French Croissant - or why you need to lock your computer
Last year the first day of my internship I was given a computer and asked to install and secure it for two days. After that delay anyone can try to attack and compromise my machine, and if so I was welcome to buy some “French Croissants” to the team while the attacker explain his method to get access into your computer the next morning. There are some techniques you need to be aware of when you’re securing your machine, the list below is not exhaustive.
When your colleague leave their computer without locking their session, it’s time to go on their laptop and interact with it. In this scenario you can :
- send an email to the team if he was logged into his mail account
- if he was using Linux, you may want to keep a simple backdoor in order to do a privilege escalation and become a root user, the easiest way to achieve is to backdoor the .bashrc with a reverse-shell
Maybe the most unskilled scenario, sometimes the user will write some interesting informations onto a paper sheet or a post-it, and leave it on their desktop. You can just grab the credential.
The computer has to be updated, if your colleague doesn’t do the regular patches you might be able to take advantages of this. Commonly you can target the Operating system e.g:Windows XP with MS08-067, or the Browser (Chrome/Firefox etc)
Sometimes the guest account is enable and allows you to get further access into the machine. LightDM (Ubuntu 16.04/16.10) - Guest Account Local Privilege Escalation
Most of the times you can acces the debug application on the port 80 on the internal network if there is no filtering. Depending of the application you look for :
- Common vulnerabilites (OWASP top 10)
- Debug interface (Python Flask)
USB Live ISO
When there is no bios password, it’s easy to compromise the computer by booting with a Live USB / Live CD and adding the backdoor.
Grub - Root access
Even if there is a bios password you still need to secure your Grub (boot-manager), otherwise anyone can edit it in order to start a root shell.
USB : Rubber Ducky or Teensy
If you are willing to spend around 40$, you can buy a Rubber Ducky. This is a fake USB which will act as a keyboard and send any key to the plugged computer. The payload can be created within a notepad or online at https://ducktoolkit.com/.
The full documentation is available at https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript
The following script was generated by DuckToolkit and serve a directory via HTTP
Alternatively you can buy a Teensy board for 15$, it requires a little bit of configuration but it works as well First, you need to install the arduino IDE, the Teensyduino and the rules for the Teensy board.
The following code press the keys [ALT]+[F2], then write “xterm”, followed by an echo into the user’s .bashrc
NOTE: When programming the board press the “RESET” button to avoid the launch of the payload on your computer
Initramfs Backdoor - Encrypted Hard Drive
When you’re booting there is one partition that is not encrypted in order to start. It will ask for your password and then decrypt and mount the other partition. If you have and access to the hard drive it is possible to replace the Initramfs.img in order to get the password to decrypt the full hdd, you can also wait for the decryption and then inject what you want inside a file as root :)
Mounting boot partition (not encrypted)
Adding the backdoor and packaging back to a .img