Categories
Podcast Episodes

Steamed hams but its a text based adventure game. Ep 4 of the Cyberkat cafe podcast is available now!

Hello to all you 1337 haxors surfing the interwebs, if you like memes and text based adventure games I have great news for you. I’ve recently released an open source text based adventure game based on Steamed Hams. I go into more detail in the episode and do a play through of the games main path on my podcast.

Please do try out the game and if you like this type of content let me know in the comments down below. And since you’re here I’ll give you a tip, try using the Hint verb. Who knows what you might find out…

Stay tuned for next episode where I talk about Von Neumann architecture and how analog computing may be the answer for neural networks and compute in memory!

Until next time this is Killer Kat signing off! Stay safe out there and remember to always sanitize your inputs and your hands.

Categories
Podcast Episodes Uncategorized

CyberKat cafe Podcast ep 3 on the Y2K crisis is out now!

Hello internet it is once again your friendly neighborhood Script Kitty here with another episode of our podcast, this time I cover the Y2K bug through a modern lens of Cybersecurity and Emergency management. Check it out here: https://anchor.fm/cyberkatcafe/episodes/Ep-3-The-Millennium-Bug–A-hackers-retrospective-on-Y2K-e1t0s3c

And with that said, this is Killer Kat signing off, stay safe out there and I’ll see you in the New Year!

Categories
Podcast Episodes Uncategorized

Tis the Season for Cybercrime: 5 Things you can do to protect yourself this holiday season.

Hello again internet, its me your host the Script Kitty: Killer Kat! Once again the holidays are right around the corner and I have a special gift for you, 5 things you can do to protect yourself from cyber crime this holiday season.

Whether you are looking under the tree for a new VR headset, a smart home device, or anything else WiFi enabled there is one thing for sure, black hat hackers are waiting for their own present, the thousands of unpatched devices that go online every year on December 25th. Every holiday season thousands of people receive new devices as gifts and in a rush to use their new devices many people, especially younger people skip installing device updates before connecting and using the device. To a hacker an unpatched device is a goldmine, many security updates contain fixes for well known security issues and when a device is left unpatched it allows hackers to gain easy access by exploiting well known security flaws. Because cyber criminals know lots of unpatched devices will go online on December 25th many of them search for and target these unpatched devices, but the good news is that knowledge goes both ways and that brings us to my first tip: Update and setup devices before gifting them. If you have a game console, computer, phone, or any other device you are planning to gift to someone this year (especially if that person is younger) take the time to install software updates and set up the device before hand. Not only will this protect the device from opportunistic cyber criminals but it will also save your loved ones valuable time spent waiting for software updates to download and install on Christmas morning.

Installing software updates will keep your devices from getting hacked through outdated software but what about more deceptive social engineering based attacks. Well its sad to say but the holidays are a prime time for cyber scams such as phishing, with many cyber criminals exploiting the chaos of the holidays to craft convincing looking emails or phone scams designed to trick you into loosing your valuable data. If you get an email that informs you of a problem (Usually with an online shopping order) and provides a link that then asks you to reenter your login information, then there is a good chance that you have fallen victim to a classic phishing scam. Lucky I have some tips to help you avoid these scams, if you are presented with a login page close that page of your browser and manually enter the website directly, this prevents hackers from using fake websites to steal your login information. Even though the idea of a fake website seems a little crazy at first glance, through a combination of almost identical URLs and exactly copying the original webpage’s HTML (Which is the information your web browser uses to show you what a website looks like) these fake websites have fooled even experienced Cybersecurity experts and high ranking government officials.

On the topic of shopping online, this next topic is something I’ll be exploring in future episodes so if you haven’t already please consider subscribing so you don’t miss out on those and all the rest of the fascinating content I have in store for the CyberKat Cafe! With that said our third topic is online shopping. Be it fake 5 star reviews, counterfeit and mislabeled goods, or even straight up scams the holiday season is rife with online shopping based cyber attacks. Some things to watch out for while shopping online are: Fake 5 star reviews, many online brands have been bribing regular users on sites like Amazon to leave 5 star reviews in exchange for free products and sometimes cash or gift card payments. While this goes against the rules of basically every online market place I have reported this behavior directly to amazon and they declined to comment, I’ll also note that as of time of writing they have also not taken visible action against the companies and people involved in this. So since Amazon is not going to take these reviews down, I’ll help you spot them. The first thing to look for are vague 5 star reviews that don’t really say anything about the product, usually something like “Its great!” or “I bought this for someone and they loved it!”, especially look out for “I haven’t received/used this yet but it looks great!” many of these fake 5 star reviews get a rebate on the purchased item that is only applied once they have left the review so they will often times leave a review before they actually get the product so they can get their rebates early. I’ll be going further in depth on my research into this issue so if that is something that interests you watch this space.

Another thing to look out for while shopping online is SEO or Search Engine Optimization. Now SEO by itself is not malicious, perhaps a little manipulative or deceptive but never the less a standard practice used by organizations to improve online visibility. SEO takes advantage of the way search algorithms work to make something appear more frequently or higher up in searches. Have you ever seen an amazon post with 30 different keywords in the product name before getting to what the item is actually called? Usually something along the lines of “| Gift for him | Gift for her | Travel |For home | gift for men ” etc. That is a classic example of SEO in action, because these keywords are so effective at getting visibility and selling products they are often combined with other scams such as the fake reviews mentioned above. Real companies with established brands don’t use SEO like this to grab attention, and while not every product with a word salad title is a scam the majority of them are low quality and not worth your money.

So you have your gifts bought online safely, software updates installed, you’re safe right? Well almost, there is one last way that black hat hackers take advantage of the holiday season and that’s through holiday apps with hidden malware. As reported by Barracuda Networks hackers are using holiday themed android applications to infect users phones with malware. Now malware on Android is nothing new, I even have an upcoming episode on the disturbing prevalence of Android malware. The best way to protect yourself against this malware is to only download apps from official market places such as the Google Play Store, however even the Play Store is rife with malware. Be cautious of downloading free apps and of apps that ask for unnecessary permissions. There are many kinds of malicious apps, some slow your phone down by using its resources to mine Cryptocurrency or to show you thousands of invisible ads to farm ad revenue. Some will steal your information or encrypt your phone. But no matter what kind it is, malware is certainly something you don’t want to get for Christmas.

My 5th and final tip is to share this with someone, Cybersecurity works best when everyone is informed and educated about best practices. The human element is often one of the easiest things for hackers to exploit but with proper education it can also be one of the greatest defenses. This holiday season take the time to share this with someone you love so they can be informed and protected against cyber criminals. And if you enjoyed this please remember to subscribe so you can be notified whenever new content is available.

And with that said, until next time this is Killer Kat signing off, stay safe out there, and don’t forget to have a merry Christmas and a happy New Year!

Categories
Meta

A signal through the noise: The CyberKat Cafe podcast goes live.

Hello internet! Welcome back to the CyberKat Cafe with me your host the Internet’s resident Script Kitty, Killer Kat! For the first time ever available in audio format.

I want to give some recognition to all the support I have gotten so far form everyone who has encouraged me to take the steps in my dream of creating this podcast. Thank you all, I could not have done this without you!

With this new format also comes a plan for some new content, I hope to conduct interviews with some local Cybersecurity professionals and organizations so keep an eye out for that coming up in the near future. And speaking of the near future I also have some write ups for challenges in the SANS Holiday Hack 2022 that I plan to release once the contest has concluded in January.

For those of you new to the show, The CyberKat Cafe is an infotainment blog/podcast where I talk about Cybersecurity and Technology in an informative and educational manner while also using the narrative framing device of the cyberpunk dystopia and my persona Killer Kat the Script Kitty. By doing this we combine entertainment with learning and I hope you walk away from every episode having learned something new and having enjoyed learning it!

I have a lot of exciting things planned for this Podcast and if you want to be a part of the team or want to appear as a sponsor please reach out to me at our website https://cyberkatcafe.com/. (That’s here if you’re reading this on the blog!)

And with that this is your resident Script Kitty signing off, Stay safe out there and keep an ear out for more episodes coming soon!

Categories
Uncategorized Write Ups

Sans Holiday Hack 2022 Dusty Giftwrap: Windows Event logs writeup.

Hello once again internet, it’s me your one and only peppermint flavored script kitty here to wish you a happy holidays and to talk about the Sans Holiday Hack 2022! As you may know every year the team at Sans put together an online event where you can watch informative talks, solve fun hacking puzzles and talk with the Infosec community. This year I’ll be doing write ups of some of the puzzles, now I should note that it is a policy of mine to never do write ups on currently active competitions or anything that could give someone an unfair advantage. Since the event is over the activities are purely educational and exist only for fun and learning. Since fun and learning are the two cornerstones of the Cyberkat Cafe lets boot up our Christmas Synthwave Playlists and hop right into one of the first challenges!

To start the challenge off we talk with an elf by the name of Dusty Giftwrap in the Tolkien Ring area. He lets us know there was a compromise of some administrator credentials by an attacker looking to steal the secret ingredients to the Lembahn bread. However PowerShell auditing was enabled and they have saved the logs to a flat text file for us to analyze. We complete this challenge by correctly answering a series of questions related to the attack.

Now straight away the terminal lets us know that grep (Global regular expression print) will be a very useful tool and links us a helpful page on grep usage. The most important options are -i for ignore case and -n for show line numbers.

The first question is “What month/day/year did the attack take place? For example, 09/05/2021.” and there are a couple of different ways we can go about answering this question. We could take the rather primitive method of using grep **/**/2022 to get a list of all the dates in the log-file and Brute-force all the different dates, however using some Blue Team knowledge we can take a more sophisticated approach. Since we already know that there was unauthorized activity we can search the log for event ID 4104 which is the execution of a remote PowerShell command (For more information on finding malicious activity in Windows logs I recommend you check out this excellent blog post by Liam Clearly). On its own event ID 4104 doesn’t mean there was a security incident however if we do grep -n 4104 powershell.evtx.log and take a look at the entries we will see a large amount of activity on 12/24/2022 and this anomalous activity lines up with our knowledge of the attack. Using this information we can answer the first question.

Now the second question “An attacker got a secret from a file. What was the original file’s name?” a good question and again there are multiple ways we can get our answer. They way I did this was by first using some information we already know, the attacker was looking for the secret ingredient to Lembanh bread so lets do a search: grep -n Lembanh powershell.evtx.log with this we can see two interesting pieces of information on line 20207 a user was writing text to the file mydiary.txt and further up we can also see some log entries referencing “Lembahn Original Recipe”. Since we know there is a user writing to text files lets take a look for more entries in the log using grep -n Lembanh powershell.evtx.log with this we can see the other diary entries as well as some activity happening to a recipe.txt using this information we can answer the second question.

The third question “The contents of the previous file were retrieved, changed, and stored to a variable by the attacker. This was done multiple times. Submit the last full PowerShell line that performed only these actions.” caused me a bit of difficulty because I was trying to use control-v instead of control-shift-v to submit my answer, but how did I get that answer? Well in our last grep search we can see the attacker is using a variable foo to replace honey with fish oil, so if we do a grep search for fish we can see on line 7997 $foo = Get-Content .\Recipe| % {$_ -replace 'honey', 'fish oil'}.

Question 4 is “After storing the altered file contents into the variable, the attacker used the variable to run a separate command that wrote the modified data to a file. This was done multiple times. Submit the last full PowerShell line that performed only this action.” and we know the variable is foo so by doing grep -n foo powershell.evtx.log on line 7462 we see $foo | Add-Content -Path 'Recipe'. and for question 5 “The attacker ran the previous command against a file multiple times. What is the name of this file?” We can just look at our previous grep to get the answer. For question 6 “Were any files deleted?” we already know the answer from one of our previous grep searches however we can also do another search grep -n del powershell.evtx.log to look for the delete command which we see on line 6568 & 6762 and using that we can answer question 7 “Was the original file (from question 2) deleted? (Yes/No)”

Question 8 “What is the Event ID of the log that shows the actual command line used to delete the file?” Well if you remember from our first search we were looking for Event ID 4104 to see if there were many remote PowerShell commands on a certain date, this provides us with the answer to this question. Question 9 “Is the secret ingredient compromised (Yes/No)?” Is pretty simple because we already know the answer from answering question 3. And finally question 10 “What is the secret ingredient?” is also known to us because of our answer for question 3.

And with that we have completed the challenge and are rewarded 10 KringleCoin’s to spend on hats for our avatar! I hope you enjoyed this write up and this challenge, I know I learned a few tricks for analyzing windows logs and I also really enjoyed the challenge! As always if you did anything different or have any questions please let me know in the comments down below. And if you like this content please consider following my blog so you can be notified whenever I have a brand new piece of educational content to share with all you 1337 hax0rs and script kiddies out there surfing the information superhighway!

This is your one and only resident Script Kitty signing off, stay safe out there and remember never reuse your email password and have a happy holiday season!

Categories
Uncategorized

A hackers perspective: Understanding Emoji, Character encoding and why Chipotle only lets you have 3 welsh flags. 🏴󠁧󠁢󠁷󠁬󠁳󠁿

Hello Internet! It’s me once again your resident Script Kitty, here to bring you another post that I have had on my back burner for awhile now but have chronically postponed due to my ADHD and executive functioning difficulties.

Today’s topic is something that I have been researching for awhile now, as someone in the Cybersecurity world I enjoy learning about how various systems and technology work and then thinking about how different scenarios and interactions would effect or break the systems. Which brings us to our main topic today Emoji! What are they?, How do they work?, and Why is this one 🏴󠁧󠁢󠁷󠁬󠁳󠁿 so special?

To explain emoji we have to look way back, at how computers display text in the first place, you see your computer is not storing the actual words or even the letters that make up the words. Instead because all information inside a computer is ultimately comprised of binary data (strings of 1’s and 0’s) computers use something called Character Encoding. You have probably even heard of one of the most impactful character encoding scheme ASCII or American Standard Code for Information Interchange, or as the IANA (Internet Assigned Numbers Authority) prefers it to be called US-ASCII (Source). The reason why you have probably heard of ASCII before is from the term ASCII art, the practice of arranging different ASCII characters to form images. Before Emojis this was the only way to convey symbolic information through text, but how does ASCII and by extension Emoji work?

ASCII and other character encoding schemes work by translating the binary information stored in your computer into different characters. For example the capital A is 065 and the space (and yes even things we would not normally think of as characters such as space need to be included in digital text) is 032. But the astute among you may have realized a discrepancy I said that the characters were stored as 1s & 0s but 65 and 32 don’t have either. In the computer these numbers are stored as binary numbers also known as base 2. 65 would be 1000001 and 32 would be 100000. In computer memory these numbers are stored as groups of 8 Binary Digits also known as bits, with a group of 8 bits being called a byte (and a group of 4 bits being called a nibble!). Because of this encoding schemes even convert numbers, with 1 in ASCII being 0110001 and 2 being 0110010 3 as 0110011 and so on. You may be thinking something like “Well that’s nice KillerKat but how does this relate to Emoji and Chipotle?” and to answer that we have to look at the limitations of ASCII, its all well and good if you want to say something like 1001000 1000101 1001100 1001100 1001111 (HELLO) but what if you want to say something like “¿Dónde está el gato de Internet?” or “ネット猫大好き” well in that case you would run into a problem. ASCII doesn’t support Spanish accent marks (not even ñ) or Japanese Kanji, however as evidenced by that fact you are reading this our modern systems can.

This is where Unicode comes in, it allows users to bridge the gap of different languages and have all computers be capable of displaying all supported languages. To quote Wikipedia (Yes I know an academic sin but this article is an overview not a research paper) “Unicode and its parallel standard, the ISO/IEC 10646 Universal Character Set, together constitute a modern, unified character encoding. Rather than mapping characters directly to octets (bytes), they separately define what characters are available, corresponding natural numbers (code points), how those numbers are encoded as a series of fixed-size natural numbers (code units), and finally how those units are encoded as a stream of octets. The purpose of this decomposition is to establish a universal set of characters that can be encoded in a variety of ways.” -Wikipedia. This may sound complicated at first glance but the important part to understand for our purposes is that characters are no longer 1 byte (a set of 8 binary digits) but are instead defined as possible characters within a standard shared set of characters, again an oversimplification but we just need to know 2 things: 1. Not every computer/system will support all Unicode characters 2. Unicode characters can be multiple bytes or “characters” long.

Now at this point you may have already guessed that Emojis are part of Unicode, unlike previous emoticons found in IM applications or cellphones that only worked on the same platform Emojis are part of the Unicode standard. Being part of the Unicode standard means that you can send Emojis to different platforms, but you may notice that many emojis look different between platforms. This is because the Unicode standard simply describes what the emoji is, and its up to the platform to create the Emoji images themselves. This also means that not every platform supports every Emoji, if you use an old Android device you may notice it doesn’t support newer emoji. This is one of the key behaviors observed with my experiment, a second thing to note is that not all Unicode characters are visible some such as the space do not show up as characters themselves but instead influence the spacing and design of other characters. However to a platform that does support these invisible characters they would appear just as any other unknown character, usually a ?, a box, an emoji of an alien, or something to that effect.

When Unicode added support for variations in Emojis such as different skin colors or genders they did not create entirely new Emojis, instead they used these invisible characters to specify these attributes after the original Emoji. If you have a platform that does not support these changes it would still be able to show you the original Emoji allowing for backwards compatibility and limited support for lightweight systems. Indeed that may be why this: 🏴󠁧󠁢󠁷󠁬󠁳󠁿 Emoji appears as a black flag instead of the flag of Wales. Because instead of adding an entirely new Emoji for the flags of the UK Unicode extends the black flag. All of the flags for countries do this, which meant that in older versions of Twitter they would count for 2 characters. However after complaints following the introduction of the skin color emojis Twitter fixed the issue so that emojis only counted as a single character. The reason why Twitter was counting these emojis as multiple characters is because they are comprised of multiple invisible characters and the emoji in question, and to a computer it looks exactly the same as a string of multiple characters.

Now if you are a hacker like myself (White hat of course) then you may have already had the same thought I did. If these Emojis are comprised of multiple characters of information but act like a single character can you use them to cause buffer overflows? Yes, I can confirm that indeed you can. At one point I added an Emoji to my name on a Chipotle online pickup order, and I noticed that it printed out 2 ?s on the label. This made me ask 2 questions, firstly can I cause a buffer overflow and secondly what is the Emoji with the most amount of characters? Well it turns out that the answer is yes, and our friend the Welsh flag Emoji!

Putting these two pieces of information together I created a new online order and found that any more than 3 welsh flags will overflow and return an error code, the limit seems to be around 39 or so “characters”. Below you can see an example of what prints out if you put 3 welsh flag emojis into the order field, the label maker seems to run out of space before it prints all of the characters. This presents the opportunity for a future test where I attempt to place in a string of valid characters and see if it gets cut off as well.

A Chipotle order label showing many ? characters because 3 welsh flags were interred into the order name field. Copyright KillerKat 2022

The next obvious step was to research if someone else has done any similar attacks and a quick google search reveals that yes, Similar Emoji Buffer overflows have been performed. As with most of my good ideas, great minds think alike and there is a quite staggering amount of minds out there ready to have the same ideas as you. Since the concept has been proven I plan to test a few different fields in various places (All above board of course).

I hope to be posting more here soon, I’ve been doing a lot of exciting things lately. The next project I hope to cover is a soldering kit for a Bluetooth-speaker / radio combo. And if you have any stories related to buffer overflows or Chipotle please leave them down in the comments below.

With that this is KillerKat once again signing off, Stay safe out there and remember to always check your input fields!

Categories
Uncategorized

The Holiday Season, How it Effects Cybersecurity and What You Should do About it.

Hello once again internet, its me your favorite (and only) Script Kitty here to wish you some holiday cheer as we talk about the holidays and what that means for Cybersecurity.

Every year during the holiday season hundreds of people go online to purchase Christmas gifts for their family members, and this influx of activity has some risk associated with it. Always remember to practice good internet hygiene as holiday themed Phishing attacks are a common occurrence as well as less than reputable sellers hawking counterfeit goods. Just because the amazon listing says it has good reviews or its a name brand product doesn’t mean it is and Amazon knows that but doesn’t care; Pro Tip always make sure you know exactly what you’re buying or at least have a look at the seller page to see if its shady.

I have 2 related articles coming out soon exposing how companies pay Facebook users to leave fake amazon reviews and how Etsy is knowingly selling fake “Handmade” goods and the proof I collected as well as their refusal to remove these products. In the mean time if something seems too good to be true it probably is, don’t risk it.

But what about once all the shopping is over? Does the risk stop once you gather with your loved ones to exchange gifts? No sadly as one big thing to be on the lookout for this holiday season as someone who is informed about Cybersecurity is configuration of new devices. It happens after someone unwraps their new smart toaster, VR headset that makes maps of your house, RGB enabled smart face mask , or something less cyberpunk like a new laptop or smart phone. Every Christmas there is a large influx new poorly secured devices coming online and the attackers know it. Many people rush to set up these devices as fast as possible and overlook important security controls thus creating this attack surface which in turn shows the true spirit of Christmas by gifting Cyber Criminals with the gift that keeps on giving. This year if you know tech gifts are coming up take the time to discuss with the gift giver beforehand and the recipient afterwards and make sure that best practices are followed and everyone stays safe this Christmas.

And of course no December would be complete without the annual SANS Holiday Hack. As they say on their website:

Join the global cybersecurity community in its most festive cyber security challenge and virtual conference of the year. The SANS Holiday Hack Challenge is a FREE series of super fun, high-quality, hands-on cybersecurity challenges where you learn new skills, help Santa defeat cybersecurity villains, and save the whole holiday season from treachery. The SANS Holiday Hack Challenge is for all skill levels, with a stellar prize at the end for the best of the best entries.

I would highly recommend everyone to check it out even if you’re new to the Infosec community there are lots of great talks by people in the industry, last year I watched a great talk by Josh Wright about open S3 buckets which I highly recommend watching as could security is still as relevant as ever perhaps even more so with more webdevs using cloud based tools. Click this hyperlink to get more information or to start playing and a big thank you to SANS for hosting this event every year. I hope to see you there this year readers, if you see me feel free to say hello.

And with that its Killer Kat signing off until next time happy holidays, stay safe out there and keep tuned for those articles exposing Amazon and Etsy for knowingly allowing fraud on their platforms.

Categories
Uncategorized

Why I chose Infotainment, and how I think it could help shape our future.

Hello Internet! Once again its me, your resident script kitty here to talk about something meta.

As you are aware I chose to run my InfoSec blog as an infotainment platform and you may be wondering why, I would like to share my thoughts on the matter and how I think more Infotainment could help the industry as a whole.

Now right off the bat I would like to acknowledge some inspirations of mine, The SANS Holiday Hack challenge is probably the best example of infotainment in the Cyber Security sphere at time of writing. I personally enjoy it every year and I know when I was first starting out it helped make many of the complex ideas and discussions around Infosec less intimidating.

I would also like to spotlight some excellent Infosec Youtubers. LiveOverflow & PwnFunction come straight to my mind as excellent examples. Youtube as a platform as really brought infotainment into the mainstream as a medium and as someone who loves a lot of what these YouTubers are doing, and they ways they are making complex topics easy to understand and engage with while also providing free access to education content I think they deserve respect.

PBS digital studios, Game Theory and other independent creators have really spearheaded this trend and what we have seen is a massive increase in both interest and engagement in many topics often considered difficult or dry. I think the Infosec community could benefit greatly from a similar culture. How many times have you had someone say they “Just cant understand all this computer stuff” or “I don’t need to worry about my password or account security that’s what we have you for!” because they don’t understand and/or don’t want to learn even the fundamentals of Cyber Security because they view it as complex or uninteresting.

I think we all know, the human layer is the weakest part of security. This is why user awareness training is so important and why we as an industry invest so heavily into it. If you look around in the modern organization everyone is blueteam, each employee has the potential to either cause a security incident or strengthen the overall security landscape through their actions and knowledge. The future of blue team is going to involve making sure every person on board is aware of the nature of Cyber Security and the risks and potential warning signs that they may encounter.

I feel the next logical step is to move from user awareness training (Which often falls into the infotainment category itself) into a larger infotainment environment. While it may not appeal to everyone creating this media will bring these topics into conversation and provide an easy entry point for anyone who is interesting in learning more about InfoSec who may not have the resources or prior knowledge to learn through more traditional measures.

By taking something important and making it fun we can create a culture of learning and knowledge that will provide benefits to everyone involved. I truly believe that humanity is on the precipice of a new era and that educating people so they are better prepared to face the challenges of our ever evolving digital world is more important than ever.

And that is why I say: Until next time, this is your resident Script Kitty signing off!

Categories
Uncategorized

HackTheBox Delivery User own Write-up.

Hello Internet, its your resident script kitty here to talk about how I got my first own on a HTB machine. Now that Delivery is retired I can share with you the details of exactly how I got user and the interesting process that it involved.

Interestingly the largest challenge for me to overcome was that I did not initially realize that I would have to manually add the server to my hosts file because of the architecture of the lab environment. For those who are confused like I was allow me to explain, because the HTB boxes are not connected to the internet in order to resolve subdomains you must add the ip and subdomain manually to your hosts file. On Linux its as simple as just doing sudo nano /etc/hosts and making the changes, without this you may repeat my mistake of getting stuck because the subdomain wont load and going down a rabbit hole looking for the solution.

Now with that out of the way lets begin our examination, when first scanning with Nmap we see that there are only a few ports open. 22,80, and 8065. With a open port 80 its pretty obvious our first move, we connect to the server with out web browser and sure enough its a website(Pictures not included sadly as I forgot to take them at the time and I don’t have the premium subscription so I cant get back into retired machines). A cursory examination of the landing page reveals that they have a help desk page, this is where adding the subdomain to your hosts file is important. But perhaps more interesting is that they have a Mattermost server that only requires a @Delivery.htb email address, but how would we get one?

Now this next step took me awhile because as previously mentioned I was unaware of the need to add the subdomain to the hosts file. Once you check out the help desk site you notice 2 things right away, the first is that it generates you an email address based on your ticket number that you can email to update the ticket and the second is that you don’t need any authentication to submit a ticket.

From here the solution is pretty obvious however I did get stuck for a second because when viewing the ticket you have to use the exact same email address you used to submit it, otherwise it wants you to create an account and verify your email address which is impossible because the server is isolated from the internet. I don’t know if this is a quirk of Firefox or if I just didn’t see a space or something but when it auto-filled for me the site would reject the email, I had to manually copy paste the email in.

Now that we have a ticket we can open a new tab and direct our browser to 10.10.10.222:8065 and see the Mattermost page, when creating a new account it sends an email with a link that validates your account however how can we view the email? Simply have it send the email to the ticket updating email we got in the last step, once sent you can see it updates the ticket and you are able to click the link and login.

Now that we are in the Matermost server we can see that the admin has left a few messages that give us exactly what we need, the login for a user with standard privileges and instructions for what we need to do if we want to get root on the box.

The next step is as simple as logging into the server via SSH on port 22 and doing cat user.txt and submitting the hash. Now I wont be covering root here today as I don’t currently have access to the retired machines, but if you’re interested the official walk though has been posted now that the machine is retired.

That’s all I have for you in this one, but if you liked this write-up please consider subscribing so you can get even more Infosec content like this, and if you have any thoughts or questions you can leave them in the comments below. Until next time, this is your resident script kitty signing off.

Categories
Uncategorized

Windows Physical Access Vulnerability, Intentional Backdoor or Gross Incompetence?

Hello once again internet, today I wanted to talk about a pretty old hack that I’m sure most of you are already familiar with: using a windows install USB stick to gain a privileged command line.

Now if you were like me then this hack might have been one of the first that you performed on an actual production system. Whether it was your own system and you just were curious to see if it would work or if like me you had a friend who forgot their password after changing it and said “Hey you’re a hacker right? Can you help me get back into my laptop.”.

The simplicity of this exploit allows even script kiddies to gain control over a windows system provided that they have physical access, this raises the question why hasn’t Microsoft patched this exploit? Today I seek to answer that question, first we are going to look at just how this vulnerability can be exploited and then we are going to look at how it can be prevented, then I’ll share my thoughts on why I think Microsoft hasn’t patched it.

Where this vulnerability really shines is in how simple and easy to use it is, you need 2 things, A windows install loaded onto a USB flash drive and physical access to the target machine. Once you boot to the flash drive you can use a keyboard shortcut to bring up a command line, next you replace one of the executables in the system32 folder with cmd.exe or ftp.exe, restart the computer and boot into the OS and then launch the executable either via keyboard shortcut or by the GUI. This brings up a privileged command line and then you own the system. For an in depth guide I recommend checking out this guide from TrustedSec.

Now lets talk about prevention, this is a relatively easy attack to prevent the obvious solution being secure the machine against physical access. However for use cases where this is infeasible the next step is to disable USB ports or use a bootlocker, if the attacker cant boot from the usb drive or change the executable names then they cant exploit this vulnerability. The third option is anti virus signatures/definitions, tellingly windows even has signatures that allow windows defender to block certain renamed executables preventing this Trojan from occurring however not all combinations are blocked.

Building on that last point lets talk about why this still works, although some combinations of filename/executable are blocked from running Microsoft has allowed some to still function including my personal favorite changing magnify.exe to ftp.exe. Personally I believe this was intentional on Microsoft’s part as there are advantages to leaving a backdoor in windows.

My reasoning is twofold, first because of the numerous ways to prevent such and attack and that it requires physical access I doubt that large organizations are putting pressure on Microsoft for a fix as this will mainly effect end users and personal systems. This allows legitimate technicians and state sponsored intelligence agencies/law enforcement access into these personal devices. And second because this is a well known vulnerability Threat Actors are more likely to attempt this attack instead of looking for other vulnerabilities that leverage physical access, this gives Microsoft and security researchers time to find and address these vulnerabilities before they can be exploited in the wild.

Now I should state that I currently have no affiliation with Microsoft and that I would personally disagree that the vulnerability should be intentionally allowed to remain, however I do feel that Microsoft’s actions or rather inaction in this case is not an example of ignorance but instead is a strategic move on the part of Microsoft.

Let me know your thoughts in the comments down below, and until next time this is your resident Script Kitty signing off.