Security – Page 2 – Eric Walker

December 4, 2013

VxWorks Memory Dump

While running an internal vulnerability scan I noticed that one of the devices was showing vulnerable to VxWorks Memory Dump.

This is exploitable by using the Metasploit wdbrpc_memory_dump module, so I fired it up and loaded the module to see if I could pull the memory from this device.

I run the exploit against the system and it began dumping the memory, and it got to about 31% before stopping, so I had to restart it from the OFFSET value it stopped at. This happened 3 more times before it finished. The output file was about 256MB in size, so I was not sure if it had good information from the system or just crap.

Being that it was a hex dump of the memory, I ran strings against the file to get a list of information and look for possible information to use. I put the output into another file to search through with “grep”.

#strings vxworks_memory.dmp > strings.memory.dmp

I was able to determine that it was a network switch from viewing the IP address on port 80 (looked back at Nessus to see what ports where open and what it thought the device was), so I decided to search for words like “password”, “enable”, and “encryption”.

At first nothing showed up that was any good or valuable to use, so I decided to search for partial words, like “assw”, “able” and “crypt” to see if the words had been split across lines in the memory dump.

#cat strings.memory.dmp | grep -i assw

#cat strings.memory.dmp | grep -i crypt

I discovered that the enable hash was in the dump, so I guessed that the password could also be stored in there as well.

Taking the new file from the strings output (strings.memory.dmp), I ran it through “sort” with the unique flag and output that into another file to use as my password list starting point.

#cat strings.memory.dmp | sort –u > passlist.list

With new list of possible passwords, and hoping that one copy of it was completely intact and not split across a line. I ran it through PW-Inspector to narrow it down to a more manageable number and realistic passwords and an actual realistic length.

#pw-inspector –I passlist.list –o passlist.uniq.list –lunps –m 8 –M 16

Now that I had narrowed the password list down to a more manageable solution, I ran John against the hash with the shorter list.

In no time at all I had the password for the hash, the switch was not Cisco and was only using an MD5 hash, which made it rather simple to crack.

Now that I had the password, I needed to search for a user name. So I started searching for common names in the file, and admin came back multiple times with the word user next to it, so with a little searching on Google, I discovered that admin was the default user on this switch.

From there I tried to SSH to the switch, but was denied due to the use of private keys and not passwords for SSH, so I tried telnet to connect to the switch and was able to login.

From there I had access to see all of the other VLANS, and IP address space that I did not have access to before. Now time to see where else the password is used.

July 23, 2013

Fun times during NVA/PT assessments over the past 3 months

Some fun things I have had to deal with during some NVA/PT assessments for customers over the past 3 months.

You begin scanning 5 hosts and the customers switch rolls over, everything stops responding, and the customer calls you asking what you did.

I enjoy customers that leave usernames and passwords for critical systems on a web page with unauthenticated access, and they say that it is not a security vulnerability.

You find access to a customers Github.com site and your boss tells you to not explore the site and only report that you had access to login, since the site was not in scope.

You report a finding that you found last year for the same customer, and it allows you complete access to the server.

You find default access to a website that controls the customers network switches, UPS, and other main pieces of their infrastructure, and the customer says he is not worried about.

You find systems that are missing patches from 2004, and the customer tells you that it is not critical. You tell them to remove it from the network, and they tell you they need it for some other system that is important.

I am sure I will have more to come in the next few months, since my boss is stacking up assessments like they are going out of style, and we are still trying to hire a new pentester.

April 29, 2013

2nd Bahrain Trip

Well I had to go back to Bahrain to work for another 5 weeks, was really not wanting to go, but I had already committed to the trip with the first 7 week trip that I did. Had a lot of stuff that needed me to be home, but luckily my wife was able to handel it in my absence.

The demonstrations were a lot lighter this trip, and I actually only saw a few burning tires (the burning remnants only). There were plenty of police and military vehicles everywhere, which might have been the reason for the fewer incidents.

Since I have already visited almost the entire Island, I did not venture out as much this trip. Went to the souq (open air market) only a few times just to see if anything new was being sold. Nothing really new, just the same stuff as before, I did pickup a few trinkets for the boys, and some jewelry for my wife.

I received a ticket to attend the Bahrain Formula 1 Grand Prix, which was an awesome event, it lasted 3 days. There were qualification runs the first two days, and some races by the smaller cars. Had some cars from the Formula Middle East, and Grand Prix 2 race a couple smaller runs. The last day was the actual race for the Formula 1, and it was followed up with a concert from Ne-yo. I would definitely recommend that if you are in Bahrain in April, this would be a must do.

My time flied this trip, and I am glad to be home. I will miss some of the friends that I have made while spending time over there, but I really started to miss the family.

February 25, 2013

Living in Bahrain for 50 days

Well I have been living in Bahrain for about 50 days now, and I am ready to head back to the United States. It is a little different living over here, most of the people are very nice, many cannot drive let alone stay in any lane on the road. Many drivers like to honk their horns; which can get a little annoying at times, especially when the light is just about to turn green and just incase you had not noticed that it was turning green they wanted to let you know by honking their horn. I have learned that if you can drive on it people will, no matter if it is the road or not, shoulders are almost like an extra lane for many people, even the dirt along the road can become an extension of the road for many people. I have seen a 3 lane road turn into a 5 lane road, with people all over the place, and as close to each other as possible with out hitting one another.

The dust in the air is awful at times and my eyes have been red the entire time I have been here, and my nose has been stopped up as well on several occasions. The weather has been fairly nice, compared to Knoxville Tennessee, which it has been snowing and raining there.

Have not had too many problems finding something to eat, there are dozens of American restaurants here. There is even a street referred to as American Alley (next to the Navy Base) and another called Shawarma Alley due to the multiple ( I believe 4) food stands located to each other on the small road.

McDonalds
Hardees
KFC
Pizza Hut
Papa Johns
Burger King
Subway
Polo Campero
PotBelly sandwiches
Fatburger
Fuddruckers
Chilis
Bennigans
Carrinos
Hard Rock Cafe
TGIFridays
Gloria Jeans
Starbucks
Aunt Annie
Baskin Robins
Cold Stone Creamery

There are probably places I am forgetting but these are the ones I have seen an can remember at the present time. I was actually surprised at the amount of American food places to eat at. Plus they all seem to have delivery which is usually guys on motorcycles and a box attached to the back of the bike.

Chili’s Delivery driver, would love to have this back home, getting chips and salsa delivered would be awsome.

There is a large Police and Military presence around town, and at times there are demonstrations.

Police and Military parked along the road all over the place.

Small demonstration I ran into driving down the road one day. police where shooting tear gas, demonstrators throwing rocks.

All in all it has been a decent trip, seen many interesting places, and people, but it is time to head home. The prices are not any cheaper like many people have told me they would be, in some cases they are the same or a little higher. It does seem to be cheaper due to the prices but when 1 Dinar is equal to 2.5624 US Dollars, that 5 Dinar item is actually 13.26 USD. I can get a Big Mac combo meal (small drink and fries) for 1.500BHD which is $3.98 USD a little cheaper than the US prices I believe, but the drink and fry sizes are smaller portions which would make up the difference in price.

Purchasing local items can be fairly cheap, but anything that is shipped in from other countries, is generally not cheaper. Purchasing Kraft cheese compared to local cheese is about double the price in some cases.

Many of the local shops (not grocery stores, or food places) expect you to haggle with them over prices of some items, so they will give you a high price when you ask. You have to know the value of the item before hand to get a good price, which is not always easy to do. Places near the Navy base, or other Expat areas are generally going to try to get you to pay more than it is worth, because they know you will pay it.

Picked up some snack to bring back with me, samboosa, mahtai, and some Fisthakiya.

Picked up a few items for my oldest son who is getting into cooking for his friends, and himself. He can cook an Indian style meal for his friends to try.

Picked up a few smal rugs for family and friends as gifts, they were 3BHD a piece or about $8.00 USD, they are about 12’x12′ in size, and are all hand made locally .

Spent a lot of time traveling around to all of the shop areas, and looking at all of the different items that are for sale, many are fakes of original items, or cheap knock offs. Some items are cheap tourst items, that they try to sell for a premium. There are many shops located all over the city, and can be as small as a single room or as large as a full department store. You name it you can probably find it here, not sure if it will be an original version of what you are looking for but you can find at least a fake version of it.

I have picked up enough items to fill a full size suitcase, and had to purchase a small duffle bag to bring items back with me to the US. I am hoping I have not gone over my $800 limit of tax free items, or I will have to pay tax on anything over the amount. Will have to check my total count of money spent and make sure I am not over. Since I have a 7 hour layover in Amsterdam I am sure I will find some more items there that I want to pick up for the family.

Well getting ready to head home, for a few weeks of relaxation, and some normalcy, then back over here for another 35 days of fun.