The Story of a Hack - Part 1. Reconaisance

[Nick]

first installment of synjunkie's "Story of a Hack"...

 

 

Sent to you by Nick via Google Reader:

 

 

The Story of a Hack - Part 1. Reconaisance

via SynJunkie by SynJunkie on 11/8/08

If you haven't read the Intro, it might help if you check out that post.

First things first, recon. I want to find out as much information about my target as possible. Some attackers might go straight to scanning IP's , not me, I want to do as little of that as possible at the moment. I start with the best tool I have available for recon, Google!

I scour the targets website. It’s a small and basic website but I get an email address, a flyer in PDF format and a list of office locations and contact details. Well that’s a start. The website is very 1.0, simple and secure I guess.

So the email address I got off the website is a generic mailbox that many organisations create, in...@hackme.co.uk Well let me I throw the domain name into Google and get a few results.

intext:”@hackme.co.uk”

Okay, So I get a few results.

l...@hackme.co.uk
ma...@hackme.co.uk

What is interesting is l...@hackme.co.uk came up in a SQL Server forum asking a question about MS SQL 2000 Server configuration.

I also use Google to see which sites are linking to HackMe Ltd.

link:www.gallifordtry.co.uk

Of the links I get returned the most useful one is from an outsourcing support company called BackupService. They provide small companies with Remote Support and have HackMe Ltd listed as a customer. Interesting, that puts them in scope as a possible attack vector.

Now I turn to the PDF file on the website. I run this through Serversniff.net to look at the metadata.

FileType(guessed) = PDF document, version 1.4
format - PDF 1.4 mimetype - application/pdf MIMEType = application/pdf
CreateDate = 2008:04:01 03:39:33
PDFVersion = 1.4 FileType = PDF Creator = PrimoPDF http://www.primopdf.com
Title = Microsoft Powerpoint Sales Brochure [Compatibility Mode]
ModifyDate = 2008:04:01 03:39:33
PageCount = 9
FileSize = 243 kB
Producer = PrimoPDF
Author = Lena Bloggs


Okay, after a quick Google, I see PrimoPDF is not vulnerable. But I have got another employee name, Lena Bloggs, and I know that my target uses Microsoft Office internally, so there probably using IE and Outlook too. Mmm, loads of possibilities there for some targeted sploits.

Let's see what I get with a quick bounce email.

I send an email to llena...@hackme.co.uk and have a look at my returned headers.

Delivered-To: syn...@gmail.com Received: from mail80.messagelabs.com (mail80.messagelabs.com Received-SPF: pass (google.com: best guess record for domain of mail80.messagelabs.com designates 195.245.230.163 as permitted sender) client-ip=195.245.230.163; 195.245.230.163 as permitted sender) smtp.mail= X-VirusChecked: Checked X-Msg-Ref: server-14.tower-80.messagelabs.com!1225463335!6552390!18
X-StarScan-Version: 5.5.12.14.2; banners=hackme.co.uk,-,- X-Originating-IP: [194.214.128.33] Received: from unknown (HELO file-server.hackme.co.uk) (194.214.128.33) From: postm...@hackme.co.uk To: llena...@hackme.co.uk boundary="9B095B5DSN=_01C8DA36Afile-server.hackme.co.uk" X-DSNContext: 335a7efd - 4523 - 00000001 - 8004546 Message-ID: Subject: Delivery Status Notification (Failure) This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. llena...@hackme.co.uk

Okay, from my bounce email I get to find out that my target is filtering email for spam and viruses, bugger. That reduces my chances of getting some of my attachments through. I do get the name of an internal server though. I also get some IP addresses.

This is all useful information that will help me decide which attack avenue will be most successful.

Now what have they got on the Internet, I know that they have a web presence and an email server so let’s look at DNS. First I do a Whois to see what that turns up.



So this gives me company and address info, and I also get to see who they use for the Name servers. Nothing too exciting.

Now DNS, For this I will use a couple of tools. Fierce Domain scanner is a favourite of mine, and has served me well before.

perl fierce.pl -dns hackme.co.uk



This has given me 2 Address blocks. One which will be the hosted website (212.140.43.175), and the other looks like the address block they use for there own servers 194.214.128.33. I'll focus on that block. What I really want to know is how big is the range the use and are there any other hosts accessible.

I use nmap to look for typical edge devices on that class C range.

nmap 194.214.128.1/24 -sP



This gives me what i suspect is the range they are using. 194.217.128.32-47 with .32 being the network address and .47 being the broadcast.

Now I check the webmail host I found and find that as I expected only port 443 is open.

nmap 194.214.128.34 -F PN

And then I confirm that IIS is in use.

nmap 194.214.128.34 -PN -p443 -sV



So now I find that they are using Microsoft IIS as suspected.

But Fierce didn't give me a mail server. Well, luckily I get that IP from my email bounce (214.214.128.33) remember.

After applying some nmap magic dust, I get some very interesting info back. It looks as though my target is using a Cisco pix firewall and they are probably NAT'ing through it to the internal hosts. Again, knowing this will help me shape my attack.



I'll also quickly Dig the MX to verify my bounce email.

dig hackme.co.uk -t mx



The results confirm what the bounce email found. HackMe is using MessageLabs for mail filtering. Buggers!


Okay, maybe I’ll stretch my legs and go for a little drive. But first I do a quick Google Map of where I'm heading.



Nice, there's a big park right outside my targets office and plenty of streets to park on.

So I stop by the targets office which is in a built up area with plenty of other small businesses around. I can park quite close to the premises and if my IPhone serves me well I see that they have a lovely wireless network going on.



WEP, you are the weakest link, goodbye!





So what have I got from my recon?

External IP Addresses

• 194.214.128.33 - mail
  
• 194.214.128.34 - webmail
  

Wireless Network

• HackMe- WEP Encryption

Users

• L...@hackme.co.uk
• Le...@hackme.co.uk
• ma...@hackme.co.uk

Internal Host Names

• File-Server

Software in Use

• MS Office
• MS IIS
  
• PrimoPDF
• MS Exchange
  
• Windows XP
• Windows 2003 Server
• MS SQL (maybe)

Other Useful Info

• Cisco Pix Firewall in use
• Using MessageLabs for email scanning
• External Support through BackupService Ltd
• Head Office is 20 minutes drive.

Not bad for a couple of hours work. This should be fun.

OK, so my attack vectors:

Client side exploits:
I know what software they are using internally so this is certainly a possibility. But I also know that they are filtering mail with a pretty good filtering service so that's not good.

Social Engineering:
I know who HackMe uses for Support, and I know quite a lot about the software they use, the names of HackMe employee's, and the infrastructure they have. This is certainly a good attack vector.

Bruteforce Webmail:
I know that they have an accessible webmail server, and I have some information to make an attempt at bruteforcing a login. I don't have enough info at this point and this would be pretty messy and unlikely to succeed.

Wireless Penetration:
Knowing they use WEP, have named the AP as HackMe and have not hidden the SSID, this tells me a great deal about the security of HackMe. This will be my preferred attack vector.


Lessons Learned

Okay, So what could HackMe Ltd have done to make the attackers life more difficult.

• Don’t use WEP. It's very broke. Hide SSID's and apply MAC Address filtering.
• Strip Metadata from documents.
• Strip Email headers.
• Minimise Information disclosed by third parties.
• Don’t post questions to tech forums from a company email addresses that disclose information about your infrastructure.

Coming up........Breaking in and Kung Fu Shopping.

 

 

Things you can do from here:

• Subscribe to SynJunkie using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

 

 

[Daniel Estrada]

All,

I just wanted to say this is a great article and some things to also keep in mind when doing Reconnaissance on a webserver.

1) A lot of corporations are now aware that many people conduct google dorking or google hacking techniques.  (Some made very popular by Johnny Long at ihackstuff.com)

   -- That being said companies that may have "leaked" information on to a search engine usually contact Google to have its cache and servers cleared of the information.   However often times they forget about MSN or yahoo.  From personal experience other search databases or "repositories" can lead to hidden treasure as well.

2) It maybe prove to be beneficial if you do some up front anonymous info gathering using a site such as netcraft which can finger print the webserver for you and also in some cases tell you how long the server has been up.  This information can let you know if they have applied any critical patches to the server that may have been released recently.

3) Continuing with anonymous information gathering, you can also use public domain registrars such as Arin (Ripe, AfriNic, etc...).  These sites also have corporate information and can lead to getting a better understanding of key personnel with out making direct queries to a dns server.

--Nick thanks for sending this out!! Great info.

Daniel