Showing posts with label windows. Show all posts
Showing posts with label windows. Show all posts
Thursday, April 13, 2017
Peculiarities of a New Windows TCP IP Stack
Peculiarities of a New Windows TCP IP Stack
Starting with Windows Vista, Microsoft has switched its operating systems to a new network stack — Next Generation TCP/IP Stack. The stack is stuffed with various perks: Windows Filtering Platform, a scalable TCP window and other delicacies. But it’s not them we will be talking about, but a specific behavioral pattern of the new network stack.Any self-respecting network scanner should be able to detect an operating system used on the host being scanned. The more parameters it uses for this purpose, the more accurate the result is. For example, Nmap employs a wide range of metrics: various TCP metrics (the timestamp values behavior, re-ordering TCP options), IP metrics (an algorithm for a packet order number calculation, processing of IP packet flags) and other metrics.
In Positive Technologies, we also collect metrics and detect OS versions. So, I’d like to tell you about a metric I’ve found recently. This metric allows detecting Windows systems that use the new stack. The detection method is based on the analysis of ICMP Timestamp responses. ICMP Timestamps is a distant ancestor of synchronization protocols that allows requesting time of a remote system. A request and response structure of ICMP Timestamp is provided in Figure 1.
Figure 1. A request and response structure of ICMP Timestamp.
The bars in red are for a standard ICMP header. Below are the timestamp bars that indicate the moment when the request was sent, the moment when the request was received by a remote user, and the moment when the response was sent by the remote user. Timestamps are the amount of milliseconds having passed from midnight till UTC. If the host is incapable of sending its time data accurate to millisecond, it should set its high bit to 1 and send at list something as time data. We are interested in the last timestamp. The fact is that Microsoft, as it tends to be, was quite frivolous about the RFC implementation: instead of transmitting the network byte order, the system sends a temporary timestamp with the host byte order without setting the high bit to 1, though it does send the timestamps accurate to a second. Moreover, starting from Vista, the Windows systems, for some inexplicable reason, do some crazy things with timestamps.
Figure 2 describes a standard behavior of timestamps. The blue line represents timestamps received from the server, while the red one represents the server time. The X axis stands for the time passed since the experiments started; the Y axis represents timestamp values in seconds. The
Figure 2 — A standard timestamp behavior.
However, the actual behavior was a far cry from all standards. Take a look at Figure 3 (the time resolution is higher).
Figure 3 — Timestamp behavior in a higher time resolution.
As you can see, every second the value of the transmitted timestamp exceeds the true one by 10000 seconds. The gaps on the graph are a mere result of the Windows scheduler decision to break off our program.
It might be that Windows transmits timestamps this way to baffle the attacker who’s trying to find out the remote host time. This behavior is typical only for Windows systems with the new stack, which allows employing the new way of detecting such systems.
Thank you for your attention.
Author: Stanislav Kirillov, Positive Research
Available link for download
Saturday, March 25, 2017
PIDGIN INSTANT MESSENGER FOR WINDOWS
PIDGIN INSTANT MESSENGER FOR WINDOWS
Name:Pidgin Instant Messenger For WindowsFile size:20 MBDate added:July 3, 2013Price:FreeOperating system:Windows XP/Vista/7/8Total downloads:1676Downloads last week:40Product ranking:★★★☆☆ Pidgin Instant Messenger For Windows is an application that graphically displays the inner workings of Mac OS X. Its user interface displays a multitude of information on the Pidgin Instant Messenger For Windows or in the Dock. The entire UI is completely configurable so you can turn off gauges you dont want, leaving only what youre interested in for easy viewing. Pidgin Instant Messenger For Windows gauges CPU activity (single and dual), system load, network activity, Pidgin Instant Messenger For Windows activity and usage, disk usage, and the current time and date. With a number of useful features for keeping track of your cash flow, accounts, income, and expenses, MoneyWell for Mac Pidgin Instant Messenger For Windows the traditional envelope budgeting method to a whole new level. The program comes with a fully-functional, free trial version limited to 200 transactions. Pidgin Instant Messenger For Windows for Mac seamlessly integrates with Pidgin Instant Messenger For Windows, giving you easy way to create real USPS postage from any photo on your Mac. Zoom, rotate, crop and apply filters to make your postage perfect. This application can easily make "averaged face","montage" and "Flashed Face Distortion Effect" by taking a picture in fitting a frame."averaged face" is putting the face of plural people on top of one another and averaged it.Not only the human being but also "average cat" is Pidgin Instant Messenger For Windows if I do it well."Montage" replaces "eyes","mouth" and "nose" of a face becoming the base . "Flashed Face Distortion Effect" is optical illusion announced in 2011 by Jason M Tangen, Sean C Murphy, Matthew B Thompson.That is all. Available as freeware, the program downloads quickly. Installation is another story, however. Initially, you are prompted to enter Pidgin Instant Messenger For Windows log-in information before the program begins. Once its entered, the next setup dialog Pidgin Instant Messenger For Windows presents troublesome privacy concerns. Essentially, Pidgin Instant Messenger For Windows for Mac seeks authorization to control almost all of the users Pidgin Instant Messenger For Windows features and permissions. This lack of user control is concerning for those with any interest in privacy. In addition, the program asks for all of your personal Pidgin Instant Messenger For Windows information, which can be detailed. The menu appears to allow these to be declined, but when attempted, the menu simply reloads and repeats infinitely. A forced program close did not work and the only way to move past the menu was to authorize the permissions or force a Pidgin Instant Messenger For Windows of the whole Pidgin Instant Messenger For Windows system. After restarting, testing the browser without signing in to Pidgin Instant Messenger For Windows was disappointing. Without the Pidgin Instant Messenger For Windows integration, the browser has no additional features over other, more-polished browsers.
Available link for download
Tuesday, March 7, 2017
PHP features in Windows operating system
PHP features in Windows operating system
Vladimir Vorontsov (aka d0znpp) has published rather interesting research about features in PHP interaction with Windows. It started as the equivalence between the following methods of file access was noticed:- any.phP
- any.php
- any.ph<
- any.ph>
Let’s consider a real situation to clearly understand the value of this method. Please, try to assume that we have a web application with a lot of holes and flaws like a colander. SQL Injection allows us to get admin password hashes, then we restore the passwords, but here’s bad luck – we are unable to find admin page :(. And there’s Sqli, but we cannot access site file system. And there’s LFI, but we can hook nothing :((. And in this situation said method can help!
We use include:
http://site/?file=a<<.php
http://site/?file=b<<.php
http://site/?file=c<<.php
...
And continue until we find something useful. Fox example, we find "useful" on "http://site/?file=m<<.php". The start to brute force 2nd character:
http://site/?file=ma<<.php
http://site/?file=mb<<.php
... and so on.
For this example, "myAdminPaneladmin.php" is a possible result.
Please ensure that this example is just a special case. This PHP feature can be used much wider! I also want to add that this method is applicable for all versions of PHP and on Windows-based systems only.
The origin is available here: http://onsec.ru/onsec.whitepaper-02.eng.pdf
Available link for download
Subscribe to:
Posts (Atom)