Reverse ICMP backdoor

Reverse icmp backdoor kit from Bernardo Damele A. G

Sometimes, network administrators make the penetration tester’s life harder. Some of them do use firewalls for what they are meant to, surprisingly!

Allowing traffic only onto known machines, ports and services (ingress filtering) and setting strong egress access control lists is one of these cases. In such scenarios when you have owned a machine part of the internal network or the DMZ (e.g. in a Citrix breakout engagement or similar), it is not always trivial to get a reverse shell over TCP, not to consider a bind shell.

However, what about UDP (commonly a DNS tunnel) or ICMP as the channel to get a reverse shell?

Bernardo: Last year a friend of mine coded a tool called icmpsh. It implements the reverse ICMP shell concept very well. The main advantage over the other open source tools is that it does not require administrative privileges to run onto the target machine.

I spent some time playing with the tool and was immediately impressed. It is clean, easy and portable. The slave (client) runs on the target machine, it is written in C and works on Windows only whereas the master (server) can run on any platform as it has been implemented in C and Perl by Nico. I ported it to Python too.

The reason for the Python port is that I wrapped it into sqlmap too. As of version 0.9 stable you can either establish the out-of-band connection via TCP with Metasploit or via ICMP with icmpsh – switch –os-pwn.

icmpsh Features

• Open source software – primarily coded by Nico, forked by Bernardo Damele A. G .
• Client/server architecture.
• The master is portable across any platform that can run either C, Perl or Python code.
• The target system has to be Windows because the slave runs on that platform only for now.
• The user running the slave on the target system does not require administrative privileges.

Example

Running icmpsh slave on target system (192.168.136.129) by specifying the master IP 192.168.136.1

Running icmpsh master on attacker machine (192.168.136.1) and issuing two OS commands onto the target system (192.168.136.129)

Response packet from icmpsh slave containing output of issued command whoami

The forked tool can be found on Bernardo’s GitHub at https://github.com/inquisb/icmpsh.

[source]

Check your system for vulnerabilities using CVEChecker

The goal of cvechecker is to report about possible vulnerabilities on your system, by scanning the installed software and matching the results with the CVE database. Indeed, this is not a bullet-proof method and you will most likely have many false positives (vulnerability is fixed with a revision-release, but the tool isn’t able to detect the revision itself), yet it is still better than nothing, especially if you are running a distribution with little security coverage.

Still, the tool remains useful. With the proper reporting in place, you are immediately warned when a new CVE has been released that might match your system. You can then take the appropriate steps (acknowledge report, verify incident, fix package or mark as false positive).

The tool however needs your help as well. The most work is to tell cvechecker how to detect which software is installed and what version. For more information, see the cvechecker man-page.

Install required packages:

Code:

root@coresec:~# apt-get install libconfig8-dev libsqlite3-dev libxslt1-dev

Compilation Process:

root@coresec:~# tar -zxvf cvechecker-3.1.tar.gz
root@coresec:~# cd cvechecker-3.1/
root@coresec:~/cvechecker-3.1# ./configure --enable-sqlite3
root@coresec:~/cvechecker-3.1# make
root@coresec:~/cvechecker-3.1# make install

Initialize SQLite3 Database:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -i

To pull the necessary data from the Internet:

Code:

root@coresec:~/cvechecker-3.1# pullcves pull
 
Downloading nvdcve-2.0-2002.xml... ok
Converting nvdcve-2.0-2002.xml to CSV... ok
Loading in nvdcve-2.0-2002.csv in cvechecker.
I am missing the index cveidx2. This is to be expected if this is the first run of cvechecker since an upgrade.
I will now create cveidx2 for you, no further actions are needed.
Some updates have occurred which might affect the database initialization.
Please restart the command.
Downloading nvdcve-2.0-2003.xml... ok
Converting nvdcve-2.0-2003.xml to CSV... ok
Loading in nvdcve-2.0-2003.csv in cvechecker.
Loading CVE data from /usr/local/var/cvechecker/cache/nvdcve-2.0-2003.csv into database
 100 records processed (0 already in db)...
 200 records processed (0 already in db)...
 300 records processed (0 already in db)...
 .....

Generate List of Files:

Code:

root@coresec:~/cvechecker-3.1# find / -type f -perm -o+x > scanlist.txt
root@coresec:~/cvechecker-3.1# echo "/proc/version" >> scanlist.txt

Gather List of Installed Software/Versions:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -b scanlist.txt
 
Searching for known software titles...
 - Found match for /lib/libpthread-2.12.1.so:   cpe:/a:gnu:glibc:2.12.1:::
 - Found match for /sbin/resize2fs:     cpe:/a:ext2_filesystems_utilities:e2fsprogs:1.41.12:::
 - Found match for /sbin/mkfs.ext4:     cpe:/a:ext2_filesystems_utilities:e2fsprogs:1.41.12:::
 - Found match for /sbin/iptables-save: cpe:/a:netfilter_core_team:iptables:1.4.4:::
 - Found match for /sbin/iptables-save: cpe:/a:netfilter_core_team:iptables:1.4.4:::
   .....

Output Matching CVE Entries:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -r
 
File "/bin/dbus-daemon" (CPE = cpe:/a:freedesktop:dbus:1.4.0:::) on host coresec (key coresec)
  Potential vulnerability found (CVE-2010-4352)
  Full vulnerability match (incl. edition/language)
File "/bin/dbus-uuidgen" (CPE = cpe:/a:freedesktop:dbus:1.4.0:::) on host coresec (key coresec)
  Potential vulnerability found (CVE-2010-4352)
  Full vulnerability match (incl. edition/language)
File "/usr/bin/dbus-launch" (CPE = cpe:/a:freedesktop:dbus:1.4.0:::) on host coresec (key coresec)
  Potential vulnerability found (CVE-2010-4352)
  Full vulnerability match (incl. edition/language)
  ......

Export to CSV format:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -r -C

Documentation: http://cvechecker.sourceforge.net/documentation.html
Download: http://cvechecker.sourceforge.net/download.html