Haxing Minesweeper

Recently I tweeted a screenshot where I won the Minesweeper game by looking at the mine field from the memory. I posted this for no reason, just for fun since I was happy that I finally won this game. I used to play this game back in 2002 in Windows XP and I never won this game, I never even understood how this game works until today when I read how it really works 😀

In few minutes my notifications were flooded, I didn’t expect to get this much of likes. Some people asked me a tutorial on this. I thought of writing a very quick blog post on this. Pardon me if I missed anything.
(more…)

Advertisements

MySQL UDF Exploitation

Overview

In the real world, while I was pentesting a financial institute I came across a scenario where they had an internal intranet and it was using MySQL 5.7 64-bit as the backend database technology. Most of the time the I encounter MSSQL in most cooperate environments, but this was a rare case. I found SQL injection in the web application and I was able to dump the username and password from the mysql.user and I realized it had privileges to write files to disk. This lead me into writing a post and sharing techniques in injecting a UDF library to MySQL and gaining code execution and popping a shell in Windows. When I Googled most techniques are a bit vague when it comes to Windows. So, I thought of writing this post with my own research to clear things and make you understand few tricks you can use to do this manually.

I will be hosting the latest MySQL 5.7.21 latest community server by the time I am blogging this, in one machine. To reproduce the scenario, I am running the mysqld server with ‘–secure-file-priv=’ parameter set to blank. In this scenario I was able to retrieve the username and password from the mysql.user table using a union based injection in the intranet. Note that in MySQL 5.7 and above the column ‘password’ doesn’t exists. They have changed it to ‘authentication_string’.

# MySQL 5.6 and below
select host, user, password from mysql.user;
# MySQL 5.7 and above
select host, user, authentication_string from mysql.user;

Note that you can use the metasploit’s mysql_hashdump.rb auxiliary module to dump the MySQL hashes if you already have the credentials. By the time I am writing this blog post the script needed to be updated to extract in MySQL 5.7 you can check my pull request here

The host column for the user ‘osanda’ allows connections from 192.168.0.*, which means we can use this user for remote connections from that IP range. I cracked password hash and got the plain text password.
(more…)

Exploiting Format Strings in Windows

I thought of making a small challenge in exploiting format strings in Windows. This is how it looks, it asks for a filename to open. At first this might be a bit confusing. There’s no vulnerable functions in reading a file. You can see that our first argument to the program is echoed back in the program.

Let’s investigate this inside a debugger. As you can see if argc == 2 the application continues the flow and argv[1] is passed into that function highlighted.



(more…)

Beagle – Find vulnerabilities in your websites easily

I came across a new scanner named Beagle. This scanner really crawls fast compared to the other scanners I have experienced. It’s faster in detecting vulnerabilities. Takes less CPU power.

An example of reporting vulnerabilities, you can choose different formats. For example, this is in PDF. Check here for sample reports generated by Beagle.

Features

(more…)

Detecting Architecture in Windows

After a while I thought of posting something interesting I noticed. Some of you know this old method of detecting the architecture using the CS segment register. This was also used in the Kronos malware

xor   eax,eax   
mov   ax,cs    
shr   eax,5      

I had a look at the segment registers last night and I found out that we can use ES, GS and FS segment registers for detecting the architecture as well.

Using ES

; Author : @OsandaMalith
main:
        xor eax,eax
        mov ax,es
        ror ax, 0x3
        and eax,0x1
        test eax, eax
        je thirtytwo
        invoke MessageBox,0, 'You are Running 64-bit', 'Architecture', MB_OK + MB_ICONINFORMATION
        jmp exit

thirtytwo:
        invoke MessageBox,0, 'You are Running 32-bit', 'Architecture', MB_OK + MB_ICONINFORMATION

exit:
        invoke ExitProcess, 0  

(more…)

A Basic RSA Encrypter

This is a small post about implementing a basic RSA encrypter to encrypt sections in an exe. We can use this to exchange exes with people. We will encrypt the section using the public key and the user has to use his private key to decrypt the exe. This can be applied in evading anti-viruses too.

I will use multiplication instead of an exponent. Since it would be easy to implement in few lines in assembly. However, this will allow breaking the private key easily hence the complete scheme is broken.

Enc = (m*e) \text{ mod } N

Dec = (c*d) \text{ mod } N

The correctness of this scheme depends on the fact that

Dec(Enc(m)) = (m*e*d) \text{ mod } N = m \text{ mod } N

(more…)

eLearnSecurity Courses

With the competitiveness of the infosec industry, security training is definitely needed. Let me share my story. Back in 2013 I heard about eLearnSecurity. Those days the only courses was Penetration Testing Professional and Penetration Testing Student. But I didn’t have enough money to sign up since I was 16 years old. With the pocket money I had, I signed up for the Penetration Testing Student course since I was curious about the material. I was amazed by their teaching techniques. Everything was so clearly written. After that I had to enter university and I had no time to concentrate on the things I like to do. Gradually eLearnSecurity started developing specialized courses starting from Web Application Penetration Testing and next came the Extreme edition of this. Meanwhile, they launched a course on reverse engineering too which I was really surprised to see that course since it was the first ever course I saw on reverse engineering.
(more…)