Nexus: Reverse Engineering

ApplicationInspector

Read

Kang Asu

ApplicationInspector - A Source Code Analyzer Built For Surfacing Features Of Interest And Other Characteristics To Answer The Question 'What'S In It' Using Static Analysis With A Json Based Rules Engine

It includes a filterable confidence indicator to help minimize false positives matches as well as customizable default rules and conditional match logic.
Be sure to see our project wiki page for more help https://Github.com/Microsoft/ApplicationInspector/wiki for illustrations and additional information and help.

Goals
Application Inspector helps inform you better for choosing the best components to meet your needs with a smaller footprint of unknowns for keeping your application attack surface smaller. It helps you to avoid inclusion of components with unexpected features you don't want.
Application Inspector can help identify feature deltas or changes between component versions which can be critical for detecting injection of backdoors.
It can be used to automate detection of features of interest to identify components that require additional scrutiny as part of your build pipeline or create a repository of metadata regarding all of your enterprise application.
Basically, we created Application Inspector to help us identify risky third party software components based on their specific features, but the tool is helpful in many non-security contexts as well.

Application Inspector v1.0 is now in GENERAL AUDIENCE release status. Your feedback is important to us. If you're interested in contributing, please review the CONTRIBUTING.md.

Contribute
We have a strong default starting base of Rules for feature detection. But there are many feature identification patterns yet to be defined and we invite you to submit ideas on what you want to see or take a crack at defining a few. This is a chance to literally impact the open source ecosystem helping provide a tool that everyone can use. See the Rules section of the wiki for more.

Getting Application Inspector
To use Application Inspector, download the relevant binary (either platform-specific or the multi-platform .NET Core release). If you use the .NET Core version, you will need to have .NET Core 3.0 or later installed.
It might be valuable to consult the project wiki for additional background on Rules, Tags and more used to identify features. Tags are used as a systematic heirarchal nomenclature e.g. Cryptography.Protocol.TLS to more easily represent features.

Usage
Application Inspector is a command-line tool. Run it from a command line in Windows, Linux, or MacOS.

> dotnet AppInspector.dll or on *Windows* simply AppInspector.exe  

Microsoft Application Inspector 1.0.17
ApplicationInspector 1.0.17

(c) Microsoft Corporation. All rights reserved

ERROR(S):
  No verb selected.

  analyze        Inspect source directory/file/compressed file (.tgz|zip) against defined characteristics
  tagdiff        Compares unique tag values between two source paths
  tagtest        Test presence of smaller set or custom tags in source (compare or verify modes)
  exporttags     Export default unique rule tags to view what features may be detected
  verifyrules    Verify rules syntax is valid
  help           Display more information on a specific command
  version        Display version information

Examples:

Command Help

  Usage: dotnet AppInspector.dll [arguments] [options]

  dotnet AppInspector.dll -description of available commands
  dotnet AppInspector.dll  -options description for a given command

Analyze Command

  Usage: dotnet AppInspector.dll analyze [arguments] [options]

  Arguments:
  -s, --source-path             Required. Path to source code to inspect (required)
  -o, --output-file-path        Path to output file.  Ignored with -f html option which auto creates output.html
  -f, --output-file-format      (Default: html) Output format [html|json|text]
  -e, --text-format             (Default: Tag:%T,Rule:%N,Ruleid:%R,Confidence:%X,File:%F,Sourcetype:%t,Line:%L,Sample:%m) 
  -r, --custom-rules-path       Custom rules path
  -t, --tag-output-only         (Default: false) Output only contains identified tags
  -i, --ignore-default-rules    (Default: false) Ignore default rules bundled with application
  -d, --allow-dup-tags          (Default: false) Output only contains non-unique tag matches
  -c, --confidence-filters      (Default: high,medium) Output only if matches rule pattern confidence [,] [high|medium|low]
     -k, --include-sample-paths    (Default: false) Include source files with (sample,example,test,.vs,.git) in pathname in analysis
  -x, --console-verbosity       (Default: medium) Console verbosity [high|medium|low|none]
  -l, --log-file-path           Log file path
  -v, --log-file-level          (Default: Error) Log file level [Debug|Info|Warn|Error|Fatal|Off]

Scan a project directory, with output sent to "output.html" (default behavior includes launching default browser to this file)

  dotnet AppInspector.dll analyze -s /home/user/myproject

Add custom rules (can be specified multiple times)

  dotnet AppInspector.dll analyze -s /home/user/myproject -r /my/rules/directory -r /my/other/rules

Write to JSON format

  dotnet AppInspector.dll analyze -s /home/user/myproject -f json

Tagdiff Command
Use to analyze and report on differences in tags (features) between two project or project versions e.g. v1, v2 to see what changed

  Usage: dotnet AppInspector.dll tagdiff [arguments] [options]

  Arguments:
  --src1                        Required. Source 1 to compare (required)
  --src2                        Required. Source 2 to compare (required
  -t, --test-type               (Default: equality) Type of test to run [equality|inequality]
  -r, --custom-rules-path       Custom rules path
  -i, --ignore-default-rules    (Default: false) Ignore default rules bundled with application
  -o, --output-file-path        Path to output file
  -x, --console-verbosity       Console verbosity [high|medium|low
  -l, --log-file-path           Log file path
  -v, --log-file-level          Log file level [error|trace|debug|info]

Simplist way to see the delta in tag features between two projects

  dotnet AppInspector.dll tagdiff --src1 /home/user/project1 --src2 /home/user/project2

Basic use

  dotnet AppInspector.dll tagdiff --src1 /home/user/project1 --src2 /home/user/project2 -t equality

Basic use

  dotnet AppInspector.dll tagdiff --src1 /home/user/project1 --src2 /home/user/project2 -t inequality

TagTest Command
Used to verify (pass/fail) that a specified set of rule tags is present or not present in a project e.g. user only wants to know true/false if crytography is present as expected or if personal data is not present as expected and get a simple yes/no result rather than a full analyis report.
Note: The user is expected to use the custom-rules-path option rather than the default ruleset because it is unlikely that any source package would contain all of the default rules. Instead, create a custom path and rule set as needed or specify a path using the custom-rules-path to point only to the rule(s) needed from the default set.

Otherwise, testing for all default rules present in source will likely yield a false or fail result in most cases.

  Usage: dotnet AppInspector.dll tagtest [arguments] [options

  Arguments:
  -s, --source-path             Required. Source to test (required)
  -t, --test-type               (Default: rulespresent) Test to perform [rulespresent|rulesnotpresent]
  -r, --custom-rules-path       Custom rules path 
  -i, --ignore-default-rules    (Default: true) Ignore default rules bundled with application
  -o, --output-file-path        Path to output file
  -x, --console-verbosity       Console verbosity [high|medium|low
  -l, --log-file-path           Log file path
  -v, --log-file-level          Log file level

Simplest use to see if a set of rules are all present in a project

  dotnet AppInspector.dll tagtest -s /home/user/project1 -r /home/user/myrules.json

Basic use

  dotnet AppInspector.dll tagtest -s /home/user/project1 -r /home/user/myrules.json -t rulespresent

Basic use

  dotnet AppInspector.dll tagtest -s /home/user/project1 -r /home/user/myrules.json -t rulesnotpresent

ExportTags Command
Simple export of the ruleset schema for tags representing what features are supported for detection

  Usage: dotnet AppInspector.dll exporttags [arguments] [options]

  Arguments:
  -r, --custom-rules-path       Custom rules path
  -i, --ignore-default-rules    (Default: false) Ignore default rules bundled with application
  -o, --output-file-path        Path to output file
  -x, --console-verbosity       Console verbosity [high|medium|low

Export default rule tags to console

  dotnet AppInspector.dll exporttags

Using output file

  dotnet AppInspector.dll exporttags -o /home/user/myproject/exportags.txt

With custom rules and output file

  dotnet AppInspector.dll exporttags -r /home/user/myproject/customrules -o /hom/user/myproject/exportags.txt

Verify Command
Verification that ruleset is compatible and error free for import and analysis

  Usage: dotnet AppInspector.dll verifyrules [arguments]

  Arguments:
  -r, --custom-rules-path       Custom rules path
  -i, --ignore-default-rules    (Default: false) Ignore default rules bundled with application
  -o, --output-file-path        Path to output file
  -x, --console-verbosity       Console verbosity [high|medium|low

Simplist case to verify default rules

  dotnet AppInspector.dll verifyrules

Using custom rules only

  dotnet AppInspector.dll verifyrules -r /home/user/myproject/customrules -i

Build Instructions
Building from source requires .NET Core 3.0. Standard dotnet build commands can be run from the root source folder.

Framework Dependent

  dotnet build -c Release

Platform Targeted Portable

  dotnet publish -c Release -r win-x86
  dotnet publish -c Release -r linux-x64
  dotnet publish -c Release -r osx-x64

Download ApplicationInspector

Regards

Kang Asu

CHAPS

By 0x000216

Read

0 Comments

Kang Asu

CHAPS - Configuration Hardening Assessment PowerShell Script

CHAPS is a PowerShell script for checking system security settings where additional software and assessment tools, such as Microsoft Policy Analyzer, cannot be installed. The purpose of this script is to run it on a server or workstation to collect configuration information about that system. The information collected can then be used to provide recommendations (and references) to improve the security of the individual system and systemic issues within the organization's Windows environment. Examples of environments where this script is useful include Industrial Control System (ICS) environments where systems cannot be modified. These systems include Engineer / Operator workstations, Human Machine Interface (HMI) systems, and management servers that are deployed in production environments.
This script is NOT intended to be a replacement for Microsoft's Policy Analyzer. The best way to audit a system's configuration is to use the Microsoft Security Compliance Toolkit and Policy Analyzer with a Windows Workstation Security Baseline GPO. The Policy Analyzer's output can be exported an MS Excel file, but it requires the Microsoft Excel is installed on the system. Cut and pasting this information does work, but might not be an option on a physical system. Also, using the Policy Analyzer requires installation of the Windows software, which may not be permitted.
This script runs in PowerShell and should be PowerShell-version independent. Some checks may fail depending on the Windows version, system configurations, and whether or not it is run with Administrator privileges. Instances where commands did not run successfully are noted and should be manually investigated where possible.
This script was developed using information from several sources (noted in Useful Resources section) to identify recommended security configurations to reduce the likelihood of a compromised system and to log user events conducted on the system. It pulls heavily from the Securing Windows Workstations baseline outlined by Sean Metcalf.

How To Use
The best way to run this script within an ICS environment is to not write any programs or scripts to the system being reviewed. Do this by serving these scripts from a webserver running on another system on the network. Download CHAPS and PowerSploit into the same directory and open a terminal and change into that directory. Using Python3 run the command 'python3 -m http.server 8181'. This will start a webserver listening on all of the systems IP addresses.
On the target system open a CMD.exe window, preferably as an Administrator. Run the command powershell.exe -exec bypass to being a PowerShell prompt. From this prompt, run the following command to execute the chaps.ps1 script.

IEX (New-Object Net.WebClient).DownloadString('http://:8181/chaps/chaps.ps1')

To run the chaps-powershell.ps1 script be sure to turn off the system's Anti-virus to include real-time protection. Running the following commands will import the appropriate PowerSploit scripts and then run them.

IEX (New-Object Net.WebClient).DownloadString('http://:8181/PowerSploit/Recon/PowerView.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://:8181/PowerSploit/Exfiltration/Get-GPPPassword.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://:8181/PowerSploit/Exfiltration/Get-GPPAutologon.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://:8181/PowerSploit/Exfiltration/Get-VaultCredential.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://:8181/PowerSploit/Privesc/PowerUp.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://:8181/chaps/chaps-powersploit.ps1')

Each script's outputs will be written to the user's Temp directory as defined by the $env:temp variable. Copy these files off of the system being reviewed, delete them, and, if necessary, restart the system's anti-virus.

System Configuration Checks

System Info Command

Run the systeminfo command to get system information to run the Windows Exploit Suggester - Next Generation tool.

System Information

Administrator rights
- This check determines if the user running the script has administrator rights. Some checks may not work without admin rights. Most of the checks will work, unless some security controls or configurations prevent it.
- There is an error suppression line that has been disabled. Uncomment the line to suppress all errors. The "-ErrorAction SilentlyContinue" has also been used on some of the commands within the script.
System information
- System Version
- User and Path Information
- System IPv4 addresses.
- System IPv6 addresses.
- Windows AutoUpdate configuration.
- Check for missing Critical and Important Updates
- Check for BitLocker Disk Encryption
- Check AlwaysInstallElevated Registry Keys
PowerShell Event Log Settings
- Determine if PowerShell Commandline Auditing is Enabled.
- Determine if PowerShell Module Logging is Enabled.
- Determine if PowerShell Script Block and Invocation Logging is Enabled.
- Determine if PowerShell PowerShell Invocation Header Logging is Enabled.
- Determine if PowerShell Protected Event Logging is Enabled.
Windows Event Log Configurations
- Check the maximum log file settings for critical logs:
- Application
- System
- Security
- Windows PowerShell
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Microsoft-Windows-TaskScheduler/Operational
- Microsoft-Windows-SMBServer/Audit
- Microsoft-Windows-Security-Netlogon/Operational
- Microsoft-Windows-WinRM/Operational
- Microsoft-Windows-WMI-Activity/Operational
PowerShell Configuration Settings
- Version of default PowerShell
- Check if PowerShell version 2 is permitted.
- Determine installed versions of .NET to determine if they support PowerShell version 2.
- Determine if PowerShell Language Mode is "ConstratinedLanguage".
Cached Credentials
- Check how many Cached Credentials the system is configured to maintain.
Remote Access Configurations
- Determine if RDP is configured to permit remote connections.
  - Check the setting of AllowRemoteRPC.
  - Check the setting of fDenyTSConnections.
Understand WinRM configuration.
- Test if the WinRM Service is running using two different methods.
- Check the Windows Firewall configuration to see if the rules to permit WinRM are enabled.
Local Administrator Accounts
- Determine if more than one user is a member of the Local Administrator group.

CHAPS PowerSploit Security Checks
The PowerSploit project (dev branch) can be used to gather additional information about the system. The chaps-powersploit.ps1 script has been developed to gather this information. Of course, most anti-malware programs will prevent, protect, and alert on the use of PowerSploit. Therefore, the anti-malware should be disabled or the chaps-powersploit.ps1 script should not be used, NOTE: anti-malware programs should be re-enabled immediately upon verification that the script ran correctly.

chaps-powersploit.ps1 TODO:
Here are a list of things that aren't working, need to be addressed, or are possible function requests.

Needs to be tested in a Domain environment.
Handle errors gracefully.
Identify new cmdlets to run, such as Find-InterestingFiles with a list of specific files related to ICS project files.

Secure Baseline Checks - Securing Windows Workstations

Check AppLocker
- Determine if AppLocker is configured to monitor scripts, at a minimum.
Check EMET
- If version is less than Windows 10, check that EMET service is running.
Deploy LAPS
- Determine if LAPS is installed. NOTE: not checking if it is configured or used.
Force Group Policy to reapply settings during “refresh”
- Determine how NoGPOListChanges is configured to see if GPOs are allied everytime they are checked.
Disable Net Session Enumeration
- NOTE: For now, extra actions are required to test this. See: TechNet script NetSessEnumPerm.ps1
Disable WPAD
- Check for a WPAD entry in the Windows "etc\hosts" file.
- Check for the WpadOverride registry key.
- Determine if the WinHTTPAutoProxySvc is running.
- Check if the Windows Hotfix KB3165191 is installed.
- Check WINS configuration.
- Determine network adapter configurations for:
  - DNSEnabledForWINSResolution
  - WINSEnableLMHostsLookup
Disable LLMNR
- Detemine if DNSClient.EnableMulticast is disabled.
Disable Windows Browser Protocol
- Determine if the Computer Browser service is running.
Disable NetBIOS
- Check the setting of TcpipNetbiosOptions to determine if it is disabled.
Disable Windows Scripting
- Check if Windows Scripting Host registry key is enabled.
- Check if Windows Hotfix KB2871997 is installed.
- NOTE: not sure how to check "Control Scripting File Extensions"
Prevent Interactive Login
- Check the configuration of registry key LocalAccountTokenFilterPolicy to see if it is disabled.
Disable WDigest
- Check the configuration of registry key WDigest.UseLogonCredential to determine if it is disabled.
Disable SMBv1
- Use Get-SmbServerConfiguration to check:
  - If SMBv1 is disabled.
  - If SMBv1 auditing is enabled.
Block Untrusted Fonts on Windows 10
- Check the registry key Kernel.MitigationOptions to determine if it is configured to block untrusted fonts.
Enable Credential / Device Guard on Windows 10
- Check if the Credential Guard or HVCI service is running. NOTE: not checking configuration settings.
- Check if Device Guard is configured. NOTE: not checking configuration settings.
Secure LanMan Authentication
- Check if the registry key Lsa.NoLmHash is enabled.
- Check if the registry key Lsa.LmCompatibilityLevel is configured to "Send NTLMv2 response only. Refuse LM & NTLM."
- Check if Anonymous Enumeration of domain is restricted.
- Check if Anonymous Enumeration of local system is restricted.
Secure Microsoft Office
- Not implemented at this time.
Restrict RPC Clients
- Determine if remote RPC client access is restricted.
Configure NTLM session security
- Check NTLM Session Server Security settings to determine if it requires NTLMv2 and 128-bit encryption.
- Check NTLM Session Client Security settings to determine if it requires NTLMv2 and 128-bit encryption.

CHAPS TODO:
Here are a list of things that aren't working, need to be addressed, or are possible function requests.

Issues
- WMI remoting and firewall rules may be required by Vulnerability scanning tools. Thus, if enabled, test for limiting to users and specific systems.
- Fix PowerShell version 2 check
- Fix .NET version check.
  - (Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse -Error Action 0| Get-ItemProperty -Name Version -ErrorAction 0) | Select-Object Version
Useful
- Generate lines for reporting.
  - Marked so another script can scan the result and build finding and recommendation sections for a report.
- Check for SYSMON Program.
- Update checks so that they are Windows version specific. E.G. Windows 10, Windows 7, Windows 2018.
- List Installed Programs (to include x86) and programs installed directly to C: drive
- Detect and acquire version information for JAVA, flash, and Adobe.
Nice-To-Haves
- Update with Domain tests, as a user specified option.
- CMD-only (non-PowerShell) version.
- Add checks from Carlos Perez's HoneyBadger plugin. Must be converted from Ruby to PowerShell.

Useful Resources:

Securing Windows Workstations: Developing a Secure Baseline
Windows Privilege Escalation Fundamentals
New tool: Policy Analyzer
Use PowerShell to Explore Active Directory Security
Penetration Testers’ Guide to Windows 10 Privacy & Security
15 Ways to Bypass the PowerShell Execution Policy
NOTE: Additional resources are outline throughout the script as references to resources that helped outline what to check for the associated subject.

Download Chaps

Regards

Kang Asu

Nexus

ApplicationInspector

CHAPS

Recent Posts

Facebook