Hacking school computers for fun profit and better grades short

g Sc hool
Ha ckin
mpu ters
Co r Grade
s
d Bette
Fun, P rofit, an

What do these people
have in common?
!   Lindsay Lohan

!   Paris Hilton

! Snooki

! Charile Sheen

Albert Gonzales
!   Hacked Wireless

!   Hacked TJ Maxx

!   90 Million Credit cards stolen

!   20 years in Jail

Detective Quiz
!   Pictures have in common

!   Cat, Chicken, Pig, Donkey, Farmer

Motivation of Hackers
!   Is money, no question about it

!   People rob banks and pick pocket wallets for
money

!   Jail

Reality of Today
!   Hackers are stealing money from computers

!   Soon smartphones

!   Smartphone hacking rising

!   Take over the world, just like Dr. Evil

u sec ure?
Are yo
PCI
u passed
a re if yo
do esn’t c
B ad guy

Perimeter is dead
!   You might have a firewall

!   Tons of traffic are punched through holes in your
firewalls

!   Billions of packets

!   How do you know you are secure?

Bad Guys
!   are after you systems. They want to hack you.

About me
!   Work at Capliano University

!   Hack wet paper bags for a living

!   I Love 80’s music

!   I Love riding my bike from downtown Vancouver

!   To North Vancouver

About Me
!   I love Backtrack4

!   Some people call me a blackhat

!   But I’ve always been a good guy since the RCMP

About Me
!   Love Plants vs Zombies

!   And my Macbook Pro

!   Read NIST publications

!   Windows Forensics Analysis Book

!   Rootkits Arsenal Book

Reading List
! Shellcoders Handbook

!   Mac Shellcoders Handbook

!   Reverse Engineering Book

!   Security Power Tools Book

Webistes
!   Google

! Youtube

!   Larry Zelster

! Sans.org

!   DFRWS

Build a Hacking
Workstation
!  BackTrack4

!  SIFT Workstation

! Maltego

!  Nessus

! Nmap

! Metasploit

! Wireshark

!  Python

!  Ruby

Hacker Cons that I follow
!   DEFCON

! CanSecWest

! SecTor

! Blackhat

!   CCC

g Sc hool
Ha ckin
mpu ters
Co grades
d b etter
Fun, P rofit, an

Methodology
!   Reconnaissance

!   Exploit Development

!   Exploit

!   Maintain Access

Recon
! Blackhats on your network

!   Dumpster diving

!   Going through your garbage and old systems

Tools for Recon
! Maltego for analysis

!   Scanning your network with Nessus

!   Scanning your network with nmap

!   Using Metasploit toolset

Tools for recon
! theHarvester
! Metagoofil
! Wireshark
! Etherape
!   Watching students
!   Watching staff and faculty

Methodology
!   Reconnaissance

!  Exploit Development
!   Exploit

!   Maintain Access

2007
.0
iPho ne OS 2
K
iPh one SD

2009 n now progra
m
rs ca
velope
iPhone De

mework
atio n Fra
Fo und Method
s
se s and
dreds of Clas
Hun

Methods to creating
exploits
!   Finding Zero Days

!   Reverse Engineering patches

!   Using malware creation kits

!   Creating shellcode to exploit OS

Finding 0day vulns
!   Fuzzing

!   Smart Fuzzing

!   Dumb Fuzzing

!   Distributed Fuzzing

Fuzzing
!   Involves providing invalid, unexpected, or
random data to the inputs of a computer
program

!   Interrupting program flow

Methods to creating
exploits

!  Reverse Engineering patches


Microsoft Patches
!   Every month Microsoft releases patches

!   You can identify vulnerabilities in the code and
create exploits for the vuln

Reverse Engineers
!   Reverse engineer Microsoft patches

!   Create specialized exploit code to exploit
specific Microsoft vulnerabilities

Reverse Engineering
Tools
!   IDA Pro
!   Immunity Debugger
! binDiff
! PaiMei
! Vmware
!   Python scripts

Remote Code
Execution

New control

IDA Pro
! Dissassembler

!   Used to reverse engineer the binary

!   Translates machine code to C

Methods to creating
exploits


!  Using malware creation kits

Zeus research
!   Source code on the Internet

!   Lots of analysis by big anti-virus vendors

!   Screenshots on the Internet of the Zeus Builder
interface, Configuration interface

Immediately Post-Infection
!  Zeus downloads encrypted config
file
!  Transmits systems details to C2
server
!  Receives additional commands

How do get infected?
!  Drive by Download
!  Phishing scams
!  Malicious Email attachments
!  Bogus Zeus Crimeware Downloads
!  SQL Injected Websites

Controllers of ZBOT
!  Capture (banking) credentials
!  Remote control
!  Keystroke logging
!  Screen capture
!  Proxy services

Typical Theft
!  Attackers steal credentials
!  Set up bogus employee/vendor
accounts
!  Accounts are actually “mules”
!  Transfers typically kept under $10K

Wire Money
!   Eastern Europe

Methods to creating
exploits



!  Creating shellcode to exploit OS

Reference books
! Shellcoders Handbook

! MacHackers Handbook

Shellcode Fun
!   Stack Overflows

!   Heap Spray

Stack Overflow
!   Typically found in C type code

!   No bounds checking

!   Always new C code being created J

Heap Spray
!   Commonly used in Javascript browser attacks

!   Can be used in putting shellcode into various
parts of unused memory

!   If you find your code…game over.

NOP sled and shellcode
!   0x90 = Intel x86 opcode

! a.k.a = NOP slide or NOP ramp

!   NOP (no-operation) instruction sequence meant
to "slide" the CPU's instruction execution flow to
its final, desired, destination.

Allocated Memory

Unused Memory Shellcode

Shellcode

Shellcode
Allocated Memory
Shellcode
Unused Memory Shellcode

Shellcode
Shellcode
Shellcode
Shellcode
Shellcode

Shellcode

Shellcode
Shellcode

Shellcode
!   Local
!   Remote
!   Download and Execute
!   Staged
!   Egg Hunt
!   Omelet

Local
• Local shellcode is used by an attacker who has
limited access to a machine

• Privilege escalation from user to Admin/root

Remote
• Remote shellcode can provide the bad guy access
to the victim machine across a network

• Remote shellcode normally use standard TCP/IP

• Connect-back shellcode is used to connect back
to the bad guys's machine

Download and Execute
• Download and execute is a type of remote
shellcode

• Instructs the victim machine to download bad
guy’s executable file off the network, save it to disk
and execute it

• This is a drive-by download attack!

Staged
• When memory space is small for a process
• Recommned staged shellcode to execute in
stages
• First, a small piece of shellcode (stage 1) is
executed. This code then downloads a larger piece
of shellcode (stage 2) into the process's memory
and executes it

Egg-Hunt
• Small egg-hunt shellcode is injected into the
process at a predictable location and executed

• This code then searches the process's address
space for the larger shellcode (the egg) and
executes it

Omelet
• This type of shellcode uses multiple small blocks
of data (eggs) and recombines them into one
larger block (the omelet)

Shellcode research
!   Smartphone exploits

!   Breaking Arms by M.J. Keith

Stack and Heap Spray
!   Countermeasures

DEP
!   Makes pages of memory

!   Read only

!   Not executable

ASLR
!   Mitigation technique which involves randomly
arranging the positions of key data areas

!   Stack Overflow protection

Microsoft Redhat Apple

win7 XP 2000 RHEL Open OSX
BSD
ASLR
Stack Protection
Heap Protection

Finding Targets to Exploit
!   A.K.A = Victims

Targets
!   Students

!   Teachers and Staff

!   Wireless, VOIP, Photocopiers, Lab computers,
staff computers, faculty computers, servers

!   Networks

Exploit Websites
!   Any internet services

!   SSH

!   HTTP

!   HTTPS

!   FTP

Exploit Toolkits
! Vmware

!   Backtrack4

! Metasploit

Social Engineering Toolkit
!   Drive by Downloads

Fake AV
!   Drive by Download Kings

Oracle Hacking
!   Need IP address

!   Need Listening Port

!   Need SID

!   Need Username and Password

Oracle Attack
Methodology
!   Determine Version and SID

!   Guess or Brute Force Username and Password

!   Privilege Escalation via SQL Injection

!   Data Manipulation or post data

!   Cover your tracks…muhahahahaha

msfconsole commands

! msf auxiliary(lt_findricset) > set RHOST 172.10.1.109

! msf auxiliary(lt_findricset) > set RPORT 1521

! msf auxiliary(lt_findricset) > set DBUSER SCOTT
! msf auxiliary(lt_findricset) > set DBPASS TIGER

! msf auxiliary(lt_findricset) > set SID ORCL
! msf auxiliary(lt_findricset) > set SQL GRANT DBA TO SCOTT

Extra DB Hacking
! db_autopwn

!   SQL Injection

db_autopwn
! msf > load db_mysql

! msf > db_create root:password@localhost/
pentest

! msf > db_nmap -A 192.168.1.0/24

! msf > db_hosts

! msf > db_autopwn -pb

SQL Injection via
SYS.LT.FINDRICSET
register_options( [OptString.new('SQL', [ false,
'SQL to execute.', "GRANT DBA to #{datastore
['DBUSER']}"]),], self.class)
•  grants the DBA permission to the DBUSER in 10g

Miscellaneous Fun
! Firesheep

! Ettercap

! SSLStrip

Last Resort
! Teensy.pde

! Powershell SAM dumps

!   Hacking update services like
windowsupdate.com

!   UPS OpenWRT

Last Last Resort
!   Create prize like IPAD2 win

!   W3AF for webscanning apps

!   Lock picking Kensington Locks with Toilet roll

!   Wireless conversations with Mallory and
JavaSnoop

Maintain Access
!   The Rootkit Arsenal is a great book

!   Create Zombies and Bots

!   Use Backtrack4

!   Use Metasploit

Migrating process
!   Avoiding detection

!   In Metasploit after you PWN a system

!   There is a Meterpreter Script to migrate process

Creating FakeAV for
!   Smartphone?

!   Make Billions

The Matrix
!   Is this movie about hacking?

Yes, Yes and Yes
!   A computer hacker learns from mysterious
rebels about the true nature of his reality and his
role in the war against its controllers

Penetration Testing

and Security Auditing
Linux Distribution

How many hits?
!   Word hacking in on Google

How many hits
!   When you search youtube?

How many PC’s deployed
worldwide?

How many smartphones?
What’s the future market?

You are under arrest for
Section 342.1
Unauthorized use of
computer, do you
understand?

You have the right to retain
and instruct counsel without
delay.

We will provide you with a toll-
free telephone lawyer referral
service, if you do not have
your own lawyer.

Anything you say can be used
in court as evidence.

Do you understand? Would
you like to speak to a lawyer?

Hacking school computers for fun profit and better grades short

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (20)

Semelhante a Hacking school computers for fun profit and better grades short

Semelhante a Hacking school computers for fun profit and better grades short (20)

Mais de Vincent Ohprecio

Mais de Vincent Ohprecio (7)

Último

Último (20)

Hacking school computers for fun profit and better grades short