Kevin Burns

WP_Query Object
(
    [query] => Array
        (
            [post_type] => Array
                (
                    [0] => post
                    [1] => webinars
                )

            [posts_per_page] => -1
            [post_status] => publish
            [meta_query] => Array
                (
                    [relation] => OR
                    [0] => Array
                        (
                            [key] => new_authors
                            [value] => "11"
                            [compare] => LIKE
                        )

                    [1] => Array
                        (
                            [key] => new_presenters
                            [value] => "11"
                            [compare] => LIKE
                        )

                )

        )

    [query_vars] => Array
        (
            [post_type] => Array
                (
                    [0] => post
                    [1] => webinars
                )

            [posts_per_page] => -1
            [post_status] => publish
            [meta_query] => Array
                (
                    [relation] => OR
                    [0] => Array
                        (
                            [key] => new_authors
                            [value] => "11"
                            [compare] => LIKE
                        )

                    [1] => Array
                        (
                            [key] => new_presenters
                            [value] => "11"
                            [compare] => LIKE
                        )

                )

            [error] => 
            [m] => 
            [p] => 0
            [post_parent] => 
            [subpost] => 
            [subpost_id] => 
            [attachment] => 
            [attachment_id] => 0
            [name] => 
            [pagename] => 
            [page_id] => 0
            [second] => 
            [minute] => 
            [hour] => 
            [day] => 0
            [monthnum] => 0
            [year] => 0
            [w] => 0
            [category_name] => 
            [tag] => 
            [cat] => 
            [tag_id] => 
            [author] => 
            [author_name] => 
            [feed] => 
            [tb] => 
            [paged] => 0
            [meta_key] => 
            [meta_value] => 
            [preview] => 
            [s] => 
            [sentence] => 
            [title] => 
            [fields] => 
            [menu_order] => 
            [embed] => 
            [category__in] => Array
                (
                )

            [category__not_in] => Array
                (
                )

            [category__and] => Array
                (
                )

            [post__in] => Array
                (
                )

            [post__not_in] => Array
                (
                )

            [post_name__in] => Array
                (
                )

            [tag__in] => Array
                (
                )

            [tag__not_in] => Array
                (
                )

            [tag__and] => Array
                (
                )

            [tag_slug__in] => Array
                (
                )

            [tag_slug__and] => Array
                (
                )

            [post_parent__in] => Array
                (
                )

            [post_parent__not_in] => Array
                (
                )

            [author__in] => Array
                (
                )

            [author__not_in] => Array
                (
                )

            [search_columns] => Array
                (
                )

            [ignore_sticky_posts] => 
            [suppress_filters] => 
            [cache_results] => 1
            [update_post_term_cache] => 1
            [update_menu_item_cache] => 
            [lazy_load_term_meta] => 1
            [update_post_meta_cache] => 1
            [nopaging] => 1
            [comments_per_page] => 50
            [no_found_rows] => 
            [order] => DESC
        )

    [tax_query] => WP_Tax_Query Object
        (
            [queries] => Array
                (
                )

            [relation] => AND
            [table_aliases:protected] => Array
                (
                )

            [queried_terms] => Array
                (
                )

            [primary_table] => wp_posts
            [primary_id_column] => ID
        )

    [meta_query] => WP_Meta_Query Object
        (
            [queries] => Array
                (
                    [0] => Array
                        (
                            [key] => new_authors
                            [value] => "11"
                            [compare] => LIKE
                        )

                    [1] => Array
                        (
                            [key] => new_presenters
                            [value] => "11"
                            [compare] => LIKE
                        )

                    [relation] => OR
                )

            [relation] => OR
            [meta_table] => wp_postmeta
            [meta_id_column] => post_id
            [primary_table] => wp_posts
            [primary_id_column] => ID
            [table_aliases:protected] => Array
                (
                    [0] => wp_postmeta
                )

            [clauses:protected] => Array
                (
                    [wp_postmeta] => Array
                        (
                            [key] => new_authors
                            [value] => "11"
                            [compare] => LIKE
                            [compare_key] => =
                            [alias] => wp_postmeta
                            [cast] => CHAR
                        )

                    [wp_postmeta-1] => Array
                        (
                            [key] => new_presenters
                            [value] => "11"
                            [compare] => LIKE
                            [compare_key] => =
                            [alias] => wp_postmeta
                            [cast] => CHAR
                        )

                )

            [has_or_relation:protected] => 1
        )

    [date_query] => 
    [request] => SELECT   wp_posts.ID
					 FROM wp_posts  INNER JOIN wp_postmeta ON ( wp_posts.ID = wp_postmeta.post_id )
					 WHERE 1=1  AND ( 
  ( wp_postmeta.meta_key = 'new_authors' AND wp_postmeta.meta_value LIKE '{4439bc39b431c8550b4138fdf24aa1fd296ecab73d374d028becbe18b8b8568e}\"11\"{4439bc39b431c8550b4138fdf24aa1fd296ecab73d374d028becbe18b8b8568e}' ) 
  OR 
  ( wp_postmeta.meta_key = 'new_presenters' AND wp_postmeta.meta_value LIKE '{4439bc39b431c8550b4138fdf24aa1fd296ecab73d374d028becbe18b8b8568e}\"11\"{4439bc39b431c8550b4138fdf24aa1fd296ecab73d374d028becbe18b8b8568e}' )
) AND wp_posts.post_type IN ('post', 'webinars') AND ((wp_posts.post_status = 'publish'))
					 GROUP BY wp_posts.ID
					 ORDER BY wp_posts.post_date DESC
					 
    [posts] => Array
        (
            [0] => WP_Post Object
                (
                    [ID] => 5889
                    [post_author] => 11
                    [post_date] => 2016-02-23 07:00:35
                    [post_date_gmt] => 2016-02-23 07:00:35
                    [post_content] => 
Directory traversal and local file inclusion bugs are frequently seen in web applications.  Directory traversal is when a server allows an attacker to read a file or directories outside of the normal web server directory.  Local file inclusion allows an attacker the ability to include an arbitrary local file (from the web server) in the web server’s response.  Both of these bugs can be used to read arbitrary files from the server.







In most cases, this means that an attacker can read the /etc/passwd file and the shell history files in order to find information leaks.  However, an attacker can also use this to read the proc file system.  This can provide some interesting insights into what's running on the server.



A few of the more interesting proc entries include:



Directory
Description
/proc/sched_debug
This is usually enabled on newer systems, such as RHEL 6.  It provides information as to what process is running on which cpu.  This can be handy to get a list of processes and their PID number.
/proc/mounts
Provides a list of mounted file systems.  Can be used to determine where other interesting files might be located
/proc/net/arp
Shows the ARP table.  This is one way to find out IP addresses for other internal servers.
/proc/net/route
Shows the routing table information.
/proc/net/tcp and /proc/net/udp
Provides a list of active connections.  Can be used to determine what ports are listening on the server
/proc/net/fib_trie
This is used for route caching.  This can also be used to determine local IPs, as well as gain a better understanding of the target’s networking structure
/proc/version
Shows the kernel version.  This can be used to help determine the OS running and the last time it’s been fully updated.







Each process also has its own set of attributes.  If you have the PID number and access to that process, then you can obtain some useful information about it, such as its environmental variables and any command line options that were run.  Sometimes these include passwords.  Linux also has a special proc directory called self which can be used to query information about the current process without having to know it’s PID.  In the following examples you can replace [PID] with either self or the PID of the process you wish to examine.



Directory
Description
/proc/[PID]/cmdline
Lists everything that was used to invoke the process. This sometimes contains useful paths to configuration files as well as usernames and passwords.
/proc/[PID]/environ
Lists all the environment variables that were set when the process was invoked.  This also sometimes contains useful paths to configuration files as well as usernames and passwords.
/proc/[PID]/cwd
Points to the current working directory of the process.  This may be useful if you don’t know the absolute path to a configuration file.
/proc/[PID]/fd/[#]
Provides access to the file descriptors being used.  In some cases this can be used to read files that are opened by a process.







Combining directory traversal and file inclusion vulnerabilities with the proc file system ends up being a great way to gain access to information relating to the running processes on a Linux system.  For instance, it's possible to locate database servers by looking at the current connections the machine has.  It also makes it easier to fingerprint what software is running on the machines in order to help determine if they are vulnerable to version-specific issues.  It's important not to overlook the proc file system when one of these vulnerabilities are found during a penetration test.

                    [post_title] => Directory Traversal, File Inclusion, and The Proc File System
                    [post_excerpt] => 
                    [post_status] => publish
                    [comment_status] => closed
                    [ping_status] => closed
                    [post_password] => 
                    [post_name] => directory-traversal-file-inclusion-proc-file-system
                    [to_ping] => 
                    [pinged] => 
                    [post_modified] => 2021-06-08 21:46:48
                    [post_modified_gmt] => 2021-06-08 21:46:48
                    [post_content_filtered] => 
                    [post_parent] => 0
                    [guid] => https://netspiblogdev.wpengine.com/?p=5889
                    [menu_order] => 665
                    [post_type] => post
                    [post_mime_type] => 
                    [comment_count] => 0
                    [filter] => raw
                )

            [1] => WP_Post Object
                (
                    [ID] => 1111
                    [post_author] => 11
                    [post_date] => 2014-07-21 07:00:13
                    [post_date_gmt] => 2014-07-21 07:00:13
                    [post_content] => 
If you've ever used SSH keys to manage multiple machines, then chances are you've used SSH-agent. This tool is designed to keep a SSH key in memory so that the user doesn't have to type their passphrase in every time. However, this can create some security risk. A user running as root may have the ability to pull the decrypted SSH key from memory and reconstruct it.



Due to needing root access, this attack may seem useless. For example, an attacker may be able to install a keylogger and use that to obtain the passphrase for the SSH key. However, this causes the attacker to have to wait for the target to type in their passphrase. This might be hours, days, or weeks, depending on how often the target logs out. This is why obtaining the SSH key from memory is vital to pivoting to other machines in a speedy fashion.



Using SSH-agent



A common method of using SSH-agent is running "SSH-agent bash" and then "SSH-add" to add the key to the agent. Once added, the key will stay in the SSH-agent's stack until the process ends, another key is added, or the user uses the -d or -D option with SSH-add. Most people will run this once and then forget about it until they need to reboot.



Pulling a SSH Key From Memory



There are a few ways to create a copy of the SSH-agents memory. The easiest way is through the use of gdb. Gdb uses the ptrace call to attach to the SSH-agent. This provides gdb with the privileges necessary to create a memory dump of the running process. The grabagentmem.sh script provides a way of automating the dumping of this memory. By default, when it runs it will create a memory dump of the stack for each SSH-agent process. These files are named SSHagent-PID.stack.



root@test:/tmp# grabagentmem.sh  Created /tmp/SSHagent-17019.stack 



If gdb is not available on the system, then it might be feasible to take a memory dump of the entire machine and use volatility to extract the stack of the SSH-agent processes. However, this process is currently out of the scope for this document.



Parsing SSH Keys From the Memory Dump



Once we have a copy of the stack it becomes possible to extract the key from this file. However, the key is kept in the stack in a different format then the one that was generated by SSH-keygen. This is where the parse_mem.py script comes in handy. This script requires the installation of the pyasn1 python module. Once that is installed the script can be run against the memory file. If that memory file contains a valid RSA SSH key then it will save it to disk. Future versions of the tool may support additional key formats, such as DSA, ECDSA, ED25519, and RSA1.



root@test:/tmp# parse_mem.py /tmp/SSHagent-17019.stack /tmp/key Found rsa key Creating rsa key: /tmp/key.rsa 



This key.rsa file can then be used as an argument to the -i switch in SSH. This will act like the original user's key, only without requiring a pass phrase to unlock it.



Obtaining valid, usable SSH keys can help a penetration tester gain further access into a client's network. It's common for keys to be used on both the user's account, as well as the root account on servers. It is also possible that a server is configured to only allow key access. Having access to an unencrypted key can make moving around the environment much easier.

                    [post_title] => Stealing unencrypted SSH-agent keys from memory
                    [post_excerpt] => 
                    [post_status] => publish
                    [comment_status] => closed
                    [ping_status] => closed
                    [post_password] => 
                    [post_name] => stealing-unencrypted-ssh-agent-keys-from-memory
                    [to_ping] => 
                    [pinged] => 
                    [post_modified] => 2021-04-13 00:05:55
                    [post_modified_gmt] => 2021-04-13 00:05:55
                    [post_content_filtered] => 
                    [post_parent] => 0
                    [guid] => https://netspiblogdev.wpengine.com/?p=1111
                    [menu_order] => 709
                    [post_type] => post
                    [post_mime_type] => 
                    [comment_count] => 3
                    [filter] => raw
                )

            [2] => WP_Post Object
                (
                    [ID] => 1122
                    [post_author] => 11
                    [post_date] => 2014-04-07 07:00:10
                    [post_date_gmt] => 2014-04-07 07:00:10
                    [post_content] => 
As a penetration tester, I like to avoid replacing binaries on running systems as it makes it more difficult to clean up the system after we're done. Occasionally a tester will come across a Linux server that is used to connect to other internal systems. It would be nice to be able to monitor the SSH sessions without replacing the SSHD daemon. This is where ptrace comes in handy.



Using strace to hook into SSH



The system call ptrace is used to monitor and control another process. It's mostly used by debuggers and programs that map out what another application is doing. One of these applications is strace. Strace connects to another process and prints out all the system calls that the attached process is using. This includes the data that is being sent from a user through SSH.



The SSH client and SSH server use different system calls to read data from the user and show data on the screen. For example, you can read what the user is typing into an SSH client by connecting strace to the process and looking for read(#, "[data]", 16384) system calls. If you attach to an SSH server then you can read what the user is sending by looking for the write(#, "[data]", 1) system calls. The # symbol represents the file descriptor number that SSH is using. This can change based on a number of factors, but should be the same for each SSH process on a system.



# ps -fC sshd UID        PID  PPID  C STIME TTY          TIME CMD root      2734     1  0 10:27 ?        00:00:00 /usr/sbin/sshd root     13909  2734  0 14:05 ?        00:00:00 sshd: root@pts/0 root     13919  2734  0 14:05 ?        00:00:00 sshd: root@pts/1  # strace -p 13909 -e write 2>&1 | egrep "^write(.*1)" write(7, "p", 1)                        = 1 write(7, "a", 1)                        = 1 write(7, "s", 1)                        = 1 write(7, "s", 1)                        = 1 write(7, "w", 1)                        = 1 write(7, "o", 1)                        = 1 write(7, "r", 1)                        = 1 write(7, "d", 1)                        = 1 write(7, "r", 1)                       = 1



We can use awk to make the output a little prettier:



# strace -p 13909 2>&1 | awk '/^write(.*1)/ {gsub(/"/, "");gsub(/,/, "");gsub(/\r/, "\n");sub(/[0-9]*)/," ",$2);sub(/\177/,"b",$2);sub(/\t/,"t",$2);sub(/\3/,"^C",$2);printf $2}' passwordn



Automated strace SSH key logger Python proof of concept



It is possible to automate hooking into new SSH connections using strace and outputting the results to a file. The python code available here can do that. Due to how the python code is parsing the data it will update the log files after a certain amount of bytes are read. While this method isn't that stealthy, it is possible to use exec -a [name] to have strace appear to be a different command in ps and top.



Mitigate ptrace attacks by disabling ptrace



Linux Kernel version 3.4 and above support the ability to limit or disable ptrace altogether. This can be done by using sysctl to set kernel.yama.ptrace_scope to a 1, 2, or 3. By default most distributions set this to 1. According to the Linux Kernel Yama Documentation These numbers map to the following permissions:



0 - Allow non-child processes to ptrace a process



1 - Block non-child processes from ptrace-ing a process



2 - Only processes with CAP_SYS_PTRACE may use it or children calling PTRACE_TRACEME



3 - Disable ptrace. Requires a reboot to change



This makes it possible to disable ptrace on a system by running "sysctl kernel.yama.ptrace_scope=3". However, this may break other programs that are running. Wine, for example, does not work properly with ptrace disabled. I suggest that you test a non-production server and verify that all of its functions can run properly without ptrace enabled. Disabling ptrace also prevents some debugging features.



Conclusion



While ptrace provides useful debugging functionality, in the wrong scenario it can cause security issues. This is why it is important to take a look at what is needed for a server to perform its function and disable any unneeded functionality and services.

                    [post_title] => Using strace to monitor SSH connections on Linux
                    [post_excerpt] => 
                    [post_status] => publish
                    [comment_status] => closed
                    [ping_status] => closed
                    [post_password] => 
                    [post_name] => using-strace-to-monitor-ssh-connections-on-linux
                    [to_ping] => 
                    [pinged] => 
                    [post_modified] => 2021-04-13 00:05:56
                    [post_modified_gmt] => 2021-04-13 00:05:56
                    [post_content_filtered] => 
                    [post_parent] => 0
                    [guid] => https://netspiblogdev.wpengine.com/?p=1122
                    [menu_order] => 719
                    [post_type] => post
                    [post_mime_type] => 
                    [comment_count] => 0
                    [filter] => raw
                )

        )

    [post_count] => 3
    [current_post] => -1
    [before_loop] => 1
    [in_the_loop] => 
    [post] => WP_Post Object
        (
            [ID] => 5889
            [post_author] => 11
            [post_date] => 2016-02-23 07:00:35
            [post_date_gmt] => 2016-02-23 07:00:35
            [post_content] => 
Directory traversal and local file inclusion bugs are frequently seen in web applications.  Directory traversal is when a server allows an attacker to read a file or directories outside of the normal web server directory.  Local file inclusion allows an attacker the ability to include an arbitrary local file (from the web server) in the web server’s response.  Both of these bugs can be used to read arbitrary files from the server.







In most cases, this means that an attacker can read the /etc/passwd file and the shell history files in order to find information leaks.  However, an attacker can also use this to read the proc file system.  This can provide some interesting insights into what's running on the server.



A few of the more interesting proc entries include:



Directory
Description
/proc/sched_debug
This is usually enabled on newer systems, such as RHEL 6.  It provides information as to what process is running on which cpu.  This can be handy to get a list of processes and their PID number.
/proc/mounts
Provides a list of mounted file systems.  Can be used to determine where other interesting files might be located
/proc/net/arp
Shows the ARP table.  This is one way to find out IP addresses for other internal servers.
/proc/net/route
Shows the routing table information.
/proc/net/tcp and /proc/net/udp
Provides a list of active connections.  Can be used to determine what ports are listening on the server
/proc/net/fib_trie
This is used for route caching.  This can also be used to determine local IPs, as well as gain a better understanding of the target’s networking structure
/proc/version
Shows the kernel version.  This can be used to help determine the OS running and the last time it’s been fully updated.







Each process also has its own set of attributes.  If you have the PID number and access to that process, then you can obtain some useful information about it, such as its environmental variables and any command line options that were run.  Sometimes these include passwords.  Linux also has a special proc directory called self which can be used to query information about the current process without having to know it’s PID.  In the following examples you can replace [PID] with either self or the PID of the process you wish to examine.



Directory
Description
/proc/[PID]/cmdline
Lists everything that was used to invoke the process. This sometimes contains useful paths to configuration files as well as usernames and passwords.
/proc/[PID]/environ
Lists all the environment variables that were set when the process was invoked.  This also sometimes contains useful paths to configuration files as well as usernames and passwords.
/proc/[PID]/cwd
Points to the current working directory of the process.  This may be useful if you don’t know the absolute path to a configuration file.
/proc/[PID]/fd/[#]
Provides access to the file descriptors being used.  In some cases this can be used to read files that are opened by a process.







Combining directory traversal and file inclusion vulnerabilities with the proc file system ends up being a great way to gain access to information relating to the running processes on a Linux system.  For instance, it's possible to locate database servers by looking at the current connections the machine has.  It also makes it easier to fingerprint what software is running on the machines in order to help determine if they are vulnerable to version-specific issues.  It's important not to overlook the proc file system when one of these vulnerabilities are found during a penetration test.

            [post_title] => Directory Traversal, File Inclusion, and The Proc File System
            [post_excerpt] => 
            [post_status] => publish
            [comment_status] => closed
            [ping_status] => closed
            [post_password] => 
            [post_name] => directory-traversal-file-inclusion-proc-file-system
            [to_ping] => 
            [pinged] => 
            [post_modified] => 2021-06-08 21:46:48
            [post_modified_gmt] => 2021-06-08 21:46:48
            [post_content_filtered] => 
            [post_parent] => 0
            [guid] => https://netspiblogdev.wpengine.com/?p=5889
            [menu_order] => 665
            [post_type] => post
            [post_mime_type] => 
            [comment_count] => 0
            [filter] => raw
        )

    [comment_count] => 0
    [current_comment] => -1
    [found_posts] => 3
    [max_num_pages] => 0
    [max_num_comment_pages] => 0
    [is_single] => 
    [is_preview] => 
    [is_page] => 
    [is_archive] => 
    [is_date] => 
    [is_year] => 
    [is_month] => 
    [is_day] => 
    [is_time] => 
    [is_author] => 
    [is_category] => 
    [is_tag] => 
    [is_tax] => 
    [is_search] => 
    [is_feed] => 
    [is_comment_feed] => 
    [is_trackback] => 
    [is_home] => 1
    [is_privacy_policy] => 
    [is_404] => 
    [is_embed] => 
    [is_paged] => 
    [is_admin] => 
    [is_attachment] => 
    [is_singular] => 
    [is_robots] => 
    [is_favicon] => 
    [is_posts_page] => 
    [is_post_type_archive] => 
    [query_vars_hash:WP_Query:private] => 14d63f9c885ed0f24452774099c845e4
    [query_vars_changed:WP_Query:private] => 
    [thumbnails_cached] => 
    [allow_query_attachment_by_filename:protected] => 
    [stopwords:WP_Query:private] => 
    [compat_fields:WP_Query:private] => Array
        (
            [0] => query_vars_hash
            [1] => query_vars_changed
        )

    [compat_methods:WP_Query:private] => Array
        (
            [0] => init_query_flags
            [1] => parse_tax_query
        )

)

Technical Blog Web Application Penetration Testing

Directory Traversal, File Inclusion, and The Proc File System

Kevin Burns

February 23, 2016

Technical Blog Network Penetration Testing

Stealing unencrypted SSH-agent keys from memory

Kevin Burns

July 21, 2014

Technical Blog Network Penetration Testing

Using strace to monitor SSH connections on Linux

Kevin Burns

April 7, 2014