HACKING EXPOSED: NETWORK SECURITY SECRETS & SOLUTIONS
PART I CASING THE ESTABLISHMENT 1 CHAPTER 1 FOOTPRINTING 7 CHAPTER 2 SCANNING 47 CHAPTER 3 ENUMERATION 83 PART II ENDPOINT AND SERVER HACKING 157 CHAPTER 4 HACKING WINDOWS 159 CHAPTER 5 HACKING UNIX 231 CHAPTER 6 CYBERCRIME AND ADVANCED PERSISTENT THREATS 313 CONTENTS PART I CASING THE ESTABLISHMENT CASE STUDY AS YOU WILL DISCOVER IN THE FOLLOWING CHAPTERS FOOTPRINTING SCANNING AND ENUMERATION ARE VITAL CONCEPTS IN CASING THE ESTABLISHMENT JUST LIKE A BANK ROBBER WILL STAKE OUT A BANK BEFORE MAKING THE BIG STRIKE YOUR INTERNET ADVERSARIES WILL DO THE SAME THEY WILL SYSTEMATICALLY POKE AND PROD UNTIL THEY FIND THE SOFT UNDERBELLY OF YOUR INTERNET PRESENCE OH AND IT WON T TAKE LONG EXPECTING THE BAD GUYS TO CUT LOOSE A NETWORK SCANNER LIKE NMAP WITH ALL OPTIONS ENABLED IS SO 1999 WHICH COINCIDENTLY IS THE YEAR WE WROTE THE ORIGINAL HACKING EXPOSED BOOK THESE GUYS ARE MUCH MORE SOPHISTICATED TODAY AND ANONYMIZING THEIR ACTIVITIES IS PARAMOUNT TO A SUCCESSFUL HACK PERHAPS TAKING A BITE OUT OF THE ONION WOULD BE HELPFUL IAAAS IT S ALL ABOUT ANONYMITY STUPID AS THE INTERNET HAS EVOLVED PROTECTING YOUR ANONYMITY HAS BECOME A QUEST LIKE NO OTHER MANY SYSTEMS HAVE BEEN DEVELOPED IN AN ATTEMPT TO PROVIDE STRONG ANONYMITY WHILE AT THE SAME TIME PROVIDING PRACTICALITY MOST HAVE FALLEN SHORT IN COMPARISON TO THE ONION ROUTER OR TOR FOR SHORT TOR IS THE SECOND GENERATION LOW LATENCY ANONYMITY NETWORK OF ONION ROUTERS THAT ENABLES USERS TO COMMUNICATE ANONYMOUSLY ACROSS THE INTERNET THE SYSTEM WAS ORIGINALLY SPONSORED BY THE U S NAVAL RESEARCH LABORATORY AND BECAME AN ELECTRONIC FRONTIER FOUNDATION EFF PROJECT IN 2004 ONION ROUTING MAY SOUND LIKE THE IRON CHEF GONE WILD BUT IN REALITY IT IS A VERY SOPHISTICATED TECHNIQUE FOR PSEUDONYMOUS OR ANONYMOUS COMMUNICATION OVER A NETWORK VOLUNTEERS OPERATE AN ONION PROXY SERVER ON THEIR SYSTEM THAT ALLOWS USERS OF THE TOR NETWORK TO MAKE ANONYMOUS OUTGOING CONNECTIONS VIA TCP TOR NETWORK USERS MUST RUN AN ONION PROXY ON THEIR SYSTEM WHICH ALLOWS THEM TO COMMUNICATE TO THE TOR NETWORK AND NEGOTIATE A VIRTUAL CIRCUIT TOR EMPLOYS ADVANCED CRYPTOGRAPHY IN A LAYERED MANNER THUS THE NAME ONION ROUTER THE KEY ADVANTAGE THAT TOR HAS OVER OTHER ANONYMITY NETWORKS IS ITS APPLICATION INDEPENDENCE AND THAT IT WORKS AT THE TCP STREAM LEVEL IT IS SOCKETS SOCKS PROXY AWARE AND COMMONLY WORKS WITH INSTANT MESSAGING INTERNET RELAY CHAT IRC AND WEB BROWSING ALTHOUGH NOT 100 PERCENT FOOLPROOF OR STABLE TOR IS TRULY AN AMAZING ADVANCE IN ANONYMOUS COMMUNICATIONS ACROSS THE INTERNET WHILE MOST PEOPLE ENJOY THE TOR NETWORK FOR THE COMFORT OF KNOWING THEY CAN SURF THE INTERNET ANONYMOUSLY JOE HACKER SEEMS TO ENJOY IT FOR MAKING YOUR LIFE MISERABLE JOE KNOWS THAT THE ADVANCES IN INTRUSION DETECTION AND ANOMALY BEHAVIOR TECHNOLOGY HAVE COME A LONG WAY HE ALSO KNOWS THAT IF HE WANTS TO KEEP ON DOING WHAT HE FEELS IS HIS GOD GIVEN RIGHT THAT IS HACKING YOUR SYSTEM HE NEEDS TO REMAIN ANONYMOUS LET S TAKE A LOOK AT SEVERAL WAYS HE CAN ANONYMIZE HIS ACTIVITIES TOR MENTING THE GOOD GUYS JOE HACKER IS AN EXPERT AT FINDING SYSTEMS AND SLICING AND DICING THEM FOR FUN PART OF HIS MODUS OPERANDI MO IS USING NMAP TO SCAN FOR OPEN SERVICES LIKE WEB SERVERS OR WINDOWS FILE SHARING SERVICES OF COURSE HE IS WELL VERSED IN THE NINJA TECHNIQUE OF HACKING EXPOSED NETWORK SECURITY SECRETS AND SOLUTIONS 2 USING TOR TO HIDE HIS IDENTITY LET S PEER INTO HIS WORLD AND EXAMINE HIS HANDIWORK FIRSTHAND HIS FIRST ORDER OF BUSINESS IS TO MAKE SURE THAT HE IS ABLE TO SURF ANONYMOUSLY NOT ONLY DOES HE WANT TO SURF ANONYMOUSLY VIA THE TOR NETWORK BUT HE ALSO WANTS TO ENSURE THAT HIS BROWSER NOTORIOUS FOR LEAKING INFORMATION DOESN T GIVE UP THE GOODS ON HIM HE DECIDES TO DOWNLOAD AND INSTALL THE TOR CLIENT VIDALIA GUI FOR TOR AND PRIVOXY A WEB FILTERING PROXY TO ENSURE HIS ANONYMITY HE HITS HTTP WWW TORPROJECT ORG TO DOWNLOAD A COMPLETE BUNDLE OF ALL OF THIS SOFTWARE ONE OF THE COMPONENTS INSTALLED BY VIDALIA IS THE TORBUTTON A QUICK AND EASY WAY TO ENABLE AND DISABLE SURFING VIA THE TOR NETWORK TORPROJECT ORG TORBUTTON AFTER SOME QUICK CONFIGURATION THE TOR PROXY IS INSTALLED AND LISTENING ON LOCAL PORT 9050 PRIVOXY IS INSTALLED AND LISTENING ON PORT 8118 AND THE TORBUTTON FIREFOX EXTENSION IS INSTALLED AND READY TO GO IN THE BOTTOM RIGHT CORNER OF THE FIREFOX BROWSER HE GOES TO TOR S CHECK WEBSITE CHECK TORPROJECT ORG AND IT REVEALS HIS SUCCESS CONGRATULATIONS YOU ARE USING TOR LOCKED AND LOADED HE BEGINS TO HUNT FOR UNSUSPECTING WEB SERVERS WITH DEFAULT INSTALLATIONS KNOWING THAT GOOGLE IS A GREAT WAY TO SEARCH FOR ALL KINDS OF JUICY TARGETS HE TYPES THIS IN HIS SEARCH BOX INTITLE TEST PAGE FOR APACHE IT WORKED THIS WEB SITE INSTANTLY A LIST OF SYSTEMS RUNNING A DEFAULT INSTALL OF THE APACHE WEB SERVER ARE DISPLAYED HE CLICKS THE LINK WITH IMPUNITY KNOWING THAT HIS IP IS ANONYMIZED AND THERE IS LITTLE CHANCE HIS ACTIVITIES WILL BE TRACED BACK TO HIM HE IS GREETED WITH THE ALL TOO FAMILIAR IT WORKED THE APACHE WEB SERVER IS INSTALLED ON THIS WEB SITE GAME ON NOW THAT HE HAS YOUR WEB SERVER AND ASSOCIATED DOMAIN NAME HE IS GOING TO WANT TO RESOLVE THIS INFORMATION TO A SPECIFIC IP ADDRESS RATHER THAN JUST USING SOMETHING LIKE THE HOST COMMAND WHICH WILL GIVE AWAY HIS LOCATION HE USES TOR RESOLVE WHICH IS INCLUDED WITH THE TOR PACKAGE JOE HACKER KNOWS IT IS CRITICALLY IMPORTANT NOT TO USE ANY TOOLS THAT WILL SEND UDP OR ICMP PACKETS DIRECTLY TO THE TARGET SYSTEM ALL LOOKUPS MUST GO THROUGH THE TOR NETWORK TO PRESERVE ANONYMITY BT TOR RESOLVE WWW EXAMPLE COM 10 10 10 100 WWW EXAMPLE COM AND 10 10 10 100 ARE USED AS EXAMPLES AND ARE NOT REAL IP ADDRESSES OR DOMAIN NAMES AS PART OF HIS METHODICAL FOOTPRINTING PROCESS HE WANTS TO DETERMINE WHAT OTHER JUICY SERVICES ARE RUNNING ON THIS SYSTEM OF COURSE HE PULLS OUT HIS TRUSTY VERSION OF NMAP BUT HE REMEMBERS HE NEEDS TO RUN HIS TRAFFIC THROUGH TOR TO CONTINUE HIS CHARADE JOE FIRES UP PROXYCHAINS PROXYCHAINS SOURCEFORGE NET ON HIS LINUX BOX AND RUNS HIS NMAP SCANS THROUGH THE TOR NETWORK THE PROXYCHAIN CLIENT FORCES ANY TCP CONNECTION MADE BY ANY GIVEN APPLICATION NMAP IN THIS CASE TO USE THE TOR NETWORK OR A LIST OF OTHER PROXY SERVERS HOW INGENIOUS HE THINKS BECAUSE HE CAN ONLY PROXY TCP HACKING EXPOSED NETWORK SECURITY SECRETS AND SOLUTIONS 3 CONNECTIONS VIA PROXYCHAINS HE NEEDS TO CONFIGURE NMAP WITH VERY SPECIFIC OPTIONS THE ST OPTION IS USED TO SPECIFY A FULL CONNECT RATHER THAN A SYN SCAN THE PN OPTION IS USED TO SKIP HOST DISCOVERY SINCE HE IS SURE THE HOST IS ONLINE THE N OPTION IS USED TO ENSURE NO DOMAIN NAME SERVER DNS REQUESTS ARE PERFORMED OUTSIDE OF THE TOR NETWORK THE SV OPTION IS USED TO PERFORM SERVICE AND VERSION DETECTION ON EACH OPEN PORT AND THE P OPTION IS USED WITH A COMMON SET OF PORTS TO PROBE SINCE TOR CAN BE VERY SLOW AND UNRELIABLE IN SOME CASES IT WOULD TAKE MUCH TOO LONG TO PERFORM A FULL PORT SCAN VIA THE TOR NETWORK SO HE SELECTS ONLY THE JUICIEST PORTS TO SCAN BT PROXYCHAINS NMAP ST PN N SV P 21 22 53 80 110 139 143 443 10 10 10 100 PROXYCHAINS 3 1 HTTP PROXYCHAINS SF NET STARTING NMAP 4 60 HTTP NMAP ORG AT 2008 07 12 17 08 GMT S CHAIN 127 0 0 1 9050 10 10 10 100 21 OK S CHAIN 127 0 0 1 9050 10 10 10 100 22 DENIED S CHAIN 127 0 0 1 9050 10 10 10 100 53 OK S CHAIN 127 0 0 1 9050 10 10 10 100 80 OK S CHAIN 127 0 0 1 9050 10 10 10 100 443 OK S CHAIN 127 0 0 1 9050 10 10 10 100 110 OK S CHAIN 127 0 0 1 9050 10 10 10 100 143 OK S CHAIN 127 0 0 1 9050 10 10 10 100 139 TIMEOUT S CHAIN 127 0 0 1 9050 10 10 10 100 21 OK S CHAIN 127 0 0 1 9050 10 10 10 100 53 OK S CHAIN 127 0 0 1 9050 10 10 10 100 80 OK S CHAIN 127 0 0 1 9050 10 10 10 100 110 OK S CHAIN 127 0 0 1 9050 10 10 10 100 143 OK S CHAIN 127 0 0 1 9050 10 10 10 100 443 OK S CHAIN 127 0 0 1 9050 10 10 10 100 53 OK INTERESTING PORTS ON 10 10 10 100 PORT STATE SERVICE VERSION 21 TCP OPEN FTP PUREFTPD 22 TCP CLOSED SSH 53 TCP OPEN DOMAIN 80 TCP OPEN HTTP APACHE HTTPD 110 TCP OPEN POP3 COURIER POP3D 139 TCP CLOSED NETBIOS SSN 143 TCP OPEN IMAP COURIER IMAPD RELEASED 2005 443 TCP OPEN HTTP APACHE HTTPD SERVICE DETECTION PERFORMED PLEASE REPORT ANY INCORRECT RESULTS AT HTTP NMAP ORG SUBMIT NMAP DONE 1 IP ADDRESS 1 HOST UP SCANNED IN 65 825 SECONDS JOE HACKER NOW HAS A TREASURE TROVE OF INFORMATION FROM HIS COVERT NMAP SCAN IN HAND INCLUDING OPEN PORTS AND SERVICE INFORMATION HE IS SINGULARLY FOCUSED ON FINDING HACKING EXPOSED NETWORK SECURITY SECRETS AND SOLUTIONS 4