Binnavi install on Windows

Great app...I couldn't find anywhere that talked about what you need to make it so here goes:

Apache Ant
Apache Maven 
Java JDK 
PostgreSQL 

Install the JDK, create a new Windows Environment Variable called JAVA_HOME that should point to install directory (e.g. C:\Program Files\Java\jdk1.8.0_60).  Extract your apache-maven-*.*.*-bin.zip and apache-ant-*.*.*-bin.zip, put them somewhere (I put mine just in "c:\", and add both to your PATH (I renamed these and mine look like: C:\apache-maven\bin;C:\apache-ant\bin).

Install PostgreSQL, and with pgAdmin create a new user (I called mine binnavi), then create a new database (I called mine binnavi) with the owner being binnavi.

Get a command prompt/powershell and cd to binnavi-master then build:

mvn dependency:copy-dependencies
ant -f src/main/java/com/google/security/zynamics/build.xml build-binnavi-fat-jar
 
Then run and point to your PostgreSQL instance:
java -jar target/binnavi-all.jar




Done.

Breaking Windows 10 with a Firewall

Breaking Windows 10 with a Firewall

My firewall of choice is Commodo since I can get pretty granular with it.  Settings below:

After running for a couple days with this configuration, these are some observations:

• Clicking the Windows Start Button results in a spin wheel...takes several tries to get the menu to pop up
• Said menu is completely blank

•  Calculator no longer functions (for another post)

More to come...

Powershell executable search order

Powershell executable search order

Seems legit....just type "calc" in a shell...hope nobody places anything naughty there.

Windows 10 Observations

Windows 10 Observations

I wonder why SearchUI.exe (Cortana) needs all those User Agents?

Bro IDS SMTP File Extraction

Bro-ids SMTP file extraction script, first attempt:
 
#define list of mime types to extension that we want
global ext_map: table[string] of string = {
        ["application/x-dosexec"] = "exe",
        ["application/zip"] = "zip",
        ["application/msword"] = "xls",
};
event file_new(f: fa_file)
        {
        # if this isn't SMTP, we don't want it
        if ( f$source != "SMTP" )
                return;
        #if it's not a mime type, or it's not in our list we don't want it
        if ( ! f?$mime_type || f$mime_type !in ext_map )
                return;

        local ext = "";

        if ( f?$mime_type )
                ext = ext_map[f$mime_type];

        local fname = fmt("%s-%s.%s", f$source, f$id, ext);
        Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=fname]);
}

VT used to be good

Sad

 

Blackhole Exploit Kit Observations

Hey all,

Been doing a bit of research, and I've found some interesting correlations with the BEK.  First off, I'll be looking at three separate incidents:

Oct 22 2012 - Microsoft Support spoofed emails
Oct 23 2012 - LinkedIn spoofed emails
Dec 4 2012 - US Airways spoofed emails

The method of infection is pretty much the same and well documented...click the link, and your flash/reader/java versions are checked, then exploited.  After that, usually Zeus or Cridex is installed and your machine starts talking to their C&C servers.  It's this point that I'm looking at.  There are some variances, but the general flow seems to be:

Exploited java creates:
C:\Documents and Settings\username\wgsdgsdgdsgsd.exe

Internet Explorer creates:
C:\DOCUME~1\username\LOCALS~1\Temp\wpbt0.dll

wpbt0.dll creates (and starts) a secondary downloaded executable file
or
wgsdgsdgdsgsd.exe creates (and starts) a secondary downloaded executable file, usually a KB00random#s.exe
 
File C:\Documents and Settings\username\Application Data\94B3EB7A and Registry Key HKCU\Software\Microsoft\Windows NT\S94B3EB7A are created.  This entry is what I believe to be the list of banks and sites to steal your data and has some interesting bits:

File C:\Documents and Settings\jlay\Local Settings\Temporary Internet Files\Content.IE5\<random>\AjX0[1].txt is created.  This file I believe is encrypted and portions of it are sent to the C&C server:

I suspect this file contains information about your machine/user info/etc.  In two cases this file was close to 100kB, in the last case it was over 440kB!

For reboot survival, key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KB00729045.exe is created.

Lastly, wgsdgsdgdsgsd.exe and wpbt0.dll createa couple .bat files are created that attempt to delete a few files:
C:\Documents and Settings\username\Local Settings\Temp\exp3.tmp.bat
C:\Documents and Settings\username\Local Settings\Temp\exp1.tmp.bat 

Things I need to do:
Create a snort rule
Figure out how to decrypt the AjX0 files

Thanks.