Jump to content
OpenSecurity.global

Kevin Beaumont

Members
  • Content Count

    211
  • Joined

  • Last visited

  • Days Won

    23
  • Invited by

    DarkOverlord

Posts posted by Kevin Beaumont


  1. In March this year, Microsoft plan to change LDAP (an authentication system) behaviour so you are required to make connections which is signed and basically secure.  If you have systems which authenticate with Active Directory in plain text, they will break post update.

    More info here:

    https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows

    https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023

    This is a big change which may have production impacts, i.e. systems may break.

    How to identify systems which will break

    Go to your domain controllers and look for Event ID 2887:

    Product: Windows Operating System
    ID: 2887
    Source: Microsoft-Windows-ActiveDirectory_DomainService
    Message: During the previous 24 hour period, some clients attempted to perform LDAP binds that were either:
    (1) A SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP bind that did not request signing (integrity validation), or
    (2) A LDAP simple bind that was performed on a cleartext (non-SSL/TLS-encrypted) connection

    If you see this error, you need to take action as something will break.

    You can manually enable LDAP interface event logging, and afterwards Event ID 2889 will be logged in same location with the IP addresses of clients using insecure LDAP.

    On each DC:

    # Enable Simple LDAP Bind Logging 
    Reg Add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v "16 LDAP Interface Events" /t REG_DWORD /d 2
    

    This will get you the IP address of systems using insecure LDAP.. the next issue is to get them to... not do that.  Over to you!

    • Like 1

  2. The boilerplate description

    "A vulnerability has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution."

    What it means in practice

    Unauthenticated remote code execution on internet connected Citrix Gateway devices = bad.

    Are attackers actually exploiting this vulnerability?

    Yes, at scale, against targeted and untargeted assets.

    Impact

    Lame stuff like coin miners, but also devices getting backdoored, and people trying to use this to deploy ransomware inside Windows orgs behind the Citrix boxes.

    Vendor advisory and patches

    Here: https://support.citrix.com/article/CTX267027

    Checking if your device has already been exploited

    Check out this tool, which is getting frequent updates: https://github.com/fireeye/ioc-scanner-CVE-2019-19781/tree/v1.2

    Scale of the issue

    Somewhere in the region of ~100k devices were exploitable with this back in December.  After have a huge awareness campaign via all sorts of orgs, this one is about ~10k unpatched devices at present.  Those orgs are still in serious danger of exploitation.

    If you patched late

    You want to run the FireEye tool linked above to look for exploitation, as attackers may have backdoored your device.

    I just applied the mitigations

    You should also apply the patch, as it hardens the setup - just the mitigations alone present some issues.


  3. On 9/18/2019 at 10:35 PM, Steve Walsh said:

    Cheers guys. My org recently had a sextortion attack. Used 1647 unique outlook address with a PDF attached which was password protected. The name of the PDF was the name of previously used password and contained within psf was usual sextortion bullshit with a link to a wallet. All mails involved were in have I been pwned. So I'd like to connect with the API to do password audits.

    That probably isn’t the use cases for HIBP, eg they don’t provide passwords. 


  4. I did a PoC with it at Crabbers back in 2016, but didn't reach the pentesting phase I'm afraid.  I aborted out of it for cost reasons more than anything, and at the time the product functionality wasn't very broad (I bet it has improved a lot since).

    With Windows 10 nowadays it has lots of exploit protection built in, e.g. at current jobbing we have all the different exploit prevention technology turned on with Group Policy in Windows 10 pilot:

    image.thumb.png.0ac9bcebdb2a39323b52e7fa07b9667b.png


  5. Some logs you can retrieve with this remotely:

    • https://host/dana-na/../dana/html5acc/guacamole/../../../../../../data/runtime/logs/log.admin.vc0?/dana/html5acc/guacamole/
    • https://host/dana-na/../dana/html5acc/guacamole/../../../../../../data/runtime/logs/log.access.vc0?/dana/html5acc/guacamole/

    As an attacker you can use these to figure out to some degree if the box has been tampered with already.

    Note that to have a hope of figuring out exactly what attackers tampered with, you need to manually (it is disabled by default) enable "Unauthenticated Web Requests" logging under System -> Logs/Monitoring in the Pulse Secure admin centre.  As a result of this many orgs compromised before they installed the patch will not realise if attackers have created backdoors, and they may still be compromised.  I recommend turning on logging, and looking at the admin logs - it won't catch everything (because HTTP requests aren't logged) but you might find other signs of tampering.

    Shoutout to Alyssa Herrera who continues to figure out this vulnerability.


  6. 18 minutes ago, Steve Walsh said:

    It was part of the August patch updates. Not related to the RDP vulnerability. But the issue came with the patch. So if you were quick off the mark, it hurt you a bit https://www.ghacks.net/2019/08/15/visual-basic-issues-in-windows-august-2019-updates/

    Oh I get you.  Yeah, I wouldn't rush out patching for this, just patch as usual process.


  7. CVE-2019-15107 is being exploited in the wild.  It's a pre-auth exploit which allows admin password change, a.k.a. RCE, introduced by an attacker via a backdoor in the application.

    Via BinaryEdge.io:

    image.thumb.png.40dd75cdec005022e02a37b9487c5e4e.png

     

    Timeline

    April 2018 - an attacker backdoor'd WebMin's Sourceforge repo via build process.

    17th August 2019 - 0day exploit available to exploit vulnerability.

    17th August 2019 - WebMin issue advisory

    20th August 2019 - mass exploitation seen in wild.

×
×
  • Create New...

Important Information

We use cookies as we're cookie monsters. Privacy Policy