Gray Hat C: Creating and Automating Security Tools

264 Pages·2017·3.153 MB·English

by  Brandon Perry

Gray Hat C#
A Hacker’s Guide to Creating and Automating Security
Tools
Brandon Perry
San Francisco
GRAY HAT C#. Copyright © 2017 by Brandon Perry.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the
publisher.
ISBN-10: 1-59327-759-8
ISBN-13: 978-1-59327-759-8
Publisher: William Pollock
Production Editors: Alison Law and Serena Yang
Cover Illustration: Jonny Thomas
Interior Design: Octopod Studios
Developmental Editors: William Pollock and Jan Cash
Technical Reviewer: Brian Rogers
Copyeditor: Barton D. Reed
Compositor: Susan Glinert Stevens
Proofreader: Paula L. Fleming
Indexer: BIM Creatives, LLC.
For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
245 8th Street, San Francisco, CA 94103
phone: [phone]; [email protected]
www.nostarch.com
Library of Congress Cataloging-in-Publication Data
Names: Perry, Brandon, author.
Title: Gray hat C# : a hacker's guide to creating and automating security tools / Brandon Perry.
Description: San Francisco : No Starch Press, Inc., [2017]
Identifiers: LCCN 2017002556 (print) | LCCN 2017005221 (ebook) | ISBN
9781593277598 (pbk.) | ISBN 1593277598 (pbk.) | ISBN 9781593278311 (epub)
| ISBN 1593278314 (epub) | ISBN 9781593278328 (mobi) | ISBN 1593278322
(mobi)
Subjects: LCSH: C# (Computer program language) | Automatic control--Computer
programs. | Computer security.
Classification: LCC QA76.73.C154 P44 2017 (print) | LCC QA76.73.C154 (ebook)
| DDC 005.8--dc23
LC record available at https://lccn.loc.gov/2017002556
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names
mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a
trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of
this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage
caused or alleged to be caused directly or indirectly by the information contained in it.
BRIEF CONTENTS
Foreword by Matt Graeber
Preface
Chapter 1: C# Crash Course
Chapter 2: Fuzzing and Exploiting XSS and SQL Injection
Chapter 3: Fuzzing SOAP Endpoints
Chapter 4: Writing Connect-Back, Binding, and Metasploit Payloads
Chapter 5: Automating Nessus
Chapter 6: Automating Nexpose
Chapter 7: Automating OpenVAS
Chapter 8: Automating Cuckoo Sandbox
Chapter 9: Automating sqlmap
Chapter 10: Automating ClamAV
Chapter 11: Automating Metasploit
Chapter 12: Automating Arachni
Chapter 13: Decompiling and Reversing Managed Assemblies
Chapter 14: Reading Offline Registry Hives
Index
CONTENTS IN DETAIL
FOREWORD by Matt Graeber
PREFACE
Why Should I Trust Mono?
Who Is This Book For?
Organization of This Book
Acknowledgments
A Final Note
1
C# CRASH COURSE
Choosing an IDE
A Simple Example
Introducing Classes and Interfaces
Creating a Class
Creating an Interface
Subclassing from an Abstract Class and Implementing an Interface
Tying Everything Together with the Main() Method
Running the Main() Method
Anonymous Methods
Assigning a Delegate to a Method
Updating the Firefighter Class
Creating Optional Arguments
Updating the Main() Method
Running the Updated Main() Method
Integrating with Native Libraries
Conclusion
2
FUZZING AND EXPLOITING XSS AND SQL INJECTION
Setting Up the Virtual Machine
Adding a Host-Only Virtual Network
Creating the Virtual Machine
Booting the Virtual Machine from the BadStore ISO
SQL Injections
Cross-Site Scripting
Fuzzing GET Requests with a Mutational Fuzzer
Tainting the Parameters and Testing for Vulnerabilities
Building the HTTP Requests
Testing the Fuzzing Code
Fuzzing POST Requests
Writing a POST Request Fuzzer
The Fuzzing Begins
Fuzzing Parameters
Fuzzing JSON
Setting Up the Vulnerable Appliance
Capturing a Vulnerable JSON Request
Creating the JSON Fuzzer
Testing the JSON Fuzzer
Exploiting SQL Injections
Performing a UNION-Based Exploit by Hand
Performing a UNION-Based Exploit Programmatically
Exploiting Boolean-Blind SQL Vulnerabilities
Conclusion
3
FUZZING SOAP ENDPOINTS
Setting Up the Vulnerable Endpoint
Parsing the WSDL
Creating a Class for the WSDL Document
Writing the Initial Parsing Methods
Writing a Class for the SOAP Type and Parameters
Creating the SoapMessage Class to Define Sent Data
Implementing a Class for Message Parts
Defining Port Operations with the SoapPortType Class
Implementing a Class for Port Operations
Defining Protocols Used in SOAP Bindings
Compiling a List of Operation Child Nodes
Finding the SOAP Services on Ports
Automatically Fuzzing the SOAP Endpoint for SQL Injection Vulnerabilities
Fuzzing Individual SOAP Services
Fuzzing the HTTP POST SOAP Port
Fuzzing the SOAP XML Port
Running the Fuzzer
Conclusion
4
WRITING CONNECT-BACK, BINDING, AND METASPLOIT PAYLOADS
Creating a Connect-Back Payload
The Network Stream
Running the Command
Running the Payload
Binding a Payload
Accepting Data, Running Commands, and Returning Output
Executing Commands from the Stream
Using UDP to Attack a Network
The Code for the Target’s Machine
The Attacker’s Code
Running x86 and x86-64 Metasploit Payloads from C#
Setting Up Metasploit
Generating Payloads
Executing Native Windows Payloads as Unmanaged Code
Executing Native Linux Payloads
Conclusion
5
AUTOMATING NESSUS
REST and the Nessus API
The NessusSession Class
Making the HTTP Requests
Logging Out and Cleaning Up
Testing the NessusSession Class
The NessusManager Class
Performing a Nessus Scan
Conclusion
6
AUTOMATING NEXPOSE
Installing Nexpose
Activation and Testing
Some Nexpose Parlance
The NexposeSession Class
The ExecuteCommand() Method
Logging Out and Disposing of Our Session
Finding the API Version
Driving the Nexpose API
The NexposeManager Class
Automating a Vulnerability Scan
Creating a Site with Assets
Starting a Scan
Creating a PDF Site Report and Deleting the Site
Putting It All Together
Starting the Scan
Generating a Report and Deleting the Site
Running the Automation
Conclusion
7
AUTOMATING OPENVAS
Installing OpenVAS
Building the Classes
The OpenVASSession Class
Authenticating with the OpenVAS Server
Creating a Method to Execute OpenVAS Commands
Reading the Server Message
Setting Up the TCP Stream to Send and Receive Commands
Certificate Validation and Garbage Collection
Getting the OpenVAS Version
The OpenVASManager Class
Getting Scan Configurations and Creating Targets
Wrapping Up the Automation
Running the Automation
Conclusion
8
AUTOMATING CUCKOO SANDBOX
Setting Up Cuckoo Sandbox
Manually Running the Cuckoo Sandbox API
Starting the API
Checking Cuckoo’s Status
Creating the CuckooSession Class
Writing the ExecuteCommand() Methods to Handle HTTP Requests
Creating Multipart HTTP Data with the GetMultipartFormData() Method
Processing File Data with the FileParameter Class
Testing the CuckooSession and Supporting Classes
Writing the CuckooManager Class
Writing the CreateTask() Method
The Task Details and Reporting Methods
Creating the Task Abstract Class
Sorting and Creating Different Class Types
Putting It Together
Testing the Application
Conclusion
9
AUTOMATING SQLMAP
Running sqlmap
The sqlmap REST API
Testing the sqlmap API with curl
Creating a Session for sqlmap
Creating a Method to Execute a GET Request
Executing a POST Request
Testing the Session Class
The SqlmapManager Class
Listing sqlmap Options
Making a Method to Perform Scans
The New Main() Method
Reporting on a Scan
Automating a Full sqlmap Scan
Integrating sqlmap with the SOAP Fuzzer
Adding sqlmap GET Request Support to the SOAP Fuzzer
Adding sqlmap POST Request Support
Calling the New Methods
Conclusion
10
AUTOMATING CLAMAV
Installing ClamAV
The ClamAV Native Library vs. the clamd Network Daemon
Automating with ClamAV’s Native Library
Setting Up the Supporting Enumerations and Classes
Accessing ClamAV’s Native Library Functions
Compiling the ClamAV Engine
Scanning Files
Cleaning Up
Testing the Program by Scanning the EICAR File
Automating with clamd
Installing the clamd Daemon
Starting the clamd Daemon
Creating a Session Class for clamd
Creating a clamd Manager Class
Testing with clamd
Conclusion
11
AUTOMATING METASPLOIT
Running the RPC Server
Installing Metasploitable
Getting the MSGPACK Library
Installing the NuGet Package Manager for MonoDevelop
Installing the MSGPACK Library
Referencing the MSGPACK Library
Writing the MetasploitSession Class
Creating the Execute() Method for HTTP Requests and Interacting with MSGPACK
Transforming Response Data from MSGPACK
Testing the session Class
Writing the MetasploitManager Class
Putting It All Together
Running the Exploit
Interacting with the Shell
Popping Shells
Conclusion
12
AUTOMATING ARACHNI
Installing Arachni
The Arachni REST API
Creating the ArachniHTTPSession Class
Creating the ArachniHTTPManager Class
Putting the Session and Manager Classes Together
The Arachni RPC
Manually Running the RPC
The ArachniRPCSession Class
The Supporting Methods for ExecuteCommand()
The ExecuteCommand() Method
The ArachniRPCManager Class
Putting It All Together
Conclusion
13
DECOMPILING AND REVERSING MANAGED ASSEMBLIES
Decompiling Managed Assemblies
Testing the Decompiler
Using monodis to Analyze an Assembly
Conclusion