Monday, February 3, 2020

Hunting for APT28 malware in a stockpile of samples

Recently I wanted to do some data analysis on APT28 malware samples I had.  I have some samples sorted and organized but have a pile of unsorted encrypted zip and rar files with a bunch of other unrelated malware samples and warez.

The question is what APT samples are hiding in my stockpile of malware samples and what of those samples are related to APT28.



So how do we get to the juicy samples inside the thousands of password protected files?

We brute force them of course.  Being as they're malware samples more than likely the password will be something like the following:

infected
password!
malware

or some variation similar.


After some google and testing of a small script I had something that worked using John The Ripper to brute force the zip file password.

#!/bin/bash
echo "Brute all the zip files in dir";
if [ $# -ne 2 ]
then
echo "Usage $0 <directory_with_zip_files> <wordlist>";
exit;
fi
FILES="$1*.zip"
echo $FILES
for f in $FILES
do
for i in $(john --wordlist=$2 --rules --stdout)
do
echo -ne "\rtrying \"$i\" "
unzip -d zip-out -o -P $i $f >/dev/null 2>&1
STATUS=$?
if [ $STATUS -eq 0 ]; then
echo -e "\nArchive: $f  password is: \"$i\""
fi
done
done


Running it.

<  INSERT FORGOTTEN SCREENSHOT HERE   >

Modifying this script I was able to get a sort of hacky brute force that seems to work with the rar files.

#!/bin/bash
echo "rar file brute";
if [ $# -ne 2 ]
then
echo "Usage $0 <directory_with_rar_files> <wordlist>";
exit;
fi
FILES="$1*.rar"
echo $FILES
for f in $FILES
do
#unrar x $f -pinfected rar-out/ >/dev/null 2>&1
while IFS= read -r line
do
echo "File: $f"
echo -ne "\rtrying \"$line\" "
unrar x $f -p$line rar-out/ >/dev/null 2>&1
STATUS=$?
if [ $STATUS -eq 0 ]; then
echo -e "\nArchive: $f  password is: \"$i\""
fi
done < $2
done


Yes I realize its not perfect like the output password isnt set to the right variable... but it works and ill fix it later.



Running it.





brute forcing the zips was a lot cleaner.


Anyways we now have two directories with a bunch of malware samples.  i also ran the zip brute force inside the zip-out directory to get any samples still ziped up and I got a few. :)



So now we have all the malware samples that were decrypted from the rars and zips.


How are we going to sort through 10,000+ malware samples?


With Yara and bash of course.

Using the Yaras APT rules to sort through all the samples we find some interesting malware.



yara -p 20 -g /YARA_RULES/rules/malware/APT_*.yar -r /MALWARE 



command breakdown:

-p 20          Use 20 threads
-g               print tags
<yara rules>
-r                recursive search
<malware directory>

run with the -m flag to get meta data which will be very helpful when sorting the malware families.


So we see there's a lot of info and a lot of various APT malware samples.  Now we need to sift out the APT28 samples.


This is where we grep is our friend

grep "APT28"

 yara -p 20 -g -m /YARA_RULES/rules/malware/APT_*.yar -r /MALWARE | grep "APT28" | sort | cut -d"/" -f1,2,3,4,5,6,7,8,9,10,16,17,18,19

You can ignore the cut command.  I just wanted to clean up the output.





Now lets sort the malware into its family groups.


Basically we want to sort out the APT28 familys into the sample gorups
we use grep to pull out samples related to the family name like
grep "CORESHELL"
grep "X-Agent"
etc..

 
Using a little command line kung-fu we can pull out the sample directories and the copy those samples into the malware family directories.


I wrote a small shell script to do this.

echo "YARA APT28 MALWARE FAMILY SORTER"
echo " Sorts CORESHELL, X-Agent, XTunnel, etc..."
list=(X-Agent CORESHELL XTunnel EVILTOSS BlackEnergy)
for i in ${list[@]}
do
# Sorted known APT28 files
yara -p 20 -g -m /YARA_RULES/rules/malware/APT_*.yar -r /MALWARE-SAMPLES/APT28/ | grep "GRIZZLY-STEPPE" | grep "$i" | sort > APT_28-$i-Family_Samples.txt
# Unsorted stockpile dir
        yara -p 20 -g -m /YARA_RULES/rules/malware/APT_*.yar -r /MALWARE | grep "GRIZZLY-STEPPE" | grep "$i" | sort >> APT_28-$i-Family_Samples.txt
cat APT_28-$i-Family_Samples.txt | cut -d"]" -f3 > sample_dir.txt  samples=sample_dir.txt
while read -r sample
do
echo "\nFAMILY: $i"
echo "$sample" cp "$sample" APT28/Malware-Family/$i/
done < "$samples" done

I manually created directories... why? Because that's just how it happened.
Running the script resulted in the following




There you have it.  We successfully sorted through a pile of malware searching for samples from APT28 and separated out the samples into the malware families.

Next step is to use the malware sample set for some data science and machine learning fun.

Like what?

Well like doing a little shared code analysis on the samples.

But that's for another blog post. 

Thursday, October 17, 2019

Attacking SSH



Attacking SSH


Goals:

  • Discover hosts with ssh running on a network.
  • Brute force ssh credentials using Hydra and wrapper script
  • Intro to SSHOOTER forsystem managment or post exploitation of SSH.



Scan for ssh running on network and get the ip addresses.

Nmap -p22 –open 192.168.1.1/24 | grep “scan report” | cut -d” “ -f5







results:
192.168.1.103
192.168.1.148
192.168.1.150
192.168.1.157
192.168.1.172
192.168.1.182
192.168.1.162


put into a file.
Now we have our list of targets. Lets use Hydra to brute force ssh credentials.
Im going to use a shortened wordlist but feel free to use lists from SecLists or other sources.

Hydra -L wordlist/usernames/labsmall.txt -U wordlists/passwords/lab-small.txt -t4 -M targets.txt

then wait…






WIN!

We have creds.

A keen eye might note the current working directory of the above screenshot. I wrote a wrapper script to brute force ssh and format it in such a way that we can use later on.

Lets see this script in action now.













So thats how the ssh_bruter.sh script works.

So why the formatted output? Im glad you asked.


USERNAME@IP:PORT PASSWORD


Let me introduce you to another little tool I wrote I like to call SSHOOTER.

Its kind of a SSH administration tool. I plan on adding more features in the future but it helps with some simple tasks for now. It takes a creds.txt file with the formatted output from the ssh_bruter.sh script.


Why?

I wanted a centralized way to manage multiple systems that were running ssh in a somewhat easy way.  Got tired of having multiple terminals sshd into a remote box and trying to execute a simple task on them all and get the output.  You know when youre in your pentest lab and need to check the ip on a few systems or restart a service.


So what can we do with SSHOOTER?

  • manage multiple remote systems with ssh enabled using username and password or key file.
  • Execute command on a host or multiple hosts
  • Upload/Download files
  • Establish shell on remote host
coming soon:
  • ssh tunneling
  • importing new hosts



Starting SSHOOTER







Main Menu:





List hosts:





As we can see the creds logged in and we have gotten the hosts runtimes. :)

Lets open a shell on host 0. Its a metasploitable 2 vm FYI.





Enter the host we want to open the shell on.




And there we have it. A shell on the remote machine using ssh. Pretty simple. Basically just runs `ssh msfadmin@192.168.1.103` for you.

type exit to exit the shell.

Lets download the ‘/etc/passwd’ from the 192.168.1.103

enter 4 in the main menu
When prompted enter the file to download from host
then the destination
and the host to execute on.




Results:










Running command on multiple hosts


























That's it for now.
Hope you enjoyed the blog post.


Feel free to play around with the scripts and see if they help you.  I've noticed hydra is pretty unstable sometimes and just hangs.


CODE:







Sunday, August 9, 2015

Exploit-Development 1 Notes and write-up (Strategic Security training.)

This is a blog post contains Personal homework notes/step-by-step instructions on a buffer overflow exploit development. This material is from Joe McCrays Strategic Security training.



Lets begin...

First we need a skeleton script for out exploit.


























This will send 2000 A's to the IP address specified as the first parameter of the programs










Next lets start up the target application using Immunity Debugger on the target system.

Now we run the program by clicking the “play” run button >


Next we need to run our skeleton script from the attacking host.









Doesnt look exciting from this view.

Checking out the target.

Boom! Its dead!
Notice EIP is 41414141 with is AAAA.


Now we need to find how much room we have for shellcode. :)

Lets use pattern_create.rb to generate a pattern that we can use.


Copy this into our skeleton script. I like saving it under a new name so I keep a skeleton script around.





Now we run this against our target.
NOTE: Remember to restart the application within Immunity.

And this is what we get.




















Lets calculate our shellcode spacing.

We get the value in EIP and ESP.




Now we can use pattern_offset.rb to find the offsets at which these values are at.



So it looks like pattern_offset is having issues finding the offset of 0Aj1A

Lets do it by hand.

Vim find





















Ok so we found it at 281. But thats from beginning of line which includes 'buff =' We don't want that. The actual string starts at offset 9. so 281-9=272

Now we have the offset of ESP

and its only 4 bytes away from EIP.

Lets translate this information into our python exploit.




























Offset to EIP was 268 so we fill buffer with 268 A's

EIP is 4bytes long so we fill that with B's

ESP is filled with C's

Lets test it out and we should see EIP have B's and ESP C's.








































Cool what we thought should happen did.

So we confirmed our information and now we can actually exploit this.





First we need the location of our shellcode, this is ESP. Since we have control over EIP we can just put the address directly in.

Lets generate some shellcode real quick, a bind_tcp should work for a poc.
Insert the shellcode into our script

New exploit script looks like this.



























Lets run it agains our target now and if all goes as planned we should be able to use netcat to connect in on port 4444 (default for msf payloads).


And we have a shell.





Notice our connection in netstat from 192.168.0.109