Computers, ssh and rock'n roll
The comments around the last OpenSSH issue (CVE 2016-0777, you must read excellent Qualys’ analysis if you’re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. I will attempt to give a few advises, prioritized in feasibility order, and with graphical annotations:
Very easy to set up.
Requires a lot of work to set up.
Will provide you some protections against difficult attacks.
Will protect against very simple or effective attacks.
I’ve participed to NDH2013 this year and worked on a very interesting binary : k1986. It comes with two files :
aris@kali64:~/ndh2013$ ls -l k1986 license.db -rwxr-xr-x 1 aris aris 14984 jun 23 02:07 k1986 -rwx------ 1 aris aris 360 jun 22 22:54 license.db aris@kali64:~/ndh2013$ file k1986-orig license.db k1986-orig: ELF 64-bit LSB executable, x86-64, invalid version (SYSV), for GNU/Linux 2.6.32, dynamically linked (uses shared libs), corrupted section header size license.db: data
It’s starting well, corrupted ELF file. The content of license.db seems encrypted, so my first guess was that it was a DRM server of some kind. It becomes more fun when you try to check what it does:
aris@kali64:~/ndh2013$ objdump -t k1986-orig objdump: k1986-orig: File format not recognized aris@kali64:~/ndh2013$ gdb --quiet ./k1986-orig "/home/aris/ndh2013/k1986-orig": not in executable format: Format de fichier non reconnu (gdb) quit aris@kali64:~/ndh2013$ nm ./k1986-orig nm: ./k1986-orig: File format not recognized aris@kali64:~/ndh2013$ ldd ./k1986-orig n'est pas un exécutable dynamique
I built a new lab environment at home, using VMWare ESXi 5.0, which is a very nice product, if we expect the windows-only GUI 1GB HDD needed to install bloatware. You can do pretty much anything from there, except something that looks so important that I wonder why it’s not on the windows GUI: mapping local disks to VMs.
I made this little post as a reminder for myself rather than a full tutorial. You can get more info on http://blog.davidwarburton.net/2010/10/25/rdm-mapping-of-local-sata-storage-for-esxi, on which this post is based.
In a nutshell:
This weekend I found a nice application to control my mac from my iPhone. It’s Remotemouse from http://www.remotemouse.net.
Unfortunately, when testing I found out that there was no pairing request nor any authentication… I just fired up wireshark to see what was happening and as expected, it’s a very dump cleartext protocol that indicates mouse gestures, clicks, and keyboard events.
I took my editor and went with this little script that connects to my mac, put the mouse on the upper right corner (over the search lense), click it and search for the terminal. Opens it and launches a bindshell.
Remotemouse is binding on all interfaces, ipv4 and ipv6, so if you’re using it and allow direct connections from the outside, you are vulnerable.
Continue reading “Remotemouse considered harmful”