Another hazard relates to the lack of regular system updates.
Also other software installed in their computer is often left out.
David this issue has a bearing on security as computer holes and vulnerabilities are being detected
practically on a daily basis.
There is no piece of software that's perfectly secure.
A while back a certain developer announced that he'd pay a hundred dollars out of his own pocket if
a bug is found on his program.
This is the only known case when someone publicly claimed that they created a perfect application.
The program in question was quite basic and this happened 25 years ago.
The reality is that programs do and will have bugs.
Some of these bugs can put the program or the entire system and perhaps even the user in jeopardy.
It's essential to remember about regular software updates
software developers take different approaches to detecting and eliminating known vulnerabilities
as far as Microsoft is concerned.
The company treats this issue with considerable respect.
Keep in mind a simple security rule we've mentioned earlier if you don't install security updates and
patches regularly you practically give up control over your network.
The next presentation will show why this is so crucial.
We'll see how easy it is to take over a system that has known vulnerabilities or known security holes.
We'll switch to the meadow split environment and run the program.
The framework was used before and one or two case studies met us it as broadly speaking a tool a framework
used for testing software a security.
The basis of the program is a database that contains no security holes with descriptions exploits programs
that automated attacks have been developed for many of the vulnerabilities
but a splays database also contains exploits in their descriptions.
A framework user only needs to choose a target computer that is potentially outdated next.
An exploit has to be selected using it.
You can execute the exploit remotely and attack the system.
One of the most popular exploits makes use of a security hole in Windows file server.
The list of exploits in this version of Maeder spoilt the program hasn't been updated for 11 days.
Includes a vulnerability that exploits a stack buffer overflow in Windows SMB
Merritt's Floyd allows you to view the provider of the exploit and includes a list of susceptible operating
systems note that one Windows system comes in many language versions
because this exploit uses a buffer overflow it has to know the memory address is used for some system
libraries.
The addresses can be different depending on the language version of the system.
Our attack is universal and covers most of the language versions.
Let's see now if the computer we want to connect to is vulnerable to the attack
we'll use the presented exploit.
We've gone through the first part of the attack we've selected a vulnerability and a corresponding exploit.
Now it's time to specify the targeted computer and set up the address of our computer the address we
want our victim to connect to
the address will be configured globally as a local host global variable
will need our own IP address.
It can be obtained for example by typing the IP config command in the command line interface.
Our address is 1 9 2 1 6 8 0 that 56 1 variable is already set.
The second will be the address of a remote computer.
All attacks are run on computers we control.
So it's not a problem to check the address of a remote computer by typing the IP config in a computer's
command line interface.
The IP address of the remote computer is 1 9 2 1 6 8 0 5 5.
Let's set a local variable.
Since it's possible that we'll be changing targets.
Let's now view the configuration of the attack.
The attack is launched on a computer with the IP address of 1 9 2 1 6 8 0 5 5 on the port 4 4 5 which
is the default port used by SNB.
It seems that so far so good.
The second part of the attack is selecting a payload the actions that you want to execute after you
break into a remote computer.
Let's assume that the payload is making a remote machine connect to us.
This would be proof that we've taken over the computer.
Let's use one of the predefined code snippets.
We're almost ready to begin.
Let's see if we can manage to takeover a remote system.
It seems that we've succeeded.
The session is opened with a 1 9 2 1 6 8 0 5 6 host.
This means that the attack has been launched successfully.
We can now check if we can connect to the computer
as you can see a connection can be made.
You can now launch remote programs of your choice in the system.
Let's go back to the command line interface and execute a code remotely for example start a calculator
a process has been launched because we physically control both computers we're able to check if the
remote system really runs a calculator
as you can see in the Windows Task Manager.
The calculator has launched
what were the actual attackers do on our place
the attackers would probably be interested in sensitive data and take a snapshot of log in details and
other confidential data being provided on a forum or a Web site
and attacker could also acquire additional information on the remote computer.
Scraper is one of the scripts that gather system data during the reading of registry keys.
After a scraper is launched the program will try to gather information in the session that was declared
session id one if the program succeeds all configurations will be written to a file and sent to us the
attack will probably succeed registry keys are being exported this process takes quite long.
This is because a computer retargeted has a low processing power.
If we had malicious intent after the process is completed we would also need to hide the fact that we
had broken into the system and harvested some data the information on intrusion is probably recorded
in system logs in the system security log in particular also other logs can contain traces of the attack.
In that case let's try to wipe all system logs.
If a victim browses through the logs from time to time they'll notice that a deletion event has been
logged which could be a problem.
This would be the sole information that points to a successful attack having been run.
The last thing we want to do is exactly that clearing event logs
as you probably all know Windows has 3 event logs applications system and security event logs as you
can see all entries in the logs have been deleted
using several Meadow's split commands.
We've managed to take over a machine that wasn't updated regularly.
We were able to monitor the process is launched on a victim's computer.
We also run our own processes and gathered system configuration information.
This could be beneficial for example if we wanted to break into another computer on the same network
at the end.
We also wiped the security logs.
That's it for this case study.