Nessus and WSUS

Tenable recently added the ability to query various patch deployment management systems to get the patching status of the system being scanned.

This is a handy feature when you can not use scans in order to query the scanned system directly because of credential or port restrictions.

The set up is explained very well at http://blog.tenablesecurity.com/2011/12/wsus-patch-management-and-nessus.html.

When testing in my environment, the WSUS scan was not working. Looking at the event logs on the WSUS server, showed several account logon failures. A little searching  lead me to make the changes detailed in http://technet.microsoft.com/en-us/library/cc720470(WS.10).aspx and voilà...patch management status and other vulnerability details all in one handy report.

Christmas Challenge 2011

Well....I didn't win the annual Ed Skoudis and friends Christmas Challenge (http://pen-testing.sans.org/blog/2012/01/26/holiday-challenge-2011-winners-answers) but thought I would share my solution anyway.
Please fell free to sing along................


Well now Rudolph was frantic
cause Grandma was missing
The police thought he did it
His iPhone confirmed it.
The GPS on the phone
Matched a jpg showing Grandma's coat alone.

Rudolph heard little Timothy
interrupt and tell the court.
He had found some evidence
but did not know how to parse it out.

Cupid had mad Wireshark skills
and went right to work.
The first thing that he noticed
was an email and a doc in Word.

The email revealed a secret plan
that Grandma had cooked up.
She planned to frame Rudolph
and topped her insurance up.

The capture showed a fatal flaw
with Santaslist PHP.
Grandma took over MyDNS,
by hacking her some Apache.

Then with trojaned updates
and the DNS manipulation,
SQLite was used to add
the damning CellLocation.
Rudolph was proven innocent.
The Plaza was where they knew,
the police could find Grandma
wearing one red shoe.

BONUS: Extended special live only verse
And so little Timmy Tweeted,
"Network Miner is 'freein'
Rudolph’s not a flea bitten beast
and for Grandma there'll be no Caribbean"

W3AF update on Samurai WTF

Here is my unscientific will probably only work once method for getting the latest version of w3af to run in Samurai WTF (http://samurai.inguardians.com/):

After I updated w3af using the svn update menu in Samurai, launching the w3af GUI present some errors. It seems that the latest version of w3af needs some extra python fu libraries. Fortunately, w3af is very helpful and suggests which packages to install. Unfortunately, doing an apt-get for the required packages returned a message of Couldn't find package __X__ for each package.

The Samurai WTF version I am using, .9something, is running an older version of Ubuntu, Jaunty, whose packages are not actively maintained.
:
To get the required packages, the following worked for me"

Add the following to /etc/apt/sources

deb http://old-releases.ubuntu.com/ubuntu/ jaunty main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ jaunty-updates main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ jaunty-security main restricted universe multiverse

Do an apt-update
apt-get python-svn python-scapy and python2.6-dev
The next piece of the puzzle was python-nltk, which had to be installed manually from nltk.org. The source is available on the site. It require one python-yaml, which could be added with another apt-get install python-yaml..
Then finally, follow the instructions from w3af on how to install pybloomfiltermap and success....w3af GUI goodness.

Your mileage may vary.