[MUSIC PLAYING]
Welcome to the Hacker House hands-on hacking UNIX module.
We're now going to continue our internal perspective
and begin looking at UNIX estates.
As we've seen throughout most of this course so far,
we've been heavily focused on Linux.
The term Linux actually stands for Linux is not UNIX
so we're now actually going to look
at a genuine real UNIX or UNIX operating system.
And the system that we're going to use is Solaris.
Is built by Sun Microsystems, now currently owned by Oracle.
And if you've ever seen the movie Jurassic Park, when
you envision a UNIX system administrator,
you might envision someone like Dennis Nedry--
messy desk, lots of UNIX lots of code,
and this stereotypical picture of someone
who might administer Unix systems.
So they have a term and we'll explain that in a moment,
but Sun Solaris, Sun Microsystems UNIX also called
SunOS, is now owned by Oracle.
It's an Oracle owned operating system.
However, it was temporarily open source
as a tool called Open Solaris, and subsequently Open Solaris
is what we're going to be looking at.
It was a beautiful kernel.
Very stable and great source code to read.
You can actually read through it.
It's a very, very beautiful piece of code.
I spent a lot of time reading through its kernel,
so if you are interested in seeing
how to do some good coding, maybe
reading through the Solaris kernel will give you an idea.
Sadly, unfortunately, most of the rest the operating system
was terrible and was littered with vulnerabilities.
So in particular, Telnet.
Solaris, despite all their innovations, Sun Microsystems
and all its innovation, they just kept screwing up Telnet.
They couldn't get Telnet right.
They kept making bugs into Telnet.
They kept introducing overflows.
They even introduced direct command execution and code
injection vulnerabilities in their Telnet service.
So we have plenty of weaknesses within the Telnet service
and in particular, one bypass in Solaris 10,
which we'll look at as well.
Remote Procedure Calls.
And as we saw in the previous NAS module,
Remote Procedure Calls were first
implemented by SUN, outlined in RFC 1831,
and it uses something called XDR, which is a data record
type, or it describes data that's
sent through an RPC service.
An RPC is designed to allow computers to run tasks
on each other, and as an example,
you could use R uses as an RPC service
to tell us who's logged onto that remote computer.
So Remote Procedure Calls, pretty important when
you're looking at Unix systems.
Understand those Unix programs, understand what vulnerabilities
might be present in them.
And a brief history of SunOS attacks.
These are kind of old vulnerabilities now,
but we can't have a Solaris slide without mentioning them.
KCMS, dtprint overflow, rpc.statd, sadmind, TTDD,
there are many others.
But around 1999 to 2000, there were
numerous RPC vulnerabilities including this KCMS exploit.
And it was a very popular activity
to scan the web for Solaris systems.
This was prior to many windows systems being hacked.
It was pre 2003.
So a lot of UNIX hacking was going on,
and a lot it was focused on Solaris.
And in fact, during the year 2000,
it was known that if you had a Solaris box
and it was connected to the internet,
it had been compromised by more than one attacker, sometimes
three groups of attackers.
So if you had a Solaris system that
was plugged on the internet, hacking was so rampant in 2000
that it had been compromised by at least three different groups
of people.
So subsequently, those attacks are kind of a bit old
now and a bit legacy and a bit in the tooth,
so we'll have a look at some newer ones.
Likewise, the X Window subsystem is a bitmap windowing system
designed for kind of multi-user work experiences.
And it uses a client server model.
It was a big deal for SUN.
They were like, the network is the computer,
and it was the big slogan for them
as they tried to increase networking and connectivity
and make things more remote and accessible
and drive this kind of innovation area.
And they came up with this--
X Windows subsystem, which they didn't come up with,
but is used for remote access, follows this client server
model, and you can do interesting stuff with it.
If you think about your cali instance,
when you run your desktop and you open a program,
every single program is a client in a server client model,
and that has permissions to the server
to allow it to interact with your keyboard, your mouse,
and your screen and allow you to feed input in there.
But obviously, we can look at those permissions
and try and do bad stuff with it.
Or good stuff depending on your perspective.
R star services, the so-called remote services for Access
can be found on AIX, HP-UX, SunOS, and all
these other commercial Unisys.
So rsh, rlogin, rexec run on TCP ports 512, 513, and 514,
and you have this .r host file which allows specific computers
to trust other computers and can be vulnerable to TCP/IP
spoofing attacks, information discloses,
and generally should be disabled today.
So if you see these r services, you typically
wouldn't want them enabled.
They've subsequently been replaced by SSH,
they've been replaced with SSH and other more secure shells
implementations.
And if you were a bit of a history buff
and you were interested in learning about rshell
and TCP/IP spoofing attacks in general, this set of services
was actually one of the most famous attacks conducted
by Kevin Mitnick and his friends when they breached a researcher
system using a blind spoofing attack.
It was actually targeting these rshell services
and allowing for a kind of code injection in a completely
blind way.
So it was a very interesting attack and one
to read through if you have time.
Jurassic Park, thankfully, is not run on Solaris.
It was indeed run on a separate kind of Unix system,
but it was a Unix like operating system,
and worryingly it controlled all the electric fences.
So you might find Unix systems in areas of industry,
you might find it in telecoms, you might find it
in human resources, you might find in places
where systems have been around for a while and the quite
important.
So you might find Solaris or some supported commercial Unix.
And the reason is because Linux is open source, it's free,
and it didn't come with great support.
And the big contender was people went with either IBM, Hewlett
Packard, Sun Microsystems because they
got a service level agreement.
They got a patching.
They got an engineer.
They got a guy who could come out and fix
the machine if it broke.
These people have names or have names today.
They're called dinosaurs.
These UNIX system administrators are dinosaurs.
Now, dinosaurs could be kind of an alarming term,
because they are also like dinosaurs, prone to be angry,
and they may eat you.
So please don't anger a dinosaur.
CRON time-based job schedulers are the ways which
they may use to schedule tasks.
A dinosaur may need to look up different commands in different
Unixes, and to do so, he or she would use the Rosetta Stone
bhami.com/rosetta.
If you've never seen the Rosetta Stone before,
I suggest opening it up.
It contains a big table.
If you look at my GitHub, you'll even
find it in a SQL-like database.
If you know the commands for one Unix system,
it works a little bit like the ancient Greece Egyptians'
Rosetta Stone.
If you know the commands for adding a user on Hewlett
Packard's Unix, you can look in the table
and find the same command for IBM AX, for instance,
or Compaq True 64.
So knowing one set of Unix commands
allows you to translate them to another set of Unix commands
by following those tasks or permissions,
and Rosetta Stone contains maybe a few hundred commands
that you might find of use.
So I like to keep a copy of that to hand.
File permissions are often overlooked.
Dinosaurs often set weak file permissions
or make an inverted mistake here and there.
And the idea is that you will hunt down insecure files
and review the data.
A little bit like a pack animal, you
want to go and get the target and attack it from the sides
and maybe eat it.
It doesn't respond well to unclean shut downs.
If you ever want to hear a dinosaur roar,
if you would like to hear somebody get very upset,
simply go and unplug his workstation while it is live,
and you will see him get very, very angry very, very quickly,
because they do not respond well to unclean shut downs.
They often lose files, and they can corrupt the system data
making them a headache to then reboot.
So yes, if you want to anger a dinosaur, walk
past his terminal, pull the power cable out,
and he will eat you.
Don't do that.
So CVE-2010-4435 rpc Calendar Manager remote buffer overflow
is a commonly seen RPC program program, which is 10086.
It effects multiple systems.
So the calendar manager that was shared
between many different Unix environments,
because a lot of them have code reuse.
Bell Labs wrote something, AT&T wrote something,
and they all copied it and made it
terrible in their own unique way.
But you often find bugs that also
are shared across these services, and one of them
is the calendar manager service, which
can be exploited in metasploit for AIX,
and also if you nick the NSA's tower information leaks,
you'll find a tool called Calendar Manager Service
Exploit, or CMSX that you could also
run to exploit that calendar manager
service on an impacted server.
Likewise, the National Security Agency had two really neat
little tools that we did some analysis on
and submitted some findings for, and we
found that they had two vulnerabilities that
were silently patched by Oracle in 2017.
And these were CVE-2017-3622, CVE-2017-3623,
and that contains what's known as the common desktop
environment's dtappgather, which was a directory traversal
vulnerability that was a local roots exploit that could be
leveraged on Solaris six, seven, eight, nine, and 10 and even 11
where the common desktop environment was installed.
And we actually did some reverse engineering on these attacks
and tried to re-implement them for our own uses.
And it actually turns out that the NSA
has done such a good job that I actually
just tend to use their exploits instead of rewriting them
completely from scratch, because there's just so many targets
and setups that they've already tested it against.
Now, you're looking at an espionage related
exploit that's been used practically
in the field for well over a decade
and has even been used to breach systems like the Greece telecom
network and spy on the prime minister of Greece.
So we've got certainly a lot of interesting exploits here,
and these ones at the local root exploit,
which can used as privilege escalation,
usually will be vulnerable on most Solaris's except
for the very, very recent versions or those very, very
recent versions where somebody has added common desktop
environment.
And also, XDR RPC overflow.
This remote root exploit was extremely powerful.
It could exploit any RPC service by misusing the data structures
of an RPC service so that you could specify and jump
to any portion of memory, and you would effectively
get code execution and be able to run your own tools.
And interestingly, they even make use of a fine SOP routine
to try to reuse that RPC service and try to re-integrate
with that same service port to avoid a connect back
and to avoid a bind shell.
So that's kind of really interesting,
and there are various other exploits in the dump,
so you can explore some of the NSA's tool.
But we're going to look at those two tools, Extreme
Par and EBBSHAVE.
This is an example of EBBSHAVE being run.
It's the tool the National Security Agency developed,
and you can see here that this exploit came through,
and they may have got this from one of their partner
organizations.
But as you can see, this exploit's being run,
and then you can see a shell shortly appearing,
and then you will see this exploit dropping down here.
Have a great day, and you can see that it's actually
provided you with remote root access
by exploiting this service, and we'll
have to look at how that attack works.
Going through the UNIX hacking tool box, what do you need?
Well, much of hacking is just unauthorized system
administration, so you're going to use
a lot of the same tools the system administrator uses.
So we're going to use rpcinfo, showmount, rusers, maybe
use some specific tools for interacting with x services
this time around, and we're going
to use those common system administration
tools which a dinosaur will be intimately familiar with.
So if you are struggling with them, I'm no doubt in my mind
that you will come across or encounter a dinosaur,
so I suggest warming them nicely with chocolates or flowers
or speaking to them in a soft tone
so that they don't mistake you for prey.
UNIX system administrator tools that you would use,
you can find some books on that in there.
This brings us to the hands on hacking lab practical.
This concludes the theoretical introductions for this module.
We're now going to look at hacking in a UNIX environment,
like a real UNIX environment, not Linux,
which is not actually UNIX.
So we're going to download some tools,
and we're going to basically set up the appliance.
However, there's some different steps involved in this,
so please do pay attention during the practical part
of this module.
And I will look forward to seeing you later on.