Fun with 'Active Defense'

Active Defense is steadily becoming a popular trend in the security field, both in a theoretical and practical approach. From its humble beginnings it has made its way to a fully functional software implementations that aim at making your attacker's job a bit more miserable.

The whole concept can be treated as a response to insufficient defense mechanisms or simple desire to actively take vengeance on those who dare to attack your precious systems. Whatever the real reason is, lets have a look at how we can use some of the 'Active Defense' concepts in real life, without going into moral and legal aspects.

In order to effectively 'deal' with our attackers we need a tool that will implement at least two concepts:

• Annoyance and Camouflage

Aims at maximizing the required amount of attackers manual work (preferably arduous and non automated) and significantly increasing the amount of generated traffic towards the target system or environment.

By default the reconnaissance phase should be time consuming and easily detectable by your intrusion detection systems...

In practice this can be achieved by a range of different (often combined) techniques - a few of them have been implemented in the Portspoof tool.

• Offensive Defense(Exploitation)

Aims at DOS'ing and exploiting your attackers tools and software.

In practice it means exploiting your attacker's exploits or other scanning software, during their espionage against your system. This can be done in an automated (blind) manner or targeted at a particular bug in your attacker's software.

Based on the above-mentioned concepts, as a fully functional proof of concept, a tool called Portspoof was developed.
Its main purpose is to fool/slow down to ultimately keep attackers from staying low profile while trying to analyze your system(s). It can also help you to exploit their toolbox.

1. Annoyance and Camouflage (practical example)

Port scanning a system behind Portspoof :

# nmap -sV -p - portspoof.org

Will result in:

• 8 hour port scan
• Around 120MB of sent data
• 65535 open tcp ports (with identified services running on every port)
• Imprecise OS identification results
• Cool ASCII arts (ports 1-50)

Conclusions:

• Stealth scans are no longer helpful, since all ports are always open.
• For the moment - The only way to tell if a particular service is fake is with a protocol probe.
• Services running on randomized ports can be really difficult to find.

2. Offensive Defense (practical example)

This research was not only focused on Nmap or McAfeesoftware (there are many others that are vulnerable), but due to their popularity I found them as a great example to support my claim about the huge potential that lies in "Active Defense".

Exploiting the official Nmap NSE http-domino-enum-passwordsscript (arbitrary remote file upload).

https://www.trustwave.com/en-us/resources/security-resources/security-advisories//TWSL2013-024.txt

This vulnerability was found while carrying out a code  review for some of the latest Nmap nse scripts.

Vulnerable http-domino-enum-passwords.nse code:

local status, err = saveIDFile( ("%s/%s.id"):format(download_path, u_details.fullname), http_response.body )

We are in control of 'u_details.fullname' and in order to bypass the second part of the format string parameter "%s.id" and be able to write arbitrary files to the operating system the following payload should be appended to the second format string parameter value (it exploits a bug in LUA io.open function):

The issue allows you to upload multiple arbitrary files to the "attacker" system.

The command that will trigger the vulnerable script is:

$ nmap --script domino-enum-passwords -p 80 <evil_host>--script-args domino-enum-passwords.username='username',domino-enum-passwords.password=secret,domino-enum-passwords.idpath='/t

Exploiting McAfee Super scan 4.0 script (XSS UTF-7).

Super scan 4.0 port scanner has a report generation functionality that inserts version banners directly in to the generated html page.

Although most of the crucial HTML characters are filtered out to prevent Cross-Site-Scripting, like:< > ( ), the character encoding isn't defined. Therefore we are able to inject an old school partially encoded UTF-7 payload with a setter method to work around the parenthesis-filtering problem:

+ADw-img src=x onerror='a setter=alert,a="UTF-7-XSS";'+AD4-

This will execute unsophisticated JavaScript code in old browsers:

There is also a possibility in Portspoof to set up a fuzzing like approach with your own payloads and try to exploit some of the attackers XSS vulnerabilities blindly:

Conclusions

All software is prone to vulerabilities and security toolsare not an exception. You can either start looking for bugs in your attacker's toolboxes or be a bit more paranoid about the security tools that you use.Probably the best way forward is to start doing both...