Ventz | VPetkov.net

29Nov 2015

Sending HTML emails with Perl to a remote SMTP with TLS

This problem starter as a rather simple one — I needed to send HTML emails, using Perl, to a remote SMTP server with user authentication and TLS support (STARTTLS). The extra “gotcha” is that I refused to read books about MIME structures. Easy enough right? It turns out, it can be if you know the right answer.

Let start with the answer for those that are impatient – it turns out this is the easiest way to achieve this:


sub amazon_sendhtmlemail_to_from {
    my ($from_email, $to_email, $subject, $url) = @_;

    # Pull HTML content down from URL
    use WWW::Mechanize;
    my $mech = WWW::Mechanize->new();
    $mech->agent_alias( 'Mac Safari' );
    $mech->get( $url );
    my $html = $mech->content;

    # Create Email itself - hard part, in HTML use Email::Stuffer;
    # The "->email" is key because it returns a Email::MIME object which is needed for the send
    my $email = Email::Stuffer->from($from_email)->to($to_email)->subject($subject)->html_body($html)->email;

    ###############################################################################
    use Email::Sender::Simple qw(sendmail);
    use Email::Sender::Transport::SMTPS ();
    my $smtpserver = 'smtp.domain.tld';
    my $smtpport = 587;
    my $smtpuser   = 'Username';
    my $smtppassword = 'Password';

    my $transport = Email::Sender::Transport::SMTPS->new({
        host => $smtpserver,
        port => $smtpport,
        ssl => "starttls",
        sasl_username => $smtpuser,
        sasl_password => $smtppassword,
    });

    sendmail($email, { transport => $transport });
    ###############################################################################
}

sub amazon_sendhtmlemail_to_from {

my ($from_email, $to_email, $subject, $url) = @_;

# Pull HTML content down from URL

use WWW::Mechanize;

my $mech = WWW::Mechanize->new();

$mech->agent_alias( 'Mac Safari' );

$mech->get( $url );

my $html = $mech->content;

# Create Email itself - hard part, in HTML use Email::Stuffer;

# The "->email" is key because it returns a Email::MIME object which is needed for the send

my $email = Email::Stuffer->from($from_email)->to($to_email)->subject($subject)->html_body($html)->email;

###############################################################################

use Email::Sender::Simple qw(sendmail);

use Email::Sender::Transport::SMTPS ();

my $smtpserver = 'smtp.domain.tld';

my $smtpport = 587;

my $smtpuser = 'Username';

my $smtppassword = 'Password';

my $transport = Email::Sender::Transport::SMTPS->new({

host => $smtpserver,

port => $smtpport,

ssl => "starttls",

sasl_username => $smtpuser,

sasl_password => $smtppassword,

});

sendmail($email, { transport => $transport });

###############################################################################

}

That’s it — and “it just works” ™. As you might have guessed, this is also the perfect solution for something like Amazon’s AWS SES service.

Continue Reading →Sending HTML emails with Perl to a remote SMTP with TLS

27Jan 2015

GHOST – glibc Remote Linux Vulnerability POC Exploit – CVE-2015-0235

by Ventz ⋅ Leave a Comment

The guys at Qualys discovered a very interesting buffer overflow in the __nss_hostname_digits_dots() function of glibc. The main problem is that you can take advantage of this remotely via the gethostbyname*() functions, which are used in many applications. They dubbed this “GHOST” (due to the GetHOST… name). The CVE assigned to this is: CVE-2015-0235.

Currently, all distributions of Linux are vulnerable.
This was apparently fixed between glibc-2.17 and glibc-2.18, but it was ignored in the long term “stable” releases.

Here is some code to check if you are vulnerable:
Continue Reading →GHOST – glibc Remote Linux Vulnerability POC Exploit – CVE-2015-0235

14Oct 2014

OpenSSL – SSL 3.0 Poodle Vulnerability

by Ventz ⋅ 2 Comments

Lately, we have seen some really bad vulnerabilities in regards to SSL (Heartbleed) and Bash (later dubbed “Shellshock”), along with some slightly “lighter” linux/open source ones.

In September of this year, Google first discovered a fallback attack for SSL v3.0, and they wrote published a paper on it: https://www.openssl.org/~bodo/ssl-poodle.pdf.
Today, it was officially confirmed that SSL version 3.0 is no longer secure, and thus, it is no longer recommended in client software (ex: web browsers, mail clients, etc…) or server software (ex: apache, postfix, etc…).
This was dubbed the “POODLE” vulnerability, and given CVE-2014-3566

A “POODLE attack” can be used against any website or browser that still supports SSLv3.
Browsers and websites need to turn off SSLv3 as soon as possible in order to avoid compromising sensitive/private information. Even though a really small percent of servers/browsers are vulnerable (mozilla estimates 0.3% of the internet), that is quite large in the total number of users.

How can I check if my browser is Vulnerable?
~~The guys at dshield setup this nice browser check: https://sslv3.dshield.org:444/index.html~~ For checking your browser, use: https://www.poodletest.com

Poodletest was first mentioned to me by Curtis Wilcox.
Continue Reading →OpenSSL – SSL 3.0 Poodle Vulnerability

24Sep 2014

Bash remote exploit vulnerability

by Ventz ⋅ Leave a Comment

As some of you may have heard, a very serious remote vulnerability was ~~discovered~~ disclosed today within bash.

A quick summary of the problem is that bash does not properly process function definitions, which can be exported like shell variables. This is a bit like a SQL/XSS injection problem — you provide an “end” to your input, and continue writing other functions/calls after it, which then get executed.

A quick example:


env x='() { :;}; echo vulnerable!' bash -c ''

env x='() { :;}; echo vulnerable!' bash -c ''

A vulnerable system looks like this:
vulnerable!

A patched system looks like this:
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x’

Continue Reading →Bash remote exploit vulnerability

11Apr 2014

Ridiculously fast Heartbleed Subnet Scanner – nmap heartbleed howto and tutorial

by Ventz ⋅ Leave a Comment

UPDATE: Insecure has released v6.46 which contains all of these patches. Just grab the latest and follow the usage info here

If you don’t know what Heartbleed is, you can find out here: http://heartbleed.com/. If you don’t want to read the details above, XKCD put together a great short comic about it: http://xkcd.com/1354/

NOTE: I first put this together 3 days ago, but I am just now releasing after being asked by many people for the package and directions.

The problem: How do you scan a bit more than 5 class B’s (~328000 IP addresses) before any off the vendors (Tenable, Qualys, Rapid7) have released signatures? Easy – you build your own!
The goal was to scan as many IPs as possible at work as quickly as possible.

After using the Heartbleed github project (https://github.com/FiloSottile/Heartbleed) and creating a Dancer web service around it, I realized that there still needed to be a faster way to scan for this. How much faster?

How about a /24 (254 IP addresses) in less than 10 seconds.

I have a patched version of NMAP already (6.40) that has Heartbleed checks.
Again, Insecure has released v.6.46 which has these patches. Grab that and follow these directions

Then, you can scan like this:


/usr/local/bin/nmap --open --script ssl-heartbleed -p 443 SUBNET-CIDR-HERE

/usr/local/bin/nmap --open --script ssl-heartbleed -p 443 SUBNET-CIDR-HERE

If you want cleaner results, for a script, a good way to filter the output will be with something like this:


/usr/local/bin/nmap --open --script ssl-heartbleed -p 443 SUBNET-CIDR-HERE | sed -e '/report for/,/ssl-heartbleed/!d' | grep -v 'Host is up' | grep -v 'SERVICE' | sed -r 's/Nmap scan report for //'

/usr/local/bin/nmap --open --script ssl-heartbleed -p 443 SUBNET-CIDR-HERE | sed -e '/report for/,/ssl-heartbleed/!d' | grep -v 'Host is up' | grep -v 'SERVICE' | sed -r 's/Nmap scan report for //'

This produced a clean 2 line result, where if it’s vulnerable, it will have “ssl-heartbleed” under each host/IP address entry.

How to build your own patched NMAP binary?

But what if you don’t trust my binary? Good – let me show you how to build one yourself:

Continue Reading →Ridiculously fast Heartbleed Subnet Scanner – nmap heartbleed howto and tutorial

01Mar 2014

Web Exploit – user modifiable Read and Execute can give you Write access

by Ventz ⋅ Leave a Comment

There are many ways to exploit a web server and gain access to the file system – read or write (sometimes both). This becomes even easier when one hosts CGIs or other dynamic code – especially when that code includes user based inputs. Recently, I found one of the most elegant exploits that I have seen for this kind of an attack vector, so I wanted to go over it and share some information about how it works and what exactly it exploits.

To setup the background for this scenario, imagine a web server (ex: ‘www.example.com’) setup with userdirs, which allows CGI execution – not an uncommon situation at all. This means that ‘user1’ will have a directory like ‘public_html’, which will become directly accessible at: ‘http://www.example.com/~user1/’. For example, creating a ‘blah’ folder in ‘/home/user1/public_html’, will create ‘http://www.example.com/~user1/blah’ on the web.

At some point, ‘user1’ creates a file called ‘x.cgi’, which simply has a GET parameter called ‘file’, and if that parameter is a file that exists, it loads it via an include. Otherwise, it loads a default.html file. Let’s assume that ‘x.cgi’ is a PHP file which looks like this:


#!/usr/bin/php
// x.cgi file - used as a "pre-processor" for loading HTML files
$file = $_REQUEST['f'];
if (file_exists($file) ) {
    include($file);
}
else {
    include('default.html');
}
?>

#!/usr/bin/php

// x.cgi file - used as a "pre-processor" for loading HTML files

$file = $_REQUEST['f'];

if (file_exists($file) ) {

include($file);

}

else {

include('default.html');

}

Continue Reading →Web Exploit – user modifiable Read and Execute can give you Write access

31Aug 2013

OpenStack – Network Controller – Open vSwitch – Network Interfaces Config

by Ventz ⋅ 2 Comments

Setting up the network interfaces is something that seems to give people a hard time (clearly visible here: http://docs.openstack.org/grizzly/basic-install/apt/content/basic-install_network.html). If you follow that guide, one of the most confusing points is how the Open vSwitch fits into the existing architecture.

Assuming you are following the guide, you have 2 networks:
10.10.10.0/24 -> private
10.0.0.0/24 -> public

Your Network Controller, again per the guide, will have an internal-network interface of “10.10.10.9” and an external-network interface of “10.0.0.9”

Your starting network config (/etc/network/interfaces) file will look like this:


########################################
# Internal Network
auto eth0
iface eth0 inet static
    address 10.10.10.9
    netmask 255.255.255.0

# External Network
auto eth1
iface eth1 inet static
    address 10.0.0.9
    netmask 255.255.255.0
    gateway 10.0.0.1
    dns-nameservers 8.8.8.8
########################################

########################################

# Internal Network

auto eth0

iface eth0 inet static

address 10.10.10.9

netmask 255.255.255.0

# External Network

auto eth1

iface eth1 inet static

address 10.0.0.9

netmask 255.255.255.0

gateway 10.0.0.1

dns-nameservers 8.8.8.8

########################################

Now, you will first install the packages needed:


# apt-get install quantum-plugin-openvswitch-agent \
quantum-dhcp-agent quantum-l3-agent

# apt-get install quantum-plugin-openvswitch-agent \

quantum-dhcp-agent quantum-l3-agent

Then you will start the Open vSwitch:


# service openvswitch-switch start

# service openvswitch-switch start

Continue Reading →OpenStack – Network Controller – Open vSwitch – Network Interfaces Config

31Aug 2013

OpenStack – Quantum – Open vSwitch – datapath for tunnels or patch ports

by Ventz ⋅ 6 Comments

Recently, while setting up my the network controller for OpenStack, I saw this message:

# tail -f /var/log/quantum/openvswitch-agent.log

ERROR [quantum.plugins.openvswitch.agent.ovs_quantum_agent] Failed to create OVS patch port. Cannot have tunneling enabled on this agent, since this version of OVS does not support tunnels or patch ports. Agent terminated!

What this means is that the versio of the datapath (shipped by Ubuntu) does not have the support needed to create tunnels or patch ports. This happened on Ubuntu 13.04.

Fortunately, it is VERY easy to solve this. You need to simply build your own datapath for your kernel. For this, you OpenvSwitch’s datapath source, and you need module-assistant:


apt-get install -y openvswitch-datapath-source module-assistant

apt-get install -y openvswitch-datapath-source module-assistant

You can then grab your kernel headers and any other dependencies:


module-assistant prepare

module-assistant prepare

I noticed that either the kernel headers do not have the version.h in the right place, or the module-assistant looks in the wrong place. You can solve this by doing:


cd /lib/modules/`uname -r`/build/include/linux
ln -s ../generated/uapi/linux/version.h .

cd /lib/modules/`uname -r`/build/include/linux

ln -s ../generated/uapi/linux/version.h .

And finally, to download, build, and install the modulle:


module-assistant auto-install openvswitch-datapath

module-assistant auto-install openvswitch-datapath

Now, reboot your system so that the new module is loaded, and you are ready to go. You will notice that “/var/log/quantum/openvswitch-agent.log” no longer has this issue.

24Jul 2013

1 Week (so far) with the BlackBerry Q10!

by Ventz ⋅ 1 Comment

Disclaimer: I wrote this myself and posted it first on PinStack.com. Then I posted it on CrackBerry.com. I am re-posting it here because I think it will benefit people, and I would like to save a copy of it.

[I am going at this from truly personal experience, along with some background so that you know what kind of an user I am. If you are interested in the specs and overall usage, there are thousands of reviews. I hope that people will appreciate this a bit more than a typical “i used it, it made phone calls, it lasted 12 hours, the screen is small, the back over heated, the keyboard was amazing, it’s not an iPhone or Android and there are no apps” review]

First – a bit of background about me and cellphones: to call myself a cellphone enthusiast/a power user, or someone who is obsessed with cellphones would be kind of like calling Tiger Woods “ok at golf” or the Bugatti Veyron “faster than a honda”. To give you some quick numbers: I’ve gone though >30 phones in ~4 years (many many more since the early part of 2000), I have switched through each major US carrier about ~5 times, and in the whole process, I have only paid a cancellation fee twice. [Please note that I have really toned this down lately – mostly because carriers like Samsung have found a way to push a new device every 3-4 months without doing anything exciting and ground breaking.]

Continue Reading →1 Week (so far) with the BlackBerry Q10!

22Feb 2013

Firewall the Inside of your OpenVPN or L2TP/IPSec Tunnel on Android

by Ventz ⋅ 4 Comments

The Scenario:

Let’s say you are at a coffee shop with public internet access, and you don’t want someone snooping on your traffic, so you VPN to your work. However, you also don’t want to tunnel personal stuff out of your work VPN (chat, facebook, youtube, your personal email maybe?), so the question becomes, how do you create 2 different firewalls – one that ONLY allows you to VPN and does not allow any other applications access, and one that then controls the traffic within the VPN channel so that you can utilize the connection for some apps but not others?

At this point, there are only 2 “methods” of running a Firewall on Android: having root and managing/accessing IPTables, or, the only alternative – creating a sub-VPN channel that you pipe the traffic over and filter (which does not require root). Unfortunately, the second type (without root) will not work for this, since we will need to utilize the VPN channel ourselves for our VPN, and to my knowledge, Android let’s you setup only 1 active VPN channel. So, you need 1.) a way to root and 2.) a good Firewall

Continue Reading →Firewall the Inside of your OpenVPN or L2TP/IPSec Tunnel on Android

« Previous 1 2 3 4 5 Next »

Author Archives: Ventz

Sending HTML emails with Perl to a remote SMTP with TLS

GHOST – glibc Remote Linux Vulnerability POC Exploit – CVE-2015-0235

OpenSSL – SSL 3.0 Poodle Vulnerability

Bash remote exploit vulnerability

Web Exploit – user modifiable Read and Execute can give you Write access

OpenStack – Network Controller – Open vSwitch – Network Interfaces Config

1 Week (so far) with the BlackBerry Q10!

Firewall the Inside of your OpenVPN or L2TP/IPSec Tunnel on Android

Post Navigation