Fun with 'Active Defense'

Active Defense is steadily becoming a popular trend in the securityfield, both in a theoretical and practical approach. From itshumble beginnings it has made its way to a fully functional software implementationsthat aim at making your attacker's job a bit more miserable.

The wholeconcept can be treated as a response to insufficient defense mechanisms or simple desire toactively take vengeance on those who dare to attack your precious systems. Whatever the real reason is, lets have a look at how we canuse some of the 'Active Defense' concepts in real life, without goinginto moral and legal aspects.

In order to effectively 'deal' with our attackers we need a tool thatwill implement at least two concepts:

  • Annoyance andCamouflage

Aims atmaximizing the required amount of attackers manual work (preferably arduous and non automated) andsignificantly increasing the amount of generated traffic towards the targetsystem or environment.

By default the reconnaissancephase should be time consuming and easily detectable by your intrusiondetection systems...

In practicethis can be achieved by a range of different (often combined) techniques - a fewof them have been implemented in the Portspoof tool.

  • Offensive Defense(Exploitation)

Aims at DOS'ing and exploiting your attackers tools andsoftware.

In practice it means exploiting your attacker'sexploits or other scanning software, during their espionage against your system. This can be done in an automated (blind) manner or targeted at a particular bug in your attacker's software.

Based on the above-mentioned concepts, as a fullyfunctional proof of concept, a tool called Portspoof was developed.
Its main purpose is to fool/slow down to ultimately keep attackers fromstaying low profile while trying to analyze your system(s). It can also help youto exploit their toolbox.

1. Annoyance and Camouflage (practical example)

Port scanning a system behind Portspoof :

# nmap -sV -p - portspoof.org

Screen Shot 2013-07-04 at 8.35.15 PM

Will result in:

  • 8 hour port scan
  • Around 120MB of sent data
  • 65535 open tcp ports (with identified services running onevery port)
  • Imprecise OS identification results
  • Cool ASCII arts (ports 1-50)

Conclusions:

  • Stealth scans are no longer helpful, since all ports arealways open.
  • For the moment - The only way to tell if a particularservice is fake is with a protocol probe.
  • Services running on randomized ports can be really difficult tofind.

2. Offensive Defense (practical example)

This research was not only focused on Nmap or McAfeesoftware (there are many others that are vulnerable), but due to their popularity I foundthem as a great example to support my claim about the huge potential that liesin "Active Defense".

Exploiting the official Nmap NSE http-domino-enum-passwordsscript (arbitrary remote file upload).

    https://www.trustwave.com/spiderlabs/advisories/TWSL2013-024.txt

    This vulnerability was found while carrying out a codereview for some of the latest Nmap nse scripts.

    Vulnerable http-domino-enum-passwords.nse code:

    local status, err = saveIDFile( ("%s/%s.id"):format(download_path, u_details.fullname), http_response.body )


    We are in control of 'u_details.fullname' and in order to bypass the second part of the format string parameter"%s.id" and be able to write arbitrary files to the operating systemthe following payload should be appended to the second format string parametervalue (it exploits a bug in LUA io.open function):

    Screen Shot 2013-07-25 at 10.36.06 PM

    The issue allows you to upload multiple arbitraryfiles to the "attacker" system.

    The command that will trigger the vulnerable script is:

    $ nmap --script domino-enum-passwords -p 80 <evil_host>--script-args domino-enum-passwords.username='username',domino-enum-passwords.password=secret,domino-enum-passwords.idpath='/tmp'

    Exploiting McAfee Superscan 4.0 script (XSS UTF-7).

      Superscan 4.0 port scanner has a report generationfunctionality that inserts version banners directly in to the generated htmlpage.

      Although most of the crucial HTML characters are filtered out to prevent Cross-Site-Scripting, like:< > ( ), the character encoding isn't defined. Therefore weare able to inject an old school partially encoded UTF-7 payload with asetter method to work around the parenthesis-filtering problem:

      +ADw-img src=x onerror='a setter=alert,a="UTF-7-XSS";'+AD4-

      This will execute unsophisticated JavaScript code in old browsers:

      Screen Shot 2013-07-05 at 6.34.10 PM

      There is also a possibility in Portspoof to set up a fuzzinglike approach with your own payloads and try to exploit some of the attackers XSS vulnerabilities blindly:

      Screen Shot 2013-07-05 at 4.58.10 PM

      Conclusions

      All software is prone to vulerabilities and security toolsare not an exception. You can either start looking for bugs in your attacker's toolboxes or be a bit more paranoid about the security tools that you use.Probably the best way forward is to start doing both...

      Related Advisories:

      https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt

      https://www.trustwave.com/spiderlabs/advisories/TWSL2013-024.txt

      Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.