{"id":738,"date":"2017-05-31T12:30:51","date_gmt":"2017-05-31T12:30:51","guid":{"rendered":"https:\/\/zed.inguardians.com\/?p=738"},"modified":"2018-11-30T21:08:22","modified_gmt":"2018-11-30T21:08:22","slug":"protecting-the-mr-robot-vuln-hub-machine-part-1-breaking-a-password-spray-with-ossec-active-response","status":"publish","type":"post","link":"https:\/\/zed.inguardians.com\/blog\/protecting-the-mr-robot-vuln-hub-machine-part-1-breaking-a-password-spray-with-ossec-active-response\/","title":{"rendered":"Protecting the Mr Robot Vuln Hub Machine \u2013 Part 1 \u2013 Breaking a Password Spray with OSSEC Active Response"},"content":{"rendered":"

by Jay Beale<\/h3>\n

(This post has a sequel<\/a>.)<\/p>\n

I admit it\u200a\u2014\u200aI haven\u2019t been purely vacationing during my San Diego PTO. I\u2019ve found particular intellectual joy in figuring out how to hack some of the CTF-type virtual machines from VulnHub<\/a>. That led to looking through an answer key (also known as a \u201cwalkthrough\u201d) for one and wanting to publish an attack-defense hybrid walk-through, showing how to attack the machine, but also break each stage of the attack.<\/p>\n

Spoilers Ahead! If you want to attack the Mr. Robot virtual machine on VulnHub<\/a>, please come back and read this afterward.<\/p>\n

The Mr Robot vulnerable virtual machine\u2019s author got creative with his story tie-in. Take a look at the first screen you see when you find the web application listening on port 80:<\/p>\n

\"\"<\/p>\n

In this blog post, I’ll take you through the attack on this capture-the-flag-style system and then on how you could defend it without stripping out the vulnerabilities.<\/p>\n

Attack: Password Spraying the Login\u00a0Page<\/h2>\n

Looking at the web server\u2019s robots.txt file grants the first flag, as well as a dictionary file for username and password guessing, called fsocity.dic.<\/p>\n

\"\"<\/p>\n

A quick run of dirbuster…<\/p>\n

\"\"<\/p>\n

…finds a WordPress login page.<\/p>\n

\"\"<\/p>\n

This version of WordPress gives differing messages for non-existent user names versus incorrect passwords, allowing us to brute force to get a correct username.<\/p>\n

The fsocity.dic file has a ton of repetition, so we sort and uniq it, pruning it from more than 858,000 lines to under 11,500 lines.<\/p>\n

It takes under two minutes to find that the elliot username is valid.<\/p>\n

\"\"<\/p>\n

Now, we use wfuzz to try passwords for two and half minutes, when it finds the show\u2019s protagonist\u2019s password, \u201cER28\u20130652.\u201d<\/p>\n

\"\"<\/p>\n

As my friend Skip Duckwall<\/a> likes to say, \u201cWinner, winner, chicken dinner!\u201d<\/p>\n

I\u2019ve sent a few over 5,500 login attempts to find a user name, then about the same number to find that user\u2019s password.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Defense: Break Password Sprays with OSSEC\u2019s\u00a0iptables Active Response<\/h2>\n

This is the first point where my defender\u2019s mind just wants to scream, \u201cWhy the heck did you let me send tens of thousands of login attempts?!\u201d Let\u2019s use OSSEC to break that pair of brute forcing attacks. Mike Poor<\/a> introduced me to OSSEC about five years ago. It\u2019s a powerful detection tool, combining four\u00a0major functions:<\/p>\n