Ethical Hacking: DIY Mobile Security Workstation (For Cheap)

No ratings

Presented at BSidesSan 2019 by

Dale Meredith

Every red and blue teamer needs a dedicated workstation when engaging a network via a pen test or even if you want to test your security skills. While some companies charge up to $749 for this exact system, Dale will show you what he reverse engineered (Are you surprised he hacked it?) using $250 in parts from Amazon and open source software to build the BatPi, a complete mobile security workstation. The BatPi is powerful enough to run Kali Linux or the Parrot Project, both of which contain more than 300 tools, from scanning wireless networks to running Wireshark, to documenting your engagement… Oh and did I mention it has a touchscreen?! High Performance VM Introspection Using Virtualization Exceptions Raul Tosa & Cristinel-Ionel AnichiteiN/Ahttps://static.sched.com/hosted_files/bsidessf2019/ca/High%20Performance%20VM%20Introspection%20Using%20Virtualization%20Exceptions.pdfHypervisor memory introspection is a security solution isolated from the protected virtual machine's operating system by leveraging hardware virtualization technologies. It relies on the second-level address translation (SLAT) mechanism, in order to enforce restrictions on certain memory areas of the protected VM. In some scenarios this can have a high performance impact, especially due to accesses inside the guest paging structures done by the CPU page walker or the OS memory manager. Most of these accesses are not relevant to the HVI logic. This presentation addresses these issues, promoting an innovative approach on filtering the page-table accesses directly from the guest VM. The filtering is done by a small in-guest agent that uses the virtualization exception (#VE) mechanism: relevant accesses are reported to the main HVI module via a hypercall, while the other accesses are discarded with minimal performance impact. We also discuss a method of protecting the in-guest agent from possible malicious guests by isolating it inside a different physical address space. WHOIS Calling the 80s to Get Their Finger Back: LOL with Old TCP Services Joakim KennedyN/AN/AA current trend among threat actors is the notion to Live Off the Land (LOL). LOL involves using binaries provided by the operating system to reduce the chances of being detected or to bypass application whitelisting. This presentation will look into the possibility of writing a remote access trojan (RAT) that does not handle any network connection on its own. The RAT instead uses TCP services, such as Whois and Finger, that are provided by the operating system to do the network connections to the command and control server. We will also take a look from a defender's perspective. How can we detect this in our environment?As a bonus, we will also create bash one-liner reverse shells using these services. Automating Web Application Bug Hunting Jonathan Cran & Jerry GamblinN/Ahttps://static.sched.com/hosted_files/bsidessf2019/65/Automating%20Application%20Security%20Bug%20Hunting.pdfIf you are a bug bounty hunter or an application security analyst the ability to automate your web hunting tools is the best way to get paid. In this talk, I will discuss how I do this and share some of my favorite scripts. Journey to Command Injection: Hacking the Lenovo ix4-300d Rick RamgattieN/AN/AFully comprising an embedded device isn't always as easy as sending a GET request with admin=true. Sometimes, owning an embedded device takes multiple different vulnerabilities, creativity, and a little finesse. In this live demo, we show how we were able to chain multiple vulnerabilities in the Lenovo ix4-300d network attached storage (NAS) device into a remote exploit that can be executed with little user interaction. As a result, an adversary can provide the victim with a link to a malicious page that grants the attacker the ability to extract all information stored on the victim's NAS, and the ability to execute arbitrary operating system (OS) commands on the compromised NAS. In the talk we cover how we first identified command injection, then used cross-site scripting (XSS) and cross-site request forgery (CSRF) to build an exploit that would hijack values stored in the victim's browser storage, issue a malicious request on the user's behalf, and issue an OS command to open a remotely accessible operating system shell.