Printing System.
It's used for sharing printer resources across the network.
So people will connect CUPS environments
in that has a little built in web server.
And it's quite tricky to get printing working with CUPS.
It's quite tricky to get network printing working with anything
Unix-like in general.
And often, network printer appliances
will be using this technology, as well.
And it can often be found on the network servers that
supply printing resources.
Problem with it is, printing onto Unix
is just so damn difficult, that it's even more
difficult to secure it.
So people often leave these things unsecure.
If they get it working, they probably
don't want to change any passwords on it.
Because they're just happy that the printer prints.
So we can often misuse this misguided trust
in their printing devices.
As printers are effectively often
little computers with storage processors
and network connection.
So we want to be able to hack those, as well.
So looking at things like Common Unix Printing System
is a good way.
If you're familiar with the team Phenoelit,
by an excellent computer hacker named FX.
If you look at his tools, you can see some tools
like Hijetter which can be used for interacting with printers
on their IPL port.
You can send printing related jobs.
We're not going to cover printer hacking, specifically.
But if you are interested in it.
I'd recommend taking a look at Hijetter by Phenoelit.
So history of command injection, as well.
So things like CUPS have been vulnerable to the same kinds
of injection attacks.
Similar kind of stuff that we saw in the previous modules.
There's a lot of command injection.
You should be getting a theme now.
The number one ways that websites are breached
are injection attacks.
And the ways companies are breached, injection attacks.
This course has a lot of injection command, injection
attacks.
Which is some of the basic premises for how injection
vulnerabilities come to light.
[MUSIC PLAYING]
So RSYNC is another technology.
RSYNC can be used often for package management.
It's a way of synchronizing files and folders
between different servers.
And it stores configuration files and data.
And in fact, in 2003, it's a very fascinating case,
2003 a completely unknown computer hacker
used a 0day heap overflow against the Gen2 RSYNC
services.
Compromised the package management,
and was in the process of back-dooring
all of the Gen2 services.
And was actually caught by a very, very, very paranoid
system administrator who was running multiple integrity
checkers on the server.
And they almost, almost, very, very nearly got away with it.
They were never caught.
But in 2003 there was a security advisory
for a 0day heap overflow in an RSYNC service,
which is a fascinating read through
on how a vendor was getting hacked in 2003 in a very
prominent Linux distribution.
It stores configuration files and data.
And if you set up RSYNC in an insecure way,
it can expose sensitive files.
And people often use it for either backing up servers
and inadvertently expose files on it.
Or they're using it for package management, internal package
management, pushing patches to their Unix estates or Linux
estates.
Because Linux is not Unix.
[MUSIC PLAYING]
Network File Service, originally developed by Sun Microsystems.
Sun Microsystems have been really at the forefront
of a lot of innovation of different kinds of technologies
that we use.
So NFS version 2, 3, and 4, was a widely supported way
of sharing files between computers on the network.
So it's a way of sending information, files, sharing
them between different servers, NFS systems.
And in an insecure configuration,
it can be susceptible to a number of attacks.
And the reason was nearly days of networking, and network
technology, and network file services often
made an implicit mistake.
They did some client-side trust.
They believed the client.
They didn't trust the server.
So the permissions and things were coming from the client.
And we'll look at that.
[MUSIC PLAYING]
Coming to permissions.
Now, this is the Unix permission model, or the Unix file system
permission model, generally.
If you look at Mac OS X, there'll be a different model.
If you look at Windows, there'll be different model.
So we're talking about Linux, Unix,
and general Unix-like operating systems.
You'll have seen in the previous module, we did CHMOD.
We changed some permissions around.
But this here is actually the tree
that explains the Unix permission models.
So these octal representations here actually
add up to some numbers.
So you've got three values.
You've got the user.
That is the user who owns the file.
You've got the group.
That is the group of the user who owns the file.
And then you have other.
Which is everybody else on the computer.
So if you are the user, let's say you create a file,
you would do read, write and execute.
You want to be able to read, write, and execute to the file.
So you would turn read on.
So you give it a 1.
You give write on.
So you give that a 1.
And you give x on, so you'd give that a 1.
And then what you'd do is you'd say, OK.
Take the numbers 4, 2, and 1, add them together,
and you've got 7.
So your flag, your mask, your optal values here, will be 7.
So that you will get read, write, and execute
bits enabled.
And group, you perhaps want everyone
in the group to read your file and execute it.
But you perhaps don't want everybody
in your support or staff group to be
able to write to your file.
So you would turn off write.
So you'd put read 1, write off with a 0,
x for on to execute the file.
So you'd then end up with 4 and a 1,
and you'd get the number 5.
And then that would enable read and execute permissions
for people in the group.
Other you would have read, write, and execute.
And here we can see we've got 4, 2, and 1.
And we just want, we don't want everyone else to run our files,
we just want them to be able to read them.
At which, in fact, they could then just copy, and read them,
and run them.
But you could then do 4, 1, and 4.
And that would give you the permission mask of 4.
So you would have read on, and all of these other bits
set to off.
So you'd have a 4 here.
So that's how you build up the combination of flags,
or users, group and other.
And it's important, other means anything else on the system.
So if it's a process coming from a network, other applies.
If it is a group, it's anyone in that group ID
that you belong to, who owns the file.
And you can change those files with CHOWN and CHMOD.
There is also an imaginary number here,
which is a special bit.
And this special bit denotes to the same things
it has a sticky bit for user group and then truncate bits.
So those same values, but sticky user, sticky group truncate.
Which means prevent anyone from writing.
So if you were to put a 4 in here.
And turn this sticky user imaginary bit on.
You would have a 4 in here.
And what that would do is give you 4, 7, 5, 4.
And the sticky bit means when you execute this binary,
it will execute with the permissions of the user.
Which is why we search for those binaries
in the previous module, to try to find
permission binaries that run with another user's
permissions.
So the sticky bit runs the binary
with other user's permissions.
So we want to stick the user or the group.
If we were to stick the group, it would be a 4 and a 2.
So we could put 2, 7, 5, 4, and it would just
give us group permissions.
If we did 6, 7, 5, 4, it would be group and user permissions.
And if we did 7, 7, 5, 4, it would be group and user
permissions.
Plus nobody on the file system would
be able to write to that file.
The other x field is a field that you probably don't want.
And doesn't really care for you.
You're probably just 1, 4, and 2.
So anything with a 4, a 2, a 6, or a 7
is probably of something of interest.
So this becomes very important when networks are using files.
Because if you have a file you created on your computer,
and you have your permissions and you set those permissions.
And then you're sharing that file across a network,
where do the permissions come from?
Does your computer give the permissions?
Or does it come from the connecting client?
So it's important to understand where the permissions model sit
and where they exist in a network.
[MUSIC PLAYING]
So you also have vulnerabilities.
There's been a number of vulnerabilities in different
OS's.
In particular in Samba, there's a particular vulnerability,
CVE-2017-7494, called SAMBA CRY.
This is a vulnerability that allows users to execute code
on some of the hosts.
And the attacker just simply needs write permission
to the share.
So what you'd have to do, is you have
to have the ability to upload a file to a Samba host.
And then you can upload a shared object file.
And inside that shared object file
can contain your commands to execute some other kind of code
injection command execution type vulnerability that can be
leveraged through metasploits.
Or indeed any other exploit that you might have.
So that concludes the theory for this module.
What we're going to do now is we're
going to demonstrate hacking into a commonly seen NAS type
environment.
So I want you to download the file server ISO.
Make sure you've got your reference guides
and your tools ready.
Perhaps re-watch through this video.
Make sure you're comfortable with that Unix permissions
model.
We're then going to do a lot of different practical elements
where we demonstrate some of these theoretical concepts
so that we can solidify that knowledge
and demonstrate how these present risks to the network.
So I'll look forward to seeing you in the next module.
Thank you.