Easy Exploit

If you ever want to try an easy exploit, I recommend the Intel AMT Vulnerability CVE 2017-5689.  This vulnerability is slightly scary because it's a firmware vulnerability that is accessible remotely.  The only problem:  You need a computer that has an Intel VPro Core processor.  Those are usually sold to businesses.  They are easily spotted because they usually have a nice sticker that says its a VPro Core Processor.  Not always though.  Sometimes the sticker is removed, or it never had one, so check the processor specs online if you aren't sure.

Items Needed:

Computer with an Intel Core VPro Processor
AMT drivers and software
Firefox and Tamper Data-or whatever you prefer to use to tamper with html requests.

The vulnerable processors and AMT version numbers are here:

https://security-center.intel.com/advisory.aspx?intelid=intel-sa-00075&languageid=en-fr

Here is a getting started guide for setting up Intel AMT, if you'd like to try to exploit this vuln:

https://software.intel.com/en-us/articles/getting-started-with-intel-active-management-technology-amt

The only nightmare is getting the computer configured to be vulnerable.  I found that if you custom install Windows, that some of the required drivers are not present, so you have to look up your computer model number and install the drivers.  Once that is done, it's not so bad to configure.

You have to configure it in Intel Management Engine BIOS extension (Intel MEBx).  For the computer I was testing, I had to press Ctrl-P before the computer booted into Windows to access that menu.  Then you just configure all the options.  Piece of Cake.

There's plenty of tutorials about how to exploit the vuln.  One is here:

https://security-center.intel.com/advisory.aspx?intelid=intel-sa-00075&languageid=en-fr

The user has to be admin, or a valid user, otherwise, obviously, it won't log you in.

Thankfully, it looks like this vuln has been patched, so make sure to install the patch if you have vulnerable systems.

It's good to be admin. :)  Have fun.

DerbyCon Door Key Challenge

If you look on Twitter, CounterHack has opened the DerbyCon Door Key Challenge up to everyone.  I'm not going to publish the answers to the challenge right now so that others can join in on the fun.  It's open until October 13th.  Didn't take long to solve.  You should be able to use your mobile phone to solve it.  Good luck!

Fortinet HQIP Test

I've been busy lately, obviously.  Learning a bunch of new stuff related to my job, and some unrelated.  In order to be good at information security, one should be good at areas in IT-the sys admin work.  So I'm learning about Fortigate firewalls.  

Sometimes issues come up and tests need to be performed in order to be able to get a return authorization for the device.  Since I have an older model, I had to perform something called an HQIP Test.  The directions are here: 

http://wiki.diagnose.fortinet.com/index.php/Running_an_HQIP_(Hardware_Quick_Inspection_Package)_test

The directions show the diagram for the 60C Model.  The model that I have is a 60D.  Needless to say, there are a couple of different things about the model that I have.  Mine has 7 switch Ports, a DMZ port, a WAN1 port, and a WAN2 port.

So, I will describe how to perform the test to make others lives easier.

Make sure you have everything that you need:

Hardware

Laptop/Desktop Computer to act as Terminal/TFTP Server

Ethernet Cables * 5 in this case.

A USB-to-Console adapter

The console cable that came with the device.

The power cable that came with the device.

A paper clip.

USB drive

Software

FortiExplorer can be used.  However I didn't use it because I didn't know how to save the output with it.  In order to do an RMA, the output must be included with the request.

I used Putty and SolarWinds TFTP Server.  

Correct HQIP Test Image

Firmware Image on a USB drive in case something goes wrong.

Acquire The Test Image

The image can be downloaded from the Fortinet Support site.

https://support.fortinet.com

• Login with your account username and password
• Click on your account.
• Select the Download Tab
• Select the HQIP Images Option
• Click on the text-box
• Type in your serial number
• Download the specified test image by clicking on the link.
• Once the TFTP Server is set up, move this image from downloads to C:/TFTP-Root which is the default folder for SolarWinds TFTP Server or whatever folder you set it up to be in.

Device Set-UP

• Connect the USB-Console adapter into the firewall via the Console Port
• Make sure that the other end is connected to the laptop via the USB port.
• Connect the Ethernet Cable from the laptop to the WAN1 port on the firewall (this can be any of the ports so long as it’s configured properly in the test script.)
• Connect the loopback wiring according to the diagram below.  If the diagram is wrong, the test will tell you how to wire it properly.
• You will not start out with the device properly wired according to the instructions.  Wire as much of it as you can to make your life easier later.  Don’t worry that you can’t wire all of it properly yet.  One port has to be connected to the laptop serving as the TFTP Server/Terminal, leaving one port open.  This is normal.  Before the test is performed, you will be asked to wire the rest of it properly.
• Connect the Power Cable

FortiWifi 60D Loopback Wiring Diagram

Port 1 to Port 2

Port 3 to Port 4

Port 5 to Port 6

Port 7 to DMZ Port

WAN1 Port to WAN2 Port

Set Ethernet Adapter to Static IP Address

For Windows 10:

• Right-Click on the Connection Icon in the task bar on the right hand side
• Select “Open Network and Sharing Center”
• Click on the “Change Adapter Settings Link” on the left-hand side
• Right-Click on the Adapter you want to use
• Select “Properties”
• Click on “Internet Protocol Version 4 (TCP/IPv4)” to highlight it
• Click the “Properties” button
• Select the “Use the following IP Address” radio button
• Type in the desired IP Address, Subnet, and default Gateway

Make Sure that the Firewall Allows TFTP

For Windows 10:

• Click the Windows icon at the bottom left of the screen
• Type “Windows Firewall”
• Select the “Windows Firewall Control Panel” Option
• A popup will appear
• Click on the “Advanced Settings” link on the left-hand side
• Click on “Inbound” Rules
• Click on the “New Rule” link on the right-hand side
• A pop-up will appear to configure the new rule.
• Click on the "Port" radio button
• Click "Next"
• Click on the "UDP" radio Button
• Click on the "Specific Local Ports" radio button
• Type "69" into the text box
• Click "Next"
• Choose the “Allow the connection” radio button
• Choose which areas the rule applies.  Be careful with this one because you don’t want just anyone to be able to connect.  Most people choose domain or home-actually as I recall though, public has more strict rules-but you don't want the TFTP server to be connected to on a public network, so it’s best not to use public.
• Type in a Name for the rule: TFTP, and a Description if desired.
• Click "Finish"

• To ensure that not just anyone can connect, you can limit the IPs that can connect to it.
• Find the TFTP rule in the rules list
• Right-Click on it
• Click "Properties"
• Click "Scope"
• Change the scope to the IP or range of IPs that you are comfortable connecting with your TFTP server.  (In this case, the IP that you plan to set the firewall to in the HQIP test.)
• Remember that people can spoof IP Addresses, so this isn't foolproof.

• If you’re paranoid, remove/disable this rule when you are done.  Disabling is as simple as right-clicking the rule in the rules list and selecting the “Disable” option.

• Repeat the above steps with the exception of choosing “Outbound” instead of “Inbound” rules in the second step.

Setting up the TFTP Server:

If you are using SolarWinds TFTP Server:

• Click on “File>Configure”
• Select the “Server Bindings Tab”
• You can bind it to all IP Addresses on the machine by selecting the "bind to all IP Addresses" radio button.  This is not recommended for security reasons.
• Select the “use custom server binding” radio button
• Click in the text box
• Type the desired IP range that the laptop will be serving the file from in CIDR notation (if it is not specified, the program will choose the CIDR notation.  Like /32.
• Click the + sign on the right side.  The IP Address should now be added to the custom server binding box.
• Click OK
• There should be a popup showing that TFTP was started on Port 69.

Setting up Putty for the Console Connection:

• On the left-hand side, there will be a section called “Connection”
• Choose “Serial”
• On the right-hand side, change the “Serial line to connect to” to the COM interface of the laptop.
• This can be checked in "Device Manager" under "Ports (COM & LPT)"
• On the right-hand side,
• Speed(baud) should be 9600
• Data bits should be 8
• Stop bits should be 1
• Parity should be None
• Flow Control should be XON/XOFF
• Click "Open".  Assuming that the cables are properly set up and device is functioning properly, you should get a console connection to the device.  Sometimes you have to press Enter to see the prompt.

Configure the Settings on the Router for the TFTP Transfer

• Login using your credentials.  The default username for this model is: admin, the default password is <no password>.
• Type “execute reboot”.
• Watch the screen carefully.  When it says, “Please wait for the OS to boot, or press any key to display configuration menu”, at this point, press any key.
• A configuration menu will be displayed.

The first menu looks like this on this model:

[C]:  Configure TFTP parameters.

[R]:  Review TFTP parameters

[T]:  Initiate TFTP firmware transfer

[F]:  Format boot device.

[I]:  System information.

[B]:  Boot with backup firmware and set as default

[Q]:  Quit menu and continue to boot.

[H]:  Display this list of options.

Configure the following settings, noting that anything in brackets is the default setting.

First, we want to configure it to grab the test image from the TFTP server (AKA our laptop/Desktop computer running Solarwinds TFTP Server.)

So the first option we should select is C.

The next menu looks like this:

[P]:  Set firmware download port

[D]:  Set DHCP mode

[I]:  Set local IP address.

[S]:  Set local subnet mask.

[G]:  Set local gateway

[V]:  Set local VLAN ID

[T]:  Set remote TFTP server IP address

[F]:  Set firmware file name

[E]:  Reset TFTP parameters to factory defaults

[R]:  Review TFTP parameters

[N]:  Diagnose networking(ping).

[Q]:  Quit this menu

[H]:  Display this list of options.

Select P to set the firmware download port.  You can choose the default option-in this case I think that it’s WAN1, but keep in mind that if that port is bad, it won’t work, so you’ll have to choose a different port in that particular case.  It’s trial and error choosing the correct one because the default port may be different for each model and like I said, the port could be bad.   If one port fails to work, start this portion over again, and try another.  The options are:

[0]:  Any of port 1-7

[1]:  WAN1

[2]:  WAN2

Choose 1 for the WAN1 port.

The next option that should be selected is I, to set the local IP address.  This is the IP address of the firewall.  Again, you can select the default, just make sure that the ethernet adapter on your laptop is configured to be on this same subnet.  I make it easy and use 192.168.0.2.

Select S to set the local subnet mask.  I use 255.255.255.0, which is the default.  Press enter to choose the default.  Just make sure that your laptop ethernet adapter is configured with the same subnet mask.

Select G to set the local Gateway.  I make this the same as the laptop/TFTP Server/Terminal.  Usually 192.168.0.1.

I’m not concerned with the local VLAN ID, but this may apply to you if you use VLANs, so use it if you need to.

Select T to set the remote TFTP server IP Address.  This should be the same as your laptop Ethernet Adapter IP Address.  Again, I use 192.168.0.1.

Select F to set the firmware file name.  This must the same name as the test image name you downloaded from the fortinet support site or whatever you rename it to.

Select R to review the settings.

Make any necessary changes.

Select Q to exit this menu and return to the first menu.

Select T to grab the test image from the laptop/TFTP Server.

If the file is transferring properly, you will see a bunch of pound signs in the Putty display.  When the image is transferring, you will see a notification in the SolarWinds TFTP window.

If it isn’t transferring, do normal troubleshooting to find out what the error is.

Common issues:

Cables aren’t properly configured.

The wrong download was chosen in the router settings.

TFTP server not configured properly.

Firewall not configured to allow TFTP connections.

If it transferred properly, the Putty/Terminal display will ask you what you want to do with the test image.

Type R to reset without saving the image.

In this case, it doesn’t start on it’s own.  (Some models will automatically start.)  You have to login with the default credentials.  For this model:  User: admin, password: <no password>.

Type “diagnose hqip start” into Putty/Terminal Session.

There will be a message asking for a USB key.  Don’t worry about it.  That is for a firmware image on a USB drive.  Just press enter twice.  Since you selected “R”, it should just keep the old firmware.  You may want to reset the firmware anyway, but for RMA purposes, it may be best to keep the firmware as is.

It will run tests on its own.

You will be asked to check the LEDs.  Follow the directions in the Putty/Terminal session.  Press the spacebar if it passes, enter if it fails.

You will be asked to check to see if the reset button functions properly.  Follow the directions in the Putty/Terminal Session.  Simply use a paperclip to press the reset button.  If it functions properly, you will see output and the word “PASSED”.  If you don’t see that, then it may have “FAILED”.  Wait a few minutes.  If it still doesn’t do anything, press Enter.  For the 60D model, it is located near the power plug in.

Do not unplug anything yet.

Save the Test Results

In Putty:

Method 1:

Right-Click on the Title in the Terminal Screen

Select "Copy Contents to Clipboard"

Open Notepad

Paste the contents into the file

Save the results as your desired file name (I use serial number_HQIP_Test_Results)

Method 2:

Enable Logging in Putty

On the left-hand side, there will be Session.  Select Logging.

Choose the “Printable Output” radio button.  (“All session output” will show you everything.  For RMA, the All session output option may be the best.)

Select the log file name.  The default is “putty.log”

Choose what to do if the file exists.  Choose either the radio button that says, “always append to the end of it” or the “ask the user” radio button.

Confirm that all the output was captured.

Gracefully Shut Down the Firewall

In the Putty session, before unplugging anything, type "execute shutdown" and press enter.

Do not unplug anything until it says, “The system is halted.”

Intern

Started a new job.  I'm slightly afraid to be talking about it because my boss my read this.  It's exciting.  I'm an intern.

I'm not exactly sure where I expected to start, but it wasn't like this.  My friends told me that they started internships that were fairly easy-just the daily work of IT people-installing software, deleting software, moving equipment around, some troubleshooting...

I don't know how much I can say about what I do.  I can say capture the flags and challenges do not make someone proficient in a task.  They show that a person is willing to work hard and learn; not what they know, now.

Also, red team is not blue team.  Red team is easier.  If I find one vulnerability, that's all I need to start.  Sure, finding others is nice, but one gets me in.  Then I can establish persistence, and use the tools already there to move further into the network.

Blue team has to think of everything, and they have to balance the organizarion's needs with Security.  Sometimes software can't run with fully patched systems-sometimes the budget doesn't allow for an upgrade of equipment, sometimes executives want x software, yesterday without thinking about how it affects the overall security posture...  which isn't necessarily a bad thing.  We're supposed to give them the best advice we can and let them choose.  Sometimes blue team has to do "good enough" Security, not best Security.  And that makes things a little tougher.

I feel like I did when I first started doing challenges, it was frustrating at times, but I really wanted to do well and learn as much as I can.  I hope that I rise to that challenge.  Right now, I'm not feeling so great, though.  I still have a lot to learn.

Kali Meta-Packages

Recently, my spouse purchased a Software Defined Radio Starter Kit and a Yard Stick One for my birthday.  Yesterday, I finally got a chance to start configuring the Yard Stick One.  I was watching a video on the Hak 5 Shop: https://hakshop.com/products/yard-stick-one, about how to get started configuring and using the Yard Stick One.

There's a program mentioned in the video, gqrx:  http://gqrx.dk, that's supposed to be included with Kali.  I happen to have a couple of Kali VMs, so I decided to try to set up my Yard Stick One on one of the VMs.  The program wasn't on my particular Kali VM.  So, I googled how this could be.  Turns out, that when installing Kali, it's modularized, meaning that one can choose which install of Kali that they want.  With the default install, some tools may not be available.  That is when I learned about this awesome feature of Kali:  You can choose which packages you want with these things called Kali Meta-Packages:  https://tools.kali.org/kali-metapackages.  There is more information on the Kali news site as well:  https://www.kali.org/news/kali-linux-metapackages/.  If you don't have a Kali VM, already, here is how to customize your installation:  https://docs.kali.org/downloading/live-build-a-custom-kali-iso.  If you already have a distro, and want to add a package to it, it's as easy as the following command:

sudo apt-get install <Kali meta-package name>

So, if I want all the software defined radio tools that are available in Kali at this time, I simply type:

sudo apt-get install kali-linux-sdr

That's it.  It's that easy.

What if you don't know the name of the package you want?  This command: "sudo apt-cache search kali-linux", is noted in the website I mentioned earlier in the post:   https://www.kali.org/news/kali-linux-metapackages/, or you can find the meta-packages listing at:  https://tools.kali.org/kali-metapackages.

Hopefully this helps others, because some people on Stack Exchange and other websites were asking how to do this.  I just thought I'd try the normal way of installing packages on Kali and see if it worked.  It did.  Have fun everyone! :)

NetWars Core Tournament Champion

I won the NetWars Core Tournament here at SANS Rocky Mountain last night.  I never thought that I'd say those words.  I just happened to luck out.  There weren't many alumni here this time that I know of-ie players that had played before.  

Achievement Unlocked:

People assume that I know more than I do.

I will be the first to say, I still have a lot to learn, and I really mean that.  I'm not working in information security or IT.  I hope to be soon, but I'm not in the field yet.  I love this field because it is a field that continually challenges you to learn and grow.

I'm a NetWars Tournament Champion, and last night, I wasn't doing much hacking.  People watching were wondering if I was going to score again.  I had 248 at the beginning of the night, and it took a while for me to score.  Why?  Because I was testing the functionality of something, figuring out how it works.  The technology used in this particular point in the game was something I was unfamiliar with.  Once I figured out enough of how it worked, then I tried to find ways to exploit it.  So it was a while before I finally put points on the board.  I ended up being at 275 by the end of the night.  Then I didn't really know where to go from there.  So it would've taken more time for me to figure that out.

I highly encourage people to go to NetWars.  Even if you think that you don't know much.  It's worth it for what you can learn, and you'd be surprised how much you learn from it.  Considering NetWars comes free with a 5-6 day course, there is no reason not to play.  Maybe you'll luck out and be the next champion, even if you don't, that really shouldn't be the goal.  The goal should be learning as much as you can.

Tips:

Keep meticulous notes.  Sometimes, we come across a problem that is similar, possibly even exactly the same, to problems that we've seen before.

Don't worry about what others are doing.  You don't have to be perfect.  No-one started in the field perfect.  To this day, I'm sure that even the experts sometimes feel lost about what to do.

Stay calm.  You'll hear people saying, "Yes!" and other things.  Don't let it discourage you.  Persistence is key.  You'll eventually get there, just keep trying.

Ask for help.  The SANS people are more than happy to help when they can, especially if it's a technical issue that isn't part of the game.  Even if it is part of the game, they will happily give hints to help you get unstuck.

Copy down the NetWars questions-levels 1-2, you can work on outside of NetWars-they are all on the image.

Level 3-4-think of creative ways you can work on it-for example, screen shot pages, so you can study how it works.  Many times, we think attack, when we should be thinking of more defensive things. :)

 Google anything that you don't know.  It's ok to Google.

SANS TA

Having an interesting week this week.  Working as a TA for SANS.  I wasn't quite sure I was ready for it.  Still not sure I'm ready for it.  Currently Day 4.  So far most of the questions haven't been too difficult.  I've come across some that I didn't know exactly how to resolve them without asking someone for help or looking them up.  Anyone who's worked in technical support knows that that is normal.

I'm hoping that this first time isn't my last time as a TA.  I enjoy helping people and learning from people that are more knowledgeable than I am.  It's difficult to read exactly what the instructor thinks about my performance, though.  The conversations between myself and the instructor have been, "Everything ok?", "Hi.", and "How are you?"  Don't misunderstand, he's a nice guy.  Just haven't talked to him a lot.

One big tip for people who are considering being a TA:

Always recheck what the students say.  This is not anything against students at all.  The students all come from different backgrounds, and many of them are probably more knowledgeable than you are, but, sometimes it's really easy to overlook one little thing, especially when there are long training hours.  We are in bootcamp hours:  9AM - 7PM.

Example:  Two similar user names are on the virtual machine.  The usernames have the same password.  Sometimes students log into the wrong one.
I asked, "Did you log in to the correct user?"  They thought that they did.  I didn't follow up on it to check because if you're in this class, you probably know at least as much or more than I do.  So, the time I spent fixing a couple of short cuts so that they could complete a lab could have  taken less time just by switching users.

I'm taking notes of some of the issues that came up this time, just in case I get to do this again, so I can remember what to look for next time.  I'm sure if I do this again, I'll get some more off the wall questions.  There's always something more to learn.

"R00k" has a good guide on being a TA.  You may want to visit his blog for more information: https://r00k.io/2017/05/experiences-of-a-sans-ta/.