Raytheon Challenges

I'm always up for hacking/forensic challenges so when I came across raytheon.com I decided to check them out. The goal is to complete a URL to get to the final page.

You can find the challenges here: http://rtncyberjobs.com

Challenge 1:

The first challenge is very basic and shouldn't take anyone more than a few seconds to figure out. The answer is right in the text on the image:

Right click and view the page source like the text says. Upon scrolling down there is a large comment block containing the answer to the first challenge:

<!--    ********************************************************    -->
<!--    *             Identification Key = hiddengem           *    -->
<!--    ********************************************************    -->
<!--                                                                -->
<!--    Great job, you found the first identification key! Good     -->
<!--    thinking to look in the source code, but this was an        -->
<!--    easy one! You'll need to keep your eyes open and skills     -->
<!--    sharp in order to find and solve the other challenges.      -->
<!--                                                                -->
<!--     Choose to:                                                 -->
<!--     1. type the key "hiddengem" into the 'id key' textbox      -->
<!--        and see what's next                                     -->
<!--     2. solve the other 2 puzzles and find their keys           -->
<!--                                                                -->
<!--    ========================================================    -->

To complete the challenge you just append the Identification Key to the end of the URL: http://rtncyberjobs.com/hiddengem

Challenge Δ:

Challenge Δ was a bit trickier. Here is the image:

The first thing that came to mind was steganography. I saved the image locally and checked it with stegdetect:

# stegdetect puz1b.jpg
puz1b.jpg : negative

Nothing. The next thing that came to mind was checking the Exif data of the image:

# exif puz1b.jpg

EXIF tags in 'puz1b.jpg' ('Motorola' byte order):
--------------------+----------------------------------------------------------
Tag                 |Value
--------------------+----------------------------------------------------------
Image Description   |Getting warmer! Use concealment to uncover even more as yo
Manufacturer        |concealment
x-Resolution        |1.00
y-Resolution        |1.00
Resolution Unit     |Internal error (unknown value 1)
Artist              |concealment
YCbCr Positioning   |centered
Exif Version        |Exif Version 2.1
FlashPixVersion     |FlashPix Version 1.0
Color Space         |Internal error (unknown value 65535)
--------------------+----------------------------------------------------------

It appeared as though the Image Description was being truncated so I ran strings against the file:

# strings puz1b.jpg | more
JFIF
Exif
Getting warmer! Use concealment to uncover even more as you hunt for the solution string to this puzzle...like hide and seek...
concealment
concealment

I played around with scalpel which did give me (i think) a couple false positives. One was an rpm package that file couldn't detect, and another copy of the original jpg image. Hmm. What does this mean? I tried 'concealment' and a few variants but nothing worked. I'll have to think about it and come back. Onto the next challenge:

Challenge 3:

This next challenge was to decrypt the text, and then figure out who said the quote. At first glance looks like it could take quite some time to figure out. It turned out to be a simple crytogram. I just used an online crytogram solver and pasted in the text from the image:

Cryptogram:

TDS JPBBPS IB IV BA NDSP KIZGBX BGIQZV, BA WIQ ZEASIAFV BSIFKCGV, PRPQ BGAFZG LGPLUPSPN JX TDIEFSP, BGDQ BA BDUP SDQU WIBG BGAVP CAAS VCISIBV WGA QPIBGPS PQMAX KFLG QAS VFTTPS KFLG, JPLDFVP BGPX EIRP IQ BGP ZSDX BWIEIZGB BGDB UQAWV QPIBGPS RILBASX QAS NPTPDB.

Deciphered Text:

far better it is to dare mighty things, to win glorious triumphs, even though checkered by failure, than to take rank with those poor spirits who neither enjoy much nor suffer much, because they live in the gray twilight that knows neither victory nor defeat.

Once the message was deciphered I just pasted it into Google. According to Google that was a quote from Theodore Roosevelt. I tried the key of 'roosevelt' which was correct.

Challenge Σ:

At the top was this message:

The key for this part of the challenge is the key to this cypher text:

Ntf zdym cvhcze khy Hjxehqsv ccbivr, fulv afx qflsmmghunfkiw ojghydt, zs na ezsagjje jxbznnqyk lyfuvr zdfhuyzdzem, iizcb uokelrfiem ijkh u euiacsikfidxrrx mqglcobkiiz pw flqrlehoz rnuxzjim. Rpi iheurnwq, jw P ce uye gatk flqrlehf mvtnqs zn u ojghyd uvxn iifsy bmrihffot ce je Ehsmzsb, aov mcsik soeqvcn firt J opiryeqfnxe uf E, vqdrumq F zs ntf domf giekgfetfk vjex xfktyd je Ehsmzsb. Tpnepqs, lsczh khy Hjxehqsv ccbivr, Y obe by qotijtfiex mt uizrfiehf dzpbqskerf mvtnqsj an pjwfydfet jajetm uo khy yfjsusf, khoe evfymuzna ejdpfq giekgfecs morlsejj.

I used another online tool to decipher the text:

The idea behind the Vigenere cipher like all polyalphabetic ciphers is to disguise plaintext letter frequencies which interferes with a straightforward application of frequency analysis. For instance if P is the most frequent letter in a cipher text whose plaintext is in English one might suspect that P corresponds to E because E is the most frequently used letter in English. However using the Vigenere cipher E can be enciphered as different ciphertext letters at different points in the message thus defeating simple frequency analysis.

At first I thought that the word 'vingenere' was the key to this challenge, but it wasn't. Next I had to figure out what the key to this cipher was. I used this tool to figure that out (it took forever).

Key: UMBRA


When I get some free time I'll go back and figure out that steganography challenge. At least I think that's what I need to do.

Why are people still using WEP?

I was driving around in my car one night with my laptop riding shotgun. I decided I might as well fire up airodump-ng and see what wireless networks were around me. First thing's first; put the card into Monitor Mode:

# airmon-ng start wlan0

With the card in Monitor Mode I decided to see how many people were still oblivious to the insecurities of relying on WEP to protect their wireless networks from unauthorized access. Let's see who's out there:

# airodump-ng --encrypt wep mon0

There was only 1 in range. I fired up wifite.py so I could get on IRC from my laptop.

After a couple minutes I was online. I got curious and decided to see what was on this network I was connected to. I ran ifconfig wlan0 to see what my IP address was, and then made an educated guess that my Default Gateway was 192.168.100.1, which turned out to be correct. Next I ran nmap to see what other devices were on the network:

Let's take a look at this nmap command:

• -sV performs a Service Scan which determines the running services listening on each port, and it's version
• -O does Active OS Detection
• -A enables OS detection, version detection, script scanning, and traceroute. Yes it's redundant, but that's how I roll.
• -oX will dump the output in XML format (which we will use later with Metasploit) to an XML file. It also prints everything to STDOUT.

Next I fired up Metasploit and loaded my XML file that nmap generated:

Now that I had all the data nmap gathered from the target network, I could work with it easily from within Metasploit. Below is a list of all the devices on the network:

That Windows 2000 box looked tempting but I decided to just start at the top and work my way down. I figured there was no way the infamous MS08-067 exploit would work, so I decided to try it just for the lulz. I mean, everyone patches their boxes right? It's only in Metasploit as a demo exploit isn't it? Well, not really. In this case anything was possible because the admin was still using WEP with the very secure key of 1234567890.

Hmm, first box, first try and I get a Meterpreter shell. Kinda pathetic but lets move on.

First I migrated to another process incase the one my Meterpreter shell was living in crashed:

I figured the only way it could get any easier was to get an RDP session on the box. So that's what I did. I added myself a new account to the administrators group:

Now that I have an account on the box named hacked with password password, I could RDP into it:

# rdesktop -u hacked -p password -r clipboard 192.168.100.30

• -u Specifies the username to connect with
• -p The password for the account
• -r clipboard Redirects the remote clipboard to the local machine. I use this so I can copy and paste between the remote host and my machine.

At that point it was game over, but I was curious so I dug around a little.

After digging around on the box with the account I created I decided to crack the Administrator account password to see if there was anything interesting on that account.

Using my Meterpreter shell I ran hashdump to dump the SAM database:

 
I cracked the NTLM hashes using an online hash cracker which took about 4 seconds. With the password for the Administrator account I RDP'd into the box and started looking around. The first thing that caught my eye was an icon for the management software for Carbonite Backup. I started it up and was prompted for a password, the username was already filled in. I tried the password that I cracked and bam, I was in. The drive contained thousands of files containing social security numbers, names, and addresses. Jackpot for anyone with malicious intent.

Covering my tracks was pretty easy because they didn't have the Event Log service running.

The ironic thing was that this company does computer training. What they train people to do exactly I'm not sure, but obviously they aren't teaching security or secure best practices.

Lessons learned: Don't use WEP, patch your systems, and don't reuse passwords for everything. That same password was probably used on every system on the network, but I didn't bother checking.

The company was notified via anonymous email.

dcprom0

Get the MAC Address of All Systems on Your Subnet Remotely

Several years ago I interning and was tasked with updating the DHCP reservations on a FreeBSD DHCP server. The Network Administrator told me to go around to each machine and write down the IP Address and it's MAC Address. I thought to myself, there's no way in hell I'm walking around to every system in the building and doing that. How did I do it? I wrote a handy script called getMAC.bat:

@echo off
setlocal enabledelayedexpansion
if [%1] == [] (
  echo.
  echo Please specify a Subnet or IP address.
  echo Example: 192.168.1.0 or 192.168.1.10
  goto :eof
)
arp -d > nul
for /f "tokens=1-4 delims=." %%a in ('echo %1') do (
if not "%%d"==0 (
ping -n 1 -w 5 %1 > nul
for /f "tokens=1,2 delims= " %%x in ('arp -a ^| findstr "%1"') do (
echo.&&echo %%x %%y
goto :eof
)
)
for /l %%i in (1 1 254) do (
set ip=%%a.%%b.%%c.%%i
ping -n 1 -w 5 !ip! > nul
if [!errorlevel!]==[0] (
call :_print !ip!
)
)
)
:_print
for /f "tokens=1,2 delims= " %%x in ('arp -a ^| findstr "%1"') do (
echo %%x %%y
)

Sample run:

getMAC 192.168.1.0

192.168.1.1     00-21-29-b9-22-9d

192.168.1.3     00-26-4a-ee-84-c4

192.168.1.5     00-23-a5-00-06-a2

192.168.1.7     e0-cb-4e-39-b6-40

192.168.1.10    00-0c-29-53-3f-6f

192.168.1.11    00-0c-29-2e-c2-ab

You could also redirect the output to a file for later parsing:

getMAC 192.168.1.0 > outfile.txt

You can also specify just a single IP address to retrieve the MAC Address for:
getMAC 192.168.1.7
e0-cb-4e-39-b6-40

And people say batch scripts aren't useful.

How does it work? It works by pinging each machine and then comparing that IP address against the local machines ARP table to see if it exists. If it does, it prints the IP address and its corresponding MAC address.

This turned manual task that would have taken a couple hours into just a couple minutes of waiting for the script to finish.

Keep in mind this was a fairly small network with roughly 100 nodes. It was a /24 (255.255.255.0) network on a 192.168.10.0 subnet. A couple more things to keep in mind is that I set the ICMP ECHO REPLY timeout to 5 milliseconds with the -w 5 switch to speed up the script. The caveat with this is that any node that takes longer than 5ms to reply will not be found. This can easily be adjusted if your network has higher latency.

Obviously this will only work on a /24. Perhaps if I get tasked with something similar I'll update the script to work on additional networks like 10.0.0.0/18, but at that point I'd be trying to write a subnet calculator in pure batch. : ) This was just an exercise in batch scripting to see what I could come up.

dcprom0

Connecting to NATed Virtual Machines

Recently I've been setting up a lab here at the house for testing different network configurations and services. I setup VMware Workstation 8 on my server box running Windows Server 2003 RC2. The server runs headless so I typically RDP from my Ubuntu box into it for any configuration that needs to be done. Once I had VMware Workstation 8 installed and setup I created a new Virtual Network using the Virtual Network Editor that is packaged with VMware Workstation.

The problem I was having was connecting to my VM's over RDP (TCP 3389)  so I could manage them.

My virtual network configuration is as follows:

The Gateway IP in the second image is essentially the internal IP address for the virtual NIC VMnet8 interface, much like you would have on a typical NAT device such as a router. You can think like the 192.168.1.1 IP that most SOHO routers ship with by default. In this case the external IP would be my physical NIC in the server which is configured with 192.168.1.250. On your router that would be the external interfaces IP address assigned by your ISP.

Next, I created a new VM and installed Windows Server 2008 R2 on it.

My Virtual Machine is configured with the following settings:

As you can see the Default Gateway on the VM is set to the Gateway IP that is configured in the NAT settings in VMware.

I needed to be able to RDP into this VM so I could configure it without first having to RDP into the host machine, and then RDPing into the VM guest. I know I could have just installed VMware Workstation 8 on my Ubuntu box and shared the VM's but what fun is that? : )

To allow connections to your VM's you need to forward the appropriate ingress ports to your VM's. Below is how I have mine configured:

After saving your configuration you can make sure that the new ports are listening with the following command:

netstat -an | findstr "400 "

  TCP    0.0.0.0:4000           0.0.0.0:0              LISTENING

  TCP    0.0.0.0:4001           0.0.0.0:0              LISTENING

Great! It looks like both sockets are listening for connecitons. Let's try it.

Remember you have to connect to your host machines IP address, NAT will do the rest:

Since I use Ubuntu as my primary OS I will be connecting over RDP using the rdesktop command, but the Windows utility mstsc.exe will accomplish the same thing:

rdesktop -u administrator -r clipboard 192.168.1.250:4000

The -u switch specifies the username that I want to authenticate with, the -r clipboard switch redirects the remote clipboard to my local clipboard so I can copy and paste between the VM and my Ubuntu machine.

And voila!

You can use this same method to connect to any service running on your VM's.

Note: While I was testing this I had all firewalls disabled. If you are unable to connect after following the above procedure, try disabling the firewall on both your host machine and your Virtual Machine. On Windows machines you can use this command to disable it:

netsh firewall set opmode disable

In the next article I'll talk about securing this, and how to allow connections to your VM's from the Internet so you can manage your VM's from anywhere. Double-NAT anyone? : )

dcprom0