Exploit A Day

[exploitaday-blog]

A keylogger that charges your phone

Keysweeper is a keylogger disguised as a simple charger.

Samy Kamkar does some reversing to figure out what radio frequencies are used on certain Microsoft keyboards and piles a few embedded devices into a wall charger to do some real time keylogging.

Part of it is retrofitting a $1 radio chip to be promiscuous on the network, based on Travis Goodspeed's article Promiscuity is the nRF24L01+'s Duty. Travis also finds a way to force the Nordic nRF24L01 to send more than the contained packet information, such as the MAC address of the target machines.

Samy goes over strategies he used to reduce scan time around finding Microsoft keyboards on the network. Additionally, he leverages the KeyKeriki Project's research which reaveals that the "encryption" process is an XOR of the MAC address on each byte.

Lastly, he uses the AdaFruit Phonoboard to send the keys to a server to display over the web and SMS messages to a phone for particular string matches.

Of course, this machine can be retrofitted to attack other weakly protected systems.

More information about his project can be found here: http://samy.pl/keysweeper/

Sources: Travis Goodspeed's article http://travisgoodspeed.blogspot.com/2011/02/promiscuity-is-nrf24l01s-duty.html

KeyKeriki Project http://www.remote-exploit.org/articles/keykeriki_v2_0__8211_2_4ghz/

[exploitaday-blog]

Tell me. Are these paths the same?

[Affects pre-2008 Microsoft Windows machines without a MS08-067 patch]

Today, if you look up MS08-067, you can find a reliable exploit for it in Metasploit's archive. Executing the exploit on a vulnerable machine will result in an administrative shell one out of every two to three tries.

How can MS08-067 be found?

Thank goodness for Portcullis Labs.

They created a vulnerability check which would run through an open 445 port, usually open for MSRPC (Microsoft Remote Procedure Calls) over the SMB protocol. This system is regularly leveraged by machines communicating over LAN to share files, and call other services. The check creates a DCE/RPC bind over the SRVSVC (Server Service) Protocol and then builds and sends a malicious NetprPathCompare Packet (http://msdn.microsoft.com/en-us/library/cc247259.aspx) asking the server to compare two paths.

The first path is: \\\AAAAA\\\..\\\p

The second path is: \\\p\\\

Where p is a variable that represents 3 random letters joined together.

If the server responds with a "WERR_OK" or 0x00000000 in the Windows Error value field, then it is vulnerable.

You can find the  checking code in detailed python here: https://labs.portcullis.co.uk/tools/ms08-067-check/

This code uses its own set of functions to construct the NDR Network Data Representation (implementation of the presentation layer) around the check. And its code has some amusing comments at the top.

Checks run for this vulnerability on Windows XP SP2 and SP3 machines could lead to a race condition and heap corruption that can crash the service at any time (either immediately or later in any of the shared services within the svchost.exe container).

Nmap's script "smb-check-vulns.nse" also checks whether this exploit exists, but this script also runs the risk of crashing the machine.

Additional Sources (Mitigation strategies, etc.): https://technet.microsoft.com/en-us/library/security/ms08-067.aspx

[exploitaday-blog]

Adapter, Thunderstrike Attack! Now!

Trammell Hudson reverse engineered Apple's EFI boot firmware and discovered that the only security around it was software-based. Welp. It's too bad that software is incredibly prone to overwriting.

Trammell was able to find the code specifications for the firmware in Intel's docs online with some Google searches based on his hex findings, and he then parsed together how Apple signs their firmware updates. Leveraging research presented at other conferences around Apple's boot system, he discovered that you can use option ROMs as an attack vector.

He then modified an Apple Ethernet adapter to hook into the EFI's SCAP verification code, replace the RSA key with one they control, fix the firmware crc32 checksums, and then allow the attacker to flash whatever they want using Apple's update tools.

You can watch the explination of the exploit here: http://bit.ly/1Dr5cCq

He mentions the following tools in his presentation:

Hudson's software to give Canon EOS cameras more functionality http://www.magiclantern.fm/

Hudson's faster SPI flash reader: https://trmm.net/SPI

Hopper (reverse engineering tool for OS X and Linux): http://www.hopperapp.com/

Binwalk (firmware analysis tool): http://binwalk.org/

[exploitaday-blog]

Widening Attack Surfaces with Unicode

Microsoft's Internet Information Services (IIS) is a webserver created for the Windows NT family. IIS allows users to read, write, and execute programs and files within specific directories, giving them the ability to serve static and dynamic files to the web.

In order to keep users inside particular directory structures and thereby keeping them from gaining full control of the system, IIS has path-checking code designed to keep users from using the backslash character to traverse up the directory tree and enter locations that belong to other users. In 2000, Microsoft included support for the Unicode character set in order to take advantage of Unicode's 2-bytes/character allotment which allowed users to represent tens of thousands of possible characters. This enabled support for more languages, including Chinese and Arabic. Unfortunately, the added complexity allowed multiple representations of the backslash character, like "%5c" for example. Transitioning from the Unicode representation of %5c to \ occurred after the path-checking code, and this oversight allowed for worms like Sadmind and CodeRed to deface web pages. The vulnerability was fixed with the MS00-057 patch. Sources: www.giac.org/paper/gcih/115/iis-unicode-exploit/101163 www.securityfocus.com/bid/1806/exploit

[exploitaday-blog]

Drop your Spring Pictures

Dropping USBs is a well known penetration testing technique based on the idea that basic human curiosity will inspire an unsuspecting victim to plug the USB they found on the floor into their computer, thus resulting in the execution of malicious code to compromise not only their computer but the network they're connected to.

Peter Kim talks about an exploit along a similar vein in his book The Hacker Playbook. Instead of dropping USBs, he drops CDs with the label "Spring Break Pictures" on the front. And even though the file inside ends explicitly with ".jpg.exe" people click away.