KoreLogic 2011 Crack Me If You Can

Due to a lot of family-type things happening around the BlackHat/Defcon/CCC dates I have been unable to attend. Usually it's work that precludes the "having fun in 120 degree Las Vegas weather."

Thankfully KoreLogic has given non-attendees the chance to play in their "Crack Me If You Can" game for Defcon! Hooray! 48 hours of unadulterated power consuming, hash generating, text file management, pgp encrypting and general usage of unused computing cycles!

This year I decided to devote a few hours to this contest while the wife and baby sleep. I'll be writing some updates as I get some time on how things are going. It's now been a little over an hour since I started so here's where things stand.

On Your Mark
Pre-registration involved generating a PGP key (if you didn't already have one) and sending it off to KoreLogic's scoring server for verification. This was easy if you've spent any time doing encrypted communication exchanges.

Get Set
While I waited for the contest to start I made sure I had all my tools and systems ready. This would be the chance to help prove out the expenditure of NVidia GTX580 cards, high-end CPUs, RAID disk space, etc. Since I'm running in an even shorter timeframe (and smaller team size... of one!) early preparation was key.

Tools I planned on using:

• John the Ripper, latest jumbo patches and GPU patches if time and code permitted
• The oclHashCat suite
• Misc rainbowtables collected over the years
• Misc wordlists collected over the years

GO!

Molly wakes me up at 5:50am on Friday morning for her regular feeding... 20 minutes of extra sleep! I check my e-mail and am excited to see the encrypted contest e-mails in my inbox. A quick pgp decryption and the URLs to download are shown. Hooray!

Oops, based on the CMIYC twitter feed they had generated some weak hashes. Use the two files instead of the first one. Ok!

Down they come with wget.... Hmm, zip files. No problem! Take a peek with 'unzip -v' and the contents look pretty good. Time to get rolling...

~/korelogic-2011/test$ unzip ../2011-CrackMeIfYouCan_part1.zip  

Archive:  ../2011-CrackMeIfYouCan_part1.zip

   creating: contest_tree/challenge1/

[../2011-CrackMeIfYouCan_part1.zip] contest_tree/challenge1/challenge1.zip password: 

Oh. Of course it's going to be password protected. But it's pretty easy to guess if you take a step back and think about it.

Two hours in...

4066 password hashes cracked, 123780 left

A long way to go still... Right now I'm basically not caring about the scoring points and going after "low-hanging passwords" using a very large dictionary, JTR's stock rules and patience. Some high scoring hashes may be cracking, I don't really know right now.. Time to feed the baby again.

Where's grutz?

I've been very busy with a number of things and haven't been able to focus on fun things to share. Work work work work work! This year MacWorld did finally manage to fix their issue so no free platinum passes using the same, tired exploit! Squirtle has been put on the backburner for now and valentines day is right around the corner. Too bad I'm not Cupid... and I'm filled with hatred and rage!



Here's to hoping your 2009 is a great one. Happy Chinese New Year!

Squirtle and MS08-068

HD Moore already did some great analysis on how the MS08-068 patch affected the SMB Relay attacks within Metasploit. The answer?

You can't attack the source workstation/server if MS08-068 has been applied.

This ONLY affects Squirtle if your evil agent attempts to communicate back to the victim. It should not impact attacking their IMAP, HTTP or File/Print servers.

As always the goal of Squirtle is to permit others to extend their own tools to permit the use of authentication requests from controlled browsers and at your own time or when the right users click on your evil link!

Have fun with the latest updates and thanks to Natron for pointing me towards HD's analysis.

Squirtle Updates: IMAP, Metasploit integration complete

I just gave a talk to everyone here at DeepSec 08. Other than the weather being a bit cold and wet Vienna is awesome. Everyone seems happy to be at this conference and to share and network with each other. It's always fun giving the Squirtle talk to new audiences and see their eyes light up as they start to get why this attack matters to their environments or how they could use it on a client's penetration test.

With the conclusion of this talk I'm happy to announce that two new evil agent updates have been completed!

• IMAP Mirroring! Download a victim's entire IMAP directory! Use social engineering, have the help desk e-mail them a new password!
  
• Metasploit integration! SMB Relay an enterprise's server farm with Squirtle!
  

Get the latest updates from the Squirtle SVN at http://squirtle.googlecode.com/. The MSF update is a patch against the as-of-writing-this MSF 3.2-current SVN code. If things change I'll try to keep it updated. Not sure if this is "MSF-code worthy" as it uses the JSON ruby gem vs processing the result manually. I had the library installed, didn't want to write my own parser. :P

On Nov 11th MSRC posted some information on MS08-068 implementing some changes to the NTLM protocol to neuter the SMB Relay attack and possibly (but not mentioned) Squirtle as well. I haven't had a chance to play with yet as I didn't want to possibly spoil the live demos so close to DeepSec. It's nearly time to spend the evening at Metalab so more information as it develops (I promise!)

Big thanks to everyone here at DeepSec for coordinating this one-of-kind conference. Vienna is such a beautiful place to visit, I only wish it would be earlier in the season when it's not so cold and dreary outside. I hope to come next year for DeepSec 09!

Also, look for my ugly mug to make an appearance on Help Net Security soon. It's a brief plea on using Squirtle and hopefully my excitement over reaching more people isn't too transparent. :)

Upcoming Speaking Gigs

Tying a neat little bow to my NTLM/HTTP research I'll be presenting "One XSS to Rule The Enterprise" at ToorCon X the end of September and "NTLM SSO Weaknesses" at DeepSec in November. Both talks will show off the Squirtle Attack Toolkit. Hopefully I'll have some of the updates I didn't get into the DefCon release ready by ToorCon!

When friends ask "should I go to Defcon?" I always respond "Hey, check out ToorCon. It's in a nicer climate!" Vegas in July? Pfft, San Diego in September! One of the best conventions out there, period. Just check out the conference lineup!

Passing The Dutchie @ Defcon 16

Like many things with this blog, I don't prioritize it above things like hanging out with my girlfriend, going to work, sleeping, breaking my iPhone, losing all my Defcon pictures, etc.

Last weekend was Defcon 16. I had a really great time speaking to a packed house on the death of NTLM. Slides, slide video and source code to Squirtle are now available for your pleasure. I'll be doing some more work and documentation on Squirtle shortly.

A few quick changes were made to the slide deck from what was presented (and the slides on the CD are waaaaaay something different :). Mostly added NTLM Signing as a mitigation and correctly stating that JoMoKun did the Samba Pass-The-Hash modifications. Sorry!

More updates coming.

NTLM is Dead: Defcon 16

Friday, August 8th @ 2pm. Come learn how to own an enterprise with one XSS!

Slides and other material will be on-line after Defcon. Source code available here