| > company > connection magazine | |||||
|
|||||
|
|||||
|
|||||
|
This article defines some of the tools which students use in the "White Hat Toolbox" hands-on course that tours around the United States and Europe in 2004. (Visit www.hotlabs.org/whitehat for more information.) Be certain you have permission from the owner of the target system (preferably in writing) before you perform password-integrity tests, port scans, vulnerability scans or any other communication that might be deemed intrusive. I must admit, my heart skips a beat or two each BrainShare when I look out at the line of eager techies waiting to scan their badges, take their seats and watch the Hot Tools class. This was the third year I'd presented this course at BrainShare and I admit—it is my favorite course to teach! Essentially, we throw out the slide presentation (my apologies to the graphic design team) and we start working live on the network. It is always a blast to start playing on the show network with vulnerability scanners, interceptors and redirectors, packet generators and forensic tools. Live! Once we took over a security camera and found a guy who had access to a shared directory that really shouldn't have been shared (yipes!). We've found assorted open systems (and I don't mean that in a nice "open source" sort of way) and a few print servers without passwords. If you found those hosts on your network, you would probably shut them down in no time. With the right tools, you can easily find these lapses in your systems and address them. In addition, with the right tools, you should be able to troubleshoot network communications, locate unsecure systems, identify unsecure applications and trace back to an attacker. These tools should allow you to test systems in your lab, check how an Intrusion Detection System (IDS) handles unacceptable traffic and even note when a user is scanning the network (and hitting your decoy along the way). Who says networking is boring? C'mon, now! We are in the right field at the right time—all you might be missing are the right tools! Let's examine the low-cost and free tools that make up my White Hat Toolbox.
You can use a network analyzer to
determine if you have unencrypted data
crossing your network, troubleshoot
network communications and even
measure latency on the network.
Ethereal You can use a network analyzer to determine if you have unencrypted data crossing your network, troubleshoot network communications and even measure latency on the network. Although typically pigeon-holed as a troubleshooting tool, your network analyzer can also be used to test the security of an application. During another recent onsite visit, I tapped into a large medical network that had thousands of medical records flowing in clear text to and from numerous connections—frightening when you consider that the United States passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996 which imposes a fine of US$25,000 per incident for each privacy violation. HIPAA is similar to Europe's "Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data," which was adopted in 1995. In Figure 1, I have used Ethereal to capture a plain-text password crossing the wire. You can clearly see SpamKiller (a spam-elimination tool by McAfee Security) sending out the POP password in plain text. I configured the password as "seethecleartextpassword?" in this example because I wanted the password to really stand out in the trace file. When you run Ethereal to check for plain-text passwords and unencrypted data, make sure you look in the hex window—which is where the clear text information will be visible if it exists. Other features that make Ethereal stand out are:
I often refer to Ethereal as the "ankle biter" to the big analyzer manufacturers such as Network Associates and WildPackets. If you are used to those full-functioning analyzers, it is difficult to step down to work with Ethereal. If, however, you have not become spoiled by easy charting, graphing and filtering and you are on a severely restricted budget, then Ethereal is the tool for you. NetScanTools Pro If you have someone knocking at your network door and you'd like a bit more information about them, click on the Automated button and enter what you know about the target (such as their IP address, domain name or e-mail address). You can choose to be stealthy by not contacting the target directly or go all out and scan the target directly. (Remember the warning about scanning systems without the owner's permission.) NetScanTools can also be used to locate a rogue server on your network through a simple port scan. In Figure 2, I set up NetScanTools to perform a scan of a set of network addresses (10.1.0.1 through 10.1.0.254) to look for anyone running services on port 21 (typically used for FTP services). There are other tools that can be used for a standard port scan, but NetScanTools offers customized port probes over TCP or UDP. You can create a TCP port probe using any combination of TCP flags—you can even define the source port and Maximum Transmission Unit (MTU) size to checking path MTU. There are so many features available with NetScanTools Pro; you can look for rogue servers by performing a port scan, test blocked ports on a firewall or router, test for SMTP relaying and perform reconnaissance on an attacker. This is why I consider it a "must-have" tool for any network. As an added bonus, Kirk Thomas, the developer of NetScanTools, has also included help files that define the technology as well as the tasks that can be completed with it. Aida32 In addition, Aida32 can be used as a forensic tool since it provides a clear report of software loaded on the local system, startup applications, system accounts, software keys and more. Note: Unfortunately, on March 23, 2004, Tamas Miklos announced that he would no longer be continuing Aida32 development because he accepted an offer to "drive a large development project" and won't have time for the Aida32 private project. Sigh. Fortunately you can still download and use Aida32— there just won't be any additions or future development. Figure 3 shows the software key listing on a target system. The target can be either a local device or a remote device. By default, Aida32 runs over port 2345 to perform a remote audit of another system, but it can be configured to use another port if desired. Aida32 is one of the jewels that should be in everyone's toolbox. LANguard Network Security Scanner When you run LANguard NSS, be sure to take an Ethereal trace to examine the processes LANguard NSS uses to perform its vulnerability scans. In your trace, you will see LANguard NSS running a NetBIOS name query followed by an SNMP GET request and a series of ICMP packets used to perform an OS fingerprinting operation. What a great trace! Figure 4 shows the results of a LANguard scan on Chadwick (my primary teaching system—which you may have seen all over the network at BrainShare). LANguard has determined that ports 21, 23 and 135 are open on the target. In addition, LANguard notified me that there are some possible security holes on Chadwick. Packet Builder Note: Packet Builder was previously called Rafale X. You may see some references to the Rafale name at various points in Packet Builder, especially in the scripting area. With Packet Builder, you can build special packets to identify device vulnerabilities or to perform reconnaissance probes on an attacker. In addition, you can test an IDS or Intrusion Prevention System (IPS) by hand-crafting and transmitting unacceptable packets past the IDS/IPS device. Did it log the packets? Did it try to snipe the connection? Packet Builder has a nice, clean interface that enables you to build UDP, TCP and ICMP packets in seconds. In addition, you can build the IP header from scratch. Building a packet from scratch requires extensive knowledge of the protocols and fields. Of course you could just build anything you want and see if it makes it through the network to the destination, but keep in mind that you may cause unpredictable behavior or even crash systems that cannot process the bizarre packets you may create. Use some caution here. Packet Builder allows you to spoof your address. Spoofing your IP address enables you to test your firewall and determine if it allows packets through from restricted addresses. However, Packet Builder doesn't provide any feedback on what is received in response to the packets sent. You must run Ethereal in the background to see your outbound packets and the associated responses, if any. One of the most impressive features of Packet Builder is its ability to run scripts of entire packet transmission sequences. If you are testing a single machine on a number of vulnerabilities, open up the example *.rsb file that is included with Packet Builder. This file provides you with all the information you need to start building and testing scripted transmissions. HTTP Sniffer There are several reasons why you might want to see the graphics cruising along the cabling system. Consider a user who is hogging the bandwidth of the Internet pipe. Using HTTP Sniffer, not only can you examine the user's HTTP activity, but if you suspect some unusual graphic files (can you spell p-o-r-n?) crossing the wire, you can capture the traffic and view the graphics. HTTP Sniffer is not a packet-oriented analysis tool. It focuses on the HTTP transactions and files transferred. HTTP requests and replies are grouped together, and the main window displays a total byte count for transferred files, the URL associated with the communications and the HTTP status. The HTTP status column indicates whether a TCP FIN was sent (indicating the transfer was completed) and the response code received from the HTTP server. You can probably imagine how this information can be used for troubleshooting. If a user complains of poor performance when Web browsing, you can rule out HTTP errors by simply viewing the list of response codes in the Status column. Ettercap Now you must be thinking, what? Intercepting switched traffic? Isn't that a hacker trick? Well, it could be. However, it can also be used to troubleshoot network traffic. For example, you may need to find out what data a particular user is sending/receiving on the network. However, your switch is not manageable and doesn't support spanning. Or, you can't put a hub in place to listen in on that user's traffic. You can intercept that user's traffic using Ettercap. Ettercap uses a three-step process to scan the IP addresses on a network, poison the ARP cache on one side of a local communication and then poison the ARP cache on the other side of a local communication. The switch has no idea that Ettercap has been run; it just forwards packets based on information in its MAC address tables. Ettercap doesn't even alter the switch's MAC address table. Slick, eh? Naturally, you don't want anyone else running Ettercap on the network. Ettercap has a nice Poison Locater feature that can detect other systems running Ettercap. The Poison Locater sends out a series of ICMP echo request packets with a specific value, 0xe77e, in both the IP header and the ICMP header ID fields. Although many systems may respond to an ICMP echo request packet, they should reply with a different IP header ID field value. If a response contains the value 0xe77e in the IP header ID field, then the sender is most likely running Ettercap. I recommend you work with Ettercap in your lab. Try all the options available so you know what Ettercap can do for (and to) you. Brutus Password Cracker Brutus is referred to as an authentication engine testing (AET) tool. Password-cracking routines are referred to as authentication tests. Brutus ships with numerous prebuilt authentication tests (such as HTTP-Basic Authentication, HTTP-HTML Form/CGI, POP3, FTP, SMB and Telnet). You can also download other authentication test configurations (such as IMAP, NNTP and NetBUS) from www.hoobie.net and import them into Brutus. This test can really get you in trouble, so be certain you cover yourself before you start running a brute force password crack on the target. Keep in mind that many systems may be configured to lock an account after a certain number of unsuccessful login attempts. If you run a password-cracking routine on these systems, the attempt will not only be noticed, but may also disrupt accounts. Disrupting accounts can be considered one form of a Denial of Service (DoS) attack in which an attacker purposefully sends invalid user names and passwords in an attempt to lock out an account. Brutus must understand a protocol or application in order to build a logical process to crack the password. Figure 5 illustrates the process Brutus follows to crack an FTP username/password on a target system. This is a four-step process—two steps to identify the correct user name and two steps to identify the correct password. Brutus listens to the FTP response codes sent by the FTP server. During an FTP crack, Brutus understands that response code 220 and 331 are sent by the server to request a user name and password, respectively. A response code 230 always indicates a successful attempt. Consider downloading a list of default passwords and default user names to test systems placed on the network. No systems should use their default security settings. Hurricane Search For example, suppose your company recently started negotiating a contract with XYZ corporation to sell widgets to a large customer in Depoe Bay, Oregon. Suddenly a competitor jumps in with a bid that slightly undercuts your company's bid. How did the competitor know your bidding price? Searching for the term XYZ on the salesperson's drive reveals that he has numerous documents he's not supposed to have on his drive. Or, suppose Fred (the "user from Hell") has been downloading some interesting files, which have eaten up most of your network bandwidth in the past few days. You suspect his drive may contain a ton of music files. Using Hurricane Search, you can search Fred's drive for .mp3. Even if Fred zipped his music files for distribution, Hurricane Search can find them. I also use Hurricane Search to find specific strings in my trace file directory. Sometimes I configure Ethereal to capture to files directly to my hard drive. I then use Hurricane Search to identify any root.exe or cmd.exe strings in the traffic. Save your searches as Hurricane Search projects so you can use them again and again. In addition, you can perform these searches on mapped network drives. Hex Workshop Hex Workshop includes a set of hexadecimal development tools for Microsoft Windows. With Hex Workshop, you can edit, cut, copy, paste, insert and delete hex; print customizable hex dumps; and export to RTF or HTML formats. You can also find, replace, compare and calculate checksums and character distributions within a file. I use Hex Workshop to open suspect applications before launching them. In addition, I use it to edit my trace files before sending them out to vendors or publishing them in courses or articles. (If you take the White Hat Toolbox course, you'll use Hex Workshop to import and export Ethereal filters.) Keyghost Keylogger I always travel with my trusty keylogger—last year at BrainShare we had a keylogger set up at our booth for attendees to try. My favorite keylogger is Keyghost. The Keyghost keylogger is made by Keyghost Ltd., in Christchurch, New Zealand. Two types of Keyghost keyloggers are available—the Keyghost barrel connector and the Keyghost keyboard. The Keyghost barrel connector is a physical device that is connected to the keyboard cable on one end and the CPU's keyboard port on the other end. The Keyghost keyboard is a complete replacement keyboard that contains the keylogging hardware. Everything that is typed on this keyboard is recorded into the Keyghost keyboard's memory. Warning: Before you even consider placing a keylogger, ensure that you have the authorization to keylog the target. Privacy laws typically prevent you from keylogging someone without his or her permission unless you have implied or explicit authorization from that person to do so. Check your local laws before planting a keylogger on your corporate network. After you place the Keyghost, every keystroke typed on the system is recorded. With a hardware keylogger, you can catch any changes that are made at the BIOS level (such as setting a BIOS-level password). Software keyloggers cannot detect these changes because software keyloggers must be loaded into memory before they start logging.
With the right tools, you should be
able to troubleshoot network
communications, locate unsecure
systems, identify unsecure applications
and trace back to an attacker.
After retrieving the Keyghost barrel connector or keyboard, you simply place it on another system, open up a text editor (MS Word or Notepad, for example), and type in the Keyghost password. The Keyghost keylogger barrel is shown at the top of this page and the Keyghost menu is shown below in Figure 6. Honeypot: Specter According to pcwebopedia.com, a honeypot is "an Internet-attached server that acts as a decoy, luring in potential hackers in order to study their activities and monitor how they are able to break into a system. Honeypots are designed to mimic systems that an intruder would like to break into but limit the intruder from having access to an entire network." Placing a honeypot in key spots on your network can alert you to scans and some attempted attacks that come from inside or outside the network. Your servers should not be burdened with the task of reporting possible scans—that's the job of your honeypot. A good honeypot doesn't stand out like a sore thumb. It simply looks like a system that has an interesting name, operating system or open port list. Specter has numerous elements that you can configure individually to customize and disguise your honeypot, as shown in Figure 7. If you are going to configure and deploy a honeypot, consider reviewing the honeypot/honeynet technology and hacker profile information provided by The Honeynet Project. This group boasts of an impressive Board of Directors including George Kurtz, CEO of Foundstone; Bruce Schneier, CTO of Counterpane; Alfred Huger, CTO of SecurityFocus.com; Martin Roesch, CTO of SourceFire; and Jennifer Granick of the Stanford Law School. Check out The Honeynet Project at http://project.honeynet.org. Our Protocol Analysis honeypot was up and running for much of the time during BrainShare. It was hammered with scans—mostly from people checking out port 79 (the fingered port) since I mentioned that the honeypot would respond to that port although most other systems would not. We could see numerous users trying to bring the honeypot down by performing a SYN attack on several open ports, but the Specter honeypot was configured to allow only 500 connections per service making the attempted Denial of Service attack quite ineffective. We did learn who the aggressive folks were on the show network, however. This is a perfect example of using a honeypot on the inside of a network to see what your users are up to. Wrapping It All Up And, remember to get appropriate authorization to run these
programs on your target(s). Laura Chappell is a Sr. Protocol Analyst at the Protocol Analysis Institute.
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
)
)
)
)
)
)
)
