SEC-SEE

Nmap 6.49BETA1 released

Fyodor has announced the release of Nmap 6.49BETA1.This version will have hundreds of improvement, including:

Integrated all of the latest OS detection and version/service detection submissions (including IPv6)
Infrastructure improvements: an official bug tracker
Added options --data and --data-string to send custom payloads in scan packet data.
25 new NSE scripts (total is now 494):

o bacnet-info gets device information from SCADA/ICS devices via BACnet (Building Automation and Control Networks)

  o   docker-version detects and fingerprints Docker
  o   enip-info gets device information from SCADA/ICS devices via EtherNet/IP
  o   fcrdns performs a Forward-confirmed Reverse DNS lookup and reports anomalous results
o   http-avaya-ipoffice-users enumerates users in Avaya IP Office 7.x systems.
o   http-cisco-anyconnect gets version and tunnel information from Cisco SSL VPNs
o   http-crossdomainxml detects overly permissive crossdomain policies and finds trusted domain names available for purchase
o   http-shellshock detects web applications vulnerable to Shellshock (CVE-2014-6271).
o   http-vuln-cve2006-3392 exploits a file disclosure vulnerability in Webmin.
o   http-vuln-cve2014-2126, http-vuln-cve2014-2127, http-vuln-cve2014-2128 and http-vuln-cve2014-2129 detect specific vulnerabilities in Cisco AnyConnect SSL VPNs
  o   http-vuln-cve2015-1427 detects Elasticsearch servers vulnerable to remote code execution.
  o   http-vuln-cve2015-1635 detects Microsoft Windows systems vulnerable to MS15-034
  o   http-vuln-misfortune-cookie detects the "Misfortune Cookie"    vulnerability in Allegro RomPager 4.07, commonly used in SOHO routers for TR-069 access.
o   http-wordpress-plugins was renamed http-wordpress-enum and extended to enumerate both plugins and themes of Wordpress installations and their versions. http-wordpress-enum is now http-wordpress-users.
o   mikrotik-routeros-brute performs password auditing attacks against Mikrotik's RouterOS API.
o   omron-info gets device information from Omron PLCs via the FINS service.
o   s7-info gets device information from Siemens PLCs via the S7 service, tunneled over ISO-TSAP on TCP port 102.
o   snmp-info gets the enterprise number and other information from the snmpEngineID in an SNMPv3 response packet.
o   ssl-ccs-injection detects whether a server is vulnerable to the SSL/TLS CCS Injection vulnerability (CVE-2014-0224)
o   ssl-poodle detects the POODLE bug in SSLv3 (CVE-2014-3566)
o   supermicro-ipmi-conf exploits Supermicro IPMI/BMC controllers.
o   targets-ipv6-map4to6 generates target IPv6 addresses which correspond to IPv4 addresses mapped within a particular IPv6 subnet.
o   targets-ipv6-wordlist generates target IPv6 addresses from a wordlist made of hexadecimal characters

Microsoft Plans to Add Secure Shell (SSH) to Windows

Until now Unix and Linux system administrators have to download a third-party SSH client software like Putty on their Windows machines to securely manage their machines and servers remotely through Secure Shell protocol or Shell Session (better known as SSH).

This might have always been an awkward feature of Windows platform, as it lacks both – a native SSH client software for connecting to Linux machines, and an SSH server to support inbound connections from Linux machines. But…

Believe it or not:

You don't need to deal with any third-party SSH client now, as Microsoft is working on supporting OpenSSH.

- See more at: http://thehackernews.com/2015/06/windows-secure-shell.html#sthash.40ZCfuy1.dpuf

Yes, Microsoft has finally decided to bring OpenSSH client and server to Windows.

The PowerShell team at Microsoft has announced that the company is going to support and contribute to OpenSSH community in an effort to deliver better SSH support in the PowerShell and Windows SSH software solutions.

So, the upcoming version of Windows PowerShell – the command-line shell and scripting language – will allow users to manage Windows and Linux computers through SSH

For those who are unaware, SSH is basically designed to offer the best security when accessing another computer remotely. It not only encrypts the remote session, but also provides better authentication facilities, with features like secure file transferring and network port forwarding.

This is not first time Microsoft has planned to adopt SSH for its Windows platform, the company had tried to allow the secure shell protocol to be used within Windows twice but was unable to implement it.

However, developers who are eager to use this new functionality in PowerShell still have to wait for some time, as the project is still in the early planning phase. So far, there isn’t any definite release date.

The PowerShell team will update more information on when users can expect SSH support shortly.

Ransomware Response Kit

A security researcher has made a ransomware removal kit available online with the hope that it will help security professionals and system administrators alike in responding to instances of ransomware infection.

Researcher Jada Cyrus has published the kit on Atlassian Bitbucket. The kit itself consists of removal tools for common ransomware variants, as well as guides on how to perform the necessary removal tasks.

download from here

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable

A critical vulnerability resides in AFNetworking could allow an attacker to cripple the HTTPS protection of 25,000 iOS apps available in Apple’s App Store via man-in-the-middle (MITM) attacks.

AFNetworking is a popular open-source code library that lets developers drop networking capabilities into their iOS and OS X products. But, it fails to check the domain name for which the SSL certificate has been issued.

Any Apple iOS application that uses AFNetworking version prior to the latest version 2.5.3 may be vulnerable to the flaw that could allow hackers to steal or tamper data, even if the app protected by the SSL (secure sockets layer)

protocol

online application check tool as scanned by SourceDna code scanning start-up vendor .

MS15-034 - Vulnerability in HTTP.sys Could Allow Remote Code Execution Nmap script check

http://seclists.org/nmap-dev/2015/q2/37

add the below text to a .nse file and add in to nmap plugin folder

usage example included in the code

FYI

local shortport = require "shortport"

local http = require "http"

local stdnse = require "stdnse"

local string = require "string"

local vulns = require "vulns"

description = [[

Checks for a remote code execution vulnerability (MS15-034) in Microsoft Windows systems (CVE2015-2015-1635).

The script sends a specially crafted HTTP request with no impact on the system to detect this vulnerability.

The affected versions are Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1,

and Windows Server 2012 R2.

References:

* https://technet.microsoft.com/library/security/MS15-034

]]

---

-- @usage nmap -sV --script vuln <target>

-- @usage nmap -p80 --script http-vuln-cve2015-1635.nse <target>

-- @usage nmap -sV --script http-vuln-cve2015-1635 --script-args uri='/anotheruri/' <target>

-- @output

-- PORT STATE SERVICE REASON

-- 80/tcp open http syn-ack

-- | http-vuln-cve2015-1635:

-- | VULNERABLE:

-- | Remote Code Execution in HTTP.sys (MS15-034)

-- | State: VULNERABLE (Exploitable)

-- | IDs: CVE:CVE-2015-1635

-- | A remote code execution vulnerability exists in the HTTP protocol stack (HTTP.sys) that is

-- | caused when HTTP.sys improperly parses specially crafted HTTP requests. An attacker who

-- | successfully exploited this vulnerability could execute arbitrary code in the context of the System account.

-- |

-- | Disclosure date: 2015-04-14

-- | References:

-- | https://technet.microsoft.com/en-us/library/security/ms15-034.aspx

-- |_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1635

-- @args http-vuln-cve2015-1635.uri URI to use in request. Default: /

---

author = {"Kl0nEz", "Paulino <calderon()websec.mx>"}

license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

categories = {"vuln", "safe"}

portrule = shortport.http

action = function(host, port)

local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or "/"

local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)

local vuln = {

title = 'Remote Code Execution in HTTP.sys (MS15-034)',

state = vulns.STATE.NOT_VULN,

description = [[

A remote code execution vulnerability exists in the HTTP protocol stack (HTTP.sys) that is

caused when HTTP.sys improperly parses specially crafted HTTP requests. An attacker who

successfully exploited this vulnerability could execute arbitrary code in the context of the System account.

]],

IDS = {CVE = 'CVE-2015-1635'},

references = {

'https://technet.microsoft.com/en-us/library/security/ms15-034.aspx'

dates = {

disclosure = {year = '2015', month = '04', day = '14'},

}

local options = {header={}}

options['header']['Host'] = stdnse.generate_random_string(8)

options['header']['Range'] = "bytes=0-18446744073709551615"

local response = http.get(host, port, uri, options)

if response.body then

local title = string.match(response.body, "<[Tt][Ii][Tt][Ll][Ee][^>]*>([^<]*)</[Tt][Ii][Tt][Ll][Ee]>")

if title == "Requested Range Not Satisfiable" then

vuln.state = vulns.STATE.EXPLOIT

end

return vuln_report:make_output(vuln)

end

Some PRISM post mortal conclusions

Following the understanding of NSA ways of intercepting our digital communication, and the shutting down of services like LavaBit email encryption services,here our some quick conclusions

Never trust a third party in holding your encryption keys ,so if Google will start encrypt your email on their hard disks (like they recently published ) , they will still hold the keys and some day will hand them to the NSA or another agencies.
try to use open source as much as we can ,you don't know what or when a commercial company will put a backdoor for NSA or alike.
make our "followers " life harder using software and services like: GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit