Moving onto the next level

Hi all,
umm..To begin with (before guys start falming me or anything), let me ******** that I completely understand and know about Antionline rules and I am just looking for an advice/guidance from some senior pen-tester or a security professional(Since, in my opinion I have learnt alot,alot while just reading the everyday posts on antionline).

So, here is the situation. My friend has decided to set up a war game. He'll defend and I'll attack. His point is that an updated Windows 2000 machine, with all patched software does not need a firewall and only a potential hacker (with sharp programming skills) can either discover a 0 day exploit and then exploit the machine. My point is that he still needs a firewall to harden his machine. Now I am supposed to attack his updated Microsoft Windows 2000 Advanced Server machine and take it down. What I did was is following:

1) I nmap'd his machine and found out the following:

53/tcp open domain Microsoft DNS
80/tcp open http Apache httpd 2.0.55 ((Win32))
135/tcp open msrpc Microsoft Windows RPC
1027/tcp open msrpc Microsoft Windows RPC
1029/tcp open msrpc Microsoft Windows RPC
1030/tcp open msrpc Microsoft Windows RPC
3306/tcp open mysql MySQL 4.1.16-nt
3389/tcp open microsoft-rdp Microsoft Terminal Service

2) I ran nessus against his machine(with all updated plugins) and found no serious vulnerability. What I found was some information from the port scanners and a couple of warnings, which were almost harmless.

3) It's been almost 2 days that I am googling for RPC exploits and searching Packetstorm and BugTraq. What I found was DCE-RPC tester and a couple of old vulnerabilities, which have been already patched by the vendor.(I compiled them and ran against the machine and it didnt work).

Now, its been a couple of days, and I am all lost with this. What i need from you guys is to help me moving in the right direction. I believe there is a difference in "help me taking down my friend's machine" and "help me learning the security concerns" notion. :)

What I can do is to 'syn flood' or 'DoS' his machine to take it down, but this is not the real purpose of setting up this war game. What I am looking at is Microsoft RPC and RDP terminal services to exploit, but didnt found out something really serious to do that.(Only a couple of NULL session vulnerabilities, which have been already patched). What do you guys have to say about this? Am i moving in the right direction.

I really feel that I lack this confidence of actually carrying out a pen-test and the ability to exploit a hole. Since, it has been long that I am reading alots of stuff on different security portals, mailing lists, pen-testing tutorials, experience with knoppix and other security distributions but hav'nt really shown these exploiting abilities. Help me building my confidence AO :(

Looking forward to your response...

With this little wargame, do you just have to retrieve a file, or drop a file onto the box.?
If not then i personally would Dd0s it until it drops offline..
Also has he checked with he/her's ISP to make sure that we you's are doing is approved? As the ISP might see the attemts, and think something is up, and investigate.
And while there investigating you might find that both of your internet connection's might get suspended..

just a few thoughts.

cheers
front2back

.:front2back:. I forgot to mention that we are on the same subnet/LAN set up internally in our homes. So no bandwidth/ISP issues. That might be easy to do this ICMP reflection or D'DoSing the machine, but this is not the purpose. I am not supposed to drop or reterieve any file from the box. Its just that the machine is breathing and I have to take it down (not in 3l33t3 Script Kiddie way..DoS or anything).. I am looking for some service to exploit and found no way of doing that as yet ...
so any responses AO?

Try looking more towards other forms of attack other than the RPC that you seem to have focused on. Check the websites of any servers he is running. Maybe he is not as up to date as he might think...

There are many thinkgs you could think of.

In this situation the direct, upfront attack seems to be yielding poor results. The next step?

Pretend to be someone else (love interest perhaps?)
Email a trojan & try and get it executed.
Persuade them to talk to you via MSN & look for & try vunerabilities. (Send a file!).
Break into the machine & gain pyhysical access, install a trojan.

These are all things the 'bad guys' might try if the frontal attack fails and they really need to gain control of a machine.

Just my 2c

Steve

read the news. your zero-day is already out. of course it doesn't really work if no one uses the machine. you could try emailing it to the box if it has email. I remember the f-secure blog said it infected a DOS box after just downloading it. Play around with the WMF. what do you really have to lose at this point. hell, just load up a linux livecd and give him the actual one. thumb your nose at him with the spyware. lol.

*edit*

you said your on a LAN, so can you knock him off by messing with the switches or routers? it's technically a win.

well..first of all..seeing the negative status of the thread is "disappointing".. :(

steve.milner: This is against the agreed rules of war game. So I wo'nt go for it. Secondly, he is not using this machine as his primary machine (where he checks his email and uses IM clients)..

killerbeesateme: I have read about the WMF zero-day exploit, but again since he does not use that machine to broswe or anything, so its kinda useless.. What I am going to do next is to fire up a live CD and try some stuff from it...

Guys..till this very moment..I still havnt got a serious clue to head in the right direction.. I still wonder that an updated Windows 2000 Advanced server machine can be this secure and so hard to break into..I am not learning anything new and I am getting frustrated now..

still need a serious piece of advice from senior pen-testers..Irongeek,Th3horse13,gore,nihil,negative,HTRegz,catch,Soda_Popinsky,MemorY..where are you guys..I believe you all know me for a long time now..help me moving in the right direction... :(

ommy, first of all, there is no 100% secure machine. If I were you I'd take killers suggestion and find a way to gain access through the LAN, messing with hardware or whatever. By the way don't count on MemorY for computer advice lol (he's banned, he now goes by the name Copyright) :p

Well... my last bit of advance kind of sucked. but there is another way. Not really any better than just a DoS, but you can go LAND attack on it. I don't think that ever got patched.

I was LAND attacking my coworkers at my last job when they pissed me off and they were all running XP SP2. (my admin didn't care, he didn't like those people either and i wasn't disrupting business)

It'll shoot their resources use up to 99% as long as you keep shooting packets at it. Probably won't help, but yea. I'd say mess around with the RDP too. see where you get. Sorry, I'm not much of a pen tester but I'm bored at work so you have to deal with my crappy advice.

You might want to redefine the rules of the game and start over. You aren't to DDoS it, but you need to take the server down. Why take it down? Why not just change the wallpaper remotely, once you have cracked the system? It doesn't *really* matter, but I'm using this to help you in other channels...think beyond the boundaries, the bad guys certainly will. That's why you've gotten the suggestions you have.

To be honest, with the restrictions you two have placed on this game and in this setting your friend may be right and you may be wrong. You are dealing in too many finite points, and Security is not a finite (science|school of thought|art).

Why can't you DDoS it? The end result is the same. If the point is to exploit the box ONLY via RPC vulnerabilities, and it is up-to-date, then you may have already lost...UNTIL the next RPC exploit is found.

Raion: May be I am not putting things clearly.I can take down his machine messing around with the switches or DoS.. But the real motive is'nt "taking the machine down"..It is to figure out operating system weaknesses and proving the fact that "yes it could have been more secure on the operating system level rather then just updating the latest operating system patches and running a more stable version of network services"... I think I have made myself clear enough..:)

killerbeesateme: Your advice is'nt really crappy but it does not fulfill my motive of "taking the machine down" in a real way..exploiting the OS weaknesses...

besides..synflood and ICMP echo reflection (smurf,trinoo) are the only remote Dos that I know about. Would anyone like to add to it?

I am going to try this metasploit framework tonight. If I would be able to discover something, I would share it with AO.

Quote:

---

So, here is the situation. My friend has decided to set up a war game. He'll defend and I'll attack. His point is that an updated Windows 2000 machine, with all patched software does not need a firewall and only a potential hacker (with sharp programming skills) can either discover a 0 day exploit and then exploit the machine.

---

your searching for exploits on the web. all your going to find is code for non-0day exploits for holes that have already been patched. you friend is right. if there's nobody using the server that you can get to do something stupid your not getting in unless you can find and exploit a weakness that hasn't been discovered yet. or watch the boards for news of a hole that a patch has not been released for yet and move real fast before he does a work around.

you might be able to dig around, look over his shoulder or guess for his admin name and password and use pskill remotely to kill svchosts or services or psexec to open a shell on the server.

ommy:

So basically your only attack vector is across the network. Some thoughts...

* Research to see if any of the versions of the apps/services he's running (ie.; MySQL) have any known vulnerabilities. You can check this using the various vuln dbs out there: Security Focus, NIST Nat Vuln Db, Secunia.

* Try sending his computer malformed packets. Never done it myself before but have worked with pen-testers who've done it. Maybe look into the tool hping

Good luck, hope this helped.

well, if it's any consolation, MS has been having a small track record of not fully patching exploit vectors. you could try back tracking a couple patches that have gone out and see if you can think of a way to do around the same thing but just a little bit different.

another thing to think about, what is being served on the apache server? is it running php or asp? you may be able to do something with that. I'd say start nitpicking it.

Can you resolve any of the services/users/shares or anything else that you can use to your advantage?

zencoder: A very smart piece of advice..Thank you for this. Guide me a little further with this in context of DDosing. :)

ric-o: I am going to try this with hping. Does anyone have an idea that how does Microsoft implementation of TCP stack responds to a typically crafted packet? any suggestions??

killerbeesateme: Apache server is not running any PHP or CGI scripting. I have ran nikto against it. No shares or users can be resolved on the machine.

besides I kinda exploited this wmf zero-day vulnerability (thanx to metasploit framework and gore :)). And it kinda gave me a little insight of how this "exploitation" works.

Any thoughts on DoS or DDoS?? guys...

The more I read this thread the more I begin to see yet another script kiddie asking how to hack a system. Sorry ommy, no help for you here, and reds for the thread. If you're truly wargaming to learn, you'll eventually figure out how to ddos/dos a system on your own.

Quote:

---

Originally posted by ommy
ric-o: I am going to try this with hping. Does anyone have an idea that how does Microsoft implementation of TCP stack responds to a typically crafted packet? any suggestions??

---

Once you've mastered hping you are one step closer to becoming a God amongst simpleton technocrats.

A good place to start reading is here


Also, theHorse13 had a brilliant 4-part tutorial on the usage of hping right here on AntiOnline.

Speaking of, whatever happened to part 5 of that tutorial, theHorse13?

|3lack|ce: I understand the fact that you are a "senior member" here..But I give you no rights (what so ever) to doubt my intentions of learning. I find myself extremely honest with my network security passion and I allow no one to comment on that. SIR |3lack|ce just for your information, I know some stuff about DoS and D'Dos atleast on the basic level (Smurf,trinoo,header fragmentataion, syn floods, ICMP reflection), because of the fact that I am reading alot about them (from books,articles and GOOGLE)... I just asked it here because I wanted to know that if there is something that I am missing or what sort of DoS attacks are more affective practically (since, I have never done that before and I am learning things gradually and I consider it a good practice to seek an advice from the "Seniors" of the community)..

Can I give you a piece of advice?? Can you be little less cynic while judging people's intentions about their passion for knowledge?? YES, you have certainly offended me a great deal...It's not the matter of "RED's" or "GREEN'S"..Its about one's dignity..It's about doubting their thirst for knowledge..Its about doubting their trust on the community...Its about doubting their honesty..I AM DISAPPOINTED...

You have not inspired me like some other senior AO members...like gore,Thehorse13,MsMittens,Tedobe1,CopyRight and bunch of others..I believe you owe me a sorry for this...

[WebCarnage]:Thanx for the advice..I absolutely feel the importance and strength of hping..and I am going to read more and more about that..

best regards,
SCRIPT KIDDIE (with an honest intention to grow and become a part of security community(may be like tony watson or Fyodor) )

Quote:

---

I understand the fact that you are a "senior member" here..But I give you no rights (what so ever) to doubt my intentions of learning.

---

Wonderful. Now you're in the position of giving rights to someone across the net? Yah, ok.

Of your intentions of learning I have no doubt. You're quite like countless others I've seen come to this security forum asking how to hack, you're just going about it in a bit different manner. Same old stuff, different day.

Skipping the next bit of drivel because frankly I don't care what you know from google - it's usually useless and patched - we arrive at:

Quote:

---

affective

---

Oops! Effective. Perhaps a sixth grade reading course might be more to your level? Seriously, if you're going to be decent at what you do, you've got to learn to spell. Contrary to popular belief that isn't a slam, it's serious. Ask any programmer who's spent hours pouring over a piece of code he's written that doesn't function correctly, only to find it's a spelling error.

Quote:

---

Can I give you a piece of advice??

---

Yep, you can give all the advice you want. I reserve the right, however, to tell you either politely or impolitely precisely where to stuff it. Now for some serious advice to you: Yesterday I was nice and only redded the thread, which was promptly negated by another senior who greened me. Your posting here whining about me redding your thread has brought attention on you in a negative light. Bad move guy.

Quote:

---

YES, you have certainly offended me a great deal..

---

Insert extra drivel ad nauseum because I don't feel like quoting his actual whining here.

Quote:

---

I AM DISAPPOINTED...

---

So? Shall we throw you a pity party?

I ALWAYS doubt honesty when it comes to someone asking about how to hack, crack, phreak, or otherwise compromise a system. Others may think that I'm spewing 'elitist' crap here. In reality, I'm being a healthy computer security techie. It's my job to be paranoid.

Quote:

---

You have not inspired me like some other senior AO members...like gore,Thehorse13,MsMittens,Tedobe1,CopyRight and bunch of others..I believe you owe me a sorry for this...

---

I'm neither here to inspire you nor to entertain you. I believe you're quite sorry indeed to heap such expectations upon others. There. You've been promoted to 'sorry script kiddie'. Congratulations.

Now bugger off before I get really torqued.

Greeting's

Quote:

---

Currently, 21 out of 113 Secunia advisories, are marked as "Unpatched" in the Secunia database.

---

Quote:

---

.......you're just going about it in a bit different manner .........

---

:rolleyes:

|3lack|ce: No comments on whatever you said...Because I strongly discourage bashing/flaming of newbies who are lost and looking for a direction/guidance from the people already in the industry...

You don't need to throw a pity party..I still respect you and your ideas of being paranoid when it comes to disclosing such sensitive information..May be being paranoid is what it takes to be a security professional..

And if it does satisfy your "potentially paranoid" self (to point out my 6th grade spelling mistakes..stuff my advice anywhere you want(politely or imploitely)..throw me a pitty party..make me feel like a "sorry script kiddie") .. then please keep on doing that..

However, I would certainly appreciate if you do not "inspire"/entertain/flame/bash me anymore..I believe there is nothing wrong in "heaping" expectations from people who have been a source of continuous learning for more then 3 years now :)..Please do not waste your energy to prove me a lame kid asking "how to 0wN ma frie3nDs machine"..

ByTeWrangler: I am looking into it..probablly i didnt see the Secunia advisories site that closely..Thank you for "entertaining" my lame thoughts..lolz

[WebCarnage]: Thehors13's tutorials are extremely cool..gave me a good insight..Thank you for your links too..Is there anything else that you guys would like to add or should this thread be considered officially close :)

Finally, I did this DoS attack on my friend's machine (Syn flooding different ports) and managed to take it down for some time. But the bottom line is that I learnt alot. I atleast managed to move a little further and that was kinda fun.

Thank you AO for your ongoing support. :)