CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Fun with 'Active Defense'

Active Defense is steadily becoming a popular trend in the security field, both in a theoretical and practical approach. From its humble beginnings it has made its way to a fully functional software implementations that aim at making your attacker's job a bit more miserable.

The whole concept can be treated as a response to insufficient defense mechanisms or simple desire to actively take vengeance on those who dare to attack your precious systems. Whatever the real reason is, lets have a look at how we can use some of the 'Active Defense' concepts in real life, without going into moral and legal aspects.

In order to effectively 'deal' with our attackers we need a tool that will implement at least two concepts:

  • Annoyance and Camouflage

Aims at maximizing the required amount of attackers manual work (preferably arduous and non automated) and significantly increasing the amount of generated traffic towards the target system or environment.

By default the reconnaissance phase should be time consuming and easily detectable by your intrusion detection systems...

In practice this can be achieved by a range of different (often combined) techniques - a few of them have been implemented in the Portspoof tool.

  • Offensive Defense(Exploitation)

Aims at DOS'ing and exploiting your attackers tools and software.

In practice it means exploiting your attacker's exploits or other scanning software, during their espionage against your system. This can be done in an automated (blind) manner or targeted at a particular bug in your attacker's software.

Based on the above-mentioned concepts, as a fully functional proof of concept, a tool called Portspoof was developed.
Its main purpose is to fool/slow down to ultimately keep attackers from staying low profile while trying to analyze your system(s). It can also help you to exploit their toolbox.

1. Annoyance and Camouflage (practical example)

Port scanning a system behind Portspoof :

# nmap -sV -p - portspoof.org

10531_8df27657-7277-4bb8-ab02-e79d2bbdd42f

Will result in:

  • 8 hour port scan
  • Around 120MB of sent data
  • 65535 open tcp ports (with identified services running on every port)
  • Imprecise OS identification results
  • Cool ASCII arts (ports 1-50)

Conclusions:

  • Stealth scans are no longer helpful, since all ports are always open.
  • For the moment - The only way to tell if a particular service is fake is with a protocol probe.
  • Services running on randomized ports can be really difficult to find.

2. Offensive Defense (practical example)

This research was not only focused on Nmap or McAfeesoftware (there are many others that are vulnerable), but due to their popularity I found them as a great example to support my claim about the huge potential that lies in "Active Defense".

Exploiting the official Nmap NSE http-domino-enum-passwordsscript (arbitrary remote file upload).

https://www.trustwave.com/en-us/resources/security-resources/security-advisories//TWSL2013-024.txt

This vulnerability was found while carrying out a code  review for some of the latest Nmap nse scripts.

Vulnerable http-domino-enum-passwords.nse code:

local status, err = saveIDFile( ("%s/%s.id"):format(download_path, u_details.fullname), http_response.body )


We are in control of 'u_details.fullname' and in order to bypass the second part of the format string parameter "%s.id" and be able to write arbitrary files to the operating system the following payload should be appended to the second format string parameter value (it exploits a bug in LUA io.open function):

10035_77ed5eff-6c5f-4716-ae50-a5ede4ce44ef

The issue allows you to upload multiple arbitrary files to the "attacker" system.

The command that will trigger the vulnerable script is:

$ nmap --script domino-enum-passwords -p 80 <evil_host>--script-args domino-enum-passwords.username='username',domino-enum-passwords.password=secret,domino-enum-passwords.idpath='/t

Exploiting McAfee Super scan 4.0 script (XSS UTF-7).

Super scan 4.0 port scanner has a report generation functionality that inserts version banners directly in to the generated html page.

Although most of the crucial HTML characters are filtered out to prevent Cross-Site-Scripting, like:< > ( ), the character encoding isn't defined. Therefore we are able to inject an old school partially encoded UTF-7 payload with a setter method to work around the parenthesis-filtering problem:

+ADw-img src=x onerror='a setter=alert,a="UTF-7-XSS";'+AD4-

This will execute unsophisticated JavaScript code in old browsers:

10672_94014fb7-99af-4c2e-bb74-e89c45dfde76

There is also a possibility in Portspoof to set up a fuzzing like approach with your own payloads and try to exploit some of the attackers XSS vulnerabilities blindly:

11046_a5d64ba9-1251-4d6e-8a61-5645038c7e6b

Conclusions

All software is prone to vulerabilities and security toolsare not an exception. You can either start looking for bugs in your attacker's toolboxes or be a bit more paranoid about the security tools that you use.Probably the best way forward is to start doing both...

Latest SpiderLabs Blogs

EDR – The Multi-Tool of Security Defenses

This is Part 8 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here.

Read More

The Invisible Battleground: Essentials of EASM

Know your enemy – inside and out. External Attack Surface Management tools are an effective way to understand externally facing threats and help plan cyber defenses accordingly. Let’s discuss what...

Read More

Fake Dialog Boxes to Make Malware More Convincing

Let’s explore how SpiderLabs created and incorporated user prompts, specifically Windows dialog boxes into its malware loader to make it more convincing to phishing targets during a Red Team...

Read More