Just Another IT Security Blog

 The last couple of years I've spent doing a job that was out of my usually wheel house. I went to a learning and content development team within Cisco where I served as a SME for a lot of Cisco Secure Products. This position was not as technical as I'd like and ultimately led to my demise at Cisco. My position was terminated in July and I've spent the last few months looking within Cisco and outside for a new position. From what I can tell, most places have turned me down, which I can only assume, due to my none technical position the last two years. This is very annoying as I still have most of my technical information in my head and still know how to do things. But I guess it only matters what you have done recently. I'm hopeful to find something but in the mean time I'm going to start blogging about new things I'm trying to learn to further develop my security skillset. 

It's been over a year since the last time I posted anything so I'll give a quick update. The whole AFL thing didn't pan out as much as I'd like as I never really made time for it. I did add another child into the world so I got that going for me. As for work, I'm still at Cisco Talos doing the Detection Response Team (DRT) stuff, basically creating rules for Snort and sigs for ClamAV. That's going ok, gets a little mundane at times as I'm a researcher by trade and love looking into different things, especially mobile stuff, but overall I feel it's going well. At least no one has told me otherwise. That's pretty much it for me over the last year so lets start on some new exciting info. I recently went to TROOPERS  for TROOPERS19 and it was awesome. For those that don't know, it is a computer security conference in Heidelberg, Germany that takes place in March time frame. The city of Heidelberg was beautiful and the content of the conference was ...

Over the course of my INFOSEC career I've worked in many different positions. IDS, network analysis, pentester, mobile application testing and a few others but one area has always stoked my interest. Vulnerability development is an area I wish I knew more about along with having a better grasp of reversing software. So over the next few months I've decided to try and fuel that interest by jumping into the world of fuzzing. I have chosen to start messing around with american fuzzy lop (AFL)  and see if I can find my first CVE. So here goes nothing.

It's been a few months since my last post and I thought that a post about what items might be considered suspicious in an APK would be good to have. There is only two main items that I can think of but should provide a researcher with an idea of when they might need to reverse an application to figure out exactly what it is doing. Permissions In order for applications to access certain features of an Android device they must request access to the corresponding permissions for that feature. Such as, if an application wants to send SMS it must request access to that feature. This is usually done on install. When you choose to install a new application the user has to grant or deny access. This is the only time a user is prompted to allow access as the application will not request permissions when running. This can be dangerous if you allow access to an application and do not know what it is actually requesting access to. Permissions are a good place to start with when trying to ...

Hope you brought your shovel as we start to take apart this malware and look at it's internal code. To get started we will need to pull the APK from the device to our local system. To do this you will need to turn on usb debugging on the phone or emulator from the settings menu of Android (Check out this link if you don't know how https://www.kingoapp.com/root-tutorials/how-to-enable-usb-debugging-mode-on-android.htm ). Now that you have your phone/emulator connected to your system you can now download the malicious APK. In our case we already have the APK but for those situations when you might now already have it downloaded you use the adb pull   command (e.g. adb pull /data/app/bad.apk)to pull the package from the device. After you have completed this process we can now start the static analysis of APK. The main tool for performing static analysis of the APK is a decompiler. I prefer JEB ( https://www.pnfsoftware.com/jeb2/ ) but it requires a subscription. A free decom...

In the previous post I covered how to get an Android image running in an emulator and how to install the malicious APK to the device. This post will focus on performing some basic dynamic analysis of the APK in the emulator. The first thing we need to do is start our device. I've found the best way to do this that allows me to save the network traffic is with the command line tool ' emulator '. If you type ' emulator -help ' you will get a ton of arguments which this command takes but thankfully for us we only need a few of them. We start our device with the command emulator -avd  MyDevice -qemu -tcpdump traffic.pcap. This will start the device and save out a pcap of the network connections to the file specified. TestAndroid - Galaxy Nexus Android v4.2.1  Now its time to get to work. I pulled done a sample from VirusTotal that I've worked with before which is called MisoSMS . This malware was found targeting users in Asia and FireEye did a good writeup o...

Over the last year I have been performing research on mobile devices. My last job had me analyzing the security of Android applications and recently I found my new job drawing on my past experience to help someone analyze some Android malware. First we started to do some research on potential solutions that could help automate analysis or at least do some type of dynamic analysis and that is were I stumbled onto CuckooDroid (https://github.com/idanr1986/cuckoo-droid). After a day or two of  messing with CuckooDroid I decided that it was a little overkill for what I needed to do which was grab a PCAP of the traffic. In one of my next post I'll cover setting it up but for now here is what you need to do if you want to do a quick and easy analysis of an Android malware sample.  1) Install Android Studio (http://developer.android.com/sdk/installing/index.html) 2) Use the SDK Manager to install the SDKs and Images to work for the malware you are going to be analyzing. ...

I spent some time cleaning up my laptop the other day which included removing unused programs and files. It then hit me that I probably had a bunch of wifi profiles that I don't need anymore so I thought about writing a script to call the netsh command to output this info. After working on this for about an hour and finally having a crude Powershell command that did output me this info I did a search and sure enough someone else had already wrote on. Anyways, here is the command I came up with and a link to the script I found. PS C:\Windows\system32> netsh wlan show profiles | Select-String -Pattern "All User Profile"  | ForEach-Object {$_.ToString()} | ForEach-Object {$_.Replace("    All User Profile     : ",$null)} | ForEach-Object {netsh wlan show profile name=$_ key=clear} | Format-List Profile Wireless1 on interface Wi-Fi: ======================================================================= Applied: All User Profile   Profile informa...

It's been a few weeks since my last post so I've decided to try out some more Powershell scripting. Here is a script to do some port scanning from a Windows system with Powershell. Right now it only allows for IP Addresses to be used. ############################################################################################### # # Script: PSPortScanner.ps1 # By: Tim Muniz # Date: 20160120 # ############################################################################################### <# .SYNOPSIS This script scans a remote host to check what ports are open. .DESCRIPTION This script scans a remote host to check what ports are open. .PARAMETER Target Remote host to scan .PARAMETER SPort Port to start scan with. .PARAMETER EPort Port to end scan with. .EXAMPLE Scan remote host to check what ports are open. PSPortScanner.ps1  1  1024 10.1.1.2 .NOTES Please let me know what you think or if it isn't working. #> [CmdletBindin...

Over the last couple of days I've been responding to question about Joomla's 0-day which has been gaining some attention lately. I decided to write a PowerShell script to check a Joomla server if it is running the at least 3.4.6 or 3.4.7. Hope you enjoy it and let me know your thoughts. ############################################################################################### # # Script: CheckJoomla.ps1 # By: Tim Muniz # Date: 20151222 # ############################################################################################### <# .SYNOPSIS This script checks Joomla Version to check if the remote host is vulnerable to CVE-2015-8562. .DESCRIPTION This script checks Joomla Version to check if the remote host is vulnerable to CVE-2015-8562. .PARAMETER target a host running Joomla to test. .PARAMETER Https To test a host running SSL/TLS.  This is an optional parameter. .EXAMPLE Check remote Joomla ...

In the next couple of weeks I will be moving onto a position with Cisco Talos as a Research Engineer. I'm very excited about the move and the chance to work with an awesome group of people. I can't wait to get started and the move has rekindled the love I once had for staying up late to learn some new techniques. So here is a script I created to grab useful IR info from a Windows box with PowerShell. I guess you could also use it to grab info while doing pentests as well. It's very generic and crude as I'm just starting to get into PowerShell. # # Name: Win_IR.ps1 # Desc: Powershell script for gathering useful information for # performing IR on a Windows Host # # by: Tim Muniz # Date: 20151221 get-date -format s whoami hostname #Get Boot Time systeminfo | select-string -pattern 'System Boot Time.*' #Get Running Processes Get-Process | Format-Table #Get Registry Keys Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersi...

This is a post I've been thinking about writing for some time now as I was sitting at work one day. Why not use a tool we already have to do some IR on a suspect system? We have Nessus and we use it to scan systems all over the network so I know I can log into the system remotely. This would save me time and speed up my preliminary investigations. I mean Nessus already has plenty of plugins that will report on useful IR information just people have probably never thought to use it that way. So here are the plugins I've come up with to try and do some preliminary IR with Nessus. Here is a list of the information that I need: - Running Processes 70329 Microsoft Windows Process Information - Active Connections 34220 Netstat Portscanner (WMI) 58651 Netstat Active Connections 64582 Netstat Connection Information - AutoRuns (Checking for persistence) 70615 Microsoft Windows AutoRuns Boot Execute 70621 Microsoft Windows AutoRuns Logon 70625 Microsoft Windows AutoRun Sch...

A few of weeks ago I took SANS 560 Network Penetration Testing and Ethical Hacking course. It was an awesome course and I had a lot of fun completing the exercises and practical. I gave myself a week to study for the exam and scheduled the GIAC GPEN exam for the following Monday.  I studied a couple of hours each night trying to finish at least one of the 5 books a night. When the day came I felt ready. The exam is open book so I took all my materials in the event I couldn't remember something and had to look it up. I scored an 87% and was extremely happy having passed the exam. There were a few questions I had to look up but not many so I feel comfortably that I know the material. For anyone looking to taking the GIAC GPEN I have a few recommendations. Take the course, whether that is live, online or by some other means that SANS offers as I feel it is well worth it. Prior to the exam give yourself a few hours each night to study at least one section at a time and re-read the pa...

It's been a long time since I last blogged. I've changed jobs and started my own company. Recently, I started gearing up for the SANS GCFA exam as I only have a month left to study until my voucher expires. I took the practice test and scored little better than I thought going off memory so it shouldn't be too bad with the books. Computer forensics has been an interest of mine for a while and recently I've began studying about it more. This got me thinking on an idea that someone mine find useful. I've spent most of my career doing vulnerability analysis, pentesting and other offensive type of IT security and now that I've began looking into the defensive, mainly the incident response and remediation, I thought about writing how to leverage the tools I know for incident response. Take Nessus for example. There are plenty of plugins that would provide you with useful information that you would need in the event you suspect a system has been compromise. So over ...

I just recently started to mess around with MS Powershell and have found it very useful. As a Nessus Audit Writer, I'm able to perform checks like I could on linux/unix. Here is an example just one of items you can do with Powershell. Find file/drive shares that have the user 'Everyone' assigned to them PS C:>get-wmioject -namespace root\cimv2 -class win32_share | where-object {$_.path -ne ""} -erroraction silentlycontinue| get-acl | where-object {$_.accesstostring -match "everyone"} | format-list -property path,accesstostring Path : Microsoft.PowerShell.Core\FileSystem::C:\ AccessToString : Everyone Allow ReadAndExecute, Synchronize CREATOR OWNER Allow 268435456 NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl BUILTIN\Users Allow AppendData BUILTIN\Users Allow CreateFiles BUILTIN\Users Allow ReadAndExecu...

Recently, I've ran into a few situations were I had to start testing for if SSLv2 was allowing connections. Instead of using a tool such as a vulnerability scanner, I found that the best way to go about this was with openssl and s_client. This would allow me to fine tune my request to get the information that I needed manually and cut out the time spent waiting for a scanner to finish. Here is an example of how you can check if SSLv2 is allowed on a system using openssl Allowed Connection: root#openssl s_client -ssl2 -no_ssl3 -no_tls1 -connect 192.168.1.2:443 CONNECTED(00000003) ...certificate exhange etc.... SSL handshake has read 879 bytes and written 236 bytes --- New, SSLv2, Cipher is DES-CBC3-MD5 Server public key is 1024 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv2 Cipher : DES-CBC3-MD5 Session-ID: 26691A60E4F2220AB63D22A032E26872 Session-ID-ctx: Master-Key: CC2E5772DA1C9908333FC4905136041BAD...

Anyone interested in learning how to write exploits should check out the following blog http://www.corelan.be:8800/