Charla antifingerprinting

The art of disguise
Anti-fingerprinting techniques

1
Daniel García a.k.a. cr0hn - @ggdaniel - http://es.linkedin.com/in/garciagarciadaniel

Creative Commons License

The art of disguise - Anti-fingerprinting techniques
by Daniel García García a.k.a. cr0hn is licensed under a:

Creative Commons Reconocimiento-NoComercial-SinObraDerivada 3.0 Unported License.

Permissions beyond the scope of this license may be available at: dani@iniqua.com.

2

Index

2.FreeBSD: A brief introduction.

3.How fingerprint works?

4.How to defeat it?

3

FreeBSD…

A brief introduction

4

1 - FreeBSD: A brief introduction

2.How install it?

3.How manage the software?

4.How install program?

5.Main differences between GNU/Linux.

5

How install it?
Simple… With a wizard

6

Software management

• What is a port system?

• Why port is a good idea?

• How port works?

7

Installing new software
Compiling…

8

Installing new software

From binaries…

9

Main differences with GNU/Linux

FreeBSD GNU/Linux
General config file: /etc/rc.conf Multiple config files and directories

Services start
•/etc/rc.d/ Service start: /etc/init.d/
•/usr/local/etc/rc.d/

User directories: /usr/home User directories: /home
Kernel: Kernel:
- config: about 200 lines - config file: very complicated
- Many security features included - Extra features via patches
Only some distribution can do it, like
Software, natively, can be compiled
Gentoo.

10

The fingerprinting…

How it works?

11

2 – Fingerprinting: How it works?

1. Why hide your systems?

2. Operating system level.

3. Service level.

4. Application level.

12

Why hide your OS and services?

1. To hide of known (and unknown!) exploits.

2. Necessaries unpatched versions of software.

3. If somebody knows OS you’re running also
may guess the application that run in.

4. Privacy: nobody needs to know the systems
you've got running
13

Fingerprinting: Risk demo

Risk demo

14

Operating System level
mmm ... fish
• TTL

OpenBSD: 255

Linux/*BSD: 64
Windows: 128
AIX: 30

15

• Common TCP Initial Windows size

*BSD: FFFF OpenBSD: 4000

Linux: 16A0
Windows: 2000 AIX: 4470/FFFF
16


• IP ID sequence generation algorithm.

• Invalid TCP flags combination.

• Answer to closed port: RST, nothing,
ICMP unreachable.

• TCP send/receive window sizes.

• Port ranges
17

Service level
• Banners

18

Application level

• Session ID var (PHPSESID/JSESSIONID)

• Hidden/lost files.

• Meta headers.

• Vars and methods names.

19

Application level
A practical example: Metadata.

20

Application level
A practical example: Lost files.

21

The fight…

How to defeat it?

22

3 – Defeating fingerprinting

• Kernel parameters

• Changing banners

• Modifying applications

23

Kernel parameters
Disable (if you don’t need)
• SCTP
• IPv6

24

Kernel parameters
In your /etc/sysctl.conf

25

Service level
How to defeat it?

• Changing configuration files

• Changing source code of software

26

How to make a patch
Step to make a patch:
2. Download the source code of app you want to
patch.

3. Extract code an create a copy of code.

4. From your copy, make the changes you need.

5. Apply a diff to extract changes.

6. Save change into a patch-* file.
27

How to make a patch: Nginx
Step 1 and 2:
2. Download the source code of Nginx.
3. Creating a copy of source.

28

Step 3:
• Locate file that contains information of version:

• Change file information:

29

Step 4 and 5:
• Make a diff with original file and save into patch.

30

FreeBSD patching method
What need FreeBSD to apply our path?
• Put your file into:
/usr/ports/CATEGORY/PROG/files
• Your patch must be named like:
patch-ORIGINAL_FILE_NAME
• Change relative path in your patch:

31

And now, how compile our patched software…?

32

Even an idiot can do it!

33

Service level
Learning with examples:

Nginx

• OpenSSH

• PureFTPd

• Apache Tomcat
34

Service level: Nginx
Where is version information?
• In nginx.h

35

Service level: Nginx
Yes! I use a public
The result: IP for my LAN

36

Service level: OpenSSH
• In Makefile:

• Or in version.h:

37

Service level: OpenSSH
The result:

38

Service level: PureFTPd

• In pure-ftphow.c

• In altlog.c
• In ftp_parser.c

• In ftpd.c

39

Service level: PureFTPd
The result:

40

Service level: Tomcat

Where is version information:
• /usr/local/apache-tomcat-7.0/conf/server.xml

41

Service level: Tomcat

The result:

42

Service level: nmap
What think nmap?

43

Service level: fingerprinting database
Where can we find a database of fingerprintings?

44

Application level
Learning with examples…

…Testing WordPress

45

Application level: WordPress
Hiding our WordPress information:
2.WordPress version.
3.WordPress’s plugins versions.
4.Session ID
5.Custom error pages.
6.Metadata info
7.Hash of static and common files.

46
Daniel García a.k.a. cr0hn - @ggdaniel - http://es.linkedin.com/in/garciagarciadanie

Step 1: WordPress version.

47

Step 2: Plugins versions.

48

Step 1 and 2: Hiding versions.

49

Step 3: Session ID var.

50

Step 3: Hiding session ID var.

51

Step 4: Custom error pages… of IIS

52

Step 5: Metadata info.

53

Step 5: Hiding metadata info.

54

Step 6: Hash of static and common files.

• Site.com/wp-includes/css/admin-bar.css:

• Some programs have a database of hashes:

55


Step 6: Hiding common hashes:

2.Modify our static files, like css:

4.Check the new hash:

56

The result:
• Plecost (http://www.iniqua.com/labs/plecost/ )

No plugins
found!!

57

The result:
• WP-scan (http://code.google.com/p/wpscan/)
wp-scan don’t
like our filters

58

The result:
• Nmap

59

Final result….

We've earned a beer!

60

Questions?
61

Charla antifingerprinting

Recomendados

Recomendados

Más contenido relacionado

Similar a Charla antifingerprinting

Similar a Charla antifingerprinting (20)

Más de navajanegra

Más de navajanegra (20)

Último

Último (20)

Charla antifingerprinting