Gray Hat C# G r a y H a t C # a Hacker’s Guide to Creating and automating Security tools by Brandon Perry San Francisco Gray Hat C#. Copyright © 2017 by Brandon Perry. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN-10: 1-59327-759-8 ISBN-13: 978-1-59327-759-8 Publisher: William Pollock Production Editors: Alison Law and Serena Yang Cover Illustration: Jonny Thomas Interior Design: Octopod Studios Developmental Editors: William Pollock and Jan Cash Technical Reviewer: Brian Rogers Copyeditor: Barton D. Reed Compositor: Susan Glinert Stevens Proofreader: Paula L. Fleming Indexer: BIM Creatives, LLC. For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 245 8th Street, San Francisco, CA 94103 phone: 1.415.863.9900; [email protected] www.nostarch.com Library of Congress Cataloging-in-Publication Data Names: Perry, Brandon, author. Title: Gray hat C# : a hacker's guide to creating and automating security tools / Brandon Perry. Description: San Francisco : No Starch Press, Inc., [2017] Identifiers: LCCN 2017002556 (print) | LCCN 2017005221 (ebook) | ISBN 9781593277598 (pbk.) | ISBN 1593277598 (pbk.) | ISBN 9781593278311 (epub) | ISBN 1593278314 (epub) | ISBN 9781593278328 ( mobi) | ISBN 1593278322 (mobi) Subjects: LCSH: C# (Computer program language) | Automatic control--Computer programs. | Computer security. Classification: LCC QA76.73.C154 P44 2017 (print) | LCC QA76.73.C154 (ebook) | DDC 005.8--dc23 LC record available at https://lccn.loc.gov/2017002556 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. Brief ContentS Foreword by Matt Graeber . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii Chapter 1: C# Crash Course . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Chapter 2: Fuzzing and Exploiting XSS and SQL Injection . . . . . . . . . . . . . . . . . . . . . 15 Chapter 3: Fuzzing SOAP Endpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Chapter 4: Writing Connect-Back, Binding, and Metasploit Payloads . . . . . . . . . . . . . . 81 Chapter 5: Automating Nessus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Chapter 6: Automating Nexpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Chapter 7: Automating OpenVAS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Chapter 8: Automating Cuckoo Sandbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Chapter 9: Automating sqlmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Chapter 10: Automating ClamAV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Chapter 11: Automating Metasploit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Chapter 12: Automating Arachni . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Chapter 13: Decompiling and Reversing Managed Assemblies . . . . . . . . . . . . . . . . . 241 Chapter 14: Reading Offline Registry Hives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 ContentS in De tail FOrewOrd by Matt Graeber xii PreFaCe xvii Why Should I Trust Mono? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xviii Who Is This Book For? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xviii Organization of This Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi A Final Note . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi 1 C# CraSH COurSe 1 Choosing an IDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 A Simple Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Introducing Classes and Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Creating a Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Creating an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Subclassing from an Abstract Class and Implementing an Interface . . . . . . . . . . 5 Tying Everything Together with the Main() Method . . . . . . . . . . . . . . . . . . . . . 7 Running the Main() Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Anonymous Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Assigning a Delegate to a Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Updating the Firefighter Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Creating Optional Arguments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Updating the Main() Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Running the Updated Main() Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Integrating with Native Libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2 FuzzinG and exPLOitinG xSS and SQL injeCtiOn 15 Setting Up the Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Adding a Host-Only Virtual Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Creating the Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Booting the Virtual Machine from the BadStore ISO . . . . . . . . . . . . . . . . . . . . 17 SQL Injections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Cross-Site Scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Fuzzing GET Requests with a Mutational Fuzzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Tainting the Parameters and Testing for Vulnerabilities . . . . . . . . . . . . . . . . . . 23 Building the HTTP Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Testing the Fuzzing Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Fuzzing POST Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Writing a POST Request Fuzzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 The Fuzzing Begins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Fuzzing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Fuzzing JSON . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Setting Up the Vulnerable Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Capturing a Vulnerable JSON Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Creating the JSON Fuzzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Testing the JSON Fuzzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Exploiting SQL Injections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Performing a UNION-Based Exploit by Hand . . . . . . . . . . . . . . . . . . . . . . . . 38 Performing a UNION-Based Exploit Programmatically . . . . . . . . . . . . . . . . . . 40 Exploiting Boolean-Blind SQL Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . 43 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 3 FuzzinG SOaP endPOintS 53 Setting Up the Vulnerable Endpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Parsing the WSDL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Creating a Class for the WSDL Document . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Writing the Initial Parsing Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Writing a Class for the SOAP Type and Parameters . . . . . . . . . . . . . . . . . . . 58 Creating the SoapMessage Class to Define Sent Data . . . . . . . . . . . . . . . . . . 60 Implementing a Class for Message Parts . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Defining Port Operations with the SoapPortType Class . . . . . . . . . . . . . . . . . . 62 Implementing a Class for Port Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Defining Protocols Used in SOAP Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Compiling a List of Operation Child Nodes . . . . . . . . . . . . . . . . . . . . . . . . . 65 Finding the SOAP Services on Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Automatically Fuzzing the SOAP Endpoint for SQL Injection Vulnerabilities . . . . . . . . . . 68 Fuzzing Individual SOAP Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Fuzzing the HTTP POST SOAP Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Fuzzing the SOAP XML Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Running the Fuzzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 4 writinG COnneCt-BaCk, BindinG, and MetaSPLOit PayLOadS 81 Creating a Connect-Back Payload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 The Network Stream . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Running the Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Running the Payload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Binding a Payload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Accepting Data, Running Commands, and Returning Output . . . . . . . . . . . . . 86 Executing Commands from the Stream . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Using UDP to Attack a Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 The Code for the Target’s Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 The Attacker’s Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Running x86 and x86-64 Metasploit Payloads from C# . . . . . . . . . . . . . . . . . . . . . . . 94 Setting Up Metasploit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Generating Payloads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 viii Contents in Detail