CERCHIARE PARTE DI UN IMMAGINE

Salve a tutti,
non riesco a cerchiare alcune parti di un’immagine inserita in una slide fatta con beamer. Precisamente ho un immagine che raffigura una schermata di Wireshark e devo analizzarla. Quindi ho pensato di inserire frecce e testi animati lateralmente con overpic, ma sull’immagine non riesco a cerchiare con un ellisse o un rettangolo la parte interessata. Pensavo di poterla fare usando draw ma non ci sono riuscita. HELP.

`

\documentclass{beamer}
\usepackage{graphicx, overpic}
\usepackage{tikz}
\usetheme{Padova}

\title{Final Project}
\subtitle{Group 15\\Course of Computer Network Management\\}
\author{Nicol\'o Casazza \\ Jessica Mangano}
\date{}

\begin{document}

\maketitle

\begin{frame}{Outline}
\tableofcontents
\end{frame}

\section{HTML Injection + XML Bomb}

\begin{frame}{Network Configuration }
\centering

\begin{figure}[h]
\centering
\includegraphics[width=16cm] {NETWORK.png}
% \caption{Response ricevuta dal Client CoAP}
\label{etichetta}
\end{figure}
\end{frame}
\begin{frame}{HTML Injection}

Very famous attack (OWASP category A1).\\
\vspace{0.7cm}
A page which does not handle data processing correctly (HTML tags are not escaped and/or not stripped) can be attacked with HTML injection.\\
\vspace{0.7cm}
An attacker can exploit a badly programmed processing routine to inject malicious code into a web page.
\end{frame}
\begin{frame}{Example}
In this vulnerable webpage:\\
\begin{figure}[h]
\centering
\includegraphics[width=5cm] {html1.jpg}
% \caption{Response ricevuta dal Client CoAP}
\label{etichetta}
\end{figure}
If we type the following HTML code in the first text box:
$\langle button\rangle Hi \langle/ button \rangle$
\end{frame}
\begin{frame}{Example}
We obtain this result:
\begin{figure}[h]
\centering
\includegraphics[width=6cm] {html2.jpg}
% \caption{Response ricevuta dal Client CoAP}
\label{etichetta}
\end{figure}
The button has been injected into the web page.
\end{frame}

\begin{frame}{XML Bomb}
Now we want to inject something more interesting into the web page to attack the web server. \\
\vspace{0.7cm}
A very simple DoS attack against a web server is an XML Bomb, and it can be done simply by injecting HTML and JavaScript code into the victim.
\end{frame}

\begin{frame}{XML Bomb}
\begin{figure}[h]
\centering
\includegraphics[width=10cm] {xml.jpg}
% \caption{}
\label{etichetta}
\end{figure}
\end{frame}

\begin{frame}{XML Bomb}
When the XML parser reads this code, it sees the root element “lolz'', which contains the string “lol9''. \\
However “lol9'' is composed by 10 “lol8''strings… \\
And “lol8'' itself is composed by 10 “lol7'' strings…\\
… \\
\vspace{0.7cm}
In the end, the root element “lolz'' is composed by $10^9$ “lol'' strings! \\
To parse this 1KB document, the server will need 3 Gbytes of memory!!
\end{frame}
\begin{frame}{Prevention}
\begin{itemize}
\item Escape HTML code correctly during the processing of data.
\item Set a maximum amount of memory for the XML parser.
\end{itemize}
\end{frame}

\section{DCOM-RPC Vulnerability + Worm}

\begin{frame}{DCOM-RPC Vulnerability}
Exploit discovered in 2003 (MS03-026) affecting Windows 2000 and XP up to SP1. \\
Used by the very famous Blaster worm \\
\vspace{0.7cm}
Exploits a vulnerability in the Windows RPC (Remote Procedure Call) service. \\
\vspace{0.7cm}
By sending a malformed packet to port 135 an attacker can cause a buffer overflow on the victim and gain complete control.
\end{frame}

\begin{frame}{Network Configuration}
\begin{figure}[hc]
\includegraphics[width=12cm] {NETEXPLOIT.png}
% \caption{Response ricevuta dal Client CoAP}
\label{etichetta}
\end{figure}
\end{frame}

\begin{frame}{Network Configuration}
The network features different machines:
\begin{itemize}
\item 6x Windows XP SP1 Clients
\item 1x Windows XP SP1 + Firewall Client
\item 1x Windows XP SP3 Client
\item 1x Windows XP SP1 Professional (FTP and Web server)
\end{itemize}
\vspace{0.7cm}
The Clients have a bandwidth of 100Mbit/s up/down. \\
The Server has a bandwidth of 250Mbit/s up/down.
\end{frame}

\begin{frame}{BadBlood Worm}
The attacker machine (192.168.155.10) wants to attack the server, which is connected to the internet with address 82.96.4.13, using the DCOM-RPC exploit. \\
\vspace{0.6cm}
To do so, he will use a simple worm, BadBlood, which will exploit the server, plant a backdoor, and then infect all the vulnerable clients.\\
\vspace{0.7cm}
Once all the clients are infected, the attacker can exploit the backdoors to take down the server.
\end{frame}

\begin{frame}{BadBlood: attacker part}
Once the attacker runs the following command:
\begin{figure}[hc]
\includegraphics[width=9cm] {dcom1.png}
\label{etichetta}
\end{figure}
The DCOM-RPC exploit will be launched against the server, copying the backdoor and other files onto the victim.
\end{frame}

\begin{frame}{Wireshark Capture}

\begin{overpic} [width=8cm]{dcom2.png}
\pause
\put(120,57){ ciao}
\put(110,57){\vector(-2, 0){10}}
%\begin{tikzpicture}
% \draw (3, 0) rectangle (6 , 2);
%\end{tikzpicture}

%\begin{tikzpicture}
% \draw (6, 2) ellipse (5 and 4);
%\end{tikzpicture}
\end{overpic}

%\begin{figure}[hc]
%\includegraphics[width=8cm] {dcom2.png}
%\label{etichetta}
%\end{figure}
\end{frame}

\begin{frame}{Attacker: steps}
\begin{itemize}
\item Exploit the server using DCOM-RPC
\item Connect to the victim with Netcat
\item Copy the exploit files via FTP
\item Start the backdoor on the victim
\item Quit
\end{itemize}
\end{frame}

\begin{frame}{Visible effects}
Besides for the traffic, the only visible effect on an infected machine is:
\begin{figure}[hc]
\includegraphics[width=4cm] {dcom3.png}
% \caption{Response ricevuta dal Client CoAP}
\label{etichetta}
\end{figure}
\end{frame}

\begin{frame}{BadBlood: server backdoor}
Once the server has rebooted, the backdoor will start automatically with Windows via a registry key installed by the backdoor itself. \\
\vspace{0.7cm}
It will then perform several steps:
\begin{itemize}
\item Check if it already performed the infection payload
\item If it didn't, scan for every network the server is connected to, and send a packet on port 135 to each address in each subnetwork to look for potential victims
\item Whoever answers to this request is a potential victim
\end{itemize}
\end{frame}

\begin{frame}{BadBlood: server backdoor (2)}
\begin{itemize}
\item For each potential victim, perform OS recognition with nmap to identify the real vulnerable machines
\item Attack each vulnerable machine with the DCOM-RPC exploit as seen before
\item Connect to each victim, copy the backdoor via FTP and run it
\item Disconnect, then wait for a server reboot, and wait for further commands from the attacker by opening a listening socket on port 1313.
\end{itemize}
\end{frame}

\begin{frame}{BadBlood: client backdoor}
After the infection routine has completed, all vulnerable machines are now running the client backdoor. \\
\vspace{0.7cm}
Once again, the backdoor will start with Windows via a registry key, and its only purpose is to wait for a command to attack. \\
Just like the server counterpart, a socket listening on port 1313 has been opened.

\end{frame}
\begin{frame}{BadBlood: final attack}
Once the attacker issues the following command on his machine:
%inserire immagine%

\begin{figure}[hc]
\includegraphics[width=10cm] {dcom4.png}
% \caption{Response ricevuta dal Client CoAP}
\label{etichetta}
\end{figure}

A packet is sent to the server on port 1313. \\ Whenever the server backdoor receives it, as a response it sends a packet to each machine of each subnetwork it's connected to (just like the infection routine) on port 1313. \\
That is the signal for the clients to begin the attack against the server: an ICMP Flood DDoS will soon hit the server, while using all the bandwidth and CPU time of the clients.
\end{frame}
\begin{frame}{Effects}
\begin{itemize}
\item The clients are not responsive due to the DDoS using all of their resources and bandwidth.
\item The server becomes very laggy to use due to the high number of packets he's forced to process (10000-15000 packets per second).
\item The web server takes a very long time to respond (if at all) because of the bandwidth being completely utilized by the DDoS attack.
\end{itemize}
\end{frame}
\begin{frame}{Prevention}
\begin{itemize}
\item Being a very old vulnerability, the obvious solution is to upgrade the operating system to a not vulnerable version.
\item Blocking port 135 by using a firewall stops the exploit completely.
\item Blocking port 1313 can be a workaround to avoid the execution of the payload, but it won't avoid the infection or the exploitation of the machine.
\end{itemize}

\end{frame}
\begin{frame}{Conclusion}
\centering
\huge Thanks!!!
\end{frame}

\end{document}

`

Precisamente è questa parte

`

\begin{frame}{Wireshark Capture}

\begin{overpic} [width=8cm]{dcom2.png}
\pause
\put(120,57){ ciao}
\put(110,57){\vector(-2, 0){10}}
%\begin{tikzpicture}
% \draw (3, 0) rectangle (6 , 2);
%\end{tikzpicture}

%\begin{tikzpicture}
% \draw (6, 2) ellipse (5 and 4);
%\end{tikzpicture}
\end{overpic}

%\begin{figure}[hc]
%\includegraphics[width=8cm] {dcom2.png}
%\label{etichetta}
%\end{figure}
\end{frame}

`

ho commentato perchè mi da un unica figura enorme che non riesco a spostare dall’immagine, mentre io voglio evidenziare alcune parti dell’immagine