book

Security Warrior

by Cyrus Peikari, Anton Chuvakin

January 2004

Intermediate to advanced

552 pages

16h 56m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Security Warrior
Dedication
A Note Regarding Supplemental Files
Preface
Organization of This BookPart I: Software CrackingPart II: Network StalkingPart III: Platform AttacksPart IV: Advanced DefensePart V: AppendixConventions Used in This BookUsing Code ExamplesComments and QuestionsAcknowledgments
I. Software Cracking
1. Assembly Language
1.1. Registers1.1.1. Understanding the Stack1.1.2. Addressing1.2. ASM Opcodes1.3. References
2. Windows Reverse Engineering
2.1. History of RCE2.2. Reversing Tools2.2.1. Hex Editors2.2.2. Disassemblers2.2.3. Debuggers2.2.4. System Monitors2.2.5. Unpackers2.2.5.1. The PE file format2.2.5.2. ProcDump2.2.6. Personal Firewalls2.2.7. Install Managers2.3. Reverse Engineering Examples2.3.1. Example 1: A Sample Crackme2.3.2. Example 2: Reversing Malicious Code2.4. References
3. Linux Reverse Engineering
3.1. Basic Tools and Techniques3.1.1. Overview of the Target3.1.2. Debugging3.1.3. Runtime Monitoring3.1.4. Disassembly3.1.5. Hex Dumps3.2. A Good Disassembly3.2.1. Identifying Functions3.2.2. Intermediate Code Generation3.2.3. Program Control Flow3.3. Problem Areas3.3.1. Antidebugging3.3.2. Antidisassembly3.4. Writing New Tools3.4.1. The ELF File Format3.4.1.1. Sample ELF reader3.4.2. Debugging with ptrace3.4.3. The GNU BFD Library3.4.4. Disassembling with libopcodes3.5. References
4. Windows CE Reverse Engineering
4.1. Windows CE Architecture4.1.1. Processors4.1.2. Kernel, Processes, and Threads4.1.3. Memory Architecture4.1.4. Graphics, Windowing, and Event Subsystem (GWES)4.2. CE Reverse Engineering Fundamentals4.2.1. The ARM Processor4.2.2. ARM Opcodes4.2.2.1. Branch (B)4.2.2.2. Branch with Link (BL)4.2.2.3. Move (MOV)4.2.2.4. Compare (CMP)4.2.2.5. Load/Store (LDR/STR)4.2.2.6. Shifting4.3. Practical CE Reverse Engineering4.3.1. Hello, World!4.3.2. CE Cracking Techniques4.3.2.1. Predictable system calls4.3.2.2. strlen and wcslen4.3.2.3. strcmp and CMP4.3.2.4. NOP sliding4.3.3. Disassembling a CE Program4.3.3.1. Loading the file4.3.4. Microsoft’s eMbedded Visual Tools4.3.5. Using the MVT4.3.6. Experiencing the MVC Environment4.3.7. Reverse Engineering test.exe4.4. Reverse Engineering serial.exe4.4.1. Overview4.4.1.1. Loading the target4.4.1.2. Debugging serial.exe4.4.2. Step-Through Investigation4.4.3. Abusing the System4.4.4. The Cracks4.4.4.1. Crack 1: Sleight of hand4.4.4.2. Crack 2: The NOP slide4.4.4.3. Crack 3: Preventive maintenance4.5. References
5. Overflow Attacks
5.1. Buffer Overflows5.1.1. A Sample Overflow5.2. Understanding Buffers5.3. Smashing the Stack5.4. Heap Overflows5.5. Preventing Buffer Overflows5.5.1. Automated Source-Code Checking5.5.2. Compiler Add-Ons5.5.3. Miscellaneous Protection Methods5.6. A Live Challenge5.7. References

II. Network Stalking
6. TCP/IP Analysis
6.1. A Brief History of TCP/IP6.2. Encapsulation6.3. TCP6.3.1. TCP Features6.3.2. TCP Packet Field Descriptions6.4. IP6.4.1. IP Packet Format6.5. UDP6.6. ICMP6.7. ARP6.8. RARP6.9. BOOTP6.10. DHCP6.11. TCP/IP Handshaking6.12. Covert Channels6.13. IPv66.13.1. Features of IPv66.13.2. IPv6 Addressing6.13.3. Security Aspects of IPv66.14. Ethereal6.15. Packet Analysis6.16. Fragmentation6.16.1. Fragmentation Variables6.16.2. Exploiting Fragments6.16.3. Fragmenting with Nmap6.16.4. hping6.16.5. Fragroute6.17. References
7. Social Engineering
7.1. Background7.1.1. Less Elite, More Effective7.1.2. Common Misconceptions7.2. Performing the Attacks7.2.1. Active and Passive Attacks7.2.1.1. Sample 1: Impersonation7.2.1.2. Sample 2: Impersonation and authority7.2.1.3. Sample 3: Blackmail7.2.1.4. Sample 4: Sympathy7.2.2. Preparing for an Attack7.2.3. Social Engineering Action Plan7.2.4. Social Engineering Information Collection Template7.3. Advanced Social Engineering7.4. References
8. Reconnaissance
8.1. Online Reconnaissance8.1.1. Passive Reconnaissance8.1.1.1. Utilities8.1.1.2. Web reconnaissance8.1.2. Active Reconnaissance8.1.2.1. Email8.1.2.2. Web site analysis8.1.2.3. FTP8.1.2.4. A word on stealth8.1.2.5. Human reconnaissance8.2. Conclusion8.3. References
9. OS Fingerprinting
9.1. Telnet Session Negotiation9.2. TCP Stack Fingerprinting9.2.1. Nmap Test9.2.2. Nmap Techniques9.2.3. Defeating Nmap9.3. Special-Purpose Tools9.4. Passive Fingerprinting9.5. Fuzzy Operating System Fingerprinting9.5.1. Obstacles to Fingerprinting9.5.2. Fuzzy Solution to Operating System Fingerprinting9.6. TCP/IP Timeout Detection9.7. References
10. Hiding the Tracks
10.1. From Whom Are You Hiding?10.2. Postattack Cleanup10.2.1. System Logs10.2.1.1. The exploit attempt itself10.2.1.2. The attacker’s accesses before the exploit10.2.1.3. Erasing logfiles10.2.2. Application Logs10.2.3. Unix Shell History10.2.4. Unix Binary Logs10.2.5. Other Records10.3. Forensic Tracks10.3.1. File Traces10.3.2. Timestamps10.3.2.1. Countermeasures10.4. Maintaining Covert Access10.4.1. Hiding10.4.2. Hidden Access10.5. References
III. Platform Attacks
11. Unix Defense
11.1. Unix Passwords11.2. File Permissions11.2.1. Attributes and Capabilities11.3. System Logging11.4. Network Access in Unix11.4.1. TCP Wrappers11.4.2. NFS/NIS11.4.3. Backups11.4.4. X Window System11.5. Unix Hardening11.5.1. Hardening Areas11.5.1.1. Checking installed software11.5.1.2. Patching the system11.5.1.3. Filesystem permissions11.5.1.4. Login security11.5.1.5. User security11.5.1.6. Physical security11.5.1.7. Network security11.5.1.8. Daemon security11.5.1.9. System logging and accounting11.5.2. Automated Hardening via Scripts11.5.2.1. Linux Bastille11.5.2.2. Kernel-level hardening11.5.2.3. Pitbull11.5.2.4. Openwall kernel patch11.5.2.5. LIDS11.5.2.6. “Secure Unix”11.5.2.7. Encrypted filesystems11.6. Unix Network Defense11.6.1. Advanced TCP Wrappers11.6.1.1. tcpd11.6.1.2. libwrap11.6.2. Application-Specific Access Controls11.6.2.1. BIND (DNS daemon)11.6.2.2. sendmail (some versions)11.6.2.3. SSH daemon (sshd)11.6.2.4. Apache web server11.6.3. System Configuration Changes11.6.3.1. Security from eavesdropping11.6.3.2. Secure Shell11.6.4. Host-Based Firewalls11.6.4.1. Linux iptables and ipchains11.7. References
12. Unix Attacks
12.1. Local Attacks12.1.1. Physical Abuses12.1.2. Boot Prompt Attacks12.1.3. Boot Interrupt12.1.4. Screensaver Attacks12.1.5. Path Abuse12.1.6. Password Attacks12.1.7. SUID Abuse12.1.8. /tmp and Symlink/Hardlink Abuse12.1.9. Breaking Out of chroot Jail12.2. Remote Attacks12.2.1. TCP12.2.2. UDP12.2.3. Top Unix Vulnerabilities12.3. Unix Denial-of-Service Attacks12.3.1. Local Attacks12.3.1.1. Destruction of resources12.3.1.2. Resource exhaustion12.3.1.3. Filling kernel data structures12.3.2. Network Attacks12.3.3. Distributed Denial-of-Service Attacks12.3.3.1. Coordinated and reflexive denial-of-service attacks12.3.3.2. Application-level denial-of-service attacks12.4. References
13. Windows Client Attacks
13.1. Denial-of-Service Attacks13.1.1. SMB Attack13.1.2. Universal Plug and Play Attack13.1.3. Help Center Attack13.2. Remote Attacks13.3. Remote Desktop/Remote Assistance13.3.1. Abusing the Remote Desktop13.3.1.1. tscrack13.3.2. Abusing Remote Assistance13.4. References
14. Windows Server Attacks
14.1. Release History14.2. Kerberos Authentication Attacks14.3. Kerberos Authentication Review14.3.1. Accessing Cross-Domain Network Resources14.3.2. Weaknesses in the Kerberos Protocol14.3.2.1. Vulnerability14.3.2.2. Obtaining the password-verification material14.3.2.3. Decrypting the timestamp14.4. Defeating Buffer Overflow Prevention14.5. Active Directory Weaknesses14.6. Hacking PKI14.7. Smart Card Hacking14.7.1. Smart Card Advantages14.7.2. Hardware Reverse Engineering14.7.3. EEPROM Trapping14.7.4. Power Consumption Analysis14.8. Encrypting File System Changes14.8.1. Background14.8.2. User Interaction14.8.3. Data Recovery on Standalone Machines14.9. Third-Party Encryption14.9.1. Summary of Functionality14.9.2. One-Time Password14.9.3. Local and Corporate Administrator Recovery14.9.4. Authenti-Check Self-Service Password Reset Tool14.9.5. User Program Configuration Options14.9.6. Network Installation and Updating of User Programs14.9.7. Single Sign-On14.10. References
15. SOAP XML Web Services Security
15.1. XML Encryption15.2. XML Signatures15.3. Reference
16. SQL Injection
16.1. Introduction to SQL16.1.1. SQL Commands16.1.2. Use of SQL16.2. SQL Injection Attacks16.2.1. Attack Types16.2.1.1. Unauthorized data access16.2.1.2. Authentication bypass16.2.1.3. Database modification16.2.1.4. Escape from a database16.2.2. Looking for Errors16.3. SQL Injection Defenses16.3.1. Obfuscation Defenses16.3.2. External Defenses16.3.3. Coding Defenses16.3.4. Conclusion16.4. PHP-Nuke Examples16.4.1. Installing PHP-Nuke16.4.2. Attacks16.4.3. Defenses16.5. References
17. Wireless Security
17.1. Reducing Signal Drift17.2. Problems with WEP17.3. Cracking WEP17.3.1. Data Analysis17.3.2. Wireless Sniffing17.3.2.1. Extracting the keystream17.3.3. IV Collision17.4. Practical WEP Cracking17.5. VPNs17.5.1. RADIUS17.6. TKIP17.7. SSL17.8. Airborne Viruses17.8.1. Embedded Malware Countermeasures17.9. References
IV. Advanced Defense
18. Audit Trail Analysis
18.1. Log Analysis Basics18.2. Log Examples18.2.1. Unix18.2.1.1. Analysis of Unix logging18.2.2. Windows18.2.3. Remote Covert Logging18.2.4. Other Logging Variations18.3. Logging States18.4. When to Look at the Logs18.5. Log Overflow and Aggregation18.6. Challenge of Log Analysis18.7. Security Information Management18.8. Global Log Aggregation18.9. References
19. Intrusion Detection Systems
19.1. IDS Examples19.1.1. Host IDSs19.1.1.1. Logfile monitors19.1.1.2. Integrity monitors19.1.2. Network IDSs19.1.2.1. Signature matchers19.1.2.2. Anomaly detectors19.2. Bayesian Analysis19.2.1. Sensitivity Versus Specificity19.2.1.1. Sensitivity19.2.1.2. Specificity19.2.1.3. Accuracy19.2.2. Positive and Negative Predictive Values19.2.3. Likelihood Ratios19.3. Hacking Through IDSs19.3.1. Fragmentation19.3.2. Spoofing19.3.3. Protocol Mutation19.3.4. Attacking Integrity Checkers19.4. The Future of IDSs19.4.1. Embedded IDS19.4.2. Strict Anomaly Detection19.4.3. Host- Versus Network-Based IDSs19.4.4. Visual Display of Data19.5. Snort IDS Case Study19.5.1. System Setup19.5.2. Alert Viewing Setup19.5.3. IDS Rule Tuning19.6. IDS Deployment Issues19.7. References
20. Honeypots
20.1. Motivation20.2. Building the Infrastructure20.2.1. Procedure20.2.1.1. Preparation20.2.1.2. Infrastructure systems installation20.2.1.3. Victim machine installation20.2.1.4. Final steps20.3. Capturing Attacks20.4. References
21. Incident Response
21.1. Case Study: Worm Mayhem21.2. Definitions21.3. Incident Response Framework21.3.1. Preparation21.3.2. Identification21.3.3. Containment21.3.4. Eradication21.3.5. Recovery21.3.6. Follow-Up21.3.6.1. Benefits of the SANS framework21.4. Small Networks21.5. Medium-Sized Networks21.6. Large Networks21.6.1. Incident Identification21.6.2. Aggressive Response21.6.3. Recovery21.7. References
22. Forensics and Antiforensics
22.1. Hardware Review22.1.1. Hard Drives22.1.2. RAM22.2. Information Detritus22.3. Forensics Tools22.3.1. WinHex22.4. Bootable Forensics CD-ROMs22.4.1. Biatchux/FIRE22.4.2. ForensiX22.5. Evidence Eliminator22.5.1. Swap Files22.5.2. Temporary Files22.5.3. Windows Registry Streams22.5.4. Clipboard22.5.5. Chat Logs22.5.6. Browser Garbage (Internet Explorer)22.5.7. Options for Netscape Navigator Users22.5.7.1. Setting up Netscape paths22.6. Forensics Case Study: FTP Attack22.6.1. Introduction22.6.2. The Investigation22.7. References
V. Appendix
A. Useful SoftICE Commands and Breakpoints
A.1. SoftICE CommandsA.2. BreakpointsA.2.1. GeneralA.2.1.1. Time-relatedA.2.1.2. Disk accessA.2.1.3. File-relatedA.2.1.4. INI files-relatedA.2.1.5. Registry-related
About the Authors
Colophon
Copyright

Content preview from Security Warrior

Chapter 14. Windows Server Attacks

Windows Server is Microsoft’s contender against Unix in the server market. Windows .NET Server versions (e.g., Windows 2003 Server) were re-engineered from the Windows 2000 Server code base. As Bill Gates himself implied in his notorious “Trustworthy Computing” memo, the success of Windows Server depends on how users perceive its security.

We have written a separate book, Windows .NET Server Security Handbook (Prentice Hall, 2002), detailing the complete security architecture and defense of Windows Server. Instead of repeating that information here, we instead provide a new approach to learning the material. In this chapter, we actually show you how to break Windows 2000 Server and Windows 2003 Server security, using known or theoretical vulnerabilities in the operating system.

Although not specific to the operating system itself, we also use this chapter to discuss potential weaknesses in Windows Server security implementations. The goal is to help you think outside the box, like an attacker. (Where possible, we also show defenses or countermeasures to attacks.) The purpose of this is to help you integrate Windows Server into your security policy.

Release History

Originally scheduled for release in 2001, Windows 2003 Server was delayed several times, mostly for “security reasons” (according to Microsoft). Consider the following timeline of the Windows Server pre-release history:

Original codename: Whistler
Original expected release: late 2001
Original ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0596005458Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Security Warrior

by Cyrus Peikari, Anton Chuvakin

Chapter 14. Windows Server Attacks

Release History

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.