Google Bangladesh DNS HIJACKED BY TiGER-M@TE

sure enough, visitors of the company’s Bangladesh search site (Google.com.bd) see a defaced landing page rather than the usual search site. As far as I can tell, www.google.com.bd functions properly, so whether this really constitutes a ‘hack’ is up for debate.

Local Bangladesh media, including online newspaper bdnews24.com, reported on the news as well, quoting a CTO of a local ISP, who confirmed the hack.
Nevertheless, it seems like only a subset of users see the defaced landing page, while others report that they can visit and use the search engine without any hiccups.
According to Zone-h, Bangladeshi hacker TiGER-M@TE has been quite active with defacements lately, and has targeted some high-profile sites in the past, including the local website for American Express and Airtel (video).

This was a DNS hijack done in the .bd zone run by Bangladesh Telecommunications
Company Limited (BTCL). This wasn't Google hacked, per se. The hacker just decided to take advantage of what is probably the most noticeable domain in the .bd zone. They could have probably done this to any of them.

There is nothing Google could have done to prevent this. And no, DNSSEC would not have stopped this.

Anyways, it's fixed now globally. And if you used OpenDNS, our caches were cleared of the bogus records a while ago.

Razorback: A Intelligence Driven Security Framework!

Sourcefire’s Razorback Framework features an open source, distributed detection system, robust API set and a fully extensible database and data management system. It has been specifically designed with the needs of high-level incident response and detection teams. Razorback enables you to perform advanced processing of data and detection of events by fetching data as it traverses the network and even fetch data from a server. It is able to perform advanced event correlation since this framework works in a distributed fashion. You can consider it as the open source Snort NIDS front-end.

Since Razorback has to work in a distributed fashion, you can call it a collection of elements working together, where each element performs a discrete task and are tied together via the Dispatcher. The core is written in C language. Components are referred to as “Nuggets” that provide a different functionality each. These are the Nugget types that are available by default:



1. Correlation – It interacts with the database directly and tracks intrusions through the network. It also initiates defense updates.
2. Defense Update – Performs dynamic updates of multiple network devices.
3. Workstation – Provides analyst authentication and means to manage nugget components with alerts and events and system logs.
4. Data Collection – It capture data directly from the network or a network device directly or even from log files.
5. Data Detection/Analysis – Provides alerting feedback mechanism to the Dispatcher and handles incoming data from Collection Nuggets. It further splits incoming data into logical sub-blocks.
6. Output – It receives alert notification from Dispatcher and sends output data to relevant system.
7. Intelligence – Generates data that could potentially be used later for trending or event correlation.


The Dispatcher is one of the main components of this framework. It is database driven and handles all communication between nuggets.


The Razorback framework also features a custom post-mortem debugger that traps applications as they crash and sends the file that triggered the crash to Dispatcher with its metadata. The Data Detection/Analysis further contains the following nuggets:


1. Zynamics PDF Dissector – Handles deobfuscation and normalization of objects and targets known JavaScript attacks.
2. JavaScript Analyzer (w/ Zynamics) – Searchs for shellcode in unescaped blocks and heap sprays and obfuscation methods implemented on JavaScripts.
3. Shellcode Analyzer (w/ libemu) – Provides detection and execution of shellcode. It looks for code blocks that unwrap shellcode. Detects Win32 api hooking and even provide alerts that include shellcode action.
4. Office Cat Nugget – Supports full Office file parsing and provide a vulnerability centric detection against known threats.
5. SWF Nugget – Decompresses and analyzes flash and detects known flash threats.
6. ClamAV Nugget – Provides antivirus features to the framework.


The Output nugget is composed of the following output nuggets:


1. Deep Alerting System – Provides full logging output of all alerts
2. Maltego Interface – Provides data transformations targeting the Razorback database


Infact nuggets are so easy to be programmed that you can do them in any of the following languages:


* C
* Ruby
* Python
* Perl
* Or any other language that can wrap C code.

Razorback v0.1.3 (razorback-0.1.3.tar.gz) here.

Man In The Browser Carberp

Carberp hit the scene with a big bang last month targeting financial institutions with transactional two factor authentication schemes and we looked at what Carberp does to an infected system in a previous in-depth report.


Today’s Trojans are normally “just” an enabler for some sophisticated HTML and JavaScript injection into a bank website that is being targeted. The Trojan provides this Man-In-The-Browser capability and the configuration file defines exactly what happens. This is where the real damage is done. In that sense, Carberp follows the same principle as all other transactional Trojans such as Zeus, Gozi, Spyeye, Silon, etc.

While the HTML injection has been fairly static in the past (e.g. an additional ATM Pin input field), the sophistication of the injected JavaScript for Carberp is simply stunning


A must read document for security experts, which gives a fair example of Carberp.

Click here to read full article.

Mantra: A Browser based Security Framework!

Mantra is a dream that came true for the author. It is a collection of free and open source tools integrated into a web browser – Firefox, which can become handy for students, penetration testers, web application developers, security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source software. Mantra is a security framework which can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.


This is the list of tools included:

• Access Me
• Add N Edit Cookies+
• CookieSwap
• Domain Details
• FireFTP
• FireFlash
• Firebug
• Firebug Autocompleter
• Firecookie
• Firesheep
• FormBug
• FoxyProxy
• FoxySpider
• Google Site Indexer
• Greasemonkey
• Groundspeed
• HackBar
• Host Spy
• HttpFox
• JSview
• JavaScript Deobfuscator
• Key Manager
• Library Detector
• Live HTTP Headers
• PassiveRecon
• Poster
• RESTClient
• RESTTest
• RefControl
• Resurrect Pages
• SQL Inject ME
• Selenium IDE
• Tamper Data
• URL Flipper
• User Agent Switcher
• Vitzo WHOIS
• Wappalyzer
• Web Developer
• XSS Me
• refspoof

download  Mantra Pre-Alpha 0.01 here

NetworkScanViewer v1.0.4!

NetworkScanViewer is a GUI application designed to help view the results of Nessus (v4) and Nmap (v5) scan results. It combines the functionality of both NessusViewer and NmapViewer.


The application loads the scan data from nessus and nmap XML, does some data cleansing, then displays the results on the results list. The list data can be sorted by clicking on the column headers, so it is easy to order and locate particular information. There is also the ability to filter on specific information like host, port, service etc so it is easy to drill down to specific information.


A sample screenshot:

NetworkScanViewerThe export functionality exports using the data shown in the results list, so if you change the sort order or filter the results, then it is reflected in the export. It is also possible to permanently exclude scripts that just generate noise by right clicking on the item and selecting “Ignore Plugin” from the context menu. Excluded scripts can be re-added at any time by using the Options window.


Features of NetworkScanViewer:


* Data cleansing
* Export to CSV and XML
* Sortable data columns
* Data Filtering
* Script excluding


Basic requirements:


* Microsoft .NET Framework v4.0


The current version adds an extra nmap field for searching via the “Search” text box. So if an item has “Product: apache”, then you can search for “Product: apache” and all results with the value will be displayed.


Download NetworkScanViewer v1.0.4 here

Metasploit Framework v3.5.1

This is the release log:
Statistics:

• Metasploit now ships with 635 exploit modules and 313 auxiliary modules.
• 47 new modules have been added since the last point release.
• 45 tickets were closed and 573 commits were made since the last point release
• Metasploit is still about twice the size of the nearest Ruby application according to Ohloh.net (~500K lines of Ruby)

New Modules:
New Exploits and Auxiliaries

• Cisco Device HTTP Device Manager Access
• Cisco IOS HTTP Unauthorized Administrative Access
• Cisco IOS SNMP Configuration Grabber
• SNMP Community Scanner
• Exim4 <= 4.69 string_format Function Heap Buffer Overflow
• Metasploit Web Crawler
• Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service
• HTTP Form field fuzzer
• Adobe XML External Entity Injection
• SAP BusinessObjects Version Detection
• SAP BusinessObjects User Enumeration
• Web Site Crawler
• SAP BusinessObjects Web User Bruteforcer
• SAP BusinessObjects User Bruteforcer
• VNC Authentication Scanner
• SSDP M-SEARCH Gateway Information Discovery
• rexec Authentication Scanner
• rlogin Authentication Scanner
• rsh Authentication Scanner
• ProFTPD 1.3.2rc3 – 1.3.3b Telnet IAC Buffer Overflow
• ProFTPD-1.3.3c Backdoor Command Execution
• CakePHP <= 1.3.5 / 1.2.8 Cache Corruption Exploit
• Oracle VM Server Virtual Server Agent Command Injection
• Trixbox langChoice PHP Local File Inclusion
• NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow
• ProFTPD 1.3.2rc3 – 1.3.3b Telnet IAC Buffer Overflow
• FreeNAS exec_raw.php Arbitrary Command Execution
• Axis2/SAP BusinessObjects Authenticated Code Execution
• Axis2 / SAP BusinessObjects dswsbobje Upload Exec
• ColdFusion 8.0.1 Arbitrary File Upload and Execute
• Webster HTTP Server GET Buffer Overflow
• Network Associates PGP KeyServer 7 LDAP Buffer Overflow
• Internet Explorer CSS SetUserClip Memory Corruption
• Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit
• Adobe Shockwave rcsL Memory Corruption
• EnjoySAP SAP GUI ActiveX Control Arbitrary File Download
• Sun Java Runtime New Plugin docbase Buffer Overflow
• MOXA MediaDBPlayback ActiveX Control Buffer Overflow
• BACnet OPC Client Buffer Overflow
• Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow
• Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow
• Adobe Flash Player “Button” Remote Code Execution
• CitectSCADA/CitectFacilities ODBC Buffer Overflow
• MOXA Device Manager Tool 2.1 Buffer Overflow
• DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow
• CA BrightStor ARCserve for Laptops & Desktops LGServer (rxsSetDataGrowthScheduleAndFilter) Buffer Overflow
• CA BrightStor ARCserve for Laptops & Desktops LGServer Multiple Commands Buffer Overflow

New Scripts:

• Meterpreter Script for managing Windows Services
• Smart Locker Meterpreter Script
• Meterpreter Script for recording in intervals the sound capture by a target host microphone
• Schelevator — Exploit for Windows Vista/7/2008 Task Scheduler 2.0 Privilege Escalation
• Meterpreter Script for injecting a Reverse TCP Meterpreter Payload
• Webcam — view webcam over session
• Screenspy v1.0
• Meterpreter Script for Windows Event Log Query and Clear.

Framework Changes:
Java Exploitation:

• Make java_signed_applet work with generic java payloads, but keep the default tar… (r11172)
• Add rjb signing back in to java_signed_applet (r11186)
• Add ability to drop an executable from the jar. (r10973)
• Update documentation for executable dropper, thanks mihi (r11105)

Post-Exploitation:

• Scripts are now checking for the Meterpreter Platform (r10813, others)
• Full re-write of packetrecorder script (r10860)
• Merge webcam extension into stdapi. (r10997)
• Only load priv on win32/win64 sessions (r10984)
• Add functional in-memory webcam support. (r10954)
• Add service option to persistence to keep escalated privileges through a reboot. (r10847)
• Add audio (microphone) recording support to stdapi. (r11087)

Bruteforce Capabilities:

• Super-duper rservices commit (r11106)
• Big VNC update (r11033)
• Allow for blank FTP usernames. (r10834)
• Add xampp default user/pass (r10936)

Import / Export / Integration Capabilities:

• Merge in nCircle support (r10902)
• Added the “pwdump” format to db_export. (r10862)
• Updates to Nessus plugin (r11017)
• Added the ability to export hashes for John the Ripper (#3104)

Web Crawling:

• New web crawler module (r10924, r11022)
• Moved Wmap crawler into a module
• Add the crawler mixin and a sample form extractor crawler (r11025)
• Move the crawler mixin to an auxiliary (r11026)

General Updates & Changes:

• Added PacketFu library
• Properly show compatible payloads. Important for cross-platform exploits. (r10870)
• Fixed problem when running cmd_exec in PHP Meterpreter on Linux (r10850)
• MsfGui now starts a RPC daemon properly in windows (#3047)
• MsfGui can now browse drives other than “C:” during post-exploitation (#3290)
• Support browsers other than firefox when it is necessary to open a browser (#3059)
• Added an Auth’d login capability in smtp_deliver.rb (#3072)
• Added a standard ‘msfupdate’ script and add to the root of SVN tree (#613)
• Added Adodb-based cmd stager (#1431)
• Modified database migrations to play nice with MySQL (#2976)
• Test modules are now moved out of the normal exploit tree (up a directory) (2981)
• Java_signed_applet now has an up-to-date cert (#3015)
• Resolved a hang with multi-threaded meterpreter scripts (#3036, #3111)
• Standardized “Host Unreachable” vs “Port in Use” errors across platforms (#3206)
• ‘search -o’ now filters properly in msfconsole (#3306)
• Pivoted sessions now allow a report_host call without an exception (#3049)
• ‘db_nmap‘ now works from MSFGUI on Windows (#3297)
• Resolved a bug in ssdp_msearch (#3146)
• Resolved an issue with meterpreter recursive download (#3110)
• Resolved an issue with HTTP 100 continue responses (#3109)
• Added wow64 detection to rex (r11256)
• Added a nexpose rpc sample & update the discover sample (r11181)
• add a mixin for pdf gen, see (r11092 / #2841)

Known issues:

• Bug #3020 (Resolved) msfirb.bat does not support backspace on win32
• Bug #3225 Ctrl-C can sometimes kill Console2 (win32)
•  

This minor version release adds 47 new modules, including exploit covereage for recent bugs in the news: Exim4, Internet Explorer, and ProFTPd. Java payloads have seen significant improvement and java_signed_applet can now use them for complete cross-platform no-exploit-required pwnage! Eight new meterpreter scripts were added, including smartlocker and schelevator, an exploit for the 0-day privilege escalation used by Stuxnet. PCAP support has been added to db_import allowing you to pull in hosts and services without sending a single packet.
Download Metasploit Framework v3.5.1 (framework-3.5.1.exe) here.

pwnshell: A Better JSP Shell!

pwnshell is a stripped down version of the c99 shell and the likes. The only difference is that it a single JSP file, embedded with jQuery with a xterm like interface.

This is most useful at times when we when have an arbitrary file upload to a web-accessible directory that runs on J2EE. It could allow you to browse around the system with the privileges of the web application system user and execute arbitrary system commands. It can also show and alter session variables and help you dump JNDI entries.
pwnshell is a cross platform shell that runs on any system that supports Java 1.5 upwards. It’s usage is also simple – upload it to a vulnerable web directory, point your browser to the shell and when you get the shell, just pretend that you’re looking at the xterm interface. The best of all, it is open source!


Download the pwnshell here.