Zach Grace

Proxmox Cheat Sheet

Wed, 10 Apr 2019 00:00:00 +0000

Importing VMware Images

When exporting a VM from VMware, the image will likely get exported in one of two formats depending on how you exported it, OVF or OVA. Below are the steps for importing each into Proxmox. This was tested on version 5.3-8.

OVF

Transfer the .ovf and .vmdk to the host via SCP
Run qm importovf <vmid> <ovf file> <storage>, Ex: qm importovf 100 exported.ovf local-lvm

Note: if the .vmdk name differs from what’s stated in the manifest, you’ll need to rename it to match.

Red Team Telemetry Part 1

Fri, 01 Jun 2018 00:00:00 +0000

After building and releasing PWNboard, I got some great feedback from many folks especially Vyrus (seriously thanks!). Vyrus gave me a little insight into what he and the National CCDC team were prepping which made me realize they were leagues ahead of PWNboard. But it served as pure inspiration.

I started thinking about Red Ream Telemetry (RTT) beyond CCDC, what lengths could one take it to and how could I use telemetry to convey impact and insights on red team engagements. A few ideas came to mind almost immediately, have better insight into red team operations and have a log of all actions taken against a target/organization help the blue team improve their defenses.

About

Thu, 12 Apr 2018 00:00:00 +0000

I’ve worked in offensive security for nearly a decade focusing on securing financial institutions. I’ve been a systems administrator, developer, pen tester and currently lead a team offensive security team at a Fortune 100.

You might find me at our local CitySec meetup, MilSec, or at OWASP Milwaukee. I’ve also been a member of the Wisconsin CCDC Red Team since 2012.

Speaking Engagements

I’ve had the privilege to present at the follwing events. In my presentations, I like to do demos, be educational and have something for all skill levels.

CCDC Red Team PWNboard

Sun, 04 Mar 2018 00:00:00 +0000

I built an operations tool for our Midwest CCDC Red Team called PWNboard. Our biggest challenge in these competitions is that we’re in a virtual environment where teams can revert the machines at any point and essentially kill our access. So monitoring the checkins and backdoors is essential to maintaining access for the duration of the event. And that’s why I made PWNboard, an operational board that monitors our implants and backdoors. As Tim MalcomVetter put it, it’s offensive inventory management.

Hybrid Cobalt Strike Redirectors

Tue, 20 Feb 2018 00:00:00 +0000

Working for an organization with a strict data security policy puts a few challenges on a Red Team, especially when it comes to building robust infrastructure. m0ther_ and I set out to build a robust, multi-redirector infrastructure similar to what Raphael Mudge described in his blog post, Cloud-based Redirectors for Distributed Hacking, except we wanted to host the team server on-prem. The post below describes two iterations of infrastructure we built to meet our needs.

Experts Need Not Apply

Sat, 09 Sep 2017 00:00:00 +0000

Recently, I tried to hire an AppSec contractor to add some capacity to our team. The request went out to some contracting firms and we received six resumes just a few days after posting. Now, the problem is that my team and I don’t have the capacity to interview that many candidates or even a subset of candidates. So I decided to send all of the candidates a few relatively straight forward web app vulnerability challenges, or at least I thought they should have been straight forward or relatively simple to solve. The experiment showed us that the consultants, all of which claim to have 5+ years AppSec experience, couldn’t identify major flaws in some stripped down CTF challenges. Their responses left me completely baffled and disheartened. I fear for our industry.

Vulnerability Scanning - A False Sense of Security

Sun, 12 Mar 2017 00:00:00 +0000

As I tell my 6 year old daughter, be a problem solver, not a complainer.

So I s Seriously…WebSpehre

During a recent test

References

https://github.com/ztgrace/changeme

Backdooring Node.js Express Apps via SSJI

Wed, 01 Mar 2017 00:00:00 +0000

Updated: 2017.03.03

One of the interesting things about Node.js (server-side JavaScript) apps/APIs is that they’re event driven. As an attacker, this means there are new options for post-exploitation code execution, so I wrote a little PoC to demonstrate that.

In the scenario below, we’re going to assume we’ve already identified Server-Side JavaScript Injection (SSJI) in the app. This is not a new vulnerability in Express, but an experiment in post-exploitation. There are many posts on how to exploit SSJI in which they show how to read files with require(‘fs’).readFile or execute commands with require('child_process').spawn. But what if we could add our own event through the SSJI? We could modify the running app’s behavior without touching disk and have it harvest sensitive information or perform other nefarious activities.

Docker Cheat Sheet

Thu, 16 Feb 2017 00:00:00 +0000

Install docker on a debian-based system: apt-get install docker.io

Download an Ubuntu 14.04 image: docker pull ubuntu:14.04

Download many Ubuntu-based images: docker pull ubuntu

Run bash in Ubuntu: docker run -it ubuntu /bin/bash

View running containers: docker ps

Attach to a running container: docker attach b80939864b33

root@Docker:~# docker run -it ubuntu:14.04 /bin/bash
root@01a82e993d47:/# ls
bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var
root@01a82e993d47:/# touch TEST
root@01a82e993d47:/# ls
TEST bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var
root@Docker:~# docker commit -m "Test" -a "ztg" 01a82e993d47 foobar/ubuntu:v2
10a437b18b7f5aa3ee657b536505ff4bb5dd956a8611cb2324b24b03b9800f4c
root@Docker:~# docker run -it foobar/ubuntu:v2
root@0233b5a1119a:/# ls
TEST bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var

View available docker images:

Acing Your Security Headers

Thu, 13 Oct 2016 00:00:00 +0000

Mozilla recently released a security header grading site, https://observatory.mozilla.org/. Of course I had to plug my site into the scanner and found that I got an F. Not good for a security guy.

According to April King of Mozilla, the Observatory “grading is set very aggressively to promote best practices in web security”. And by looking at the scores, we can see that the far majority of sites fail the Observatory tests.

Fixing Frame Check Sequence with Scapy

Tue, 13 Sep 2016 00:00:00 +0000

[20:03:53-160913][kali:~]# scapy
INFO: Can’t import python gnuplot wrapper . Won’t be able to plot.
WARNING: No route found for IPv6 destination :: (no default route?)
Welcome to Scapy (2.2.0)
>>> packets = rdpcap(“ctf.pcap”)

packets[7] >>>

X11 Hacking

Fri, 13 May 2016 00:00:00 +0000

Setup

This tutorial is based on the X11 server in the PWN Lab project. To install the VM, follow the instructions in the pwn_lab README, then execute the commands below. This VM will take a while to finish installing and configuring as it needs to download and install the ubuntu-desktop packages.

git clone https://github.com/ztgrace/pwn_lab.git
cd pwn_lab/x11
vagrant up

If all goes well, you should have a VM running that looks like this:

Projects

Wed, 11 May 2016 00:00:00 +0000

changeme

changeme is a default credential scanner. I wrote changeme out of frustration with commercial vulnerability scanners missing common default credentials. Getting default credentials added to commercial scanners is often difficult and slow. changeme is designed to be simple to add new credentials without having to write any code or modules.

PWN Lab

PWN Lab is a collection of Vagrant scripts and boxes to create security training environments. Getting a running environment is as easy as cloning the repository and running vagrant up.

radare2 Cheat Sheet

Sat, 05 Mar 2016 00:00:00 +0000

Here’s a few commands I’ve found useful while learning the radare2 tool set.

radare2/r2

List functions

afl

Disassemble function:

aa

pdr@main

Print call graph:

agc > /tmp/foo.dot xdot /tmp/foo.dot

Print a detailed graph:

ag $$ > /tmp/c2.dot

Disassemble instruction:

pD 2

Seek to a specific memory location:

s 0x08048470

Write hex value:

wx eb

Debugging/Visual Mode

https://radare.gitbooks.io/radare2book/content/introduction/basic_debugger_session.html

r2 -d ./file

Set breakpoint

db 0x00401383

Remove breakpoint

db -0x00401383

List breakpoints

GDB Cheat Sheet

Sat, 04 Jul 2015 00:00:00 +0000

This is a collection of commands I’ve found useful when working with GDB.

Run an executable with args:

gdb --args path/to/executable -every -arg you can=think < of

gdb -q --args ./bof $(/opt/metasploit-framework/tools/pattern_create.rb 1000)

Set a breakpoint:

break main

b main

Set a breakpoint at an instruction:

b *0x80484b5

Disassemble a function:

disassemble main

disas main

Show registers:

info registers

i r

Show a specific register:

info registers eip

i r eip

Creating Vagrant Boxes

Sun, 28 Jun 2015 00:00:00 +0000

sudo visudo -f /etc/sudoers.d/vagrant

vagrant ALL=(ALL) NOPASSWD:ALL

mkdir -p /home/vagrant/.ssh
chmod 0700 /home/vagrant/.ssh
wget –no-check-certificate 

 https://raw.github.com/mitchellh/vagrant/master/keys/vagrant.pub 

 -O /home/vagrant/.ssh/authorized_keys
chmod 0600 /home/vagrant/.ssh/authorized_keys
chown -R vagrant /home/vagrant/.ssh

Ubuntu

Older training VMs use

sudo sed -i -re ’s/([a-z]{2}.)?archive.ubuntu.com|security.ubuntu.com/old-releases.ubuntu.com/g’ /etc/apt/sources.list

References

Attacking ECB

Fri, 17 Apr 2015 00:00:00 +0000

On a recent engagement, I came across Electronic Code Book (ECB) encrypted data. While there’s a plethora of documentation about performing bit flipping in ECB, I couldn’t find any decent writeups on how to perform adaptive chosen plaintext attacks to recover ciphertext.

In ECB mode, each block of plaintext is encrypted independently with the key as illustrated by the diagram below.

(Source: Wikipedia)

Since each block of plaintext is encrypted with the key independently, identical blocks of plaintext will yield identical blocks of ciphertext. The classic and poignant example of this property is an encrypted image of the Linux mascot, Tux. Below are three images, the original Tux image, an ECB encrypted Tux and a CBC encrypted Tux. The ECB encrypted Tux leaves visible artifacts whereas the CBC encrypted Tux looks like random data.

Hunting Sticky Keys Backdoors

Mon, 23 Mar 2015 00:00:00 +0000

The “sticky keys” backdoor method has been a favorite for hackers for years and it’s been gaining popularity as a malware-free persistence method. This backdoor method gives an attacker pre-authentication, SYSTEM-level access to a target remotely over RDP or locally via the console.

The backdoor can be installed in one of two ways:

Copy cmd.exe over sethc.exe or utilman.exe
Set cmd.exe as the debugger for sethc.exe or utilman.exe

The sethc.exe backdoor can be triggered by pressing the shift key five times in rapid succession. The utilman.exe backdoor can be triggered by pressing windows+u.

Exploiting MS14-068 with PyKEK and Kali

Sun, 14 Dec 2014 00:00:00 +0000

Here’s a quick writeup of exploiting MS14-068 using PyKEK and Kali.

Kali Prepwork

Install and Configure Kerberos

Install kerberos:

apt-get install krb5-user krb5-config

Create relevant kerberos config changes in /etc/krb5.conf:

[libdefaults]
 default_realm = pwn3d.local
[realms]
 pwn3d.local = {
 kdc = dc1.pwn3d.local
 admin_server = dc1.pwn3d.local
 default_domain = pwn3d.local
}

Point DNS to the DNS Server/domain controller so SRV records (e.g. _kerberos._tcp.*) will resolve correctly in /etc/resolv.conf.

According to the TrustedSec blog, you’ll need to sync time with the domain controller. During my testing I didn’t perform any syncing and had no issues.

Page Not Found

Mon, 01 Jan 0001 00:00:00 +0000