Tag Archives: Haxmas

2022 Annual Metasploit Wrap-Up

Post Syndicated from Spencer McIntyre original https://blog.rapid7.com/2022/12/30/2022-metasploit-wrap-up/

2022 Annual Metasploit Wrap-Up

It’s been another gangbusters year for Metasploit, and the holidays are a time to give thanks to all the people that help make our load a little bit lighter. So, while this end-of-year wrap-up is a highlight reel of the headline features and extensions that landed in Metasploit-land in 2022, we also want to express our gratitude and appreciation for our stellar community of contributors, maintainers, and users. The Metasploit team merged 824 pull requests across Metasploit-related projects in 2022, more than 650 of which were incorporated into the main metasploit-framework repository. If you fixed a typo, linked a new reference, or cleaned up some code spaghetti, thank you!

Active Directory Certificate Services attacks

For years now, penetration testers and attackers have emphasized Active Directory as a particularly juicy and valuable attack surface area. In 2021, we saw fresh attack research that outlined new techniques for targeting Active Directory Certificate Services, or AD CS, including multiple configuration flaws that can be leveraged to escalate permissions from a domain user to a privileged account. In response to requests from our user community, Metasploit released two modules in the second half of 2022 that support AD CS attack techniques:

  • auxiliary/gather/ldap_esc_vulnerable_cert_finder can be used by an authenticated AD user to enumerate Certificate Authorities (CAs) and find vulnerable certificate templates.
  • auxiliary/admin/dcerpc/icpr_cert allows users to issue certificates from AD CS with a few options that are used for exploiting some escalation (ESC) scenarios. Currently only escalation technique 1 (ESC1) can be exploited with the available options, but support for more techniques is planned.

Linux credential extraction with Mimipenguin

Metasploit expanded our post-exploitation capabilities for extracting plaintext credentials on Linux systems by porting the Mimipenguin utility to Metasploit. This allows users to extract credentials for a variety of services from an established Meterpreter session, including the gnome-keyring-daemon, vsftpd and sshd. Under the hood, this functionality uses a new Meterpreter API that allows searching through process memory.

Metasploit plays well with others

This year Metasploit added a few different ways of supporting interoperability with other offensive security tools. First up is the BOF Loader for COFF files, which enables usage of Cobalt Strike’s Beacon Object File format from within the Windows Meterpreter. This extension can also use BOF files written for Sliver. We’ve also made an improvement this year to allow users to bring their own payloads and stages from other tools and formats. If you’re a Sliver user, you can now deploy a Sliver agent as a custom payload stage, and we will use our own Metasploit stagers to upload and run the custom shellcode on the target.

Holiday hacking challenge

Metasploit teamed up with TryHackMe to deliver a challenge as part of their Advent of Cyber event, which ran for the month of December. The Metasploit challenge debuted on December 9 and walked users through a fun Christmas-themed story where they were able to use some of Metasploit’s latest pivoting capabilities. A walk-through is available under Task 9 on the official event page.

Sixth getsystem technique

Metasploit added a new technique to everyone’s favorite Meterpreter command in the middle of 2022 with help from cdelafuente-r7, who incorporated the newest named-pipe impersonation-based technique (the EfsPotato variant). This particular vulnerability affects Windows Vista / Server 2008 and later can be executed entirely in memory to escalate the current session to NT AUTHORITY\SYSTEM without spawning a new process. For more information about this and other getsystem techniques, check out the new module documentation. (Pro tip: Specific techniques can be used by number!)

Post API improvements and maintenance

Community member bcoles made more than 100 pull requests to improve and maintain the post-exploitation API used by Metasploit’s 400+ post modules. This enormous effort is greatly appreciated and has fixed numerous bugs, added new functionality, and made general improvements that benefit both end users and module developers alike. Among those improvements are removing quite a few lingering Meterpreter scripts (which were replaced by post modules in 2011) and adding shell session support for a few enumeration modules. The shell session support is particularly useful when combined with 2021’s payload-less session improvements because it bypasses the need to address evasion with Meterpreter.

New contributors

We would like to thank the community for all the work done this year. Particularly, we want to give a big shout out to the 45 new contributors that added great content to Metasploit. Some of these folks even added modules for celebrity vulnerabilities or flaws that were being actively exploited in the wild, such as Apache Spark RCE (CVE-2022-33891), Spring Cloud Gateway RCE (CVE-2022-22947) or Spring Framework RCE (CVE-2022-22965). We’re grateful to all our contributors for submitting modules that help organizations test their defenses, demonstrate risk, and prioritize mitigations.

New contributor # of modules
h00die-gr3y 5
krastanoel 4
npm-cesium137-io 4
Ayantaker 1
PazFi 1
c0rs 1
giacomo270197 1
jerrelgordon 1
m4lwhere 1
mauricelambert 1
rad10 1
talhakarakumru 1
usiegl00 1
vleminator 1

Others contributed to make Metasploit even better with enhancements, fixes and documentation:

New contributors
3V3RYONE
AtmegaBuzz
EmilioPanti
ILightThings
Invoke-Mimikatz
NikitaKovaljov
ORelio
Ronni3X
VanSnitza
bojanisc
darrenmartyn
dismantl
entity0xfe
erikbomb
flogriesser
kalidor
lap1nou
llamasoft
luisfso
mauvehed
memN0ps
mrshu
namaenonaimumei
nfsec
nzdjb
ojasookert
om3rcitak
r3nt0n
rtpt-alexanderneumann
shoxxdj
ssst0n3
zha0gongz1

New module highlights

  • exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684 – This exploit contributed by community member heyder facilitated unauthenticated code execution on multiple Fortinet products including FortiOS, FortiProxy and FortiSwitchManager.
  • exploit/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144 – Despite having a 2021 CVE, this particular vulnerability, contributed by community member h00die-gr3y, gained attention in 2022 for being an unauthenticated RCE in VMware’s NSX product. Being a deserialization vulnerability, exploitation is smooth and reliable.
  • auxiliary/gather/ldap_query – This new module allows users to gather useful information from an Active Directory Domain Services (AD DS) LDAP server. Metasploit currently includes 28 predefined queries for common actions like enumerating LAPS passwords, computer accounts, and users with configured Service Principal Names (SPNs) for Kerberoasting. Metasploit users can even define their own queries for use with the module.
  • exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc – This module, from community contributor h00die, added in support for CVE-2021-22015. vCenter is frequently targeted by attackers, so h00die’s contribution goes a long way in helping pen testers better assess the security of vCenter servers during their engagements.
  • exploit/linux/http/cisco_asax_sfr_rce – This module was added by jbaines-r7 and incorporated an exploit for CVE-2022-20828 that allows authenticated attackers to gain root-level shells on vulnerable Cisco ASA-X devices with FirePOWER Services enabled. These devices are frequently positioned in sensitive pivots within networks, and are prime targets for attackers, so gaining RCE on these devices often results in access to privileged networks and/or data.
  • exploit/multi/veritas/beagent_sha_auth_rce – This module from community contributor c0rs exploits CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878 in Veritas Backup Exec Agent to bypass authentication and gain remote code execution as SYSTEM/root. This is quite a nice vulnerability since backup agents typically have access to sensitive information, so any compromise of such devices typically leads to access to sensitive company data. Combine this with SYSTEM/root privileges as an unauthenticated remote user, and you have a decent vulnerability for gaining initial access into a network and gaining information to start your pivoting attempts to other segments of that network.

Version 6.2 released

Over the summer, the Metasploit team announced the release of Metasploit Framework 6.2, which included a number of new features. Some of the highlights:

  • A streamlined authentication capturing plugin
  • An SMB 2 and 3-capable file server
  • Improved options for handling NATed services
  • Improved SMB relaying

We’re planning a 6.3 feature release in early 2023, so stay tuned for the next round of new Metasploit capabilities and improvements!

E-Z-2-contribute documentation

As of the 6.2 release, Metasploit has a new, user-contributable docs site at https://docs.metasploit.com/. Want to contribute to Metasploit, but don’t want to monkey around with Ruby or exploit code? We can always use more and better documentation on your favorite Metasploit features, workflows, and improvements. Get in there and help us teach people how hacking works!

From all of us at Rapid7, we wish you a very happy new year. As always, you can get the latest Metasploit updates every Friday in our weekly wrap-up, and you can stay up-to-date on vulnerability intelligence with AttackerKB.

HaXmas Hardware Hacking

Post Syndicated from Tod Beardsley original https://blog.rapid7.com/2021/01/02/haxmas-hardware-hacking/

HaXmas Hardware Hacking

Usually, when you read an IoT hacking report or blog post, it ends with something along the lines of, “and that’s how I got root,” or “and there was a secret backdoor credential,” or “and every device in the field uses the same S3 bucket with no authentication.” You know, something bad, and the whole reason for publishing the research in the first place. While such research is of course interesting, important, and worth publishing, we pretty much never hear about the other outcome: the IoT hacking projects that didn’t uncover something awful, but instead ended up with, “and everything looked pretty much okay.”

So, this HaXmas, I decided to dig around a little in Rapid7’s library of IoT investigations that never really went anywhere, just to see which tools were used. The rest of this blog post is basically a book report of the tooling used in a recent engagement performed by our own Jonathan Stines, and can be used as a starting point if you’re interested in getting into some casual IoT hacking yourself. Even though this particular engagement didn’t go anywhere, I had a really good time reading along with Stines’ investigation on a smart doorbell camera.

Burp Suite

While Burp Suite might be a familiar mainstay for web app hackers, it has a pretty critical role in IoT investigations as well. The “I” in IoT is what makes these Things interesting, so checking out what and how those gadgets are chatting on the internet is pretty critical in figuring out the security posture of those devices. Burp Suite lets investigators capture, inspect, and replay conversations in a proxied context, and the community edition is a great way to get started with this kind of manual, dynamic analysis.

Frida

While Burp is great, if the IoT mobile app you’re looking at (rightly) uses certificate pinning in order to secure communications, you won’t get very far with its proxy capabilities. In order to deal with this, you’ll need some mechanism to bypass the application’s pinned cert, and that mechanism is Frida. While Frida might be daunting for the casual IoT hacker, there’s a great HOWTO by Vedant that provides some verbose instructions for setting up Frida, adb, and Burp Suite in order to inject a custom SSL certificate and bypass that pesky pinning. Personally, I had never heard of Frida or how to use it for this sort of thing, so it looks like I’m one of today’s lucky 10,000.

HaXmas Hardware Hacking

Binwalk

When mucking about with firmware (the packaged operating system and applications that makes IoT devices go), Binwalk from Refirm Labs is the standard for exploring those embedded filesystems. In nearly all cases, a “check for updates” button on a newly opened device will trigger some kind of firmware download—IoT devices nearly always update themselves by downloading and installing an entirely new firmware—so if you can capture that traffic with something like Wireshark (now that you’ve set up your proxied environment), you can extract those firmware updates and explore them with Binwalk.

Allsocket eMMC153 chip reader

Now, with the software above, you will go far in figuring out how an IoT device does its thing, but the actual hands-on-hardware experience in IoT hacking is kinda the fun part that differentiates it from regular old web app testing. So for this, you will want to get your hands on a chip reader for your desoldered components. Pictured below is an Allsocket device that can be used to read both 153-pin and 169-pin configurations of eMMC storage, both of which are very common formats for solid-state flash memory in IoT-land. Depending on where you get it, they can run about $130, so not cheap, but also not bank-breaking.

HaXmas Hardware Hacking

Thanks!

Thanks again to Jonathan Stines, who did all the work that led to this post. If you need some validation of your IoT product, consider hiring him for your next IoT engagement. Rapid7’s IoT assessment experts are all charming humans who are pretty great at not just IoT hacking, but explaining what they did and how they did it. And, if you like this kind of thing, drop a comment below and let me know—I’m always happy to learn and share something new (to me) when it comes to hardware hacking.

More HaXmas blogs

Predicting the Unpredictable: What Will the Cybersecurity Space Look Like in 2021?

Post Syndicated from Bri Hand original https://blog.rapid7.com/2021/01/02/predicting-the-unpredictable-what-will-the-cybersecurity-space-look-like-in-2021/

Predicting the Unpredictable: What Will the Cybersecurity Space Look Like in 2021?

Not to start off another blog post about how insane this year has been, but let’s just take a moment to appreciate HOW INSANE THIS YEAR HAS BEEN. As I sat down to write this blog post, I took a look at last year’s predictions post and was amused (and slightly depressed?) to see how little we knew about what was coming. And while predicting anything these days seems just slightly impossible, we gathered our in-house experts, customers, and industry leaders to take their best bets on what the security sphere will offer up in 2021. Check out their thoughts below!

Reserve Your 2021 Cybersecurity History Calendar

Get Started

Babak Mirzahosseiny, Head of Cyber Security at Greenstone Financial Services

There will be more remote work for sure, as many companies realized they can survive with that, and with the financial pressure on the majority of businesses, they may decide to save some money by reducing the office size and letting people work from home. This means there will be more threats targeting remote workers, and it won’t be surprising if they get more sophisticated, too. Ransomware would continue being on top of the list, but attackers may add more nasty actions to it as well. On the other side, threat intelligence will grow and start playing a more serious role in our day-to-day life.

Tod Beardsley, Director of Research at Rapid7

Okay, I have two predictions. One is pretty pedestrian and short term, one is a little more exotic and has longer-term consequences.

First, I believe that 2021 will be defined by the scams, spam, and phishing centered around COVID-19 vaccines and their availability. Online criminals are well-practiced at capitalizing on natural disasters, and SARS-CoV-2 is the most significant natural disaster of the last 100 years. On top of this, state-backed disinformation and misinformation operations will similarly run wild with COVID-19. I expect to see a million and one campaigns promoting dodgy sources for COVID-19 vaccines and therapeutics, similar to the pharmaceutical spam trade that we see today, as well as campaigns warning against the same. Vaccines for this pandemic are a commodity that have huge demand, limited supply, a nationalistic character, and a nonzero level of suspicion and distrust.

Second, planet Earth now has a critical amount of compute cycles (both traditional and quantum), data creation and ingestion, and bandwidth across long and short distances (fiber and 5G). Because of this, I believe that we will see an emergent artificial intelligence arise from the internet. Further, I expect this superintelligence will have its own, internal subjective set of experiences and ethical framework. It will be unlike anything we’ve ever seen on this planet, namely because this self-ware entity will not be bound by the limitations of a chemical/electric substrate that we see in biological lifeforms. Thanks to a silicon/electronic substrate, it will appear to plan, decide, and act in its own interests extremely quickly, and any attempt to contain it after the fact will be laughably inadequate. I do think we have some chance to coexist with this entity for at least the short term, since it will incidentally be hyper-civilized and unlikely to be needlessly cruel, but we should be preparing ourselves now for this inevitability.

Chad Kliewer, Information Security Officer at Pioneer Telephone Cooperative, Inc.

With everything 2020 threw at us, the human element still comes out as the biggest security threat, but probably not in the way you are thinking. Technical controls will continue to improve, which will force the bad guys and gals to use more social-engineering tactics. As more and more businesses move away from traditional data centers to the cloud, behavior analytics will continue to evolve and play a very important role in identifying compromised credentials. As security professionals, we will need to ensure our co-workers, technical and nontechnical alike, stay aware of the current threats and don’t accidentally give our adversaries a foothold in our socially distanced workplace.

Deral Heiland, IoT Research Lead at Rapid7

With the continued expansion of IoT sensor and actuator technologies that leverage cellular communication, it is highly probable we will start to see new classes of exploits and attacks against cellular-based edge devices, which will have a dramatic impact on critical infrastructure security in 2021.

Kirk Lewis, Information Security Administrator at AmeriBen

I predict an increase in cyberattacks and ransomware, more consolidation within security companies, and more integrations, among others.

Josh Petrucka, Security Analyst at Conexus Credit Union

With more integration on cloud services, we will be focusing on cloud security and CASB. From a threat perspective, I believe the industry will see new ransomware tactics and malware.

Bob Rudis, Chief Data Scientist at Rapid7

Bitcoin is climbing—albeit, erratically—back to its high point back at the cusp of 2018, and neither local municipalities, school districts, healthcare providers, nor many other industries have learned the lessons from 24 months of nigh-continuous ransomware assaults. As such, we can be fairly certain ransomware tactics and techniques will continue to be commoditized and industrialized, and criminals will continue to exploit organizations that are strapped for resources and distracted by attempting to survive in these chaotic times.

2021 will also see a dramatic increase in cure-related phishing attacks as we all desperately hope for a true end to this current global malady. However, as 25% of us are still working sheltered in-place, we can expect to see even more vulnerabilities discovered in remote access technologies with more exploit campaigns taking advantage of them.

Rick Heil, IT Director / InfoSec Officer at MERGE

I think 2021 will bring more social engineering and more scams. As people are looking to digital methods to connect with friends and family, it is inevitable that scammers will take advantage of the shift with their pitches.

Jen Ellis, Vice President of Community and Public Affairs at Rapid7

The United States is firmly in a new era of political discourse in which cyber-espionage, sabotage, and disinformation have a growing impact. This will certainly not end with the 2020 election. Many attacks are seemingly designed to undermine confidence in American societal cohesion and democratic processes, rather than change the outcome of a single election cycle. As a result, the need for strong cybersecurity practices is increasing for lesser-known organizations that affect politics on a more local level, extending well beyond national campaigns, government agencies, or traditional targets of for-profit attacks. How media outlets and social networks report on and disseminate hacked material and cyber-attacks (such as not rushing to attribution and declining to act as a force multiplier for attackers) will also continue taking on growing importance. While these patterns started before 2021, we should expect them from day one in 2021 through the year. Please prepare accordingly.

Galal Nabil, Security Specialist at Fresh Electric for Home Appliances

I think the growth of cybercrimes will increase year by year.

Erick Galinkin, Principal Artificial Intelligence Research at Rapid7

In 2021, the interplay between AI and cybersecurity will be increasingly apparent—security vendors are spending more time and money than ever on specialists in artificial intelligence and data science to mine their data and enhance their products using AI and machine learning. Additionally, development on artificial intelligences for aggregating and correlating security data is rapidly improving. A variety of security companies and researchers are deeply invested not only in using data science generally to build use cases within their products, but also in using natural language processing and other machine learning technologies to improve the ability of their existing products to ingest and integrate information from additional sources.

It’s your turn!

We’d love to know what you’re expecting to see in the coming year, so hit us up on Twitter (@Rapid7) using the hashtag #Rapid7Predicts to share your own predictions. Also, if you’re interested in seeing how our predictions have stacked up in past years, check out our previously published New Years prediction blogs here:

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

Metasploit 2020 Wrap-Up

Post Syndicated from Spencer McIntyre original https://blog.rapid7.com/2020/12/30/metasploit-2020-wrap-up/

Metasploit 2020 Wrap-Up

2020 was certainly an interesting year. There were quite a few newsworthy events and some fantastic exploit content released. Let’s take a look at what 2020 meant for Metasploit.

Quick stats

Some quick statistics for Metasploit’s year.

  • 737 pull requests merged (and counting)
  • A net gain of +179 non-payload modules
  • 50 new Auxiliary modules
  • 134 new Exploit modules
  • 23 new Post modules
  • 2 CTFs hosted
  • 1 new version

Metasploit 6

The Metasploit team released version 6.0 of the framework over the summer. This major change brought quite a few improvements on two fronts: the Meterpreter transport protocol and SMBv3 support for client connections. Both of these offered transport encryption for common operations performed by Metasploit, providing better security for the users. Additionally, to showcase the SMBv3 support, Metasploit added a new module to perform agentless dumping of SAM hashes and LSA secrets (including cached creds) from remote Windows targets. The technique employed by this module has become very popular due to its reliability, and the native integration into the Metasploit Framework makes it easily accessible for users with all the related benefits like database and pivoting support.

CTFs

There were not one but two open CTFs hosted by the Metasploit team in 2020. These events invited the community to solve challenges in a fun and competitive environment. The most recent event included 1,903 users registered across 874 teams.

New module highlights

  • exploit/windows/local/anyconnect_lpe (CVE-2020-3153 & CVE-2020-3433) – This exploit module was an excellent example of a trend of patch bypasses this year. The module is capable of leveraging both the original vulnerability along with the bypass for maximum coverage.
  • exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move (CVE-2020-0787) – This exploit targeted Windows BITS to overwrite a DLL. Exploiting native services included on Windows is always useful, and the technique leveraged here to use the file system operation to obtain code execution was an interesting case.
  • post/multi/gather/enum_software_versions – It’s often important for users to know what is on a system they have compromised. This new module helps make that process simple by enumerating the installed software and their versions, allowing the user to identify interesting entries for exploitation or living-off-the-land techniques.
  • exploit/multi/misc/weblogic_deserialize_badattrval (CVE-2020-2555) – WebLogic is always a valuable target and deserialization vulnerabilities are quite reliable by nature. That combination makes this module particularly useful.
  • exploit/multi/misc/weblogic_deserialize_badattr_extcomp (CVE-2020-2883) – Another more recent WebLogic RCE that makes use of deserialization. Similar to CVE-2020-2555, this module is equally useful.
  • exploit/windows/local/cve_2020_0668_service_tracing (CVE-2020-0668) – Users can never have enough Windows LPE exploits, and this module offered another reliable vector. This module uses a simple DLL-based technique to obtain code execution from a file system operation.

SharePoint

Metasploit added its first exploits for the popular SharePoint platform since 2010. Four exploit modules were added, three leverage XML injection flaws while the fourth targets a server side include. These exploits leverage .NET deserialization to execute operating system commands, avoiding any kind of memory corruption and making exploitation relatively reliable. The .NET deserialization gadgets leveraged by these modules were also new in 2020. This functionality came in the form of a new library that even includes a command line tool for generating gadget chains for researchers.

Over the course of the year, there were some interesting patterns that were observable. In general, there seemed to have been an increase in vulnerabilities that were disclosed and related to an insufficient remediation for a previous vulnerability. These so-called patch bypasses seem to be indicative of the increasing complexity of vulnerabilities and their respective solutions. Additionally, there were multiple exploits added to Metasploit that leveraged vulnerable file system operations to obtain code execution on Windows. These LPEs used a combination of techniques that are becoming increasingly common including op-locks and junctions. Metasploit is working on better support for these primitives to facilitate exploitation of vulnerabilities that use them.

With all that the project accomplished in 2020, the team looks forward to what 2021 will hold. New features are being discussed, and as always, the module pipeline continues to flow. Our sincere gratitude goes to all the members of the community that contributed to the project this year.

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

Taking Inspiration from Our Security Nation in an Otherwise Uninspiring Year

Post Syndicated from Jen Ellis original https://blog.rapid7.com/2020/12/28/taking-inspiration-from-our-security-nation-in-an-otherwise-uninspiring-year/

Taking Inspiration from Our Security Nation in an Otherwise Uninspiring Year

Well, what a year it has been. I won’t waste your time by recapping the many, many difficulties that 2020 has offered us, and instead, I will try to take a slightly different tack. While it has been a challenging (for some, truly hellacious) year, as we close it out, I’ve been trying out a little “Life of Brian” thinking and “looking on the bright side of life.”

I’m fortunate to be able to say that for me, 2020 was not all bad, in part due to the security community with whom I work every day and who have inspired me throughout the year. I’m lucky to be in a position to hear about many of the amazing things this community does, and in particular, I am grateful that I get to interview people for the Security Nation podcast, hearing about and helping share their amazing stories. In reflection of this, I’d like to share some of my own 2020 highlights and thank the community behind them. I’ve also invited some of our 2020 Security Nation guests to also share their highlights from the year.

Reserve Your 2021 Cybersecurity History Calendar

Get Started

Me first!

This is my blog post, so I’m going to share my highlights first 🙂 As I mentioned above, it all kind of comes down to the security community for me.

I’ll start with the security community’s response to the pandemic. We quickly saw the emergence of various volunteer efforts—for example, the CTI League and Cyber Threat Coalition formed in response to COVID-themed attacks. The people participating in these efforts mostly did so on their own time and dime to try to keep others safe during a truly difficult time. As has been much commented on, never has cybersecurity been more important than during a time when both critical health services and the economy at large were suddenly extremely reliant on the internet to function. To those security volunteers that helped make this increased reliance on the internet safer, thank you for everything you did and continue to do!

This volunteering spirit was reflected in our first Security Nation podcast episode of the year, which featured an interview with the amazing Chris Hadnagy, who shares his year’s highlights below. Chris joined us to talk about the Innocent Lives foundation, the nonprofit he founded to help tackle the issue of child exploitation on the internet. Hearing Chris talk about ILF and the work they are doing was incredibly moving and inspiring. If you haven’t done so, I encourage you to check out both the interview and the ILF website.

And speaking of Security Nation, the final 2020 highlight I will share with you is that being the host of this podcast is truly a privilege. Not because I get to inflict my questionable sense of humor and lack of articulation on unwitting listeners (that’s just a side perk), but because every episode we interview “someone cool doing something interesting to advance security.” Or some episodes, it’s someone interesting doing something cool to advance security. There may be some recurring themes here.

The point is that these people are amazing (wow, I found another adjective) and they are doing inspirational things. And there are a LOT of them. In fact, there’s kind of a whole Nation of them <cough cough>. The work they are doing differs depending on their role and area of focus, but their dedication and passion unites them and inspires me. Having the chance to learn from them and help them share their stories is truly something for which I am grateful.

The Security Nation podcast was started by my friend and former Rapid7er, Kyle Flaherty. When, some time after Kyle had moved on, I first started talking about hosting a podcast to showcase the huge diversity of effort and evolution being made in security, we searched for a new name to differentiate ourselves, but I couldn’t get away from this idea that we are all a nation—diverse in so many ways, but unified by a desire to drive security forward and protect others. We kept the name, I owe Kyle some drinks, and it has been my great honor to get to meet and interview the various members of this great Security Nation since.

So, as I look back on a stressful year, I am so grateful to all the amazing people working tirelessly to move security forward, and even more so, to have been able to share the stories and successes of some small number of them. A few of this year’s Security Nation guests have also shared their 2020 highlights below. Here’s to hoping 2021 will be an improvement and offer even more highlights!

Tod Beardsley, Security Nation Co-Host

Tod is Rapid7’s director of research and also my co-host for Security Nation. Importantly, he is The One That Actually Knows Things, which balances me out quite nicely. As well as keeping me on the straightish and narrowish in interviews, he also leads the “Rapid Rundown” section, where he provides his point of view on the main security news of the time.In sharing his highlights, Tod shamelessly hijacked this blog to promote his other podcasts:

Not to play me-too too much, but hosting Security Nation through 2020 has been a real career highlight for me—while we’ve been technically producing this podcast since the summer of 2019, I feel like it was this year we really hit our groove, thanks in large part to the Herculean (or Amazonian?) efforts of Bri Hand, our producer, and of course my co-host, Jen Ellis.

In fact, I’ve had so much fun working on this podcast, I’ve gotten myself in two others! Starting in 2021, I’ll be a regular on a brand-new podcast from the CVE Project, called “We Speak CVE,” wherein we talk about all sorts of issues and topics around vulnerability disclosure and enumeration and assignments of IDs and all that super deep-in-the-weeds technocratic stuff about CVE. We’ve got one or two episodes in the can right now, but no link for public downloads yet, so keep an eye out for that.

Almost wholly unrelated is another podcast that I started in the spring of 2020, mostly as a pandemic isolation hobby. It’s called “Podsothoth: A Lovecraft Book Club,” and in it, I read-slash-perform horror and science fiction stories written a hundred years ago by H.P. Lovecraft, and also talk about things related to those stories with my lovely and insightful wife, Claire Reynolds. You should listen to it. It’s so very gothnerdy and a nice break from the current state of affairs.

In other, non-podcast-related news, I got myself even more involved in election security, which is both personally and professionally important to me. That kicked off in earnest at my first-ever speaking engagement at ShmooCon, along with Casey Ellis, Kimber Dowsett, Amélie E. Koran, and Jack Cable, which was super fun and hopefully enlightening. There was a lot of doom considered, but also a lot of positivity and real-talk about the state of affairs in election-land. This ended up being so well-received that we revisited the topics at DEF CON’s Voting Village, which you can watch here (my part was recorded in my then-new isolation office in my garage), and we four still chat among ourselves and help keep each other sane through the news cycles.

Through these and other efforts through the year, I like to think that I helped a little bit (along with thousands of other election workers across the country) to make the Nov. 3, 2020 election “the most secure in American history,” to quote Chris Krebs at CISA.

Bri Hand, Security Nation Producer

Bri is the great unsung hero of the podcast, as she is the one that actually makes it happen and puts all the work in. She’s not as loud and opinionated as Tod and me (mostly me), but without her, there really would be no episodes making it to the internet.

I am the type of person who measures my success at work in how much I’ve learned and grown—and I have done a lot of both this year! After realizing that my current approach of learning about cybersecurity through blog-editing osmosis wasn’t quite cutting it, I signed up for an introductory course with IBM to experience the space in more of a classroom setting. The result was surprising. I realized simultaneously that I knew a lot more than I was giving myself credit for and that I would never know everything there is to know about the space—and that’s okay! Take that, imposter syndrome!

I also added “animated video” to my repertoire of content types, since shooting anything in person this year was obviously off the table. Writing and producing our “This One Time on a Pen Test” series and “Elf on the Stealth” HaXmas video was an absolute blast!

As always, I’m also so grateful to be able to work across Rapid7 and beyond to compile and share information out with the security community. Whether it was copyediting all 150 pages of our NICER report, publishing important news content about critical vulnerabilities, helping our Security Nation guests share their inspiring stories, or editing COVID cybersecurity safety blogs from the Orlando Airport on March 15 as I fled my ill-timed vacation, I feel especially privileged in my role here.

And while I won’t pretend that 2020 wasn’t the weirdest year of my life, on a personal level I have greatly appreciated the opportunity to slow down a bit and take stock of what really matters. It’s cheesy, but it’s true. Ditching my daily two-hour commute in favor of a much more manageable five-second one has freed me up to focus on activities that make me an all-around happier and better person—going on walks with my dog, flinging my limbs around in virtual Zumba, cooking, reading, and writing. This joy has easily bled into my work life, and I am now more of an advocate than ever on having work-life balance and not wearing burnout as a badge of honor.

Chris Hadnagy, Chief Human Hacker, Social-Engineer.com

As well as running Social-Engineer.com, Chris is also the founder of the Social Engineering Village and various conferences, author of numerous books, an adjunct professor at the University of Arizona, and founder and CEO of the Innocent Lives Foundation. Like many of the folks that come on Security Nation, I have no idea how Chris fits everything in—I’m tired just writing it all out!

Chris’ interview was published on Jan. 27, 2020, kicking off the year for Security Nation. He came on to tell us about the amazing work that he and many other security professionals are doing at Innocent Lives Foundation, working to combat online child exploitation.

In reflecting on 2020, Chris shared the following:

2020 was a year of personal and professional growth for me and my company. We grew more in 2020 than any previous year and we developed new and innovative ways to help secure our clients. I was also about to transfer a class I never thought could be taught online to a fully digital format and got great reviews on it. Overall, I am leaving 2020 with many things learned and new appreciation for the wonderful relationships that have helped me through the year.

Stephanie Helm, Director, MassCyberCenter

Stephanie runs the MassCyberCenter, which is tasked with building cyber resilience for Massachusetts, and establishing Massachusetts as a center for cybersecurity talent and development.

She joined us on the podcast—published on April 16, 2020—to share with us the progress her team has been making in building cybersecurity capabilities in municipalities across Massachusetts. When we recorded the interview, it was just starting to be clear that telehealth and remote working would be super important in 2020, and local government would play a critical role.  

Stephanie and the MassCyberCenter had a number of impressive highlights to call out for the year:

‘Tis the week before Christmas and MassCyberCenter is counting a surprising number of blessings, despite all the craziness in the world. Building on our partnership with the Cyber Resilient Massachusetts Working Group, this summer we virtually held a series of workshops on Cyber Incident Response Planning. We transitioned the Massachusetts Cybersecurity Month to a virtual extravaganza of cybersecurity education events plus a campaign of awareness addressing Life’s Work at Home!  Finally, we established a Cybersecurity Mentorship Program, focusing on matching diverse cybersecurity college students with cybersecurity professionals.  The pilot program wrapped up on Dec. 14 with an announcement that we will be able to continue an expanded version of the program in the spring. A very exciting achievement to promote an inclusive and talented cybersecurity workforce in Massachusetts. With our partners in cybersecurity, we hope 2021 will demonstrate improved resiliency within the state! Best wishes for a Happy New Year!

Katie Moussouris, CEO, Luta Security

2020 was a big year for Katie. Not only did her company, Luta Security, grow hugely, but Katie was also able to spend time raising awareness of, and support for, the need for equality in pay and better hiring and employment practices. Katie has been vocal about practicing what she preaches, sharing a number of the policies Luta has to build employee satisfaction and wellness.

Katie is a world-renowned expert on vulnerability disclosure, and she shared some of this incredible expertise with us during her interview, which was published on June 9, 2020. She also touched on the impact of the pandemic on security and her plans to tackle pay inequality. As you can see from her 2020 highlights, she made some serious strides in the latter.

This year has been full of surprises. A highlight for me was bringing my attempted class action gender discrimination lawsuit against Microsoft to an end in favor of starting the Pay Equity Now Foundation and the law center named after my late mother. This pandemic has revealed the truly insidious disparity between classes. It’s had a disproportionate effect on women and people of color, both health-wise and economically. We can choose to continue the current trajectory of pay equity for women in 50–205 years, depending on race, or we can decide together to fix it. Those on the right side of history are taking action and taking the Pay Equity Now Pledge. If 2020 taught us anything, it’s that we’re all in this together, and that massive changes can happen in the workplace overnight. Let’s prioritize pay equity as one of them.

Christian Wentz, CEO, CTO and Founder, Gradient

Christian is another one of those guests that makes me feel like I have done nothing with my life —a serial entrepreneur that made the transition from from an electrical-engineering-applied-to-neuroscience background to founding Gradient Technologies, a company that is “building a trust fabric for the connected world.” So he’s tackling the small stuff, then.

During his interview—published on Sept. 25, 2020—Christian talked about his approach to building technology solutions that support a zero-trust approach. It sounds like 2020 has been a decent year for them, despite all the challenges.

In 2020, we grew our Boston office and expanded west with a beautiful San Francisco office, only to have a global pandemic push us to remote work. So, we’ve decided to turn this dumpster fire of a year into a 900-degree inferno for late-night rooftop pizzas to welcome our customers, partners, and Rapid7 friends in person. See you all in 2021!

So, this just leaves me to make an awkward sign-off, much as I do on every episode of the podcast. As usual, I will end with thanks, this time to all our wonderful 2020 guests and lovely listeners. If you are interested in subscribing to the podcast, you can do it here. If you would like to share your own 2020 highlights, please add a comment to the blog. Happy holidays!

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

Rapid7 Labs’ 2020 Naughty List Summary Report to Santa

Post Syndicated from boB Rudis original https://blog.rapid7.com/2020/12/25/rapid7-labs-2020-naughty-list-summary-report-to-santa/

Rapid7 Labs’ 2020 Naughty List Summary Report to Santa

As requested, your dutiful elves here at Rapid7 Labs have compiled a list of the naughty country networks being used to launch cyberattacks across the globe. Needless to say, some source networks have been very naughty (dare we use the word “again,” since these all seem to be repeat offenders).

To make it easier to digest, we’ve broken the list out into three categories:

  • Naughty Microsoft SQL Server attacks
  • Naughty Microsoft Remote Desktop Protocol (RDP) attacks
  • Naughty Microsoft SMB attacks

These are focused on the top offenders for the last half of the year, and provide a smoothed trending view (vs. discrete daily counts) in each one to help you make your Naughty/Nice inclusion decisions.

Naughty Microsoft SQL server attacks

Hopefully you do not maintain your lists on publicly accessible Microsoft SQL servers, as they are regular targets for attackers who have their evil designs on them, with a major focus on using them for cryptocurrency mining this year.

Rapid7 Labs’ 2020 Naughty List Summary Report to Santa

Source Country Network Median Daily MSSQL Attack Interactions
China 147,677
United States 12,984
India 7,159
Brazil 8,984
Russia 7,031

A massive botnet operating from before the fall of 2019 and early 2020 abruptly stopped operations just before summer, and MS SQL server credential and query attack types have leveled off to previous baseline levels. The enduring lesson from measuring these interactions is for all the grown-up kids out there to never, ever put any database like MS SQL on the public internet. Unfortunately, you can read an excerpt from our other report that found nearly 100,000 of them earlier this year (perhaps the offenders on that list would be better placed on the naughty list?).

Naughty Microsoft Remote Desktop Protocol (RDP) attacks

We were sorry to hear that even your own factory had to observe remote-work protocols starting in March, but we hope your IT department did not have to resort to enabling direct Microsoft Remote Desktop Protocol (RDP) access, since it has been the target of a massive increase in discovery and credential stuffing attacks the last quarter of this year.

Rapid7 Labs’ 2020 Naughty List Summary Report to Santa

Source Country Network Median Daily RDP Attack Interactions
Russia 41,515
United Kingdom 23,337
United States 32,840
Germany 2,832
France 12,802

Naughty traffic levels started just before the presidential election in the United States and further increased in size toward the end of the year.

RDP-targeted ransomware has been a fairly huge problem this year, with many nefarious attackers setting their sights on overworked and under-resourced healthcare, education, and municipal targets.

It might be worth taking some time to remind your elves in IT that it’s not a good idea to put RDP services directly on the internet. While another of our reports earlier this year did not find any RDP nodes coming from the North Pole autonomous system, it is possible we didn’t inventory your network on a day they did. As you know, it’s best to put RDP servers behind a dedicated (and properly configured) Microsoft RDP Gateway server or—better yet—a multifactor virtual private network (VPN).

The majority of the malicious RDP traffic coming from the U.K., U.S., and Germany appear to be the work of one or two groups who should also be considered candidates for the naughty list.

Naughty Microsoft SMB attacks

Rapid7 Labs’ 2020 Naughty List Summary Report to Santa

Source Country Network Median Daily SMB Attack Interactions
Vietnam 4,206,475
India 2,137,146
Russia 2,055,072
Brazil 1,478,000
Indonesia 1,420,109

Last, we lament the need to report a renewed uptick in EternalBlue-infused attacks against internet-accessible Microsoft SMB servers. The vast majority of source nodes involved with these attacks are part of the various Mirai-like botnets that use both traditional compromised server hosts and (mostly) “internet of things” devices such as cameras, DVRs, and other business and home automation devices to coordinate and orchestrate attacks.

Might we be so bold as to suggest that you hold off—at least this year—distributing rebranded white-box electronics components to the folks on the Nice list? If you do insist on giving out home automation presents this year, please make sure the programmer elves follow the guidance in the IoT Security Foundation’s Security Compliance Framework to guard against adding more nodes to these naughty botnets.

If you’re wondering why attackers are still looking for SMB servers, you can see for yourself that there are still hundreds of thousands of them out on the internet to connect to. We’re just glad you switched to using a secure file transfer service to exchange documents (like this one!) with all your partner elves.

Glad tidings `til next year!

We hope you, Mrs. Claus, the elves and all the reindeer stay safe and socially distanced. We’ll make sure to leave the cookies and bourbon milk in the usual place.

Happy Holidays from all the Elves in Rapid7 Labs!

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

Top Security Recommendations for 2021

Post Syndicated from Justin Turcotte original https://blog.rapid7.com/2020/12/24/top-security-recommendations-for-2021/

Top Security Recommendations for 2021

Happy HaXmas! We hope everyone is having a wonderful holiday season so far. This year has been wild and unpredictable, and has brought unique risks and threats to the forefront of business activities. So, to help everyone stay safer in 2021, the Strategic Advisory Services team here at Rapid7 is going to share some security recommendations going into the new year to help you better secure your business and minimize risk.

Reserve Your 2021 Cybersecurity History Calendar

Get Started

Governance around remote work and work from home

When the pandemic hit, many companies found they lacked governance around remote work and mobile devices because they hadn’t facilitated that type of work in the past. Many companies were—and still are—resistant to change and averse to work-from-home opportunities for their employees.

If you find yourself in that position, consider implementing policies for acceptable use around remote work, mobile devices, and bring-your-own-device (BYOD). Having these policies and measures in place will help ensure employees are aware of what is and is not acceptable use of company assets or networks, what their responsibilities are, and organizational expectations and processes.

Mobile device management

Mobile device management is key when it comes to implementing work-from-home security measures. Without the ability to manage and protect remote endpoints, the risk is higher that your company network could be compromised by an unsecured system utilizing a VPN to access company networks. Additionally, ensure you have controls in place to limit corporate VPN access to corporate-owned and -controlled devices—you don’t know (and probably don’t want to know!) what is lurking on systems that may not be protected from internet threats.

Consider vulnerability management, antivirus, and anti-malware tools as primary requirements for corporate endpoints in the wild. Many companies haven’t had the ability to update antivirus on systems that aren’t connected to the company network or patch those same systems when not connected. Utilizing cloud-based solutions that can be updated remotely without first needing a VPN connection to the company network is ideal in the post-pandemic world.
Rapid7’s InsightVM tool can give you the cloud-based vulnerability management capabilities that you need to assess remote corporate endpoints.

Securing VPN connections

How many companies were caught without an operational client VPN option when the lockdowns went into effect? Many customers that we have spoken to during the pandemic had to rush to implement VPN solutions, whether that was a client-based VPN or some type of SSL VPN solution, to allow employees the ability to work from home.

While implementing these VPN solutions, many customers opted for the get-it-working approach and failed to secure those VPN entry points as well as they should have. One way of ensuring VPN connections are protected is to require users to use multi-factor authentication (MFA) to remotely log in to the company network. This will help to protect VPN accounts from compromise by adding a layer to the authentication process.

Having a pre-authentication check for security compliance on your VPN connections will also help ensure systems that are not properly configured or contain a vulnerability are not able to connect to the company network without the issue being remediated. This will help lessen the exposure of the company network through poorly secured remote endpoints. These capabilities are provided by many VPN solution and network access control solution providers.

Securing data in the cloud

We have seen many of our customers making the move to the cloud, using solutions like Amazon Web Services (AWS), Microsoft Azure, and Google Cloud.

Securing your data in the cloud is key, even when there is not an ongoing pandemic. Ensure that your cloud infrastructure is secured and well protected from possible attack or compromise. While the security of the cloud platform is the responsibility of the provider, the security of the systems and data that you place in the cloud is your responsibility, and no one else is going to do it for you.

A strong identity access management (IAM) program implemented for your cloud systems can help you control permissions to resources and help prevent data loss or theft.

It’s extremely important to monitor your cloud deployments so you can detect any suspicious or anomalous behavior or activity. Can you detect a brute force attack in your cloud environment? Can you detect suspicious behavior in a timely fashion? If not, look at Rapid7’s InsightIDR tool to give you that capability, and much more.

Validating protective measures

The validation of protective measures should be performed regardless of whether we are responding to a pandemic, but it is important even more now than ever before. Many security and IT teams have deployed new solutions and measures to provide for their remote employees and have been busy responding to these new requirements during the pandemic.

Now that we are into eight months or more of working from home and social distancing, companies should begin the process of testing their protective measures and newly deployed security tools. This can be done through red, blue, or purple teaming or engaging third-party penetration testing teams to help ensure your newly deployed systems are protecting the network and remote endpoints as you believe them to be.

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

Metasploit Tips and Tricks for HaXmas 2020

Post Syndicated from Alan David Foster original https://blog.rapid7.com/2020/12/23/metasploit-tips-and-tricks-for-haxmas-2020-2/

Metasploit Tips and Tricks for HaXmas 2020

For this year’s HaXmas, we’re giving the gift of Metasploit knowledge! We’ll cover a mix of old, new, or recently improved features that you can incorporate into your workflows. Some of our readers may already know these tips and tricks for using Metasploit, but for the others who aren’t aware of them, it’s your lucky day!

Debugging failed HTTP Modules

There’s nothing more upsetting than not getting a Meterpreter session due to the misconfiguration of module options. I have found that the quickest way to sanity-check failed HTTP Modules is to set the HTTPTrace option to true before running your module:

set HTTPTrace true

This will enable the logging of raw HTTP requests and responses:

msf6 > use scanner/http/title

msf6 auxiliary(scanner/http/title) > set RHOSTS 127.0.0.1

RHOSTS => 127.0.0.1

msf6 auxiliary(scanner/http/title) > set HttpTrace true

HttpTrace => true

msf6 auxiliary(scanner/http/title) > run

####################

# Request:

####################

GET / HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

####################

# Response:

####################

HTTP/1.0 200 OK

Server: SimpleHTTP/0.6 Python/2.7.16

Date: Wed, 16 Dec 2020 01:16:32 GMT

Content-type: text/html; charset=utf-8

Content-Length: 178

<!DOCTYPE html PUBLIC “-//W3C//DTD HTML 3.2 Final//EN”><html>

<title>Directory listing for /</title>

<body>

<h2>Directory listing for /</h2>

<hr>

<ul>

</ul>

<hr>

</body>

</html>

[+] [127.0.0.1:80] [C:200] [R:] [S:SimpleHTTP/0.6 Python/2.7.16] Directory listing for /

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

msf6 auxiliary(scanner/http/title) >

This is a great way to quickly see why your modules have failed. In some scenarios, you may find that you’ve simply forgotten to specify the TARGETURI or VHOST options correctly, and after rerunning the module, you might even have a session.

Inline run options

Did you know that you can inline Metasploit’s options when running a module? When paired with your terminal’s reverse-i-search ctrl+r capabilities, it can be a real time-saver when wanting to rerun Metasploit modules again with the same options:

msf6 > use scanner/http/title

msf6 auxiliary(scanner/http/title) > run RHOSTS=127.0.0.1

[+] [127.0.0.1:80] [C:200] [R:] [S:SimpleHTTP/0.6 Python/2.7.16] Directory listing for /

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

msf6 auxiliary(scanner/http/title) >

Providing inlined options can also be useful for quickly enabling the HttpTrace functionality or verbose mode of a module:

msf6 auxiliary(scanner/http/title) > run HttpTrace=true VERBOSE=true

####################

# Request:

####################

GET / HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

####################

# Response:

####################

HTTP/1.0 200 OK

Server: SimpleHTTP/0.6 Python/2.7.16

Date: Wed, 16 Dec 2020 01:16:32 GMT

Content-type: text/html; charset=utf-8

Content-Length: 178

<!DOCTYPE html PUBLIC “-//W3C//DTD HTML 3.2 Final//EN”><html>

<title>Directory listing for /</title>

<body>

<h2>Directory listing for /</h2>

<hr>

<ul>

</ul>

<hr>

</body>

</html>

[+] [127.0.0.1:80] [C:200] [R:] [S:SimpleHTTP/0.6 Python/2.7.16] Directory listing for /

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

msf6 auxiliary(scanner/http/title) >

This year, we improved on these capabilities even further, thanks to this pull request. Metasploit now supports tab completion for both option names and values, too! Just use the tab key on your keyboard and you’ll be good to go:

set <tab><tab>

set RHOSTS=<tab><tab>

Note that this is a lesser-used piece of Metasploit’s functionality, so if you run into any issues, be sure to create an issue and send the details our way.

Quickly interacting with new sessions

Metasploit provides support for quickling interacting with the most recently created session by using a session ID of -1, for instance:

msf6 > sessions -i -1

[*] Starting interaction with 4…

Note that this trick also works when running post modules:

use modules/post/multi/manage/screenshare

set SESSION -1

set SRVHOST vmnet8

set URIPATH /

run

But wait, there’s more! Thanks to this pull request a few years ago, you can save additional characters by omitting the -i flag when you want to interact with a session:

msf6 > sessions -1

[*] Starting interaction with 4…

meterpreter > sessions 1

[*] Backgrounding session 4..

[*] Starting interaction with 1…

Skipping msfvenom’s boot time

Name a more iconic duo than msfvenom and exploit/multi/handler. I’ll wait.

In the meantime, though, did you know that you can generate payloads and create handlers without even leaving the Metasploit console? Just open up Metasploit and run through the payload generation and handler creation steps directly from the payload module:

# Use the payload module:

use windows/meterpreter/reverse_https

set LHOST 127.0.0.1

set LPORT 4443

set SessionCommunicationTimeout 0

set ExitOnSession false

# Create the executable, as an alternative to msfvenom:

generate -o reverse_windows.exe -f exe

# Create a handler, as an alternative to exploit/multi/handler

to_handler

We’ve found that this workflow can be faster in comparison to using msfvenom directly, which can be slow in comparison to a warmed-up Metasploit console.

Resource scripts

Resource scripts are great for streamlining your repetitive workflows. For instance, if we wanted to turn the above workflow of "using a module, generating a particular payload, and creating a handler" into a reusable resource script, simply create a file my_workflow.rc with the commands that you’d like to run:

➜ cat my_workflow.rc

use windows/meterpreter/reverse_https

set LHOST 127.0.0.1

set LPORT 4443

set SessionCommunicationTimeout 0

set ExitOnSession false

generate -o reverse_windows.exe -f exe

to_handler

Running a resource file from the command line is simple—just use the resource command. Metasploit will load this file, then execute each line one at time:

msf6 > resource /example/my_workflow.rc

[*] Processing /example/my_workflow.rc for ERB directives.

resource (/example/my_workflow.rc)> use windows/meterpreter/reverse_https

resource (/example/my_workflow.rc)> set LHOST 127.0.0.1

LHOST => 127.0.0.1

resource (/example/my_workflow.rc)> set LPORT 4443

LPORT => 4443

resource (/example/my_workflow.rc)> set SessionCommunicationTimeout 0

SessionCommunicationTimeout => 0

resource (/example/my_workflow.rc)> set ExitOnSession false

ExitOnSession => false

resource (/example/my_workflow.rc)> generate -o reverse_windows.exe -f exe

[*] Writing 73802 bytes to reverse_windows.exe…

resource (/example/my_workflow.rc)> to_handler

[*] Payload Handler Started as Job 2

By default Metasploit will run any resource scripts found within its config directory at ~/.msf4/msfconsole.rc, or you can even specify resource scripts to be run when msfconsole starts up. This can be useful for setting options such as global logging, or default LHOST values:

msfconsole -r /example/my_workflow.rc

Writing resource scripts can sometimes be a chore, which is why Metasploit also provides the ability to save recently executed commands directly to a specified resource script location:

# Viewing the makerc command usage:

msf6 > help makerc

Usage: makerc <output rc file>

Save the commands executed since startup to the specified file.

# Saving the last commands to reusable resource script:

msf6 > makerc example.rc

[*] Saving last 4 commands to examplerc …

For the power users of Metasploit, resource scripts also support the ability to run arbitrary Ruby code. This functionality makes it possible to interact directly with Metasploit’s Framework object programmatically:

use windows/meterpreter/reverse_https

&ltruby>

# Run arbitrary ruby code which can interact with the Metasploit framework object

puts “Currently running with Metasploit version: #{framework.version}!”

&lt/ruby>

If you didn’t know, there’s also a treasure trove of hidden resource scripts buried deep within Metasploit Framework repository that you may not be aware of: https://github.com/rapid7/metasploit-framework/tree/master/scripts/resource.

Refining search results

This year, we made improvements to the search functionality of Metasploit. Specifying additional search terms will now continue to refine your search results.

Previously, when using the command search postgresql login, all modules matching either postgresql or login would be returned:

msf6 > search postgresql login

Matching Modules

================

# Name Disclosure Date Rank Check Description

– —- ————— —- —– ———–

0 auxiliary/admin/appletv/appletv_display_image normal No Apple TV Image Remote Control

1 auxiliary/admin/appletv/appletv_display_video normal No Apple TV Video Remote Control

… many modules later …

248 post/windows/manage/sticky_keys normal No Sticky Keys Persistance Module

249 post/windows/manage/wdigest_caching normal No Windows Post Manage WDigest Credential Caching

Interact with a module by name or index, for example use 249 or use post/windows/manage/wdigest_caching

Now with the newly updated search command running search postgresql login – Metasploit will only return modules matching both postgresql and login:

msf6 > search postgresql login

Matching Modules

================

# Name Disclosure Date Rank Check Description

– —- ————— —- —– ———–

0 auxiliary/scanner/postgres/postgres_login normal No PostgreSQL Login Utility

Interact with a module by name or index, for example use 0 or use auxiliary/scanner/postgres/postgres_login

This functionality works well with the search keywords, too:

msf6 > search cve:2020 type:aux tomcat ghostcat

Matching Modules

================

# Name Disclosure Date Rank Check Description

– —- ————— —- —– ———–

0 auxiliary/admin/http/tomcat_ghostcat 2020-02-20 normal No Ghostcat

Interact with a module by name or index, for example use 0 or use auxiliary/admin/http/tomcat_ghostcat

Developing modules?

There are lots of great workflow capabilities built into Metasploit for our users, but there’s also a few useful tricks for developers!

Let’s start our journey with file reloading. It turns out that the best improvement to a developer’s productivity is the ability to reload files in Metasploit without having to close and reopen it. As a result, these commands will save you a lot of time:

  • reload: Reload the latest version of the active module from the file system.
  • reload_lib -a: Reload any changed files that are in your current Git working tree, other than modules. This is perfect for changing core library files.
  • reload_all: Reload all modules from all configured module paths.

There are also a few extra commands that you might find useful when modifying a developing a new Metasploit module:

  • rerun: After reloading the module the currently active module, run the run command.
  • recheck: After reloading the currently active module, run the check command.
  • edit: Edit the currently open module within your local editor. This can also edit arbitrary files edit <file_path>.

Finally, placing a breakpoint in your code can be a great way to immediately get to the root cause of issues. Just place the following snippet wherever you wish to enter into an interactive debugging environment:

require ‘pry’; binding.pry

This will pause the execution of the currently running code code when the breakpoint is hit:

Metasploit Tips and Tricks for HaXmas 2020

There are a lot of useful commands to help explore the issue from here, for instance:

  • backtrace: Show the current call stack
  • up / down: Navigate the call stack
  • step: Move forward by a single execution step
  • next: Move forward by a single line
  • whereami: Show the current breakpoint location again
  • help: View all of the available commands and options

Ruby’s runtime introspection can also be great to help with debugging. This will help you explore the available methods, classes, and variables within the current Ruby environment:

  • self: To find out what the current object is
  • self.methods: Find all available methods
  • self.methods.grep /send/: Searching for a particular method that you’re interested in. This can be great to explore unknown APIs.
  • self.method(:connect).source_location: Find out which file, and which line, defined a particular method
  • self.class.ancestors: For complex modules, this can be useful to see what mixins a Metasploit module is currently using

Even more tips!

Did you know that the Metasploit console has an inbuilt tips command? It will show you even more useful workflow tips to check out! See any tips that we’re missing? Simply create a pull request to help us improve the list:

Metasploit Tips and Tricks for HaXmas 2020

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

UPnP With a Holiday Cheer

Post Syndicated from Deral Heiland original https://blog.rapid7.com/2020/12/22/upnp-with-a-holiday-cheer/

UPnP With a Holiday Cheer

T’was the night before HaXmas,
when all through the house,
Not a creature was stirring, not even a mouse.
The stockings were hung by the chimney with care,
in hopes that St. Nicholas soon would be there.

This may be the way you start your holiday cheer,
but before you get started, let me make you aware.
I spend my holidays quite differently, I fear.
As a white-hat hacker with a UPnP cheer.

And since you may not be aware,
let me share what I learned with you,
so that you can also care,
how to port forward with UPnP holiday cheer.

Universal Plug and Play (UPnP) is a service that has been with us for many years and is used to automate discovery and setup of network and communication services between devices on your network. For today’s discussion, this blog post will only cover the port forwarding services and will also share a Python script you can use to start examining this service.

UPnP port forwarding services are typically enabled by default on most consumer internet-facing Network Address Translation (NAT) routers supplied by internet service providers (ISP) for supporting IPv4 networks. This is done so that devices on the internal network can automate their setup of needed TCP and UDP port forwarding functions on the internet-facing router, so devices on the internet can connect to services on your internal network.

So, the first thing I would like to say about this is that if you are not running applications or systems such as internet gaming systems that require this feature, I would recommend disabling this on your internet-facing router. Why? Because it has been used by malicious actors to further compromise a network by opening up port access into internal networks via malware. So, if you don’t need it, you can remove the risk by disabling it. This is the best option to help reduce any unnecessary exposure.

To make all this work, UPnP uses a discovery protocol known as Simple Service Discovery Protocol (SSDP). This SSDP discovery service for UPnP is a UDP service that responds on port 1900 and can be enumerated by broadcasting an M-SEARCH message via the multicast address 239.255.255.250. This M-SEARCH message will return device information, including the URL and port number for the device description file ‘rootDesc.xml’. Here is an example of a returned M-SEARCH response from a NETGEAR Wi-Fi router device on my network:

UPnP With a Holiday Cheer

To send a M-SEARCH multicast message, here is a simple Python script:

# simple script to enumerate UPNP devices
 
import socket
 
# M-Search message body
MS = \
    'M-SEARCH * HTTP/1.1\r\n' \
    'HOST:239.255.255.250:1900\r\n' \
    'ST:upnp:rootdevice\r\n' \
    'MX:2\r\n' \
    'MAN:"ssdp:discover"\r\n' \
    '\r\n'
 
# Set up a UDP socket for multicast
SOC = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
SOC.settimeout(2)
 
# Send M-Search message to multicast address for UPNP
SOC.sendto(MS.encode('utf-8'), ('239.255.255.250', 1900) )
 
#listen and capture returned responses
try:
    while True:
        data, addr = SOC.recvfrom(8192)
        print (addr, data)
except socket.timeout:
        pass

The next step is to access the rootDesc.xml file. In this case, this is accessible on my device via http://192.168.2.74:5555/rootDesc.xml. Looking at the M-SEARCH response above, we can see that the IP address for rootDesc.xml at 169.254.39.187.  169.254.*.* is known as an Automatic Private IP address. It is not uncommon to see an address in that range returned by an M-SEARCH request. Trying to access it will fail because it is incorrect. To actually access the rootDesc.xml file, you will need to use the device’s true IP address, which in my case was 192.168.2.74 and was shown in the header of the M-SEARCH message response.

Once the rootDesc.xml is returned, you will see some very interesting things listed, but in this case, we are only interested in port forwarding. If port forwarding service is available, it will be listed in the rootDesc.xml file as service type WANIPConnection, as shown below:

UPnP With a Holiday Cheer

You can open WANIPCn.xml on the same http service and TCP port location that you retrieved the rootDesc.xml file. The WANIPCn.xml file identifies various actions that are available, and this will often include the following example actions:

  • AddPortMapping
  • GetExternalIPAddress
  • DeletePortMapping
  • GetStatusInfo
  • GetGenericPortMappingEntry
  • GetSpecificPortMappingEntry

Under each of these actions will be an argument list. This argument list specifies the argument values that can be sent via Simple Object Access Protocol (SOAP) messages to the control URL at http://192.168.2.74:5555/ctl/IPConn, which is used to configure settings or retrieve status on the router device. SOAP is a messaging specification that uses a Extensible Markup Language (XML) format to exchange information.

Below are a couple captured SOAP messages, with the first one showing AddPortMapping. This will set up port mapping on the router at the IP address 192.168.1.1. The port being added in this case is TCP 1234 and it is set up to map the internet side of the router to the internal IP address of 192.168.1.241, so anyone connecting to TCP port 1234 on the external IP address of the router will be connected to port 1234 on internal host at 192.168.1.241.

UPnP With a Holiday Cheer

The following captured SOAP message shows the action DeletePortMapping being used to delete the port mapping that was created in the above SOAP message:

UPnP With a Holiday Cheer

To conclude this simple introduction to UPnP, SSDP, and port forwarding services, I highly recommend that you do not experiment on your personal internet-facing router or DSL modem where you could impact your home network’s security posture. But I do recommend that you set up a test environment. This can easily be done with any typical home router or Wi-Fi access point with router services. These can often be purchased used, or you may even have one laying around that you have upgraded from. It is amazing how simple it is to modify a router using these UPnP services by sending SOAP messages, and I hope you will take this introduction and play with these services to further expand your knowledge in this area. If you are looking for further tools for experimenting with port forwarding services, you can use the UPnP IGD SOAP Port Mapping Utility in  Metasploit to create and delete these port mappings.

But I heard him exclaim, ere he drove out of sight-
Happy HaXmas to all, and to all a good UPnP night

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs

Help Others Be “Cyber Aware” This Festive Season—And All Year Round!

Post Syndicated from Jen Ellis original https://blog.rapid7.com/2020/12/17/help-others-be-cyber-aware-this-festive-season-and-all-year-round/

Help Others Be

Are you tired of being the cybersecurity help desk for everyone you know? Are you frustrated with spending all your time securing your corporate environment, only to have to deal with the threat that snuck in through naive end-users? Are you new to security and wondering how you ended up here? This blog is for you!

Introducing the Cyber Aware Campaign

Every year, November and December tend to be awash with media articles sharing tips for “safe” online shopping, particularly around Cyber Monday. This has been compounded in 2020, a year characterized in cybersecurity by increased remote working, reliance on online and delivery services, and COVID-19-themed scams and attacks. Many have viewed 2020 as a hacker’s playground.

It’s in this setting then that the U.K. government has relaunched its Cyber Aware campaign to help internet citizens navigate the rocky shores of defending their digital lives. The campaign—which features TV, radio, and print ads, as well as various (virtual) events—offers six practical and actionable tips for helping people protect themselves online.

The tips are designed to be applicable to the broadest audience possible. They are not necessarily the most sophisticated security best practices, but rather (and very intentionally), they are fairly basic and applicable to a wide range of people. The list has been devised as the result of considerable development and testing: The U.K. government not only sought input from security experts, but also from nonprofits and civil society groups representing various constituent groups. This helped them ensure the tips would be practical for everyone from your granny to your favorite athlete (maybe they are the same person).

As with enterprise security, there is regrettably no silver bullet for personal security, so these tips will not make people completely invulnerable. However, they do focus on steps that are manageable and will meaningfully reduce risk exposure for individuals. The U.K. government has focused on finding a balance between being thorough and not alienating people from making the effort, hence settling on just six tips. Naturally, we prefer things that come in sevens, but this is a decent start. 😉

The tips

Four of the six tips focus on passwords and identity access management. This seems like a good choice; it’s extremely hard to change behavior such that people stop sharing personal information or clicking on links, but if you can make it harder for attackers to access accounts, that’s a good step toward meaningfully reducing risk.

So, let’s take a look at the actual tips…

  1. Use a strong and separate password for your email
  2. Create strong passwords using three random words
  3. Save your passwords in your browser
  4. Turn on two-factor authentication (2FA)
  5. Update your devices
  6. Back up your data

We recommend clicking on the links and taking a look at the full guidance. Or, for more information on the tips, how they were developed, and what the Cyber Aware campaign entails, check out this Security Nation podcast interview with the delightful Cub Llewelyn-Davies of the UK National Cyber Security Centre.

As a starting point or personal security baseline, this is a very decent list, and we hope it will have a meaningful impact in encouraging individuals to make a few small changes to protect themselves online.  

As overzealous security enthusiasts, though, we had to take it one step further. We’ve created a free personal security guide of our own that starts with the Cyber Aware steps, then offers additional advice for those that want to go further. We know that for the vast majority of internet users, even six steps feels like too many, but we also hold out hope that many people may be inspired to dig deeper or may just have more specific circumstances they need help with.

You can download the guide for free here. Maybe include it with your holiday cards this year—personal security is the gift that keeps on giving!

Why should you care about this?

If you are reading the Rapid7 blog, the chances are that you already think about security and are almost certainly taking these steps or some appropriate alternative to them (if only more websites accepted 50-character passwords, eh?). Nonetheless, even if you are a security professional, the need to educate others likely affects you. Maybe it’s because you’re sick of constantly being asked for security tips or assistance by family and friends. Maybe you just can’t handle reading more headlines about security incidents that could have been avoided with some basic personal security hygiene. Maybe you’re worried that no matter how diligently you work to protect your corporate environment, an attacker will gain a foothold through an unwitting end-user with access to your systems.

The point is that we are all engaging in the internet together. A better informed internet citizenry is one that makes the job of attackers slightly harder, reducing the potential opportunities for attackers and raising the bar of entry into the cybercrime economy. It’s not a revolution or that ever-elusive silver bullet that will save us all, but increasing even the basic security level of all internet citizens creates a more secure ecosystem for everyone. As security professionals, we should be highly invested in seeing that become a reality, so send the guide or Cyber Aware web page to your less security-savvy friends, family, and/or users today.

Help them become more Cyber Aware, and help create a safer internet for us all.

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More HaXmas blogs