Aggregator

Interacting with Active Directory on the Mac

Did you ever have to interact with Active Directory on a MAC?

If yes, this post might be interesting for you. I am pretty new to the Mac and basic things I know how to do on Windows need some research to figure out. This time around I explore Active Directory/LDAP Server interactions.

• First, there is the Directory Utility on MacOS which can be quite useful.
• Second, there is Apache’s - Directory Studio - which is pretty amazing and feature rich.
• Third, you might want to write your own tools or scripts.

There are ldap commands that allow you to do most tasks in automated fashion.

English Version 中文版本

Introduction

Today, we are going to talk about the installation password of Hex-Rays IDA Pro, which is the most famous decompiler. What is installation password? Generally, customers receive a custom installer and installation password after they purchase IDA Pro. The installation password is required during installation process. However, if someday we find a leaked IDA Pro installer, is it still possible to install without an installation password? This is an interesting topic.

After brainstorming with our team members, we verified the answer: Yes! With a Linux or MacOS version installer, we can easily find the password directly. With a Windows version installer, we only need 10 minutes to calculate the password. The following is the detailed process:

* Linux and MacOS version

The first challenge is Linux and MacOS version. The installer is built with an installer creation tool called InstallBuilder. We found the plaintext installation password directly in the program memory of the running IDA Pro installer. Mission complete!

This problem is fixed after we reported through Hex-Rays. BitRock released InstallBuilder 19.2.0 with the protection of installation password on 2019/02/11.

* Windows version

It gets harder on Windows version because the installer is built with Inno Setup, which store its password with 160-bit SHA-1 hash. Therefore, we cannot get the password simply with static or dynamic analyzing the installer, and brute force is apparently not an effective way. But the situation is different if we can grasp the methodology of password generation, which lets us enumerate the password more effectively!

Although we have realized we need to find how Hex-Rays generate password, it is still really difficult, as we do not know what language the random number generator is implemented with. There are at least 88 random number generators known. It is such a great variation.

We first tried to find the charset used by random number generator. We collected all leaked installation passwords, such as hacking team’s password, which is leaked by WikiLeaks.

• FgVQyXZY2XFk (link)
• 7ChFzSbF4aik (link)
• ZFdLqEM2QMVe (link)
• 6VYGSyLguBfi (link)

From the collected passwords we can summarize the charset: 23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz

The missing of 1, I, l, 0, O, o, N, n seems to make sense because they are confusing characters. Next, we guess the possible charset ordering like these:

23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz 23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789 ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789

Lastly, we picked some common languages（c/php/python/perl）to implement a random number generator and enumerate all the combinations. Then we examined whether the collected passwords appears in the combinations. For example, here is a generator written in C language:

#include<stdio.h> #include<stdlib.h> char _a[] = "23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz"; char _b[] = "ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz"; char _c[] = "23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ"; char _d[] = "abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ"; char _e[] = "abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; char _f[] = "ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789"; int main() { char bufa[21]={0}; char bufb[21]={0}; char bufc[21]={0}; char bufd[21]={0}; char bufe[21]={0}; char buff[21]={0}; unsigned int i=0; while(i<0x100000000) { srand(i); for(size_t n=0;n<20;n++) { int key= rand() % 54; bufa[n]=_a[key]; bufb[n]=_b[key]; bufc[n]=_c[key]; bufd[n]=_d[key]; bufe[n]=_e[key]; buff[n]=_f[key]; } printf("%s\n",bufa); printf("%s\n",bufb); printf("%s\n",bufc); printf("%s\n",bufd); printf("%s\n",bufe); printf("%s\n",buff); i=i+1; } }

After a month, we finally generated the IDA Pro installation passwords successfully with Perl, and the correct charset ordering is abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789. For example, we can generate the hacking team’s leaked password FgVQyXZY2XFk with the following script:

#!/usr/bin/env perl # @_e = split //,"abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; $i=3326487116; srand($i); $pw=""; for($i=0;$i<12;++$i) { $key = rand 54; $pw = $pw . $_e[$key]; } print "$i $pw\n";

With this, we can build a dictionary of installation password, which effectively increase the efficiency of brute force attack. Generally, we can compute the password of one installer in 10 minutes.

We have reported this issue to Hex-Rays, and they promised to harden the installation password immediately.

Summary

In this article, we discussed the possibility of installing IDA Pro without owning installation password. In the end, we found plaintext password in the program memory of Linux and MacOS version. On the other hand, we determined the password generation methodology of Windows version. Therefore, we can build a dictionary to accelerate brute force attack. Finally, we can get one password at a reasonable time.

We really enjoy this process: surmise wisely and prove it with our best. It can broaden our experience no matter the result is correct or not. This is why we took a whole month to verify such a difficult surmise. We also take this attitude in our Red Team Assessment. You would love to give it a try!

Lastly, we would like to thank for the friendly and rapid response from Hex-Rays. Although this issue is not included in Security Bug Bounty Program, they still generously awarded us IDA Pro Linux and MAC version, and upgraded the Windows version for us. We really appreciate it.

Timeline

• Jan 31, 2019 - Report to Hex-Rays
• Feb 01, 2019 - Hex-Rays promised to harden the installation password and reported to BitRock
• Feb 11, 2019 - BitRock released InstallBuilder 19.2.0

English Version 中文版本

前言

Hex-Rays IDA Pro 是目前世界上最知名的反組譯工具，今天我們想來聊聊它的安裝密碼。什麼是安裝密碼？一般來說，在完成 IDA Pro 購買流程後，會收到一個客製化安裝檔及安裝密碼，在程式安裝過程中，會需要那組安裝密碼才得以繼續安裝。那麼，如果今天在網路上發現一包洩漏的 IDA Pro 安裝檔，我們有可能在不知道密碼的狀況下順利安裝嗎？這是一個有趣的開放性問題。

在我們團隊成員腦力激盪下，給出了一個驗證性的答案：是的，在有 Linux 或 MacOS 版安裝檔的狀況下，我們可以直接找到正確的安裝密碼；而在有 Windows 版安裝檔的狀況下，我們只需要十分鐘就可算出安裝密碼。

下面就是我們的驗證流程：

* Linux 以及 MacOS 版

最先驗證成功的是 Linux 及 MacOS 版，這兩個版本都是透過 InstallBuilder 封裝成安裝檔。我們嘗試執行安裝程式，並在記憶體中直接發現了未加密的安裝密碼。任務達成！

在透過 Hex-Rays 協助回報後，BitRock 也在 2019/02/11 釋出了 InstallBuilder 19.2.0，加強了安裝密碼的保護。

* Windows 版

在 Windows 版上解決這個問題是項挑戰，因為這個安裝檔是透過 Inno Setup 封裝的，其安裝密碼是採用 160-bit SHA-1 hash 的方式儲存，因此我們無法透過靜態、動態程式分析直接取得密碼，透過暴力列舉也不是一個有效率的方式。不過，如果我們掌握了產生密碼的方式，那結果可能就不一樣了，我們也許可以更有效率的窮舉。

雖然我們已經有了方向是要找出 Hex-Rays 如何產生密碼，但要去驗證卻是”非常困難”的。因為我們不知道亂數產生器是用什麼語言實作的，而目前已知至少有 88 種亂數產生器，種類太多了。同時，我們也無法知道亂數產生器所使用的字元組和字元順序是什麼。

要找出亂數產生器所使用的字元組是眾多困難事中比較簡單的一件，首先，我們竭盡所能的收集所有 IDA Pro 的安裝密碼，例如 WikiLeaks 所揭露的 hackingteam 使用之密碼：

• FgVQyXZY2XFk (link)
• 7ChFzSbF4aik (link)
• ZFdLqEM2QMVe (link)
• 6VYGSyLguBfi (link)

從所有收集到的安裝密碼中我們整理出所用到的字元組： 23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz

少了 1, I, l, 0, O, o, N, n 字元，推測這些都是容易混淆的字元，因此不放入密碼字元組中是合理的。接著，我們用這些字元組，猜測可能的排列順序：

23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz 23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789 ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789

最後，我們挑選幾個比較常見的語言（c/php/python/perl）並使用上述的字元組實作亂數產生器，列舉所有亂數組合，看看我們收集到的安裝密碼有沒有出現在這些組合中。例如我們用下面程式碼列舉 C 語言的亂數組合：

#include<stdio.h> #include<stdlib.h> char _a[] = "23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz"; char _b[] = "ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz"; char _c[] = "23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ"; char _d[] = "abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ"; char _e[] = "abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; char _f[] = "ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789"; int main() { char bufa[21]={0}; char bufb[21]={0}; char bufc[21]={0}; char bufd[21]={0}; char bufe[21]={0}; char buff[21]={0}; unsigned int i=0; while(i<0x100000000) { srand(i); for(size_t n=0;n<20;n++) { int key= rand() % 54; bufa[n]=_a[key]; bufb[n]=_b[key]; bufc[n]=_c[key]; bufd[n]=_d[key]; bufe[n]=_e[key]; buff[n]=_f[key]; } printf("%s\n",bufa); printf("%s\n",bufb); printf("%s\n",bufc); printf("%s\n",bufd); printf("%s\n",bufe); printf("%s\n",buff); i=i+1; } }

大約一個月的運算，我們終於成功利用 Perl 亂數產生出 IDA Pro 的安裝密碼，而正確的字元組順序為 abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789。例如 hacking team 洩漏的 IDA Pro 6.8 安裝密碼是 FgVQyXZY2XFk，就可用下面程式碼產生：

#!/usr/bin/env perl # @_e = split //,"abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; $i=3326487116; srand($i); $pw=""; for($i=0;$i<12;++$i) { $key = rand 54; $pw = $pw . $_e[$key]; } print "$i $pw\n";

透過這些資訊，我們可以建立一個用來暴力列舉安裝密碼的字典檔，縮短暴力列舉的時間，實作方式可參考 inno2john 專案。在一般情況下，約十分鐘即可算出 windows 安裝檔的安裝密碼。

在回報 Hex-Rays 後，他們立刻表示之後將會使用更安全的安裝密碼。

總結

本篇文章提出了一個開放性問題：在未知安裝密碼的情況下可不可以安裝 IDA Pro？結果我們在 Linux 以及 MacOS 版發現可以從記憶體中取得明文密碼。而在 Windows 版本中，我們黑箱找到了安裝密碼產生的方式，因此我們可以建立一份字典檔，用以縮短暴力列舉安裝密碼的時間，最終，我們約十分鐘可解出一組密碼，是一個可以接受的時間。

我們真的很喜歡這樣的過程：有根據的大膽猜測，竭盡全力用任何已知資訊去證明我們的想法，不論猜測是對是錯，都能從過程中獲得很多經驗。這也是為什麼我們這次願意花一個月時間去驗證一個成功機率不是很高的假設。附帶一提，這樣的態度，也被運用在我們紅隊演練上，想要試試嗎 :p

寫在最後，要感謝 Hex-Rays 很友善且快速的回應。即使這個問題不包含在 Security Bug Bounty Program 裡面，仍然慷慨的贈送 Linux 和 MAC 版 IDA 及升級原有 Windows 版至 IDA Pro。再次感謝。

時間軸

• Jan 31, 2019 - 向 Hex-Rays 回報弱點
• Feb 01, 2019 - Hex-Rays 說明之後會增加安裝密碼的強度，並協助通報 BitRock
• Feb 11, 2019 - BitRock 釋出了 InstallBuilder 19.2.0

水文预警。Attack CGI / FASTCGI / PHP-FPM / uWSGI with socket ( TCP / Unix Domain Socket )

0x00 前言
         我他妈居然在野蛮的期末考试来临之即写博客，为了防止挂科我会写的短点好腾出时间预习          pyspider是一个基于python的国人研发的爬虫系统，功能非常强大          关于这个东西。介绍如下： 采用Python语言编写，分布式架构，支持多种数据库后端，强大的WebUI支持脚本编辑器，任务监视器，项目管理器以及结果查看器。
0x01 未授权访问的威胁          pyspider还带一个webui的界面，方便调度爬虫调试代码的。可是偏偏一些铁憨憨把这个webui开到公网上面，而webui本身没有任何形式的验证机制并且允许远程执行python代码。
         我查遍了google发现这个威胁好像没人提到，那应该是我第一个发现的吧
         用数字公司的fofa一搜发现有几百个
https://fofa.so/result?q=title%3D%22Dashboard+-+pyspider%22&qbase64=dGl0bGU9IkRhc2hib2FyZCAtIHB5c3BpZGVyIg%3D%3D
0x01 POC&EXP           放https://github.com/TomAPU/poc_and_exp了           随便玩，玩累了就睡觉，没关系的          

The online video player landscape is fragmented with a wide variety of players across a mix of popular platforms. In the world of HTML5-video players in browsers, there are a number of open-source solutions (e.g., hls.js, dash.js, Shaka Player), as well as commercial offerings which include Akamai's AMP.

The Gootkit banking trojan is still active and protecting itself in Italy using a dedicated redirection defense.

The Gootkit banking trojan is still active and protecting itself in Italy using a dedicated redirection defense.

The Gootkit banking trojan is still active and protecting itself in Italy using a dedicated redirection defense.

Oracle Weblogic远程反序列化命令执行漏洞，该漏洞绕过了最新的Weblogic补丁（CVE-2019-2725）。

突然想起来我还有个博客（…… 这一个月来各种比赛跑，然而主要都是被pizza带飞。得赶紧抽空整理一下各种题目 神盾杯re500的c#没啥思路，本身对.net机制确实没啥深入理解…加入TODOLIST留待日后研究了（ babyjs 拿到html后发现按钮调用了checkLogin函数 在控制台输入checkLogin即可看到源码 obfacros 一看题目描述又是--garzon家俊那个混淆狂魔...

今天是父亲节，看着朋友圈持续刷屏的节日祝福，笔者突然想到了持续关注多年的一家著名的网安独角兽Tanium，这

今天是父亲节，看着朋友圈持续刷屏的节日祝福，笔者突然想到了持续关注多年的一家著名的网安独角兽Tanium，这

今天是父亲节，看着朋友圈持续刷屏的节日祝福，笔者突然想到了持续关注多年的一家著名的网安独角兽Tanium，这

人总应该有点焦虑的东西，否则就太不科学了。这是一篇比较丧的文章......

人总应该有点焦虑的东西，否则就太不科学了。这是一篇比较丧的文章......

又有几天没发新更了，毕竟高草是很佛系的，想到啥写啥。之前没更，原因还是一个字：懒啊~来吧，今天整点跟以前风格

又有几天没发新更了，毕竟高草是很佛系的，想到啥写啥。之前没更，原因还是一个字：懒啊~来吧，今天整点跟以前风格