Subscribe

Thursday, July 9, 2009

Nschaind v.0.3 Bind cache poisoning Scanner

nschaind is a tool that detects if a certain DNS resolver is vulnerable to cache poisoning according to VU#800113 (the Dan Kaminsky bug). This report covers weaknesses in BIND 9, BIND 8 and MS Windows DNS Server. This tool tests only the BIND weaknesses, which are described in VU#252735 and VU#927905 (discovered by Amit Klein).

The value of nschaind over other tools, is that nschaind does not require one to have direct access to the resolver being tested. The resolver must be tricked though into querying the tool, which can be accomplished in many ways.

As of release 0.3, nschaind detects vulnerable BIND 8 and BIND 9 servers.

See More Info about nschaind or Download

Wednesday, July 8, 2009

OpenSSH 0day ?

Rumors are flying of an underground openssh exploit. After some digging we find the tool name and its group:

“./0pen0wn” or “./0penPWN” by the hacker group called “anti-sec.” Check the commands below:

anti-sec:~/pwn/xpl# ./openPWN -h 66.96.220.213 -p 2222 -l=users.txt
[+] openPWN - anti-sec group
[+] Target: 66.96.220.213
[+] SSH Port: 2222
[+] List: users.txt

[~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>]


and:


anti-sec: ~ / pwn / xpl # ./0pen0wn-h 66.197.143.133-p 22
[+] 0wn0wn – anti-sec group [+] 0wn0wn - anti-sec group
[+] Target: 66.197.143.133 [+] Target: 66.197.143.133
[+] SSH Port: 22 [+] SSH Port: 22
[~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>]


Two attack logs exist on the net with this supposed exploit, both by this group. The first is an attack on an Astalavista Admin:

http://romeo.copyandpaste.info/txt/nowayout.txt

The second attack is the one the Internet Storm Center blogged on which can be seen in its entirety here:

http://tinyurl.com/l8tzba

and a Russian site has a play by play of the attack here:

http://tinyurl.com/m7cqdh

There is also another attack posted to the Full Disclosure list that seems to be the same tool:
http://seclists.org/fulldisclosure/2009/Jul/0028.html

See More Info Here

The Art of Grey-Box Attack

Whitepaper called The Art of Grey-Box Attack. It discusses how to use various tools from the hacker community while owning Microsoft Windows and various Unix systems.

Contents:

- The Art of Microsoft Windows Attack
Scanning & Enumeration
Gaining Access
Escalating Privilege

- The Art of Unix/Linux Attack
Scanning & Enumeration
Gaining Access
Escalating Privilege

- Metasploit Ninja-Autopwned
Nmap+Metasploit Autopwned
Nessus+Metasploit Autopwned

- Client-Side Attack with Metasploit
Metasploit Payload Generator
MS-Office Macro Ownage
AdobeReader PDF Ownage

See

Online attack hits US government Web sites

It was a crappy 4th of July weekend for many network admins in the US

A botnet comprised of about 50,000 infected computers has been waging a war against U.S. government Web sites and causing headaches for businesses in the U.S. and South Korea.

The attack started Saturday, and security experts have credited it with knocking the U.S. Federal Trade Commission's (FTC's) Web site offline for parts of Monday and Tuesday. Several other government Web sites have also been targeted, including the U.S. Department of Transportation (DOT).

"The DOT has been experiencing network incidents since this past weekend. We are working with the U.S. Computer Emergency Readiness Team [US-CERT] at this time," a DOT spokeswoman said Tuesday.

A spokeswoman for the U.S. Department of the Treasury confirmed that the Treasury's Web site had been hit with a denial-of-service attack. "We're working with our service provider to mitigate the impact," she said.

A spokeswoman for the FTC could not say what caused the outage at that agency's Web site, and the US-CERT did not return calls seeking comment.

Other targets have included banking Web sites in Korea, U.S. Bancorp, the U.S. Secret Service, the U.S. Department of Homeland Security, the U.S. Department of State, the White House, the U.S. Department of Defense, the New York Stock Exchange, the Nasdaq and the Washington Post, according to security researchers studying the incident.

The attack, while powerful, is not particularly sophisticated and appears to be more of a nuisance than a threat to security. It uses a variety of well-known distributed denial of service (DDoS) attacks that try to overwhelm Web sites with useless requests and make them unavailable for legitimate users, security experts say. Most of the targeted sites appeared to be working normally on Tuesday.

See More

milw0rm Shutting The Doors

In an unfortunate turn of events a great security resource is hanging up its gloves. milw0rm.com will be shutting down. The site maintainer, str0ke, posted a message on the site today explaining why.

From milw0rm:

Well, this is my goodbye header for milw0rm. I wish I had the time I did in the past to post exploits, I just don’t . For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours (taking off weekends) isn’t fair to the authors on this site. I appreciate and thank everyone for their support in the past.
Be safe, /str0ke


A sad moment but, and an all too common lament among folks who run security websites. It’s a labour of love but, at some point it can become overwhelming. I wonder who will fill the gap.

Source

Update:

msg from str0ke via twitter

I have talked with a few friends and I'll be handing the site over so a group of people can add exploits / other things to the site. Hopefully it will be a new good start

Tuesday, July 7, 2009

PyLoris 2.0 Released

PyLoris is a tool for testing a web server's vulnerability to a particular class of Denial of Service (DoS) attacks. It uses the Slowloris method; by using all available connections, web servers cannot complete valid requests.


Features:

Highly configurable HTTP connection consuming DoS
HTTPS support
GET, POST, HEAD and other headers supported
SOCKS4 and SOCKS5 proxies supported
Written in Python
Cross Platform; supported on Windows, Linux, and Mac OS X

Download the latest version of PyLoris here or see more info here

Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption - Metasploit exploit module

The exploit found is used to preform drive-by attacks via compromised Chinese web sites.
Original exploit (as it is in-the-wild) can be found here (shellcode changed to execute calc.exe) - aa.rar.
You can read the translated post here or read this post from ISC diary.

Here’s a Metasploit exploit module I wrote that exploit this vulnerability.
Tested successfully on the following platforms (fully patched 06/07/09):

- Internet Explorer 6, Windows XP SP2
- Internet Explorer 7, Windows XP SP3

Download msvidctl_mpeg2.rb.

Also, if you want to test this vulnerability manually, here’s a little Ruby script I wrote that build GIF files to trigger the vulnerability:
Download msvidctl_gif.rb.

Source rec-sec.com