Idayari kaTom Hunter: "I-Hound of the Baskervilles"

Ukubambezeleka kokusayina kuvamile kunoma iyiphi inkampani enkulu. Isivumelwano phakathi kuka-Tom Hunter kanye nesitolo esisodwa sezilwane ezifuywayo sokungena ngokuphelele sasinjalo. Bekufanele sihlole iwebhusayithi, inethiwekhi yangaphakathi, ngisho ne-Wi-Fi esebenzayo.

Akumangazi ukuthi izandla zami zaziluma ngisho nangaphambi kokuba yonke imicikilisho ilungiswe. Hhayi-ke, vele uskene isayithi uma kwenzeka, akunakwenzeka ukuthi isitolo esaziwa njenge "The Hound of the Baskervilles" sizokwenza amaphutha lapha. Ezinsukwini ezimbalwa kamuva, uTom ekugcineni wanikezwa inkontileka yokuqala esayiniwe - ngalesi sikhathi, phezu kwenkomishi yesithathu yekhofi, uTom we-CMS yangaphakathi wahlolwa ngentshisekelo isimo sezindawo zokugcina izimpahla...

Source: Ehsan Taebloo

Kodwa akwenzekanga ukuphatha okuningi ku-CMS - abaphathi besayithi bavimbele i-IP kaTom Hunter. Nakuba kungenzeka ukuthi ube nesikhathi sokukhiqiza amabhonasi ekhadini lesitolo futhi ukondle ikati lakho elithandekayo ngemali eshibhile izinyanga eziningi ... "Hhayi ngalesi sikhathi, Darth Sidious," uTom wacabanga ngokumomotheka. Kungaba okuthakasela kancane ukusuka endaweni yewebhusayithi uye kunethiwekhi yendawo yekhasimende, kodwa ngokusobala lezi zingxenye azixhumekile kuklayenti. Noma kunjalo, lokhu kwenzeka kaningi ezinkampanini ezinkulu kakhulu.

Ngemuva kwayo yonke imicikilisho, u-Tom Hunter wahlomisa nge-akhawunti ye-VPN enikeziwe futhi waya kunethiwekhi yendawo yekhasimende. I-akhawunti ibingaphakathi kwesizinda se-Active Directory, ngakho-ke bekungenzeka ukulahla i-AD ngaphandle kwamaqhinga akhethekile - ukukhipha lonke ulwazi olutholakala esidlangalaleni olumayelana nabasebenzisi nemishini yokusebenza.

U-Tom wethule insiza ye-adfind futhi waqala ukuthumela izicelo ze-LDAP kusilawuli sesizinda. Ngesihlungi sesigaba sento, esicacisa umuntu njengesibaluli. Impendulo ibuye nesakhiwo esilandelayo:

dn:CN=Гость,CN=Users,DC=domain,DC=local
>objectClass: top
>objectClass: person
>objectClass: organizationalPerson
>objectClass: user
>cn: Гость
>description: Встроенная учетная запись для доступа гостей к компьютеру или домену
>distinguishedName: CN=Гость,CN=Users,DC=domain,DC=local
>instanceType: 4
>whenCreated: 20120228104456.0Z
>whenChanged: 20120228104456.0Z

Ngaphezu kwalokhu, kwakunokwaziswa okuningi okuwusizo, kodwa okwakuthakazelisa kakhulu kwakuse >incazelo: >inkambu yencazelo. Lawa amazwana ku-akhawunti - indawo ekahle yokugcina amanothi amancane. Kodwa abaphathi beklayenti banqume ukuthi amagama ayimfihlo angahlala lapho ngokuthula. Ubani, ngemva kwakho konke, ongase abe nesithakazelo kuwo wonke lawa marekhodi asemthethweni angasho lutho? Ngakho-ke amazwana atholwe nguTom ayethi:

Создал Администратор, 2018.11.16 7po!*Vqn

Awudingi ukuba usosayensi we-rocket ukuze uqonde ukuthi kungani inhlanganisela ekugcineni iwusizo. Okwakusele kwakuwukuhlaziya ifayela elikhulu lokuphendula elivela ku-CD kusetshenziswa inkambu yencazelo: futhi nakhu - amapheya wokungena namaphasiwedi angu-20. Ngaphezu kwalokho, cishe uhhafu unamalungelo okufinyelela ku-RDP. Hhayi ibhuloho embi, isikhathi sokuhlukanisa amabutho ahlaselayo.

inethiwekhi

Ama-Hounds amabhola e-Baskerville abefinyeleleka kalula abekhumbuza idolobha elikhulu kuzo zonke izinxushunxushu kanye nokungabikezeli. Ngabasebenzisi kanye namaphrofayili e-RDP, u-Tom Hunter wayengumfana ophukile kuleli dolobha, kodwa wakwazi ukubona izinto eziningi ngamafasitela acwebezelayo enqubomgomo yezokuphepha.

Izingxenye zamaseva wamafayela, ama-akhawunti wokubalwa kwezimali, kanye nemibhalo ehlotshaniswa nakho konke kwenziwe esidlangalaleni. Ezilungiselelweni zomunye wale mibhalo, u-Tom uthole i-MS SQL hash yomsebenzisi oyedwa. Umlingo wamandla amancane - futhi i-hash yomsebenzisi iphenduke igama eliyimfihlo lombhalo ongenalutho. Sibonga uJohn The Ripper kanye neHashcat.

Lo khiye kufanele ulingane nesifuba. Isifuba satholwa, futhi ngaphezu kwalokho, "izifuba" eziyishumi zazihlotshaniswa nayo. Futhi ngaphakathi kwayisithupha lay... superuser rights, nt igunya uhlelo! Kwezimbili zazo sikwazile ukusebenzisa inqubo egciniwe ye-xp_cmdshell futhi sithumele imiyalo ye-cmd ku-Windows. Yini enye obungayifuna?

Izilawuli zesizinda

U-Tom Hunter ulungiselele igalelo lesibili labalawuli besizinda. Kwakukhona abathathu kubo kunethiwekhi "Izinja ze-Baskervilles", ngokuhambisana nenani lamaseva akude ngokwendawo. Isilawuli sesizinda ngasinye sinefolda esesidlangalaleni, njengekesi lokubonisa elivuliwe esitolo, eduze kwalapho umfana ompofu ofanayo u-Tom ehlanganyela khona.

Futhi kulokhu umfana waba nenhlanhla futhi - bakhohlwe ukususa iskripthi ebhokisini lokubonisa, lapho iphasiwedi yomphathi weseva yendawo yayifakwe ikhodi kanzima. Ngakho indlela eya kusilawuli sesizinda yayivuliwe. Ngena, Tom!

Lapha kudonswe isigqoko somlingo ngilingisa, ozuze kubaphathi besizinda abambalwa. U-Tom Hunter uthole ukufinyelela kuyo yonke imishini ekunethiwekhi yendawo, futhi uhleko lukaSathane lwesabisa ikati esihlalweni esilandelayo. Lo mzila ubumfushane kunokulindelekile.

I-EternalBlue

Inkumbulo ka-WannaCry kanye noPetya isaphila ezingqondweni zama-pentesters, kodwa abanye abalawuli babonakala bekhohliwe nge-ransomware ekuhambeni kwezinye izindaba zakusihlwa. U-Tom uthole ama-node amathathu asengozini kuphrothokholi ye-SMB - CVE-2017-0144 noma i-EternalBlue. Lokhu kuba sengozini okufanayo okwasetshenziswa ukuze kusatshalaliswe i-WannaCry ne-Petya ransomware, ukuba sengozini okuvumela ikhodi engafanele ukuthi isetshenziswe kumsingathi. Kwenye yama-node asengozini bekuneseshini yomphathi wesizinda - "exploit and get it." Yini ongayenza, isikhathi asizange sifundise wonke umuntu.

"Inja yaseBasterville"

Okwakudala kokuphepha kolwazi kuthanda ukuphinda ukuthi indawo ebuthaka yanoma iyiphi isistimu ngumuntu. Uyaqaphela ukuthi isihloko esingenhla asifani negama lesitolo? Mhlawumbe akubona bonke abanake kangaka.

Emasikweni angcono kakhulu obugebengu bokweba imininingwane ebucayi, u-Tom Hunter ubhalise isizinda esihluka ngohlamvu olulodwa olusuka kusizinda se-“Hounds of the Baskervilles”. Ikheli leposi elikulesi sizinda lilingise ikheli lesevisi yezokuphepha yolwazi lwesitolo. Phakathi nezinsuku ezi-4 kusukela ngo-16:00 kuya ku-17:00, le ncwadi elandelayo yathunyelwa ngokufanayo emakhelini angu-360 isuka ekhelini elingumgunyathi:

Mhlawumbe, ubuvila babo kuphela obusindise abasebenzi ekuvuzeni okukhulu kwamaphasiwedi. Ezincwadini ezingama-360, kwavulwa ezingama-61 kuphela - isevisi yezokuphepha ayidumile kakhulu. Kodwa kwase kuba lula.

Ikhasi lobugebengu bokweba imininingwane ebucayi

Abantu abangu-46 bachofoze isixhumanisi futhi cishe isigamu - abasebenzi abangu-21 - abazange babheke ibha yamakheli futhi bafake ngokuthula amagama abo okungena kanye namaphasiwedi. Ukubamba okuhle, Tom.

Inethiwekhi ye-Wi-Fi

Manje sasingasekho isidingo sokuthembela osizweni lwekati. U-Tom Hunter wajikijela izingcezu zensimbi ezimbalwa ku-sedan yakhe endala waya ehhovisi leHound of the Baskervilles. Ukuvakasha kwakhe akuvunyelwanga ngakho: U-Tom wayezohlola i-Wi-Fi yekhasimende. Endaweni yokupaka yesikhungo sebhizinisi kwakukhona izindawo ezimbalwa zamahhala ezifakwe kalula kumjikelezo wenethiwekhi ehlosiwe. Ngokusobala, abazange bacabange kakhulu ngomkhawulo wayo - njengokungathi abaphathi bebehlohla amaphuzu engeziwe ngokungahleliwe ekuphenduleni noma yisiphi isikhalo mayelana ne-Wi-Fi ebuthaka.

Isebenza kanjani i-WPA/WPA2 PSK security? Ukubhala ngemfihlo phakathi kwendawo yokungena namaklayenti kunikezwa ngokhiye we-pre-seshini - Ukhiye Odlula Kabili (PTK). I-PTK isebenzisa Ukhiye Owabiwe Ngaphambili kanye namanye amapharamitha amahlanu - i-SSID, I-Authenticator Nounce (Memeza), I-Supplicant Nounce (SNounce), indawo yokufinyelela kanye namakheli e-MAC eklayenti. U-Tom ubambe wonke amapharamitha amahlanu, futhi manje Ukhiye Okwabelwane Ngawo kuphela owawungekho.

Insiza ye-Hashcat ilande lesi sixhumanisi esilahlekile cishe emizuzwini engama-50 - futhi iqhawe lethu lagcina selingene kunethiwekhi yezivakashi. Kusuka kuyo ubusuvele ubona esebenzayo - ngokuxakile, lapha uTom waphatha iphasiwedi cishe imizuzu eyisishiyagalolunye. Futhi konke lokhu ngaphandle kokushiya indawo yokupaka, ngaphandle kwe-VPN. Inethiwekhi esebenzayo yavula amathuba emisebenzi enyantisayo yeqhawe lethu, kodwa akakaze engeze amabhonasi ekhadini lesitolo.

Wathula kancane uTom, wabuka iwashi lakhe, waphonsa amaphenathi ambalwa phezu kwetafula, wavalelisa, waphuma esitolo. Mhlawumbe yipentest futhi, noma mhlawumbe isingenile ishaneli yocingo Ngicabange ukubhala...


Source: www.habr.com