I failed upwards into management a few years ago. This means that I effectively opened an office for my employer and was responsible for finding, evaluating, recruiting, onboarding and generally looking after a team in Glasgow. This has been a privilege and for the most part the last two years has been a riot.
We build a pretty tight ship of overlapping skills with enough diversity in our thoughts to make things entertaining. It is to be expected that folks who join the crew set sail themselves to explore new shores someday. That doesn’t make it any easier when you effectively think of them as friends first.
Today is the last day for one of the original deck hands who is leaving for the best of reasons. What I know is that they are properly prepared for whatever is coming both personally and professionally. They will rock it out somewhere else.
I am learning there is a difference between intellectually knowing that there will be staff turnover, and experiencing it first hand a few times. Nobody said management was ever fun.
Reckon I am a bit like a parent waving their kid off to Uni and knowing that it is actually a good thing for them.
We will miss the enthusiasm and abilities day-to-day. But forever I will be up in your life so don’t you worry about that.
I did a talk “Hacking with Git” at BSides Glasgow. This was the first time I put myself out there to do a talk at a grown up event. Stop holding yourselves back! Learn, share and enjoy folks. You don’t have to become a public speaker. Blog, make youtube videos, stick a tool out there. Even if you only solve a problem that you have, you solved one of your problems.
This blog is about the things I learned along the way some of which might help you if you decide to go for something similar.
Here is a list of things that I learned or improved my abilities in during the process:
Using PowerPoint – I am god mode in the office suite (not a cool brag, but a brag there). I do not count PowerPoint when I say that. It is by far (for me) the worst bit of office. Bits of it are just plain inconsistent with how word and excel do things.
Recording videos of my desktop screen – I had tried this before. I definitely got better.
Video editing – I have never done this before.
New Python modules: CMD2, GIN, tqdm – I am so average at python. But I try and have made a few scripts in my time. These modules helped me and I am totally in love with CMD2. I plan to cover these things when I release the tools later. I have an ode to CMD2 at the end of the work blog here.
Preparing a talk for a limited time slot – I am pretty sloppy in my timing of tasks in general. I frequently talk to people so long that they are knackered and I am knackered. I am working on it 😀
Doing something beyond your current skill set is great. Not before it happens. Not during the moments of doubt. But now. Looking back at it I have nothing but positive feelings about it.
Hopefully the thoughts below help someone else add their voice to whatever event.
The Journey
After submitting the talk I went through a cycle of doubt. I avoided it. I procrastinated hard. Rather than making the slides for “Hacking with Git” I literally made a talk about procrastinating and delivered it at the local Defcon meetup DC44141.
Sorry to anyone who turned up for a real talk who saw “Professional Procrastinator”. I literally decided to do the talk about 8am on the day. Doing that was catharsis. It earned me confidence that I could just go talk rubbish for a while and the sky didn’t fall.
That talk ended with me nervously standing while this played:
A friend had asked me to put words to the Quincy theme in the days before Defcon. Instead of recording the demo videos for “hacking with git” I made this ^^^. While I was clearly procrastinating, I did learn some serious skills:
Other things you can do with VLC that I learned recently is that you can convert video files from one format to another. It is really the “Swiss army knife” of video and audio conversion and there was me thinking it just played videos.
Appease the “Demo Gods”
If you have made a tool or you have a technique to talk about then you are going to need to demonstrate it. PoC or piss off right? A technical talk needs a demo. Ask the organisers if they have a reliable network for your needs.
Live hacking something takes some guts and you need more if it needs the Internet.
Even if you can demo something live consider what happens if it all goes to shit on the day. I suggest you record a video where it worked fine. You then only have to worry about this: does the venue have speakers?
Having offset the fear of the demo gods by deciding early that I had to make videos, I relocated my fear onto the venue not having a sound system. Turns out they did, turns out it was all fine.
Desktop Recording Software
I have dabbled with recording my desktop a few times. I had used “Screen Recorder” in the past on Windows. While it works, your options for free are minimal and you are limited to 5 minutes. This is literally why most videos I made before are < 5 minutes long.
Once before I have recorded a demo within Kali using “recordMyDesktop“. Which is fine if you are doing something only within Kali. The problem I had with that personally was my voice sounded like it was coming in from another universe in that video. To solve that I ended up purchasing a USB microphone (see below) which I could send straight into the VM which was dedicated. Absolutely solved the problem.
In the end I discovered a free screen recorder baked into Windows 10. Part of the XBOX app you can record anything. This worked well and had no time limits and meant I could record anything on a screen. If you find this Microsoft. Just cut the code out from the XBOX app and provide it as a dedicated app please kthnxbye.
Buying a Microphone
I looked around for a microphone which would improve over the gaming headset I have.
After reading numerous reviews I ended up choosing a “Snowball Blue“. This has a few settings and I have been able to use it for: Skype, Recording Guitar, Singing, and making videos.
It is pretty versatile for the ~£50 price tag. I am very happy with this piece of kit. It is the only item that cost money during the process and personally it has been money well spent.
Recordings for “Hacking with Git” had to happen late at night when my kids were asleep. Sadly in a small room which makes the audio worse than it should have been. Don’t judge the mic on the audio in the videos. It has performed much better when I get the chance to use it in my living room.
Video Editing
The tools that I needed to demonstrate take a few minutes to run. I could describe what they were doing much quicker than showing them completely. I figured it would be really boring for a crowd to watch a progress bar. So I needed to learn how to edit videos.
I found OpenShot which is free and *awesome*. It is available on Windows and Linux. I tried both platforms and they worked for me. The process was intuitive and there are plenty of tutorials on YouTube.
Preparing your talk for a limited time slot
While I have done a few talks before this was the first time I practised effectively. I recorded my efforts and did a bunch of dress rehearsals. I listened back to them and found the parts where I was waffling.
An initial run of the talk was a flabby 55 minutes. On the day it was a taught 38 minutes, AND I had added a bunch of slides since the ludicrously long one to boot. I said more in LESS time! Practising is apparently good; who has knew this?
PowerPoint has “presenter” view which comes when you have two monitors (laptop and external). The external will show the slides “to the audience” and the laptop screen will show presenter view as below:
The highlighted bit shows the time since the presentation started. This was a vital part of the practice sessions for me.
PowerPoint Presenter Mode Not Working
In the days before BSides I was getting stressed because my “presenter” mode was not launching. I could not find the solution until literally the day before BSides I discovered Nvidia are messing with me.
The option shown below is buried within “nView Desktop Manager” -> “Applications” and “Enhancements” menu:
Telling that option to do one made presenter view work perfectly. Just in time for me to get my practices done. I hope that little Nvidia trick saves someone the mad panic I had.
In conclusion;
I don’t know how to end blog posts.
Sometimes you will need to test from a Windows environment. To cite merely two examples:
if you have busted out of a Citrix locked down environment and are now installing tools; or
if the customer wants you to simulate a rogue internal user with one of their Workstations (I love doing this personally!).
These come up relatively regularly in my life but not day to day. The biggest one is really: you just want to do some work and your host OS is Windows!
In those situations you might miss the friendly and warm embrace of “eth0” and that ilk we have under Linux. If you want to install and run Responder or Wireshark or whatever you will need to know your interface names.
Solution
Rename your adapters to mean something to you! Not complicated. Windows allows you to do this via “Control Panel” -> “Network and Internet” -> “Network Connections:
Pick a name that makes sense to you and be on your merry way. I renamed things to “Ethernet”, “Ethernet 2”, “WiFi” etc so I knew what they were. These names are then persisted within Wireshark when I tested it so it seemed like a good idea to me.
The rest of this blog are just random thoughts on Adapter Creep, and ipconfig rants if you want to stick around that is your choice!
Adapter Creep: How we got here
The number of network adapters has been on the increase in the last decade. You may have:
I personally find it a pain to read the output of “ipconfig” or sift through the drop downs in tools. This is another reason I decided to start renaming adapters.
Rant about “ipconfig”
The following in your command prompt will display the list of adapter names you currently have:
ipconfig | findstr "adapter"
The usage instructions for “ipconfig” do state that you have a “where” clause which can let you interact with specific interfaces:
Based on attempting this myself many years ago, and on the various Stack Overflow and forum responses I just saw on trying to use that “where”, I am going to conclude that this doesn’t work well enough for anyone.
I had hoped that explicitly setting the name of the adapter would make this easier but somehow “*Ethernet*” does nothing as far as I can see.
Solutions are out there to get what you want with .bat files, or VBS etc. Fairly hacky was to do basic networking tasks.
Netsh seemingly to the rescue
In reading the forum posts I did find a tip about using “netsh” instead of “ipconfig”. While this feels like a much much bigger tool for the job. It is possible to properly query details of specific interfaces only. So sharing the syntax in case it helps:
netsh interface ip show address name="WiFI"
Where the address name is exactly the name of the adapter.
I have been working on an Extender for Burp Suite (a local proxy which allows you to check for common problems and security weaknesses). While the proxy is written in Java it is common for the Extender’s to be made in Python.
Jython is the glue that keeps Java and Python working. My Extender had the need to execute python so I redirected the Standard Out and Standard Error streams to a MessageConsole.
Redirecting Standard out and err
The code for doing this is shown below:
// Redirect standard out and err to the MessageConsole
MessageConsole console = new MessageConsole(this.output);
console.redirectOut();
console.redirectErr(Color.RED, null)
Note: I might not leave this as the final product because I have just found this reference:
Which indicates that “setErr” and “setOut” might work better for me somehow. However, that is a side show.
With the above code if you click the “Execute” button you trigger an event handler with this code:
// Get the python code from the text area
String python = pythonTextArea.getText();
// Show user that something is happening
setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
PythonInterpreter interp = new PythonInterpreter();
// Run the user python in the Jython interpreter.
interp.exec(python);
// Close the interpreter
interp.close();
// Now our task is over show the user it is done.
setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
Pretty simple; get me the python code, start an interpreter, execute, and close the interpreter.
UnsupportedCharsetException: cp0
Using the above code you will see that you get our pesky “UnsupportedCharsetException” on first execution of Jython as shown below:
That makes for an unsightly error. It is not a blocker because as you can see the JOptionPane displayed its message after. But an error appearing to users is going to erode their trust in your software. Particularly since this happens once per execution. After it is displayed it seems Jython then selects an OK character set and plays happy from there.
Looking into it the exception is because the Java Virtual Machine has not been launched with an appropriate run-time parameter. According to the reference below:
There are other Console Choices available. But this seems to be a way to prevent the error. This is also the accepted answer on bug trackers and forums across the Internet.
It seems possible to use a “jython registry” to apply this setting but that means shipping files with your tool or making users create them. It seemed messy when what I guess we really want is a way to set the character set somehow as a property of instantiating the “PythonInterpreter” object. That doesn’t appear to be in the API so we can only dream of that.
The Right Solution
The legend that is Paj working over at PortSwigger these days fired in this nugget:
Nice write up, but what a pain! Possible workaround: System.setProperty("python.console.encoding", "UTF-8") Enjoy, Paj
Which effectively is the programmatic interface to interacting with run-time parameters. This solution works perfectly when I tested it. The code for this is below:
System.setProperty("python.console.encoding", "UTF-8");
// Redirect standard out and err to the pythonOutput textpane
MessageConsole console = new MessageConsole(this.output);
console.redirectOut();
console.redirectErr(Color.RED, null);
That got the job done right. If for some reason you are unable to use that. Then I have maintained my hilariously hacky solution which somewhat did the same job.
The Hacky Solution
In the realm of writing Burp Extenders I am not able to really influence how users launch their instance of Burp (so that -D approach is not likely). Nor would I imagine PortSwigger (the vendor) taking the time to cater for this edge case by making everybody launch burp a new way! Quite rightly too.
This means I came up with a hacky solution which avoids the errors for users:
// Here comes the dirty, dirty hack!
PythonInterpreter interp = new PythonInterpreter();
interp.exec("a=1+2");
interp.close();
// Yup. Launch the interpreter and do nothing of significance
// Do it before setting up your STDOUT and STDERR redirects
// Redirect standard out and err to the pythonOutput textpane
MessageConsole console = new MessageConsole(this.output);
console.redirectOut();
console.redirectErr(Color.RED, null);
I am going to need a shower. This feels particularly dirty even for me.
A tool which works in Kali Linux which will “upload” a file to an RDP session.
Most of the time RDP allows one of “drag and drop”, “copy and paste”, or “mounting of your local hard drive”. So 99% of the time you do not need to do this at all!
When all other options are unavailable to you then you can always simply type the contents of any file you want. Then use built in tools on the target’s side to decode and then execute your uploaded file.
This is a very old technique. All I have done is have a stab at making my own tool for doing this. I meet aspiring hackers who say they want to jump into coding, but don’t have any “ideas”. They seem unimpressed when I say write a port scanner.
If that is you then I say to you: re-invent the damn wheel!
Sometimes the wheel needs upgrading you know? Many of the tools we have now as the “goto” for something are about 17th in newness of technique. Any tool can be toppled by a better successor.
But world domination is not the goal. Implementing your own versions of old ideas is actually just for getting your skills in for the day you invent an entirely new wheel. It also teaches you how a thing works which is brilliant. At a job interview you will stand out if you actually know what the top tool does under the hood.
What I learned on this one
To make rdpupload I have learned:
argparse better (I have used this before)
how to simulate key presses in python
how to do a progress bar in a CLI
how to zip a file using python
how to play an mp3 in python
But most importantly I learned how a file upload may work by typing it, along with how to decode that on the server side easily.
Technique Used
The following summarises the techniques used:
Kali Side:
Zip the file you want to upload (might save some characters depending on the file).
Base64 encode that file (so every character we are going to use is available on a standard English Keyboard).
Split the encoded file into chunks of size 256 characters (arbitrary length choice here).
Spoof a keyboard typing each block of 256 characters until it is completed.
Display a progress bar and optionally play the sound of a typewriter hammering away while the “upload” happens.
Victim Side:
Place the cursor into “Notepad” within an RDP session.
When the “upload” is complete save that as a “.txt” file.
Open a command prompt and use “certutil.exe” to decode the base64 encoded file. The syntax for that is shown below.
Use the zip feature of Windows to unpack the zip file.
Profit.
The decoder on the server side relies on “certutil.exe”. Unless I am wrong this is available from Server 2003 upwards so is pretty useful for most use cases.
I have been making more and more Python scripts in the last 4 years. I have always had sub-optimal environments for doing so. With no interest in a debate on the best text editor. What I really wanted was an IDE. One that I can understand is ideal. As it happened I have some experience of Eclipse and tonight I found “PyDev”.
PyDev is free, easy to install, and gives me code auto-completion which I have rarely had in my Pythonic adventures to date. I love me code auto-completion. I have had it in various editors. However, I trash my Kali VMs with such regularity that I’d rather have something with an easier install than things to backup.
I am installing into a fresh install of Kali 2017.1 here. Anything else and you may have a different experience.
Prerequisites
All we need is eclipse and java 8. Install them as shown below:
When I did this Kali installed eclipse 3.8.1. This is not the latest. The newest PyDev works for later versions of eclipse. We need to install from the PyDev 4.X release stream. If you use the wrong release stream then PyDev will not show up in the GUI after installation.
Installing PyDev
Goto “Help” -> “Install New Software”
This will show you a screen where you can add a repository as shown:
Do the things in the number order above. To save you precious typing the Location is:
Follow the numbered steps again. Then click “Next” on the subsequent screen with the title “Install”.
At this point you will get the security warning prompts. This is because the package is self-signed:
It is risky. There is no doubt here that taking something with an insecure certificate is a risk. When I followed the official guide I got the same error but that was using a repository over plain-text HTTP. Neither of those cases is really up to snuff when it comes to security.
But this is an opensource project which is being made free of charge for the love of the community. So is the entire stack you are sitting on!
I rolled my risk o-meter and said my VM isn’t having customer data in it.
After the installation is complete Eclipse will restart. Then you can check that the installation worked by going to: “Window” -> “Preferences” -> PyDev.
If you have that PyDev menu there then you are all setup. Congratulations and now enjoy your Python Dev with code completion and everything you would want.
Debugging
If you do not see the PyDev option under “Window” -> “Preferences”, then:
You didn’t install java 8; or
You didn’t install from the 4.X release stream of PyDev if you are using Eclipse 3.8.X
Or you have a new problem I did not encounter during this setup.
A customer asked me to check for CiscoDiscoveryProtocol (CDP) based VLAN hopping on their LAN. It had been reported the year before and, while they hoped that it had been addressed, they wanted me to confirm that it had.
When pentesting it can often be the case that you are basically verifying the solutions to problems that some hacker from another company got to run riot with before.
Far from a burden, it gave me a chance to brush up a little bit. It got me to play with scapy a bit and so this post is basically so I can save my python code in-case I need it again, while sharing it in case it helps someone.
The easy tool for this has been Frogger for several years. It will conduct packet sniffing on an interface looking for CDP packets. Snarffle the VLAN IDs and some other information and then ask you exactly how you want to own a network.
I ran frogger and shock! No VLAN data and no CDP packets to play with. I optimistically increased the packet capture to 3 minutes and tried again. Nope…
Well I guess last years team had much more fun than me.
False Negatives
A thing to remember about Frogger is that if you are trying to run it inside a virtual machine then you might actually be getting false negatives here. Where a false negative is the absence of the vulnerability despite you doing almost the right thing to check for it.
The Readme.md for Frogger says this:
“Notes for VMware. VLAN hopping generally (not just this script) can have issues within VMware if running the VM within Windows with certain Intel drivers. The Intel drivers strip off the tags before it reaches the VM. Either use an external USB ethernet card such as a DLink USB 2.0 DUB-E100 (old model 10/100 not gigabit) or boot into Backtrack nativiely from a USB stick. Intel has published a registry fix, to work on some models: http://www.intel.com/support/network/sb/CS-005897.htm – adding “MonitorMode” 1 to the registry does resolve the issue.”
I am paranoid about false negatives so I always run around with a USB Ethernet Device. I did use this for my run of frogger and so I was pretty much certain it was not a false negative.
Checking for the VLAN IDs
Earlier in the engagement I had captured around 2 hours worth of network traffic into a pcap file. This was done from my host OS and not from within my Kali VM. This would therefore have no doubt about capturing all the layer-2 juiciness. Since it was already sitting around why not use python to parse the pcap file and tell me any VLAN ID’s it contained?
You could use a wireshark filter (and I show you the expression at the end of this post). But I am doing things pythony more an more so lets get to scapy.
Enter the VLAN ID hunting script:
from scapy.all import *
from scapy.utils import *
import sys
if len(sys.argv)!=2:
print sys.argv[0] + " <pcap_file>"
sys.exit(-1)
# If we get here we have a file
pcapfile = sys.argv[1]
# Loop through the file and check each packet
pkts=rdpcap(pcapfile)
for pkt in pkts:
if pkt.haslayer(Dot1Q):
print "VLAN ID: " + str(pkt[Dot1Q].vlan)
For full disclosure the above is heavily based on a stack overflow answer here:
All I did was give it a usage and command line argument for re-usability.
I ran this against my 2 hours worth of packets and found not a single VLAN ID. So absolutely on that day, on that part of the network, there was no evidence of last years vulnerability. Well done to the customer they fixed a thing!
I beg the audiences indulgence for a sidebar
There is an episode of Red Dwarf where Dave Lister gets sick with a radioactively mutated virus. He meets characters that represent both his confidence, and his paranoia. Right about now I was listening to my inner US game show host (representing my confidence). I was thinking: job done CornerPirate. Job done.
Then my paranoia spoke up. You haven’t tried the above script against a PCAP where you knew there was a VLAN id. What if it didn’t work?
Generating a PCAP with VLAN IDs
So lets make a pcap file which has some VLAN IDs in there. Back to python and scapy:
from scapy.all import *
from scapy.utils import *
import sys
def usage():
print "\nUsage:"
print "\t" + sys.argv[0] + " <vlan id>"
sys.exit(-1)
if len(sys.argv)!=2:
usage()
if sys.argv[1].isdigit() == False:
print "Specified VLAN ID is not a number"
usage()
# If we get here we have a vlan id to inject
vlanid = int(sys.argv[1])
# Craft a packet and send it
sendp(Ether(dst='ff:ff:ff:ff:ff:ff', src='11:22:33:44:55:66')/Dot1Q(vlan=vlanid)/IP(dst='255.255.255.255', src='192.168.0.1')/ICMP())
I ran the above with a few different numbers while using Wireshark to capture the packets. Visually I could now see there were definitely VLAN ID’s to be had as shown below:
Finding the VLAN ID using Wireshark Expression
The expression used was “vlan.id” which means “show packets which have a VLAN ID”. My 2 hours worth of packets resulted in zero packets for the same filter. My confidence was now building.
Rerunning my “check-vlan.py” script now showed the same results as Wireshark:
Listing out VLAN
So there you have it. I now know my script does what it intended to.
