Amplia Security at H2HC Cancun

Amplia Security at H2HC Cancun :)

Contributing author of Hacking Exposed Web Applications 3rd. Edition

Shamless plug alert!

Hacking Exposed Web Applications 3rd. Edition is out! and I'm a contributing author! Check it out!

 http://www.amazon.com/HACKING-EXPOSED-WEB-APPLICATIONS-3/dp/0071740643/ref=sr_1_1?ie=UTF8&qid=1288459138&sr=8-1

MS10-070 ASP.NET Auto-Decryptor File Download PoC exploit

This is another exploit part of the MS10-070 saga :)

It is not the same as our other previously released exploit, this one uses another information leak. On average, this exploit should allow you to do the same as the previous one but faster (which is important/desirable in this scenario).

You can find it here:
http://www.ampliasecurity.com/research/aspx_ad_chotext_attack.rb

MS10-070 ASP.NET Padding Oracle attack PoC exploit video

Yesterday, Agustin Azubel from Amplia Security released a proof-of-concept exploit implementing a Padding Oracle attack against ASP.NET (MS10-070) that allows an attacker to download a file from the remote web server.


Today we released a video showing how the PoC exploit works.

You can find it here:
http://vimeo.com/15856549

and also, here:
http://www.youtube.com/ampliasecurity#p/u/0/2jvmT5lmIIM


If you don't feel like installing IIS/ASP.NET and creating a sample application or don't have an already vulnerable ASP.NET application to test the PoC exploit on, the video will give you an idea on how the exploit works.

MS10-070 ASP.NET Padding Oracle Attack to download web.config or other files

You can find it here:  

 http://www.ampliasecurity.com/research/aspx_po_chotext_attack.rb 

A proof-of-concept attack against MS10-070, this PoC is an implementation in Ruby of a Padding Oracle attack and allows you to download the 'Web.config' file or any other file from a vulnerable ASP.NET installation.





It was written by Agustin Azubel (aazubel [ at ]  ampliasecurity.com).

Windows Credentials Editor v1.0 (WCE)

I just released a new tool called Windows Credentials Editor 1.0 (WCE)

It allows to perform pass-the-hash and other things related to windows logon sessions and supports XP,2003,7,2008 and Vista.


You can find it here:
http://www.ampliasecurity.com/research/wce_v1.0.tgz


Have fun!

A Padding Oracle Attack Implemented in Javascript

A Padding Oracle Attack implemented in javascript by Agustin Azubel:

http://www.ampliasecurity.com/blog/2010/09/28/a_padding_oracle_attack_implemented_in_javascript/

Transferring files on isolated remote desktop environments Turbo Talk

The slides for the turbo talk "Transferring files on isolated remote desktop environments" I presented at Ekoparty are up for download here: http://www.ampliasecurity.com/research/transferringfilesonisolatedRDenvironments-ampliasecurity.pdf

The GUI Transfer Toolkit v1.0 can be downloaded here: http://www.ampliasecurity.com/research/gtt_1.0.tgz

And also three videos are available to give you an idea of what the tools do:

Go to: http://www.youtube.com/user/AmpliaSecurity

or, for the individual videos:

"Using GTT to upload files to an isolated Citrix environment"
http://www.youtube.com/watch?v=h65Yz5n1CPw

"Using GTT fastupload to upload files to an isolated Citrix environment"
http://www.youtube.com/watch?v=gLRGuHpvYBI

"Using GTT to download files from an isolated Citrix environment"
http://www.youtube.com/watch?v=asRpCcVhnuI

Thank you!

Comments on "Assessing the risk of the February Security Bulletins"

I just read the "Assessing the risk of February Security Bulletins" blog post here http://blogs.technet.com/srd/archive/2010/02/09/assessing-the-risk-of-the-february-security-bulletins.aspx

I have some quick comments about the "SMB NTLM Weak Nonce" vulnerability we released and MS' risk assessment:

• The blog post says:"Likely to see working proof-of-concept in next 30 days for CVE-2010-0231 resulting in attacker luring remote victim user to open file on attacker server and initiating a connection back to machine where remote victim is logged on. "

We released fully working proof-of-concept code in our advisory (for two different 'approaches' to exploit the vulnerability) the same day the patch was released, so PoC is already available.

• MS calls this issue an 'Elevation of Privilege' vulnerability and 'Important'
  

(also mentioned here: http://blogs.technet.com/srd/archive/2010/02/09/ms10-006-and-ms10-012-smb-security-bulletins.aspx)

I discussed this with MS; they had their reasons which I understood but I disagree.

I'm not convinced this should be categorized as a 'remote code execution' vulnerability either, because strictly speaking.. it is not..

(although it can definitely be used to execute code remotely using DCE/RPC without user interaction, just change the PoC to, instead of creating a text file, do something similar to 'psexec', create exe+register service+start service=code execution. Code to do this is already available in metasploit. I'm going to release an improved version of the PoC with these changes, but you can easily do it yourself).

But, I feel 'Elevation of Privilege' is a term better suited to cases where you have some kind of access level (e.g.: regular user) and then you are able to *elevate* your privileges (.e.g.: you become an admin).

In this case you have no access.. and then you have access..

Following the same logic, a remotely exploitable buffer overflow (remote code execution) would also be an 'elevation of privilege' vulnerability.. :) you don't have access.. you exploit, now you do!..

Anyways... I understand it is perhaps hard to just pick the right 'class' for this vulnerability, and frankly, it doesn't matter..

I just want to say that if you are dismissing applying this patch because it is only an 'Elevation of privilege'.. and because http://blogs.technet.com/srd/archive/2010/02/09/ms10-006-and-ms10-012-smb-security-bulletins.aspx says that the severity of the four vulnerabilities included in ms10-012 is 'Important'.. I ask you to reconsider... :)

Anyways, like I said, 'Important' *should* be enough to convince you to apply the patch.. but just in case..

Also some comments about this vulnerability and Windows NT4:

if you still have some Windows NT 4 boxes on your network and they're accepting NTLMv1 auth requests and other Windows NT 4 boxes acting as clients are initiating authentication attempts using NTLMv1, your network might be vulnerable to replay attacks without any kind of user interaction. It *might* be possible for an attacker to passively sniff network traffic, collect challenges/responses, and then start making connections to the server until a previously observed challenge is returned and at that point return the corresponding response (to increase the feasibility of the attack, it will be a good idea to capture several challenge/response sessions, not just one.. :).. in fact, you could do more sophisticated attacks..)

This scenario is described in the advisory, but since Windows NT 4 is no longer supported by Microsoft, there's no patch. You'll need to do something else, like disabling incoming NTLMv1 auth attempts in Windows NT4 servers (if possible).

Windows SMB NTLM Authentication Weak Nonce Vulnerability released

In case you didn't catch it on bugtraq or full-disclosure or twitter :), please take a look at the advisory for Windows SMB NTLM Authentication Weak Nonce Vulnerability:

http://www.hexale.org/advisories/OCHOA-2010-0209.txt

It's basically a 14/17-year old vulnerability in the Windows implementation of the NLTM Authentication protocol... goes back to the Windows NT 4 days!

I´ll do a post later commenting on some of, what I think, are the most interesting and important facts said in the advisory that perhaps you didn't catch when reading it or were not clearly described.

Thank you!.