One question we get after performing a penetration test is “Why didn’t I see some of these vulnerabilities during our monthly vulnerability scans?” The truth of the matter is many flaws that both attackers and pentesters exploit do not typically show up in a Nessus, Nexpose, or [insert-vuln-scanner-name-here] scan. Most senior penetration testers and attackers will seldom leverage a vulnerability scanning tool as it’s very noisy on a network and can get you detected/removed/bandwidth issues/etc.
Some pentesting techniques require manual testing and a creative attacker mindset. With that said, there are several things pentesters do regularly that could be adopted into a vulnerability management program.
Goal: Show how vulnerability analysts can go beyond running an authenticated vulnerability scan.
Here are the tips at first glance (in no particular order) :
1) Have an understanding of free (open source) tools you can use:
Reconnaissance is King: The most important step associated with hacking, and pentesting is reconnaissance. Many of the tools mentioned above are focused around reconnaissance vs. exploitation and could be considered for a vulnerability management program.
2) Find the tech stack: Identify the technology and its versioning to check for default credentials, default content, version specific vulnerabilities and misconfigurations:
3) Understand your external footprint:
4) Investigate network shares:
5) Address web applications appropriately:
For further detail on identifying web application vulnerabilities reference: https://breakpoint-labs.com/blog/webapp-vulns/
6) Find the devices and appliances:
7) Know what vulnerabilities are interesting to attackers:
8) Be aware of the impact of outdated Windows systems on your network:
9) Understand OPSEC failures and the impact:
10) Implement user awareness exercises:
All of these techniques are obviously great for security in a perfect world. In reality there are only so many hours in the day and security analysts can get spread thin. If this is the case focus on understanding your external footprint first and then consider implementing the other tips as resources allow.
From penetration testing to real world attacks, Phishing remains to be an extremely effective way to establish a foothold into a target organization. This blog post is a follow-on to “5 Ways We Get On Your Network” with a closer look at Phishing and it’s various techniques. Phishing is essentially sending a malicious email to target users with the intent of having them perform some action (Click a link, Open an attachment, etc.).
This will be a longer post so here is a quick overview:
1) Outcome of Engagement: What Happens Once The User Clicks?
From a testing perspective, we conduct various types of phishing engagements to accomplish one of these three (3) outcomes:
2) Determining the Phishing Scenario
The goals of an assessment and Rules of Engagement (RoE) will dictate the type of phishing exercise that we leverage. In some instances we model a common threat (Ex: Ransomware), and in other instances we attempt to model a more targeted attacker or campaign.
2.1) Picking a Domain
Depending on the phishing scenario we will register domain names to be used for the attack. An example phishing campaign scenario is a UPS Tracking email. For this UPS Tracking scenario we would register a domain like “upspkgtracking.com”. For more targeted scenarios we may register a domain name that very closely resembles the target organization, potentially removing a single letter from the companies domain name (Ex: “breakpoint-labs.com” vs. “breakpoint-lab.com”) essentially we are using a doppelganger approach.
2.2) Register Your Domain With Proxies
With regards to the domain it is a good idea to submit your domain and register it to various web content filters. Some filter entities are more strict than others in validating your domain so if possible leave real content up to be classified and indexed like a blog. This can help with more restrictive environments that block domains based on web content filters. An example of this is BlueCoat, which allows you to submit and categorize domains here (Usually approved within 24 hours).
2.3) Testing the Phishing Email
Once everything is worked out we suggest testing the phishing email, potentially your testing POC from the target organization if allowed. Below is an example of a finalized phishing email for the UPS Tracking scenario described above:
3) Finding Vulnerabilities
Prior to conducting the phishing engagement we will normally perform some testing to see if we can identify any spoofing vulnerabilities, abuse features in web applications to send email, or potentially compromise an account to use.
3.1) Identifying Spoofing Vulnerabilities:
More often than not we find that customers mail servers do not have adequate protections in place for spoofing emails. We are able to telnet to their mail servers and manually create the email headers that forge the part of the email which Outlook actually displays to the user. Below are the steps to perform this testing, keep in mind you may need to play around with various components in order to get your spoofing to actually work.
Determine the mail servers for the target domain:
[code lang=”py”]~$ host breakpoint-labs.com[/code]
Connect to the mail server:
[code lang=”py”]~$ telnet alt2.aspmx.l.google.com 25[/code]
Attempt to forge the email with spoofed headers:
[code lang=”py”]
HELO google.com
MAIL FROM: <hacker@breakpoint-labs.com>
RCPT TO: <victim@breakpoint-labs.com>
DATA
From: “Hacker” <hacker@breakpoint-labs.com>
To: “Victim” <victim@breakpoint-labs.com>
Subject: Phishing Demo
Hey Victim,
This is a demo for email spoofing, click this link: http://phishing-link-demo.com/
.
[/code]
Below is an example of a phishing email that was sent using Gmail, but to the user it looks like it is coming from the Help Desk:
3.2) Contact Us Email Abuse
Sometimes the target organization web applications allow you to send emails. How often have you seen a “Contact Us” or “Feedback” form that allowed you to submit an email? In our experience these are fairly common and if they are not properly secured they can lead to email spoofing vulnerabilities.
Consider the following Contact Us Page:
On the surface this looks fine, but if you look behind the scenes with a web proxy you can see the following HTTP POST request:
In this instance all the variables to generate the email are passed via an HTTP POST request, which opens the door for an attacker to modify. When we encounter these scenarios we can often control the parameters of the email, allowing us to send email as anyone in the target organization.
3.3 Account Compromise
If you are able to compromise a legitimate user account you can have a higher level of trust with your phishing campaign. We will not dig too deep into this particular method as we plan to cover it in a later blog post.
4) Executing The Attack
For actually executing the attack we prefer to send email using Python. This allows us to control all the aspects of the phishing campaign using a quick script. We will use variations of this script to actually send the email. Some other tools already exist and can help with crafting a phishing campaign include:
Some of these tools help simplify the generation attack payloads like Empire. Other tools, like GoPhish, are geared mainly for analytics like click analysis and phishing engagement management.
4.1) Click Analysis:
In our testing a lot of the tools that are designed for click analysis can generate links that are commonly blocked by anti-spam technologies. It is important to test your phishing scenario prior to firing off an email to all your targets in scope. If not properly tested your phishing campaign can be ruined because its either not delivered or the URL is stripped within the body of the email.
The tools that aid with click analysis can be flagged by spam filters often because they generally leverage a long unique string per email. Based on which URL is accessed in web logs they can determine which user clicked the link. To counter this we use python to create a far less complex link structure that is still unique for our target users, but does not contain the complexity that flags the email spam filter(s).
4.2) Credential Gathering:
Credential gathering can be simplified with tools like the Social Engineering Toolkit (SET), which have built-in modules to support this type of attack. Additionally, you can create your own PHP snippet to accomplish the task of credential grabbing. Below is a quick snippet of PHP that will prompt users for credentials via HTTP Basic authentication. You would obviously want to modify the code to meet your specific phishing scenario, like storing the credentials to a file on the server vs. echoing to the screen:
[code lang=”php”]
<?php
if (!isset($_SERVER[‘PHP_AUTH_USER’])) {
header(‘WWW-Authenticate: Basic realm=”Secure Page”‘);
header(‘HTTP/1.0 401 Unauthorized’);
echo ‘Please Supply Credentials to Login;
exit;
} else {
echo “<p>Hello {$_SERVER[‘PHP_AUTH_USER’]}.</p>”;
echo “<p>You entered {$_SERVER[‘PHP_AUTH_PW’]} as your password.</p>”;
}
?>
[/code]
When the user visit’s the page they are presented with something similar to this prompt requesting their credentials before accessing the sites contents:
4.3) Code Execution:
Our favorite tool to aid with code execution in phishing engagements is Empire. Some common ways to accomplish code execution is by shoveling payloads into word docs (Office Macros, Embedding and Objective Linking and Embedding (OLE) Object), or hosting a malicious HTML Application (HTA). Lets explore the Office Macro technique in more detail.
The Microsoft Office Marco attack vector remains a very popular method for getting code execution via Phishing on Windows platforms. Once a document is setup for the attack the user just has to open it and enable the macro (See Image Below). Normally you can set it up so the user thinks they need to enable the macro in order to see the actual document contents.
Step 1: Generate the Payload
Empire can be used to setup the macro payload:
Step 2: Add Payload (Macro) to Office Document
Step 3: Save the document as “Excel Macro-Enabled Workbook”:
Step 4: Test Malicious Document and Email to Targets
Step 5: Get Initial Foothold
If you are interested in learning more about Phishing and Empire we suggest checking out this blog here.
5) Protection Against Phishing Attacks:
