Saturday 8 November 2014

DOS attack on windows application using global objects for single instance check.

Usually applications use global object like mutex so that only single instance of their application runs at a time. The algorithm is as follows:

Step 1: Check if some one has acquired mutex "APP_BLOCKER"
Step 2: If Yes then Goto Step 6.
Step 3: Acquire the mutex.
Step 4: Application logic comes here.
Step 5: Release the mutex.
Step 6: Exit.

With this understanding now lets start the attack,
The first thing that we need to block the application is the name of the mutex.
If the name of the mutex is taken in the code itself, we can easily extract it.

"strings" tool can be used to extract all the printable characters from the file. The tool can be downloaded from here. Extract the tool to a folder.
Now on command line move to the directory where you extracted the file. Now on the command line run the following command.

strings "C:\FULL_PATH_TO_EXE\victim.exe" >> data.txt

Now open the file data.txt in a text editor, and try to find the string "Global\AnyTextCanComeHere"
This is the most crucial part, if you find such string, its good. Or else we will go into more detailed analysis of the binary. For now we will assume that we have found the mutex name.

Now, compile the following program in visual studio,

#include <stdio.h>
#include <windows.h>

#define GLOBAL_OBJECT_NAME L"Global\\AnyTextCanComeHere"

int main()
{
    HANDLE hMutex;

    hMutex = CreateMutex(NULL, FALSE, GLOBAL_OBJECT_NAME);
    if (NULL == hMutex)
    {
        printf("\nCreateMutex failed %d", GetLastError());

        getchar();
        return EXIT_FAILURE;
    }

    printf("\nCreateMutex done.");
    WaitForSingleObject(hMutex, INFINITE);
    printf("\nWait returned.");

    getchar();
    CloseHandle(hMutex);
}

and run the exe.
Now try to run the application, if we picked the correct mutex name, the application will not run.
The application tries to acquire the mutex, but our application has already acquired the mutex, hence the legitimate application terminates.

What if the application is not blocked:
There can be n number of reasons,
1. The name of the mutex that we selected is not used for single instance check.
2. The name we selected was correct but the code at runtime applies some logic to modify the name, and then uses it,
3. Perhaps the, developer has not used mutex but some other kernel object, eg, event.

Ultimately our goal is to get the specific kernel object created, and consume it.

Most of the application's today will apply some kind of obfuscation to hide the name of the kernel object.


Thanks And Regards,
Suraj K.

Friday 7 November 2014

Installing terminator on Kali Linux

Hi folks, i just moved on to kali-linux from backtrack. Offline installation of drivers for the broadcom wireless card took a lot of time. However in this page i am writing about how to install terminator on kali-linux.

What is terminator?

Originally created and developed for a long time by Chris Jones, the goal of this project is to produce a useful tool for arranging terminals.

Terminator is pre-included in the backtrack intallation, however is not included in kali linux (1.0.9).
After a long search for how to install terminator on kali, i found the solution. Which i would like to document here.

The first thing that a debian user would do is apt-get, when i tried i got the following error.

# apt-get install terminator
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package terminator 
 
apt-get uses is a tool which is used to handle software installation and removal. It synchronizes the information about the latest softwares from the location mentioned in the configuration file /etc/apt/source.list

Hence the first thing we will do is update this source.list file.
With root privileges open this file, it should look something like follows

----------------------------------------------------------------------------------------------------------
U P D A T I N G  S O U R C E S
----------------------------------------------------------------------------------------------------------
surajk@kali:~/Desktop/terminator-0.97$ cat /etc/apt/sources.list
#
# deb cdrom:[Debian GNU/Linux 7.0 _Kali_ - Official Snapshot amd64
LIVE/INSTALL Binary 20140822-15:33]/ kali contrib main non-free
#deb cdrom:[Debian GNU/Linux 7.0 _Kali_ - Official Snapshot amd64
LIVE/INSTALL Binary 20140822-15:33]/ kali contrib main non-free
## Security updates
deb http://security.kali.org/kali-security kali/updates main contrib non-free 
  
Add the following line to the file:
deb http://http.kali.org/kali kali main 
 
Then run the command apt-get update
This command will update the required package information.

This may take some time.

root@kali:/home/surajk/Desktop/terminator-0.97# apt-get update
Hit http://http.kali.org kali Release.gpg
Hit http://security.kali.org kali/updates Release.gpg
Hit http://http.kali.org kali Release
Hit http://security.kali.org kali/updates Release
Get:1 http://http.kali.org kali/main amd64 Packages [8,450 kB]
Ign http://http.kali.org kali/main Translation-en_US
Ign http://http.kali.org kali/main Translation-en
Ign http://security.kali.org kali/updates/contrib Translation-en_US
Ign http://security.kali.org kali/updates/contrib Translation-en
Ign http://security.kali.org kali/updates/main Translation-en_US
Ign http://security.kali.org kali/updates/main Translation-en
Ign http://security.kali.org kali/updates/non-free Translation-en_US
Ign http://security.kali.org kali/updates/non-free Translation-en
Hit http://security.kali.org kali/updates/main amd64 Packages
...
Reading package lists... Done

----------------------------------------------------------------------------------------------------------
I N S T A L L I N G  T E R M I N A T O R
----------------------------------------------------------------------------------------------------------
Now run the command
apt-get install terminator

root@kali:/home/surajk/Desktop/terminator-0.97# apt-get install terminator
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
libart-2.0-2 libbonoboui2-0 libbonoboui2-common libgnomecanvas2-0
libgnomecanvas2-common libgnomeui-0 libgnomeui-common libkeybinder0 libvte-common
libvte9 python-gconf python-gnome2 python-keybinder python-pyorbit python-vte
Suggested packages:
python-gnome2-doc
The following NEW packages will be installed:
libart-2.0-2 libbonoboui2-0 libbonoboui2-common libgnomecanvas2-0
libgnomecanvas2-common libgnomeui-0 libgnomeui-common libkeybinder0 libvte-common
libvte9 python-gconf python-gnome2 python-keybinder python-pyorbit python-vte
terminator
0 upgraded, 16 newly installed, 0 to remove and 131 not upgraded.
Need to get 4,667 kB of archives.
After this operation, 16.6 MB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Get:1 http://http.kali.org/kali/ kali/main libart-2.0-2 amd64 2.3.21-2 [72.7 kB]
Get:2 http://http.kali.org/kali/ kali/main libgnomecanvas2-common all 2.30.3-1.2 [133 kB]
......
...
..

Setting up libvte-common (1:0.28.2-5) ...
Setting up libvte9 (1:0.28.2-5) ...
Setting up python-gconf (2.28.1+dfsg-1) ...
Setting up python-pyorbit (2.24.0-6+b1) ...
Setting up python-gnome2 (2.28.1+dfsg-1) ...
Setting up python-keybinder (0.2.2-4) ...
Setting up python-vte (1:0.28.2-5) ...
Setting up terminator (0.95-1) ...
update-alternatives: using /usr/bin/terminator to provide /usr/bin/x-terminal-emulator (x-terminal-emulator) in auto mode
Processing triggers for python-support ...

This should start the installation of terminator and all required depended packages.
----------------------------------------------------------------------------------------------------------

Finding this out took a lot of time for me, hope this helps someone.
I am new to kali, and have come back after a long time to linux. Any comments, improvements or suggestions are appreciated.