Auditando puertos USB y otros dispositivos. Registro de windows y software dedicado. A la hora de administrar una red local, entre otras muchas tareas que ya hemos visto, es posible que tengamos que controlar ciertos tipos de activades relativas a dispositivos conectados a las mquinas de los usuarios como dispositivos USB, telfonos moviles, cmaras digitales, adaptadores Wi. Fi, Bluetooth, etc. Los dispositivos conectados a travs de puertos USB pueden acarrearnos muchos problemas de seguridad y fugas de informacin. En esta ocasin veremos la forma de auditar este tipo de dispositivos, historial de uso y toda la informacin relativa a cada dispositivo conectado, as como fechas. Lo veremos a travs del registro de Windows y programas diseados para tal efecto y como pueden ser USB History Dump, USBDeview y Device. Lock Plug and Play Auditor. Scapy How To Install' title='Scapy How To Install' />Actualizado. Se aade USB History Dump El Registro de Windows. Cuando a una mquina se conecta un dispositivo USB, el administrador Plug and Play recibe una notificacin, consulta el descriptor de dispositivos para obtener informacin tal como el fabricante, etc para encontrar un driver o controlador para el dispositivo o cargar un nuevo controlador. Todo esto queda reflejado en el archivo setupapi. Tambin se almacenar  la fecha y la hora en que el dispositivo de almacenamiento extrable USB se conect al sistema por primera vez 2. Driver Install 0. Buscando Id. de hardware usbstordiskkingstondatatraveler2. Buscando Id. compatibles usbstordisk,usbstorraw 1. Lnea de comando procesada C WINDOWSsystem. I0. 22 Encontrado Gen. Disk en C WINDOWSInfdisk. Dispositivo Unidad de disco Controlador Unidad de disco Proveedor Microsoft Fab Unidades de disco estndar Nombre de seccin diskinstall. I0. Seccin de instalacin actual diskinstall. NT. Rango 0x. 00. Fecha de controlador efectiva 0. Funcin de instalacin de dispositivo DIFSELECTBESTCOMPATDRV. I0. El controlador seleccionado se instala desde la seccin diskinstall in c windowsinfdisk. Garmin Australia V3 Topo Map more. I3. 20 El GUID de clase del dispositivo se conservar como 4. D3. 6E9. 67 E3. 25 1. CE BFC1 0. 80. 02. BE1. 03. 18. I0. Se ha establecido el controlador seleccionado. I0. Se ha seleccionado el mejor controlador compatible. Funcin de instalacin de dispositivo DIFINSTALLDEVICEFILES. I1. R. UTScapy Unit Testing with Scapy About UTScapy What is Scapy Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a. Python for Network Engineers. This course was created for network engineers. There are too many other Python courses out there that try to make network engineers. Kilauea Mount Etna Mount Yasur Mount Nyiragongo and Nyamuragira Piton de la Fournaise Erta Ale. Realizando instalacin slo de copia de USBSTORDISK VENKINGSTON PRODDATATRAVELER2. REV1. 0. 07. 03. Funcin de instalacin de dispositivo DIFREGISTERCOINSTALLERS. I0. Coinstaladores registrados. Funcin de instalacin de dispositivo DIFINSTALLINTERFACES. Instalando seccin diskinstall. Hacking the Java Debug Wire Protocol or How I met your Java debugger. How to setup Security Onion stepbystep to help you momnitor and analyze your network resources and traffic. En esta ocasin veremos la forma de auditar este tipo de dispositivos, historial de uso y toda la informacin relativa a cada dispositivo conectado, as como fechas. Scapy How To Install' title='Scapy How To Install' />, IPv6, VMware, LinuxFoundation, F5, NetApp. Web Scraping With Python Scrapy, SQL, Matplotlib To Gain Web Data Insights. SciPy pronounced Sigh Pie is a Pythonbased ecosystem of opensource software for mathematics, science, and engineering. In particular, these are some of the. NT. Interfaces desde c windowsinfdisk. I0. 54 Se han instalado las interfaces. Funcin de instalacin de dispositivo DIFINSTALLDEVICE. I1. Realizando instalacin completa de USBSTORDISK VENKINGSTON PRODDATATRAVELER2. REV1. 0. 07. 03. I1. La instalacin del dispositivo de USBSTORDISK VENKINGSTON PRODDATATRAVELER2. Bloodrayne 2 Save Game Location. REV1. 0. 00. 70. A continuacin genera una entrada en el registro denominada Device Class ID en HKEYLOCALMACHINESYSTEMCurrent. Control. SetEnumUSBSTOR que identifica la clase del dispositivo. Bajo esta clave se crea otra clave ID de form unca Unique Instance ID utilizando el nmero de serie del dispositivo o de no haberlo obtenido o encontrado, el sistema genera un identificador tambin nico. Eso lo podemos identificar si el segundo carcter del identificador Unique Iinstance ID contiene el smbolo amp. Lo vemos En rojo tenemos el Device Class ID y en azul el Unique Instance ID. En la ventana de la derecha del editor de registro vemos tambin Observamos que el Class. GUID4. D3. 6E9. 67 E3. CE BFC1 0. 80. 02. BE1. 03. 18 lo tenemos tambin en el fragmento del archivo setupapi. Observad el Parent. Id. Prefix 7 1. Si realizamos una bsqueda en el registro por el valor de Unique Instance ID que ms arribas tenemos marcado en azul 0. HKEYLOCALMACHINESYSTEMCurrent. Control. SetControlDevice. Classes. Enmarcado en rojo tenemos el valor de Unique Instance ID que ms arribas tenemos marcado en azul 0. Un poco ms abajo tenemos otra subclave que contiene el Parent. Id. Prefix 7 1. Estas dos subclaves anteriores corresponden a Class GUID keys de disco y de volumen. Tenemos otra clave HKEYLOCALMACHINESYSTEMMounted. Devices Aqu y con el valor de Parent. Id. Prefix, veremos en que volumen se mont el dispositivo USB. Solo tenemos que editar el valor binario para en la parte en Haxadecimal buscar el valor Parent. Id. Prefix mencionado En este caso no aparece el volumen. Puede ocurrir. En la mayora si En este ltimo caso, y buscando en la clave HKEYLOCALMACHINESYSTEMCurrent. Control. SetEnumUSBSTOR vemos que se trata de un dispositivo similar para el cual se ha creado un Unique Instance ID diferente Vamos ahora con las fechas y otras informaciones que nos pueda aportar las claves. Si volvemos a HKEYLOCALMACHINESYSTEMCurrent. Control. SetControlDevice. Classes y elegimos la subclave que nos interesa, por ejemplo, las mismas marcadas en el ejemplo ms arriba reseado, hacemos lo siguiente botn derecho del ratn y explortar en archivo. Software para auditar eventos de dispositivos USB. Para esta tarea tenemos programas como USBDeview o Device. Lock Plug and Play Auditor que, adems, puede auditar Firewire IEEE 1. PCMCIA. Para usar en la consola DOS, tenemos tambin USB History Viewing. Firewire IEEE 1. PCMCIA. Para usar en la consola DOS, USB History Dump. Device. Lock Plug and Play Auditor. Con Device. Lock Plug and Play Auditor  podenos escanear una red local en busca de dispositivos en pouertos USB La informacin que nos aporta es mucha y como vemos ms abajo tenemos dispositivos moviles Nokia, USB extraibles, etc y adems informacin de si est en este momento en uso Para poder entrar en las mquinas a escanear, previamente hay que introducir las credenciales desde el menu File Credentials. Tenemos las siguientes columnas de informacin Description la descripcin del dispositivo que proporciona su fabricante. Device Information informacin adicional relativa al dispositivo proporcionada por el fabricante. Connected to interfaz donde est conectado el dispositivo USB, Fire. Wire o. PCMCIA. Class la clase del dispositivo proporcionada por Windows. Class description la descripcin de la clase del dispositivo proporcionada por Windows. Present indica si el dispositivo est actualmente conectado o no Yes o No. Device. ID texto proporcionado por el fabricante que identifica un dispositivo en particular. Driver nombre del controlador que est controlando este dispositivo. USBDView. Al ejecutar el programa botn derecho del ratn en cualquiera de los items y Propiedades. Como veis no tiene mucha historia USB History Dump. Lo descargamos desde aqu http sourceforge. History. r. 1. i. Lo ejecutamos desde una consola DOS Aqu tenemos informacin relativa a Unique Instance. IDParent. Id. Prefixen que unidad se mont el dispositivo por ltima vez. Disk Stamp y Volume Stamp. Del los ejemplos que hemos visto ms arriba en el registro de Windows 6 Kingston Data. Traveler 2. 0 USB Device instance. ID 0. 70. 31. 20. Parent. Id. Prefix 7 1. Driver 4. D3. 6E9. E3. 25 1. 1CE BFC1 0. BE1. 03. 180. 02. Disk Stamp 0. 51. Volume Stamp 0. 51. ID 2. 00. 80. 12. AB 0. Parent. Id. Prefix 7 1. Driver 4. D3. 6E9. E3. 25 1. CE BFC1 0. BE1. 03. Disk Stamp 0. 41. IOActive Labs Research Hacking the Java Debug Wire Protocol or. TL DR turn any open JDWP service into reliable remote code execution exploit insidelt plagiarism Kids, Im gonna tell you an incredible story. This is the story of how I came across an interesting protocol during a recent engagement for IOActive and turned it into a reliable way to execute remote code. In this post, I will explain the Java Debug Wire Protocol JDWP and why it is interesting from a pentesters point of view. I will cover some JDWP internals and how to use them to perform code execution, resulting in a reliable and universal exploitation script. So lets get started. Disclaimer This post provides techniques and exploitation code that should not be used against vulnerable environments without prior authorization. The author cannot be held responsible for any private use of the tool or techniques described therein. Note As I was looking into JDWP, I stumbled upon two brief posts on the same topic see 5 in French and 6. They are worth reading, but do not expect that a deeper understanding of the protocol itself will allow you to reliably exploit it. This post does not reveal any 0 day exploits, but instead thoroughly covers JDWP from a pentesterattacker perspective. Java Debug Wire Protocol. Java Platform Debug Architecture JPDAJDWP is one component of the global Java debugging system, called the Java Platform Debug Architecture JPDA2. The following is a diagram of the overall architecture The Debuggee consists of a multi threaded JVM running our target application. In order to be remotely debuggable, the JVM instance must be explicitly started with the option Xdebug passed on the command line, as well as the option Xrunjdwp or agentlib. For example, starting a Tomcat server with remote debugging enabled would look like this As shown in the architecture diagram, the Java Debug Wire Protocol is the central link between the Debugger and the JVM instance. Observations about the protocol include It is a packet based network binary protocol. It is mostly synchronous. The debugger sends a command over JDWP and expects to receive a reply. However, some commands, like Events, do not expect a synchronous response. They will send a reply when specific conditions are met. For example, a Break. Point is an Event. It does not use authentication. It does not use encryption. All of these observations make total sense since we are talking about a debugging protocol. However, when such a service is exposed to a hostile network, or is Internet facing, things could go wrong. Handshake. JDWP dictates9 that communication must be initiated by a simple handshake. Upon successful TCP connection, the Debugger client sends the 1. ASCII string JDWP Handshake. The Debuggee server responds to this message by sending the exact same string. The following scapy3 trace shows the initial two way handshake root toolsscapy hg ip addr show dev eth. Welcome to Scapy 2. Sniffed TCP 9 UDP 1 ICMP 0 Other 0 tcp. Ether IP TCP 1. S0. Ether IP TCP 1. SA0. Ether IP TCP 1. A0. Ether IP TCP 1. PA Raw. A 4. 4 5. 7 5. 0 2. D 4. 8 6. 1 6. E  6. B 6. 5         JDWP Handshake. Ether IP TCP 1. A0. Ether IP TCP 1. A0. Ether IP TCP 1. PA Raw. A 4. 4 5. 7 5. 0 2. D 4. 8 6. 1 6. E  6. B 6. 5         JDWP Handshake. Ether IP TCP 1. AAn experienced security auditor may have already realised that such a simple handshake offers a way to easily uncover live JDWP services on the Internet. Just send one simple probe and check for the specific response. More interestingly, a behavior was observed on the IBM Java Development Kit when scanning with Shodan. HQ4 with the server talking first with the very same banner mentioned. As a consequence, there is a totally passive way to discover an active JDWP service this is covered later on in this article with the help of the infamous Shodan. Communication. JDWP defines messages1. Debugger and the Debuggee. The messages follow a simple structure, defined as follows The Length and Id fields are rather self explanatory. The Flag field is only used to distinguish request packets from replies, a value of 0x. The Command. Set field defines the category of the Command as shown in the following table. Command. Set   Command. Action to be taken by the JVM e. Break. Point0x. 400x. F        Provide event information to the debugger e. JVM has       hit a Break. Point and is waiting for further actions0x. Third party extensions. Keeping in mind that we want to execute arbitrary code, the following commands are the most interesting for our purposes. Virtual. MachineIDSizes defines the size of the data structures handled by the JVM. This is one of the reasons why the nmap script jdwp exec. Class. TypeInvoke. Method allows you to invoke a static function. Object. ReferenceInvoke. Method allows you to invoke a function from an instantiated object in the JVM. Photo Studio 2000 Se Downloader. Stack. FrameGetSetValues provides pushingpopping capabilities from threads stack. EventComposite forces the JVM to react to specific behaviors declared by this command. This command is a major key for debugging purposes as it allows, among many other things, setting breakpoints, single stepping through the threads during runtime, and being notified when accessingmodifying values in the exact same manner as GDB or Win. DBG. Not only does JDWP allow you to access and invoke objects already residing in memory, it also allows you to create or overwrite data. Virtual. MachineCreate. String allows  you to transform a string into a java. String living in the JVM runtime. Virtual. MachineRedefine. Classes allows you to install new class definitions. All your JDWP are belong to usAs we have seen, JDWP provides built in commands to load arbitrary classes into the JVM memory and invoke already existing andor newly loaded bytecode. The following section will cover the steps for creating exploitation code in Python, which behaves as a partial implementation of a JDI front end in order to be as reliable as possible. The main reason for this standalone exploit script is that, as a pentester, I like head shot exploits. That is, when I know for sure an environmentapplicationprotocol is vulnerable, I want to have my tool ready to exploit it right away i. Po. C, which is basically the only thing that existed so far. So now that we have covered the theory, lets get into the practical implementation. When faced with an open JDWP service, arbitrary command execution is exactly five steps away or with this exploit, only one command line away. Here is how it would go down 1. Fetch Java Runtime reference. The JVM manipulates objects through their references. For this reason, our exploit must first obtain the reference to the java. Runtime class. From this class, we need the reference to the get. Runtime method. This is performed by fetching all classes All. Classes packet and all methods in the class we are looking for Reference. TypeMethods packet. Setup breakpoint and wait for notification asynchronous callsThis is the key to our exploit. To invoke arbitrary code, we need to be in a running thread context. To do so, a hack is to setup a breakpoint on a method which is known to be called at runtime. As seen earlier, a breakpoint in JDI is an asynchronous event whose type is set to BREAKPOINT0x.