During a CTF game, we came across very-very old systems. Turns out, it is not that easy to hack those dinosaur old systems, because modern tools like Metasploit do not have sploits for those old boxes and of course our "133t h4cking skillz" are useless without Metasploit... :)
But I had an idea: This can be a pretty good small research for fun.
The rules for the hack are the following:
- Only publicly available tools can be used for this hack, so no tool development. This is a CTF for script bunniez, and we can't haz code!
- Only hacks without user interaction are allowed (IE based sploits are out of scope).
- I need instant remote code execution. For example, if I can drop a malware to the c: drive, and change autoexec.bat, I'm still not done, because no one will reboot the CTF machine in a real CTF for me. If I can reboot the machine, that's OK.
- I don't have physical access.
I have chosen Windows 95 for this task. First, I had to get a genuine Windows 95 installer, so I visited the Microsoft online shop and downloaded it from their official site.
I installed it in a virtualized environment (remember, you need a boot floppy to install from the CD), and it hit me with a serious nostalgia bomb after watching the installer screens. "Easier to use", "faster and more efficient", "high-powered performance", "friendly", "intuitive interface". Who does not want that? :)
Now that I have a working Windows 95 box, setting up the TCP/IP is easy, let's try to hack it!
My first tool is always nmap. Let's scan the box! Below I'm showing the interesting parts from the result:
PORT STATE SERVICE VERSION 139/tcp open netbios-ssn 137/udp open|filtered netbios-ns 138/udp open|filtered netbios-dgm Running: Microsoft Windows 3.X|95 OS details: Microsoft Windows for Workgroups 3.11 or Windows 95 TCP Sequence Prediction: Difficulty=25 (Good luck!) IP ID Sequence Generation: Broken little-endian incremental
The first exciting thing to note is that there is no port 445! Port 445 is only since NT 4.0. If you check all the famous windows sploits (e.g., MS03-026, MS08-067), all of them use port 445 and named pipes. But there are no named pipes on Windows 95!
Because I'm a Nessus monkey, let's run a free Nessus scan on it!
Only one critical vulnerability found:
Microsoft Windows NT 4.0 Unsupported Installation Detection
Thanks for nothing, Nessus! But at least it was for free.
Next, I tried GFI Languard, nothing. It detected the machine as Win95, the opened TCP port, and some UDP ports as open (false-positive), and that's all...
Let's try another free vulnerability scanner tool, Nexpose. The results are much better:
- CIFS NULL Session Permitted
- Weak LAN Manager hashing permitted
- SMB signing not required
- Windows 95/98/ME Share Level Password Bypass
- TCP Sequence Number Approximation Vulnerability
- ICMP netmask response
- CIFS Share Readable By Everyone
I think the following vulnerabilities are useless for me at the moment:
- Weak LAN Manager hashing permitted - without user interaction or services looking at the network, useless (I might be wrong here, will check this later)
- TCP Sequence Number Approximation Vulnerability - not interesting
- ICMP netmask response - not interesting
- CIFS Share Readable By Everyone - unless there is a password in a text file, useless
But we have two interesting vulns:
- CIFS NULL Session Permitted - this could be interesting, I will check this later ...
- Windows 95/98/ME Share Level Password Bypass - BINGO!
Let me quote Nexpose here:
"3.2.3 Windows 95/98/ME Share Level Password Bypass (CIFS-win9x-onebyte-password)
A flaw in the Windows 95/98/ME File and Print Sharing service allows unauthorized users to access file and print shares by sending the first character of the password. Due to the limited number of attempts required to guess the password, brute force attacks can be performed in just a few seconds.
Established connection to share TEST with password P."
The vulnerability description at MS side:
For example if the password is "Password" (without quotes) and the client sends the password "P" (without quotes) and the length of 1, the client is authenticated. To find the rest of the password, the attacker increments the length to 2 and starts guessing the second letter until he reaches "PA" and gets authenticated again. As share passwords in Windows 95 are not case sensitive, "Pa" and "PA" will also be accepted. The attacker can continue to increment the length and guessing the next letter one-by-one until he gets the full "PASSWORD" (as the maximum length is 8 characters).
I believe all characters between ALT+033 and ALT+255 can be used in the share password in Windows 95, but as it is case insensitive, we have 196 characters to use, and a maximum length of 8 characters. In worst case this means that we can guess the full password in 1568 requests. The funny thing is that the share password is not connected to (by default) any username/account, and it cannot be locked via brute force.
I believe all characters between ALT+033 and ALT+255 can be used in the share password in Windows 95, but as it is case insensitive, we have 196 characters to use, and a maximum length of 8 characters. In worst case this means that we can guess the full password in 1568 requests. The funny thing is that the share password is not connected to (by default) any username/account, and it cannot be locked via brute force.
Luckily there is a great tool which can exploit this vulnerability:
Let's check this tool in action:
W00t w00t, it brute forced the password in less then 2 seconds!
Looking at a wireshark dump we can see how it is done:
As you can see, in the middle of the dump we can see that it already guessed the part "PASS" and it is brute-forcing the fifth character, it founds that "W" is the correct fifth character, and starts brute-forcing the sixth character.
If we are lucky with the CTF, the whole C:\ drive is shared with full read-write access, and we can write our team identifier into the c:\flag.txt. But what if we want remote code execution? Stay tuned, this is going to be the topic of the next part of this post.
Continue reading
- Hackrf Tools
- Hacker Tools For Windows
- Hacker Tools Hardware
- Pentest Tools List
- Growth Hacker Tools
- Pentest Tools Website
- Hack Tools
- Wifi Hacker Tools For Windows
- Hacker Tools Hardware
- What Are Hacking Tools
- Pentest Tools Framework
- Pentest Tools Framework
- Hacker Tools Free Download
- Hacking Tools Github
- Hacking Tools For Windows 7
- Hack Tools For Games
- Hacking Tools 2019
- Tools For Hacker
- Hacking Tools For Windows
- Kik Hack Tools
- Hacking Tools Windows
- Hacking Tools Download
- Pentest Tools Free
- Hack Tools
- Pentest Tools Bluekeep
- Hack Tool Apk No Root
- Hacking Tools For Games
- Hack Tools Pc
- Usb Pentest Tools
- Pentest Tools Port Scanner
- Nsa Hack Tools
- Pentest Tools Apk
- Pentest Tools Alternative
- Hacking Tools Software
- Hack Tools Online
- Hacks And Tools
- Pentest Tools Url Fuzzer
- Hack Tools Online
- Hacking Tools Github
- Hacker Tools
- Hacking Tools Github
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Name
- Hak5 Tools
- Bluetooth Hacking Tools Kali
- Hacking Tools Windows 10
- Pentest Tools Find Subdomains
- Hacking Tools For Kali Linux
- Hack And Tools
- Hack Tools For Mac
- Pentest Tools Bluekeep
- Pentest Tools Download
- Pentest Tools
- New Hack Tools
- Physical Pentest Tools
- Hacking Tools Windows 10
- Underground Hacker Sites
- Hacker
- Wifi Hacker Tools For Windows
- Hacker Tools For Pc
- Hacks And Tools
- Hacking Tools For Beginners
- Pentest Tools Linux
- Pentest Tools Subdomain
- Hacker Tools 2020
- Hacking Tools Name
- Hack Apps
- Hacking Tools Pc
- Pentest Tools Kali Linux
- Hacking Tools For Windows 7
- Usb Pentest Tools
- Hacker Tools List
- How To Hack
- Pentest Tools Framework
- Hack Rom Tools
- Pentest Tools Online
- Hacker Tools 2020
- Game Hacking
- Hacker Tools For Windows
- Nsa Hack Tools
- Easy Hack Tools
- Computer Hacker
- Hacking Tools And Software
- Hack Apps
- Hack Tools Pc
- Hacker Tools For Pc
- Hacking Tools Online
- Hacker Tools List
- Termux Hacking Tools 2019
- Beginner Hacker Tools
- Install Pentest Tools Ubuntu
- Pentest Tools Apk
- Hacking Tools 2019
- Pentest Tools Online
- Hacking Tools 2019
- Hacker Tools Linux
- Hacker Tools Linux
- Hack Tools Online
- Hacker Tools For Ios
- Physical Pentest Tools
- Hacker Tools 2019
- Best Hacking Tools 2020
- Pentest Tools Port Scanner
- Hacker Tools For Pc
- Hacking App
- Hack Tools Online
- Pentest Tools Tcp Port Scanner
- Pentest Tools Bluekeep
- Hacking Tools Windows
- Growth Hacker Tools
- Hak5 Tools
- Underground Hacker Sites
- Hacker Tools For Pc
- Hacker Tools Apk
- Nsa Hack Tools
- Best Hacking Tools 2020
- Hacking Tools 2020
- Hacker Tools Apk
- Pentest Tools Free
- World No 1 Hacker Software
- Best Hacking Tools 2020
- New Hacker Tools
- Pentest Tools
- Hacking Tools Windows 10
- Hacking Tools Kit
- Pentest Automation Tools
- Nsa Hacker Tools
- Hacker Tools Hardware
- Pentest Tools For Android
- What Is Hacking Tools
- Hack And Tools
- Pentest Tools Website Vulnerability
- Hack Tools Download
- Best Hacking Tools 2019
- Hacking Tools Name
- Pentest Tools Bluekeep
- Hack Tools
- Hack App
- Hacking Tools For Windows 7
- Computer Hacker
- Hack Tools For Windows
- Best Hacking Tools 2019
- Hacking Tools Download
- Hack Tools Pc
- Hacker Tools Online
- Hacker Tools Online
- Hacker Hardware Tools
- Pentest Reporting Tools
- Hack Tools
- Pentest Tools Alternative
- Termux Hacking Tools 2019
No comments:
Post a Comment