Bsides Orlando 2015 - Hiding your attacks with misdirection like

I gave a presentation at Bsides Orlando in 2015 called "Hiding your attacks with misdirection like <REDACTED>". The synopsis of the talk was: "As technology progresses, governments have been using electronic means of attacks more and more to further their agenda. By relying heavily on misdirection and misinformation, advanced government red-teams have gotten away with attacks for a long time without any sort of punishment.

This presentation will present an analysis of these team’s anonymization and attack methodology and explain how you as a 'penetration tester' can make use of these techniques."

You can watch the talk below:

OpenSSH three factor authentication using Google Authenticator and Public Key authentication

I use Google Authenticator on all of my Google account because it's a nice, efficent way to do multi-factor authentication for the great price of free-ninety-nine. I wanted to use it on one of my servers, but I wanted to be extra secure and use not only TOTP, but password based and RSA key authentication as well. All of the documentation I could find on doing so with OpenSSH was only on doing Google Authenticator's TOTP and password based authentication.Thankfully, this is possible since OpenSSH 6.2 introduced the AuthenticationMethods argument.

Dual boot Kali and a TrueCrypt Encrypted Windows using Multiple Hard drives

In spite of all of bad press surrounding TrueCrypt lately, which I believe is really a warrant canary, I use TrueCrypt 7.1a's full disk encryption for my Windows installation for my desktop. I also have Kali Linux installed on a separate solid state drive for my... research.

If you have ever tried to get TrueCrypt and grub to play nicely, you probably are aware that it is an absolute pain in the ass.

I tried following this guide, but when I tried to boot my TrueCrypt encrypted Windows, I kept receiving the error that grub "can not find the right disk" and that "the kernel should be loaded first". Well, I got it to work, and for the sanity of myself and other, I will post my solution here.

Like shooting phish in a barrel

So, I got sent yet another phishing email to look into to. Let's just say everything about this one had me laughing. Here is the email as it appeared:

The world's least obvious phishing email

Of course, me, being the curious guy I am, decide to click on it. I was presented with a "[redacted]redirect.php" page, which took me to a new page that did all of the "phishing".

Boy, that's sure not obvious

Right off the bat, it's pretty obvious we are dealing with an "Advanced Persistent Threat". This is not your normal script kiddie, they even included a tiled and watermarked map of the world! Impressive. In all seriousness, this was uploaded to a WordPress server under the wp-admin page, indicating that the server was compromised. The comprised server is riddled with vulnerabilities due to having an outdated version of WordPress (3.4.2) and a number of vulnerable plugins.

Clicking one of the services brings up the following:

Foolproof!

 If you notice the url, the page is running under xxxxxxxxx.com/wp-admin/css/sw/. So, if you go back a folder, you are able to list the contents of the /css directory.

Did someone say "source code"?

MFW:

Yep, download the zip and voila, source code of everything relating to the attack page.

Open up one of the $webmail_service.php pages and we are greeted by comedy gold.

MFW:

Plug the email or name into Google and you get his twitter page. Which includes the city our ub3r1337 hacker lives in:

Everything seems to match up

Alright, so now we have a twitter, full name, email, and city... I stopped at this point because it was getting pretty ridiculous, but you can easily see where some one could have gone with this.

Let this serve as an open letter to aspiring phishermen out there:

1. Don't do it. It's not worth it.
2. If you compromise a web server, don't be stupid enough to send emails from it to your personal email address.
3. Don't put your name in your source code.
4. Don't let people access your source code.
5. Don't do it. It's not worth it.

This goes to show that if you do not keep your WordPress server updated and patched, you are opening the gates to all kind of persons with malicious intent. Including (highly skilled) hackers like this...

Quick analysis of a Zeus Bot

At work, I got a few reports from users regarding a suspicious email. After looking at it, I had to admit, it was pretty convincing. They spoofed the sender to be [administrator@ourdomainname.tld] and they targeted very specific users within our organization. The actual text was well done as well, describing that we have received a fax titled our "June Payroll", and providing a link to "View this file online".

I did some checking into the headers and noticed that they were using a compromised mail server of a manufacturing company out in Illinois. After notifying the company, I span up a VM and decided to check out the link for my self.

The webpage it linked to wasn't anything impressive, pretty much just a standard "you have to update your flash player to view this document" then linked to a totally-not-malicious executable called "update_flash_player.exe". I ran it through VirusTotal and surprisingly enough, got no hits back. So I launched it in the VM and watched the traffic as it called out. Right away, I noticed it pulling down 5 seperate executables.

I didn't want to blank the ip addresses, but its for the best

After pulling them down and launching them, the VM started to make DNS quieres to what tried to look like a webmail server. From there, the VM kept talking to it, so I assumed that this was the C&C.

Blocking out my DNS server

Recently, I came across an interesting site called urlquery.net. From the website:
"urlQuery is a free online service for testing and analyzing URLs, helping with identification of malicious content on websites. The main focus of urlQuery is to find and detect suspicious and malicious content on webpages, to help improve the security industry and make the internet a safer place."

So I ran the URL through urlQuery, and it gave me an interesting hit.

Seriously, urlQuery is awesome. Give it a try.

The fact that there was a webserver running on 8080 did not surprise me, but what caught my eye was "gate.php". I remembered that "gate.php" is the name of the php page that Zeus bots use to talk to their C&C. Curious to see of I could get access to the control panel, I took a look at the default Zeus pages.

cp.php is the control panel for Zeus, but trying that failed.

Of course, even cyber-criminals are predictable, so after trying admin.php, I was presented with a lovely Russian login page.

Bingo!

BK Rios had written a tool for Zeus C&C takeovers, but I had no way of verifying the version number of this C&C. If anyone has any way of identifying this, please let me know in the comments below. Either way, it was at least worth a peek, only problem is, I would have to extract the RC4 encrpytion key from the bot. I'm not very good (read: never attempted before) at memory forensics, so this presented a challenge. Thankfully, there's a lovely framework called Volatlity that makes memory forensics really easy.

First, I did a connection scan to look at outgoing connections from my VM's memory dump.

Then I cross referenced the PID to the running processes.

Finally, I pulled additional details on that process.

Unfortunately, the C&C page went back to normal, and now looks like a legitimate website. The control panel is no longer accessible.


MD5 hashes of the binaries that were pulled down:
f2kr.exe:7F87B186C01BA3B107864604B967395B
DH8xSJxy.exe:DAFBE310C26ED5EC1EF5FCD0A0A3FECE