RE: Re: Firewall question - how easy is it to get thru - Proof

["Rivest, Philippe" <PRivest () transforcecompany com>]

Well, yes. 

I use 3 hacks, one of which is web based (IIS 5.0) which is old but works greats in classes to show it. I copy files, 
get local admin, install services and end up with full domain admin privilege.
The 2 other hacks are made against the service (locally).

So with our without a firewall, I still can get everything done. I just dont put the firewall because when I travel I 
already have a lot of equipment.


- For all those who are telling me IIS5.0 is old and obsolete... I know. Its only to show management how its made. I'm 
not fully aware of all the new hacks :P

Why the question?


 
Important: 
Please note that my new email address is privest () transforcecompany com
Please note that my new website address is http://www.transforcecompany.com

SVP Veuillez noter que ma nouvelle adresse courriel est privest () transforcecompany com
SVP Veuillez noter que ma nouvelle adresse web est http://www.transforcecompany.com
 
 

Philippe Rivest - CISA, CISSP, CEH, Network+, Server+, A+
TransForce Inc.
Internal auditor - Information security
Vérificateur interne - Sécurité de l'information
Linkedin: http://ca.linkedin.com/pub/philippe-rivest/20/19a/232
   
6600 Saint-François
Saint-Laurent (Quebec) H4S 1B7
Tel.: 514-331-4417
Fax: 514-856-7541
www.transforcecompany.com
 
 
 
 
 

-----Original Message-----
From: John Morrison [mailto:john.morrison101 () gmail com] 
Sent: 17 février 2011 15:18
To: Rivest, Philippe
Cc: security-basics () securityfocus com
Subject: Re: Re: Firewall question - how easy is it to get thru - Proof

Phillipe,

Could you add a firewall to your seminar setup? And prove it works
through a firewall?

On 16 February 2011 19:23, Rivest, Philippe
<PRivest () transforcecompany com> wrote:
> Thanks for the information, it is true that the easiest way to beat the firewall is to bypass it or use rules that 
> allow the network transaction to occur, such as web browser attacks.
>
>
> On the Metasploit note, i have too add that Metasploit is a great tool :)
> In my current company i provide a hacking seminar of 3-4 hours and i show how to use Nessus & Metasploit together to 
> perform 3 different hacks. 2 of which gives a reverse meterpreter shell. Everyone is surprised at how "easy" and 
> "quick" it is once you identify the vulnerability.
>
> Thats one of the source of my initial question. I'm always challenged on "Well in your seminar you have no 
> firewall"... It kinda bugs me that people put so much trust on that technology alone. Thats why i'd like to get 
> information & papers that shows how easy it is to simply break/attack directly the firweall and (between you and i) 
> own it.
>
>
>
> Important:
> Please note that my new email address is privest () transforcecompany com
> Please note that my new website address is http://www.transforcecompany.com
>
> SVP Veuillez noter que ma nouvelle adresse courriel est privest () transforcecompany com
> SVP Veuillez noter que ma nouvelle adresse web est http://www.transforcecompany.com
>
>
>
> Philippe Rivest - CISA, CISSP, CEH, Network+, Server+, A+
> TransForce Inc.
> Internal auditor - Information security
> Vérificateur interne - Sécurité de l'information
> Linkedin: http://ca.linkedin.com/pub/philippe-rivest/20/19a/232
>
> 6600 Saint-François
> Saint-Laurent (Quebec) H4S 1B7
> Tel.: 514-331-4417
> Fax: 514-856-7541
> www.transforcecompany.com
>
>
>
>
>
>
> -----Original Message-----
> From: Shane Anglin [mailto:shane.anglin () gmail com]
> Sent: 16 février 2011 14:19
> To: security-basics () securityfocus com; Rivest, Philippe
> Subject: RE: Re: Firewall question - how easy is it to get thru - Proof
>
> Some detail on how such a think can occur. somehow, the 'bad guy'
> tricks a target LAN user to connect his web browser to the bad guy's web server/page (phishing, social engineering, 
> etc). the requested web page maliciously loads some web browser exploit on the target LAN user's machine, and the 
> exploit runs.  The exploit could, for example, be one that simply opens up a session reversed back to bad guy's web 
> server.. And now bad guy has a link inside the target LAN network via the target LAN machine to scan from, load more 
> code onto target LAN machine, etc. and all happening along the HTTP(port 80) or HTTPS (port
> 443)  that the target LAN user initiated, and occurring within the allowed firewall rules, demonstrating that 
> firewall technology alone is not a magic pill .  Metasploit is a great tool to perform such attacks. I suggest 
> reading a bit on Metasploit's meterpreter reverse tcp basics.
>
> Regards,
> Shane Anglin
> Shane.Anglin () gmail com
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------