Ha cking
Me thodolo gie s
An overview of historical hacking
approaches
Johnny Long
http://johnny.ihackstuff.com
johnny@ihackstuff.com
Va rie d Ap proaches
“Old School”: Slow, careful, precise,
invasive
“Pros”: Fast, careful, precise, sometimes
invasive
“Skript Kiddies”: Slow, reckless,
imprecise, invasive
“Defacers”: Fast, reckless, precise, mildly
invasive
Old sc hool
For years, information security pundits have followed and believed in a
“hacking methodology” which described the steps a hacker classically
followed when performing an attack.
That methodology followed the following basic steps:
Information Gathering
Probe
Attack
Advancement
Entrenchment
Infiltration/Extraction
Ol d School : Inf ormat ion
Gatheri ng
Decide and discover which targets to
attack
Often begin with a specific network or a
specific company
Whois, nslookup queries
samspade.org
Search engines (“googlescanning”)
Old Sc hool: Pr obe
Scan specific targets for vulnerabilities
Search sweeping ranges of ports with a portscan
(nmap)
Grab details such as service versions from the
discovered ports aka “banner grabbing” (netcat)
NT: Connect to and enumerate information from
NETBios (enum)
Search the Internet for vulnerabilities based on
versions of software found on targets
Old Sc hool: Pr obe
NMAP ( http://www.insecure.org/nmap)
Superscan (http://www.webattack.com/get/
superscan.shtml)
Nessus: (http://www.nessus.org)
Whisker: (http://sourceforge.net/projects/whisker/)
Netcat: (http://www.atstake.com/research/tools/)
Enum (http://razor.bindview.com/tools/index.shtml)
THC-Probe (
http://www.thehackerschoice.com/download.php?t=r&d=
)
Old Sc hool: Pr obe
Nmap is used to scan the
ports of the target system.
Using the –O option would
also report the Operating
System of the target.
Old Sc hool: Pr obe
Nmap’s guess at
the operating
system type
Old Sc hool: Pr obe
some services
listen behind RPC.
rpcinfo can give us
this info.
Old Sc hool: At ta ck
Gather compatible exploits
Compile exploits (if required)
Launch exploits against targets
Modify parameters, re-launch exploits (if
required)
Old Sc hool: At ta ck
There are many different types of attacks
which can be broken down into several
classifications.
The attacks are performed from one of two
perspectives:
Local: The attacker has access to a command
prompt or has gained the ability to execute
commands on the target
Remote: The attacker exploits the target box
without first gaining access to a command shell
At tacks: Bu ffer
Overflo w
Aka the “Boundary Condition Error”: Stuff more data
into a buffer than it can handle. The resulting
overflowed data “falls” into a precise location and is
executed by the system
Local overflows are executed while logged into the target
system
Remote overflows are executed by processes running on the
target that the attacker “connects” to
Result: Commands are executed at the privilege level
of the overflowed program
Example: SNMPXDMID overflow (Solaris 6-8)
http://www.securityfocus.com/bid/2417
At tacks: I nput
Va lid ation
An process does not “strip” input before
processing it, ie special shell characters
such as semicolon and pipe symbols
An attacker provides data in unexpected
fields, ie SQL database parameters
At tacks: I nput
Va lid ation
Example: Trillian IRC Module Format String
Vulnerability (
http://online.securityfocus.com/bid/5388)
“A format string vulnerability has been reported
in the Trillian IRC module. An attacker can
exploit this vulnerability by enticing a user to
join a channel with a malicious channel name
(e.g. #%n%n%n). An attacker in control of a
malicious server may exploit vulnerable clients
who have connected.”
At tacks: Ra ce
Co nditio ns
An attacker forces an action during a sensitive time
window between two operations
A program checks to make sure output file
“/tmp/temp_output” does not exist
The program wanders off and does other stuff…
An attacker quickly creates a symlink from
“/tmp/temp_output” to “/etc/shadow”
The program writes to the “/tmp/temp_output” which
clobbers “/etc/shadow”
Example: RedHat Linux diskcheck (
http://online.securityfocus.com/bid/2050 )
At tacks: Enviro nme nt
Er rors
An attacker makes a change to a program’s
environment that was not expected
For example, a program relies on the UNIX
environment variable $USER to determine who
is running the program
An attacker changes this value to “root” before
executing the program
Attacks: Weak Passwords
accounts with weak passwords are
guessed by a remote attacker
Accounts with weak passwords are
cracked by attacker with access to a
password database
THC-HYDRA Login Hacker
(http://www.thehackerschoice.com/releases.php)
At tack: Ex plo it Sit es
SecurityFocus: (http://www.securityfocus.com)
Packetstorm: (http://packetstormsecurity.org)
New Order: (http://neworder.box.sk/)
Hack in the Box: (http://www.hackinthebox.org/
)
phreak.org (http://www.phreak
.org/archives/exploits/unix/)
Old Sc hool: At ta ck
phase s
The Attack is most often broken into several
phases (perhaps running cyclically)
Locating Exploits
Getting Exploits
Modification of Exploits
Building Exploits
Testing Exploits
Running Exploits
Old Sc hool: L ocatin g
exploit s
Old Sc hool: L ocatin g
exploit s
Old Sc hool: Ge tting
Ex ploits
The ‘wget’ program downloads
the exploit to the attacker’s
machine
Old Sc hool: Mo difyi ng
exploit
(-lsocket won’t work)
Most exploits will not work across all
platforms, so modifications generally
need to be made. In this case, -lsocket
is removed for running on out RedHat
7.2 attack box.
Old Sc hool: Bu il din g
Ex ploit
Some exploits come complete with a
Makefile, so a simple ‘make’ command
is all that’s required to build the exploit.
Old Sc hool: Bu il din g
Ex ploit
The make command
successfully produces the
exploit, in this case
‘automountdexp’
Old Sc hool: Te st ing
Ex ploit
The ‘–h’ parameter shows the
usage for this exploit.
Old Sc hool: At ta ck
Ru nnin g Explo it
This attack executes commands
on the target (a Solaris 2.5.1
box) as root. In this case, the
attacker drops a line into
/etc/inet/inetd.conf and a line
into /etc/services. When the
system is restarted (or inet is
restarted) a listening root shell is
opened on port 31337.
Old Sc hool: At ta ck
Su ccess!
The attacker connects to the
31337 port on the target and is
greeted with a root prompt.
Old Sc hool:
Ad vancement
(optio nal)
If needed, gain further access to targets
by further exploitation
Trojans
Local Exploits
The advancement phase will somewhat
mirror the Attack phases unless the
attacker has already tested the exploits
Old Sc hool:
En trenchme nt
Modify targets to ensure future access
Backdoors
Rootkits
En trenchme nt:
Ba ckdoors
Linux Non-listening backdoor programs = No
listening port!
SAdoor (http://cmn.listprojects.darklab.org/)
Cd00r (http://www.phenoelit.de/stuff/cd00rdescr.html)
NT/2K
Fake GINA Username and password interceptor (
http://www.rootkit.com/projects/ginatroj/ )
NTKap Removes NT ACL protection (
http://www.rootkit.com/projects/ntkap/ )
En trenchme nt:
Ro otkits
Linux
LRK5: (http://online.securityfocus.com/data/tools/lrk5.src.tar.gz)
ADORE: (http://online.securityfocus.com/tools/1490 )
KNARK (http://online.securityfocus.com/tools/1163 )
NT
NT Rootkit (http://www.rootkit.com/projects/
ntroot/)
NULL.SYS (
http://www.rootkit.com/projects/nullsys/ )
Old Sc hool:
Infilt ration/E xtr action
Install sniffers to monitor network traffic,
gather usernames/passwords
Extract data from compromised systems
Compromise neighboring targets based
on captured data or trust relationships
Pr ofessio nals
Professional hackers, or ethical hackers, tend to follow the following
methodologies:
Information Gathering
Probe
Attack
Advancement
Infiltration/Extraction
Pr ofessio nals
Most often, professional ethical hackers rely on
“Vulnerability Scanners” to perform their jobs.
Nessus
Retina by eeye
Network Associates CyberCop
H.E.A.T.
Internet Security Systems Internet Scanner
(see http://www.networkcomputing.com/1201/1201f1b1.html)
Pr ofessio nals
Vulnerability Scanner Demo
“ Sk rip t Kiddies”
Sk rip t Ki ddie s
Skript Kiddies, named for their annoying ability
to (sometimes) successfully compromise a
system using pre-written scripts, generally
follow a very simple non-cyclical methodology.
(See http://project.honeynet.org/papers/enemy/
for an interesting writeup on the topic)
Exploit Selection
Target Selection
Attack
Sk rip t Ki ddie s: Ex ploit
Se le ctio n
Nearly identical to the “Old School” method of
locating exploits, skript kiddies generally use
Search engines to locate exploits
Skript Kiddies are generally not a technically
savvy lot, so exploit selection is made based
on attack platforms available (generally
Windows-based) and ease of use.
Sk rip t Ki ddie s: Ta rget
Se le ctio n
Most target selection involves noisy
scanners, often launched from Windows
platforms
An increasing number of Skript Kiddies,
however, are gaining familiarity with
Linux and use fairly standard tools such
as nmap.
Sk rip t Ki ddie s: At tack!
Unlike old-school attacks, Skript Kiddies tools
are generally pre-compiled, or written in
interpretive languages such as PERL
If an exploit needs to be built, most kiddies will
not be able to get them working
If a built exploit fails, a skript kiddie usually
moves along to another target instead of fixing
the exploit. This makes the process non-
cyclical.
“ De facer s”
Web De facers
While “old school” methods
are still in use, web defacers
statistically own the hacking
landscape
http://www.alldas.org
Pr ofil e o f a we b
defa cer
Handle: intrud3rm4n
Age: 21
Group: Leader of ISOTK (In Search of the Knowledge!)
Defacement count (8/09/02): 960 sites, 785 addresses, 175 mass
defacements
My favorite defacement:
http://defaced.alldas.org/mirror/2002/07/21/java.capgemini.nl/
Country of Origin: Brazil
Language: Portuguese
Favorite Hacking food: Hamburgers and Fries
Favorite Hacking Music: Metallica =)
Favorite exploit: whacking LINUX boxen
Reason for defacing: FUN
De faced: Ca p Ge mini
Follo win g we b
defa cers
http://www.alldas.org
Follo win g we b
defahttp://www.zone-h.com/en/defacements
cers
Follo win g we b
defa cers
http://www.delta5.com.br/mirror/
Common Web Def acement
Me thodol ogy
Web Defacers, for the most part, have a slightly different
methodology. Instead of basing the exploit on the
target, the target is selected based on it’s vulnerability
to the exploit!
The web defacement methodology (again, often cyclical)
is generally as follows:
Exploit Selection
Target Selection
Attack
Defacement
Web De facement
Amateur defacers
usually stick with
one exploit and
one target
platform,,,
De facer’s Ex plo it
Se le ctio n
An attacker’s level of comfort with an Operating
System will often decide the types of exploits used
UNIX-based attackers often opt for C-based remote overflows
Windows-based attackers often opt for perl-based remote
overflows, visual basic tools, or command-line “net”
commands
Attackers with only browser-based experience or simplistic
attackers seeking privacy through proxies will opt for URL-
based attacks such as UNICODE or DECODE, Front Page
exploits, or PHP-Nuke attacks
De facer’s Se arch for
Ex ploits
Often an amateur defacer
will monitor popular
security sites (such as
securityfocus) to select
exploits
De facer’s Ta rget
Se le ctio n
Armed with an exploit, most web defacers now
seek for vulnerable targets using various
methods
Web searching
Netcraft
Netstat
Google
Host scanning
Nmap
Custom scanners
Defacer’ s Target
Sele ctio n: Web Searches
http://www.netcraft.com
Defacer’ s Target
Sele ctio n: Web Searches
Using search engines to locate
vulnerable servers is a very interesting
and fruitful technique which hasn’t been
explored in great detail.
http://johnny.ihackstuff.com/security/googledorks.shtml
Defacer’ s Target
Sele ctio n: Web Searches
Google query: intitle:”Index of” “Apache 1.3.11”
Here, Apache 1.3.11
servers are located
through creative use of
the Google search
engine.
Defacer’ s Target
Sele ctio n: Web Searches
http://www.netstat.ru
De facer’s Ta rget
Se le ctio n: Host
Sc annin g
Nmap’s OS
detection feature
(-O) provides a
decent guess as to
the operating
system of the
target
De facer’s Ta rget
Se le ctio n: Host
Sc annin g
http://packetstormsecurity.com
provides a great resource for
custom vulnerability scanners.
De facer’s At tack
Once the target and the exploit are
selected, the attacker launches the
attack against the server.
If the attack fails, the attacker will often
modify the attack and try again.
Qu estio ns?
