Bosses love excel, hackers too
•Transferir como PPTX, PDF•
1 gostou•2,703 visualizações
Talk delivered by Chema Alonso and Juan Garrido "Silverhack" in Defcon 19 about new tricks for hacking Citrix and Terminal Services environments using Excel (and Office Apps) to run commands in the server.
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (20)
Mais de Chema Alonso
Mais de Chema Alonso (20)
Último
Último (20)
Bosses love excel, hackers too
- 1. Bosseslove Excel …hackers too! Juan Garrido “Silverhack” Chema Alonso (@chemaalonso) INFORMATICA64.COM
- 2. Who?
- 3. About Working at INFORMATICA64.COM http://www.informatica64.com
- 4. What?
- 6. Why?
- 7. RDP
- 8. Citrix
- 9. Using Bing
- 10. GovermentSites
- 11. GovermentSites
- 12. Secure?
- 14. Verbosity Conf -files are tooverbosity Internal IP Address Users & encryptedpasswords Internal Software PerfectforAPTs 0-day exploits Evilgradeattacks
- 15. Verbosity
- 16. Verbosity Attacker can: modifyconf files Generate error messages Fingerprintingall software Example: C.A.C.A.
- 17. Terminal Services Remoteapplicationmode 0 -> Desktop 1 -> Only App Whatapp? Alternate Shell (RDP < v 6.0) RempoteApplicationProgram (RDP v 6.0++)
- 20. Playingthe Piano
- 21. Playingthe Piano Toomany links SpeciallyrunningonWindows 2008 Toomanyenvironment variables %SystemRoot% %ProgramFiles% %SystemDrive%
- 22. Window Server 2008 wantstohelpyou!! (anytime!)
- 23. Playingthe Piano Toomanyshortcuts Ctrl + h – Web History Ctrl + n – New Web Browser Shift + LeftClick – New Web Browser Ctrl + o – Internet Addres Ctrl + p – Print RightClick (Shift + F10) SaveImage As View Source F1 – Jumpto URL…
- 24. Playingthe Piano Too , Too, Toomanyshorcuts: ALT GR+SUPR = CTRL + ALT + SUP CTRL + F1 = CTRL + ALT + SUP CTRL + F3 = TASK MANAGER StickyKeys
- 25. Easy?
- 26. Demo Servers
- 27. Paths?
- 28. MinimunExposurePaths There are as manypaths as pulbishedapps Everyappis a paththatcould drive toelevateprivileges Complextools are bettercandidates Excel is a complextool
- 29. Bosseslove EXCEL
- 30. VBA
- 31. Excel 1:Thepower of VBA
- 32. Software RestrictionPolicies Toomanyconsoles Cmd.exe Windows Management Instrumentation PowerShell Jscript Cscript.. ….
- 33. Software RestrictionPolicies Forbiddenapps Via hash Viapath App Locker Using Digital Certificates ACLs
- 34. Software RestrictionPolicies Toomanyconsoles, (EvenfrOmother OS) Reactos….
- 36. Security Policesfor Excel Macros Disable VBA - Securebutit´snot REAL Excel 2) Security for macros - No macros - signed macros - Case by case - All macros
- 40. Risky?
- 41. Startthe III WorldWar Find a bug in a DHS Computer Trust in yourRogue CA Generateanattacking URL in the CRL (attacking China, forexample) Signanexcel file withyourrogue CA Send a digital ly-signedexcel file tosomeonerelevant!
- 42. Somethinglike…
- 43. Justkidding
- 44. Solutions Re-evaluateyourRemote App connections No alerts at all in Excel (and alltherest of appsyoupublish) No trustedlocations in user-profiles No sharedremoteusers Trust in nobodoy… Sorry, noteven in nobody
- 45. Howmaypaths do youhave? TS Web Access Hiddenmeansnot-removed
- 46. Contactinformation Juan Garrido “Silverhack” jgarrido@informatica64.com http://windowstips.wordpress.com Chema Alonso chema@informatica64.com http://www.elladodelmal.com @chemaalonso http://www.informatica64.com
- 47. SpecialThanksto Didier Stevens http://blog.didierstevens.com/2010/02/04/cmd-dll/ ShanitGupta http://www.blackhat.com/presentations/bh-usa-08/Gupta/BH_US_08_Gupta_Got_Citrix_Hack_IT.pdf PDP http://www.blackhat.com/presentations/bh-europe-08/Petkov/Presentation/bh-eu-08-petkov.pdf
- 48. ?