Class Presentation on Hacking

[phokur]

Hi all, allow me to pick your brains for a second...

I'm going to give a class presentation on security awareness. I plan on showing them basic hacker attacks and how they can protect themselves. I have the methodology down but I'd also like to demonstrate an attack. I will do the parlor tricks of WPA cracking, sniffing, and ARP poisoning to get their attention but I'd really like to finish with a true beginning to end attack. (i.e. Port Scan, Find Vulnerability, Exploit, Penetration)

This is a true lab environment, I can put whatever buggy apps I need to on the target machine and ignore the firewall (assume I'm inside of the network). Are there any old vulnerabilities/exploits you guys can think of? The simpler, the better. Thanks in advance!

[lupin]

Damn Vulnerable Linux has some vulnerable services on it that you can start up and configure to listen on the network.

There's also a good list of deliberately insecure web apps here, which was posted onto the forums a while ago, in a thread dedicated to learning resources (I think). Don't have a link to that thread handy, but here's the insecure web app link:

http://www.irongeek.com/i.php?page=s...b-app-security

[KMDave]

You could also check the DeIce disks. They are good for a demo too.

[Archangel-Amael]

You could also check the DeIce disks. They are good for a demo too.

Yeah the first De-Ice disk takes about 15-20 minutes or so to go from boot to root. If of course you know the procedures, and what tools to use.
Take the disk and write the steps on a 3x5 card for reference if needed, and you are done. The only thing that may need to be explained is root and it's function in a *nix environment.
DE-ICE http://heorot.net/livecds/ on the forums and registration is required I believe.
DVL http://www.damnvulnerablelinux.org/ version 1.5 is the latest.

[imported_vvpalin]

Since your already starting with wireless attacks why not stick with it. What i mean is why not just set up a WEP router and get another laptop hand it to the teacher and tell her to just browse around for awile.

Crack the WEP arp poison then then record everything shouting off what site shes visiting. If thats not enough set up sslstrip and ask her to log into her e-mail.

If that still isnt enough set up karmetasploit, or you could just take the really easy road and enable telnet on the windows box or set up sharing and trojan it.

Depending on the time your allotted you could even show them how to bypass the schools filtering policy with a ssl tunel, or show them how to break a windows user password with a simple cd. Remember its the simple shit that amazes people if you go in there telling them how to exploit a dns server there going to look at and laugh.

Whatever you do just be carefull and make sure you get WRITTEN permission. Way back when i was in computer school "what a joke and a half" i got in some major trouble for taking over an instructors personal laptop even tho i was asked if i could.

[xorred]

I think what he is looking for, is exploitation in a windows environment, by exploiting a vulnerable service and gaining access to a victim machine, that will also be more interesting to his students, I believe.
-
what you can also do, is look up the latest exploits published on milw0rm (adobe pdf as a hint), change the payload in one such pdf (yesterday they published one so you should be fairly easy to find it - and it works on all xp versions). You can even stick with the default one, as it launches calc.exe - if you don't know how to change shellcode for it to start a bind shell, for example.

You can also look for vulnerable versions of some windows ftp, http, ssh servers - there are exploits for such on milw0rm too - you can also install fairly old version of windows XP SP1 or SP2, unpatched (more easy for you to break them), start all default windows services, start IIS, and run autopwn against it... autopwn is located inside fast-track on bt3 and bt4.

I hope that helped you, at least a bit...

[phokur]

Thanks for all your replies, xorred hit it dead on. I'm going to stick with a Windows box target since the class will mostly be running Windows so it'd be most relevent to them. I'll see where autopwn gets me and probably will run milw0rm's adobe exploit as-is just to show even an updated computer isn't necessarily safe. Thanks again!

[thorin]

There is a long list of Security Test Distros/Apps over here:
http://forums.remote-exploit.org/showthread.php?t=21952

Class Presentation on Hacking
Hi all, allow me to pick your brains for a second...

I'm going to give a class presentation on security awareness. I plan on showing them basic hacker attacks and how they can protect themselves.

Hacking != Security Awareness. In fact if your audience doesn't know that hacking (as the media defines it these days) is malicious exploitation of IT security vulnerabilities then you've picked the wrong topic for them.

IMHO you'd be much further ahead (and so would your audience) if you spoke about common mistakes or misconceptions in IT security instead of trying to demonstrate some l337 hacking skills to the class using known vulnerable targets. While your idea does provide lots of nice bells and whistles so to speak it doesn't really benefit them very much. Whereas a discussion on recognizing phishing email/sites and general online safety would actually benefit them while also giving you a chance to talk about recent OS/browser/supporting app (quicktime, media player, winamp, acrobat reader) vulnerabilities.

Just my 2 cents.

[brathadair]

thorin has the rub of it, imho

I'm a firm believer that the quickest way into the network is to hack the users, not the systems. social engineering so often gets overlooked in training or mass-media simply because it isn't that sexy to report on..but it is arguably the single most important topic. Sure, give them a few flashing red lights to look at and certainly throw a couple of "i read your email" tricks at them... but to expand on thorin's wise advice, choose topics that directly impact them and their network environment. pull off a little shoulder-surfing in the class and then call them on it... introduce your grandmother who gained unauthorized access to the building and has been listening in the back of the room...call the help desk on a speaker phone and get -your- password changed without authentication challenge.

just thoughts...

peace
~b

[imported_cybrsnpr]

If you still plan on doing a live demo, make damn sure that you make a video/flash of it first. That way, when the demo gremlins pop up and ruin your live demo, you have the video/flash backup to show the audience.

I'm with the other posters here in regards that if you use a demo, make it an attention getter that ties into a discussion of security awareness, what mistakes users make and how to correct those (or be at least be aware of) problems and threats.