My initial strategy going in was to do an nmap -sS -O -P0 targets > nmapresults.txt to have a list of all the services running on the targets.  From this point I started with some general web application security tests on all of the hosts serving web.  For this a combination of Nikto2, W3af, and the Security Compass Firefox plug-ins were the main tools along with a lot of hand testing via the browser.  From that point I moved on to the Cisco router which had a default password. I then started checking out the Windows servers although I was running into issues forgetting syntax in metasploit and also some problems getting it to load up so I checked the Samba shares.  I finished the night cracking a zip file, telneting to a random high port, and trying some automated Windows scripts.

During the reveal at the end of the night it was clear that a lot of the Flags were available via one hack, for example invalid object queries after 1 flag I figured it was done, the same with directory traversal attacks.  Also, a smarter approach would be to look for simpler things first.  There was a DNS server on the network that was able to be zone transferred but it hadn’t even crossed my mind.

All in all I came out of it with the mind frame of start with the more obscure services and work back to the more common ones.  DNS isn’t obscure, but when you see that or a web application that is likely vulnerable to SQL injection, your misdirected a bit.  I also realized that I need to do a lot more hands on with the tools prior to a contest as I wasn’t remembering syntax and had to use a lot more -h’s than I’d like to admit.  For going in not feeling very confident I came out with third place and feeling like this is something I’d like to do more often.

Thanks to Hurricane Labs and the NEO InfoSec Forum for a great competition!

On the edge server

<ST root folder>/bin/cleanstdb.php

<?php
 $dbcnx = mysql_connect("127.0.0.1:33060", "root", "tumbleweed");
 if (!$dbcnx) {
 echo( "<P>Unable to connect to the " .
 "database server at this time.</P>" );
 exit();
 }
 mysql_select_db("st", $dbcnx);
 if (! @mysql_select_db("st") ) {
 echo( "<P>Unable to locate the st " .
 "database at this time.</P>" );
 exit();
 }
 $result = mysql_query("delete from logging_event where rendered_message LIKE 'SSH: Sent SSH_MSG_USERAUTH_INFO_REQUEST%';");
 if (!$result) {
 echo("<P>Error performing query: " .
 mysql_error() . "</P>");
 exit();
 }
 $result = mysql_query("delete from logging_event where rendered_message LIKE 'FTP session starting from <NAT address>';");
 if (!$result) {
 echo("<P>Error performing query: " .
 mysql_error() . "</P>");
 exit();
 }
 mysql_close($dbcnx);
?>

All that this PHP script does is go through all events and delete entries that have in the past filled the database to the point of filling the partition.  Obviously for compliance and retention you need to keep some record of these events and that is not shown in this particular example, you’ll have to add your own logic or backup the raw logs frequently enough that you have that.

<ST root folder>/bin/cleanstdb.sh

#!/bin/bash
/usr/bin/php /<ST root>/bin/cleanstdb.php > /tmp/cleanstdb.out

This just runs the php script and outputs any error messages it encounters.  I link this script into cron.hourly to do an hourly cleaning of the database and it seems to have a tremendous impact on keeping the partition from filling.

The next problem to solve is exporting the valuable information from the event log database and putting it into a human readable, and greppable format.

<ST root folder>/bin/exporteventlog.php

<?php
 $dbcnx = mysql_connect("127.0.0.1:33060", "root", "tumbleweed");
 if (!$dbcnx) {
 echo( "<P>Unable to connect to the " .
 "database server at this time.</P>" );
 exit();
 }
 mysql_select_db("st", $dbcnx);
 if (! @mysql_select_db("st") ) {
 echo( "<P>Unable to locate the st " .
 "database at this time.</P>" );
 exit();
 }
 $result = mysql_query("select event_id, timestamp, rendered_message, ndc from logging_event where rendered_message NOT LIKE 'SSH: Sent SSH_MSG_USERAUTH_INFO_REQUEST%' order by timestamp;");
 if (!$result) {
 echo("<P>Error performing query: " .
 mysql_error() . "</P>");
 exit();
 }
 while ( $row = mysql_fetch_array($result) ) {
 echo $row["event_id"] . " " . date('mdY-H:i:s', $row["timestamp"]/1000) . " " .
 $row["rendered_message"] . " " . $row["ndc"] . "\r\n";
 }
 mysql_free_result($result);
 mysql_close($dbcnx);
?>

<ST root folder>/bin/exporteventlog.sh

#!/bin/bash
timestamp=`date +%Y%m%d_%H:%M:%S`
/usr/bin/php /<ST root>/dumpeventlog.php > /<Log Dir>/steventlog_$timestamp.log

This shell script calls the PHP script to dump the valuable fields to a text file, in my case I have this on a cron job to happen every 4 hours, as I’ve seen some attacks or warnings that have rotated the entire database within 6 hours.

The back-end server scripts are almost identically the same, the only difference is the database structure between an edge and back-end server differ a bit.  As the edge reports a lot more connection errors and attack attempts than the backend, the cleanup script isn’t required on the back-end server.

<ST root>/bin/exportxferlogs.php

<?php
 $dbcnx = mysql_connect("127.0.0.1:33060", "root", "tumbleweed");
 if (!$dbcnx) {
 echo( "<P>Unable to connect to the " .
 "database server at this time.</P>" );
 exit();
 }
 mysql_select_db("st", $dbcnx);
 if (! @mysql_select_db("st") ) {
 echo( "<P>Unable to locate the st " .
 "database at this time.</P>" );
 exit();
 }
 $result = mysql_query("select id, endTime, protocol, remoteHost, accountName, localFile, filename, filesize, status from TransferStatus order by startTime");
 if (!$result) {
 echo("<P>Error performing query: " .
 mysql_error() . "</P>");
 exit();
 }
 while ( $row = mysql_fetch_array($result) ) {
 echo $row["id"] . " " . date('mdY-H:i:s', $row["endTime"]/1000) . " " . $row["protocol"] . " " . $row["remoteHost"] . " " . $row["accountName"] . " " .
 $row["localFile"] . " " . $row["filename"] . " " . $row["filesize"] . " " . $row["status"] . "\r\n";
 }
 mysql_free_result($result);
 mysql_close($dbcnx);
?>

<ST root>/bin/exportxferlogs.sh

#!/bin/bash
timestamp=`date +%Y%m%d_%H:%M:%S`
/usr/bin/php /<ST root>/bin/dumplogs.php > /<Log Dir>/stxferlog_$timestamp.log

As this only logs transfers which require logging in successfully this can be cron’d to run at a less frequent schedule than the edge server.

Despite its event log search utility being pretty bad, SecureTransport is an extremely modifiable application that has proven to be fairly resilient.  In the future I might post some more hacks and scripts used to add functionality or increase its stability.