https://pastebin.com/raw/Y1yf8kq0
正文
|
|
==========================================================================
–[1: Introduction]——————————————————-
Hello, all!
Since FlexiSpy burnt their entire network driving us out, we think it’s
time for us to release our HowTo guide for aspiring hackers, about what we
did, and how you can do it, too.
This is going out there to help people learn how to hack and how to defend
themselves, as is traditional after these types of hacks.
There are lots of articles out there written by other talented
hackers that would serve as excellent introductions, but we’d be remiss
if we didn’t include Phineas Fisher’s articles, which are fantastic
introductions [1][2][3]. They cover things like how to stay safe and many
of the basics, including many techniques we used to compromise
FlexiSpy/Vervata/etc. So read them and soak them up.
[1] http://pastebin.com/raw/cRYvK4jb
[2] http://pastebin.com/raw/GPSHF04A
[3] http://pastebin.com/raw/0SNSvyjJ (the previous link, translated into
Gringo)
–[2: Recon]————————————————————–
Just like Phineas, our initial tactic was to run fierce against both
vervata.com and flexispy.com, then do some whois lookups to enumerate the
entire IP space.
You can see the output of fierce (post-hack, sadly depleted after we stole
their DNS) below:
192.168.2.231 portal.vervata.com
58.137.119.230 www.vervata.com
180.150.144.84 api.flexispy.com
180.150.144.84 admin.flexispy.com
180.150.144.83 affiliate.flexispy.com
180.150.144.83 affiliates.flexispy.com
180.150.144.83 blog.flexispy.com
180.150.156.197 client.flexispy.com
180.150.144.82 community.flexispy.com
58.137.119.229 crm.flexispy.com
54.246.87.5 d.flexispy.com
216.166.17.139 demo.flexispy.com
180.150.144.86 direct.flexispy.com
180.150.144.85 ecom.flexispy.com
54.169.162.58 log.flexispy.com
180.150.147.111 login.flexispy.com
68.169.52.82 mail.flexispy.com
68.169.52.82 mailer.flexispy.com
180.150.144.86 mobile.flexispy.com
180.150.156.197 monitor.flexispy.com
180.150.144.87 portal.flexispy.com
68.169.52.82 smtp.flexispy.com
180.150.146.32 support.flexispy.com
75.101.157.123 test.flexispy.com
180.150.144.83 www.flexispy.com
They had several servers situated behind Cloudflare, which was a problem.
Cloudflare unfortunately has a pretty effective WAF that, while nowhere
near guaranteed to put an end to any fun, does almost guarantee that it’ll
be a lot more difficult and require a lot of configuring any automated
tools to avoid setting it off. We had time, though, and looking at that
list, what hostname seems immediately interesting?
Yes, that’s right. It’s admin.flexispy.com. Probably an admin panel.
–[3: Level 1]————————————————————
Now that we had a target, it was time to go to work.
We tried some SQL injection on the login page [1]. We didn’t get anywhere,
but this wasn’t very surprising. It’s not 2010 any more; SQL injection is a
widely-known attack, and most tutorials now teach people how to not end up
introducing simple vulnerabilities into software.
It still happens. You just can’t rely on it.
So, out of boredom, we tried some common default credentials. admin:admin,
administrator:administrator, the usual culprits. Imagine our surprise when
test:test are valid.
We log in and look around. It’s one user, tied to a gmail address. They
have one license, which seems like a dead test device.
There’s some functionality there that throws you into what appears to be
the customer interface over at mobilebackup.biz using some
oauth/single-sign-on functionality. There’s also functionality for viewing
user details, looking at license details, and editing user details like
username, password, and so on.
The URL looks like this:
https://admin.flexispy.com/secure/employee/editEmployee?employeeId=1
Of course, because we’re not dealing with people concerned about security,
you can just change the Id=1 to Id=2. And that’ll show you another user’s
details. And let you reset their password on the customer interface.
We played around with that for a couple of hours, and then we wrote a very
simple script that just used curl to request every single ID up to
99999, which was the upper limit. We repackaged this into a nice text file
and did some grepping to see if there were interesting customers (there
were several), before getting bored and moving on. There’s only so much you
can do with customer lists, and that probably wasn’t going to be enough to
kill FlexiSpy.
[1] https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)
–[4: Level 2]————————————————————
Next, we decided to use nmap to scan their office ranges. We’d found these
through our earlier fierce scan, and you can see them below.
58.137.119.224 - 58.137.119.239
202.183.213.64 - 202.183.213.79
There were a few SSH servers running, a Microsoft Exchange server, and some
RDP, along with a few websites which mostly seemed to be hosting WildFly
default pages, and one CRM instance.
Those were interesting, because it indicated there was both Linux and
Windows on their internal network, which gave us options once we got
inside. For now, though, we didn’t have access, so we looked to see what
else there was. On one server, port 8081, there appeared to be a Sonatype
Nexus repository with some jar files sitting in it, which appeared to be
for the command-and-control web applications. We assume that FlexiSpy put
them there deliberately for resellers to take and install on their servers.
What’s a group of shadowy, amorphous internet vigilantes to do but sit and
spend a little bit of time reversing them? We pulled out our copies of
procyon, a fantastic decompiler for Java [1] and got to work.
We pulled our several interesting utilities; the first would be their
Mailchimp API key. This was fun, and let us see them sending out emails to
new customers (with nice, fresh, default passwords they encouraged the
customers to change). We had a look for vulnerabilities that might let us
do some SQL injection (again) or exploit the API somehow, but the code
didn’t easily hand over any 0days to us.
What it did hand over, though, was a password, fairly simple, that looked
like it might be a shared, default password: tcpip123.
We sprayed this around against the SSH servers and the WildFly servers,
but didn’t have much luck.
Finally, we decided to try the CRM. Amazingly, we were able to compromise
an administrator account using the password we found. From there, we were
able to manipulate certain module installation functionalities into,
eventually, letting us get remote code execution, and uploaded our shell.
[1] https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler
–[5: Level 3]————————————————————
So, there we were, sitting on a server inside FlexiSpy’s internal network.
We weren’t root, and the kernel was relatively new. We could have tried
using DirtyCow [1], but many of the publicly available exploits had a high
risk of frying the server, and the more reliable methods would require
creating a development VM identical to the CRM server, which would take
time which we were not sure we had.
We dropped a simple tool that allowed us to proxy onto the internal
network, and we also placed a port scanner and an automated
credential-checking tool onto the server, and started scanning quietly for
port 22, 3389, and 23.
Once we had a list of these, the first thing we did was deploy our SSH
scanner against them to test for the simple combination of root:tcpip123,
admin:tcpip123, and Administrator:tcpip123.
We were in luck. We had managed to compromise three of their NAS servers.
These were all Linux x86-64 machines, too, which meant we could deploy our
tools on them with relative ease. We backdoored the NAS servers using some
code of our own devising, which we left running in-memory hidden as one
of the existing services to avoid bringing any unwarranted attention down
on our heads.
From there, we spent several days scouring the systems. On one, we found
source code backups, on another, we found backups of home directories, HR
documents, corporate files, some SSH keys, password backups, internal
network diagrams, you pretty much name it, we had it. Many of these files
were quite out of date, but we were able to glean the password/username
combination to several servers (services:tcpip123 and services:**tcpip!23)
which also had sudo privileges.
We stole SSH keys from a number of them, and tasked the Jenkins server
to start pulling down all of their repositories, and send them off to a
server on the internet we controlled afterwards.
We also noticed we had access to the Domain Controller for all of the
Windows domains, so we dropped some malware on that, and started slowly
infecting devices and pulling credentials from memory. One of those sets of
credentials belonged to a member of staff in charge of IT, which gave us
access to the internal SharePoint server, which is always a house of fun.
By this point, we realised that FlexiSpy didn’t give a crap about security,
and in order to give us as many different points of access as possible, we
deployed Tor across the Linux infrastructure, setting up each server’s SSHd
as a Hidden Service. We siphoned out as much as we could, stopping for a
few weeks to attempt to transfer the EDB files from the Exchange Server,
which were over 100GB in size. Eventually, we gave up, after trying several
times to exfiltrate them, because we felt if we kept going, we’d eventually
cause an alert loud enough that even FlexiSpy would notice.
Once that was done, we contacted Motherboard, gave them the interesting
files, and sat back with some popcorn.
–[6: BONUS LEVEL]——————————————————–
Wiping their servers was mostly a case of dding /dev/urandom all over all
their drives, but we did have to do that across several RAID devices on
their ESXi servers, which was one of the most frustrating things we’ve
attempted.
Not even several hackers, armed with years of knowledge of
UNIX, could enjoy trying to use ESXi. Eventually, after entering several
long and arcane enchantments, we were able to reformat and dd over the
RAID devices. The rest was fairly simple.
We used the stolen credentials from the SharePoint, NAS devices, and other
places to log into Cloudflare, drop their account, then log into Rackspace,
and destroy their servers there, and log into their multiple Amazon
accounts, deleting as many S3 buckets of backups as we could find, before
killing all of those.
Finally, we redirected their domains to Privacy International, and went on
our merry way, pausing only to hijack a few twitter accounts and laugh at
FlexiSpy.
–[7: Hack Back!]———————————————————
Firstly, we’d like to dedicate this to everyone who has ever been a victim
of Gamma, or FlexiSpy, or other surveillance tools.
We’ve stolen every a great deal of source code, going back years. We are
hoping that signatures are going to be distributed, tools written to
identify and remove infections, and we also hope that people will see that
this industry is really out there, is worth money, and that it’s terribly,
terribly evil.
We’re just, like, this group of guys, you know? We can hack these people,
and we can expose their secrets, but it’s up to everyone to make a
difference.
If you have reverse-engineering skills, please, put them to use here. And
not just with FlexiSpy. Take apart other malware samples, from other
vendors of the same scumware.
If you have contacts in the antivirus or threat intelligence industry,
push your colleagues to spend a little more time on these things.
If you’re a hacker, hack back.
If you’re an ordinary person, stay safe. Watch how things progress, and see
what people are saying about how to detect FlexiSpy and protect yourselves.
Several researchers, such as Hacker Fantastic [1], Tek [2], and Ben [3] are
doing really good work.
If you’re a spouseware vendor, we’re coming for you. Stop, rethink your
life, kill your company, and be a better person.
Otherwise, you’ll be seeing us soon.
[1] https://twitter.com/hackerfantastic
[2] https://twitter.com/tenacioustek
[3] https://twitter.com/Ben_RA
