Quick Exploit Resource

#500 Character Pattern created by pattern_create.rb in metasploit
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq

#getting the index
python
import string
find(x,"Aq1Aq2Aq")

#Calc.exe win32 shellcode: \x31\xC9\x51\x68\x63\x61\x6C\x63\x54\xB8\xC7\x93\xC2\x77\xFF\xD0

inept.py - ineFFICIENT pASSWORD tESTER

Posted this here:
inept.py

Packet Party on March 1st

The Packet Parties continue!

https://www.nova-labs.org/blog/2012/03/02/february-packet-party-or-this-was-a-high-school-assignment/

Guest Additions for Debian on Virtual Box

From here:
http://virtualboxes.org/doc/installing-guest-additions-on-debian/

1.Login as root;
2.Update your APT database with apt-get update;
3.Install the latest security updates with apt-get upgrade;
4.Install required packages with apt-get install build-essential module-assistant;
5.Configure your system for building kernel modules by running m-a prepare;
6.Click on Install Guest Additions… from the Devices menu, then run mount /media/cdrom.
7.Run sh /media/cdrom/VBoxLinuxAdditions.run, and follow the instructions on screen.

Break Digest Auth

EDIT: REPLACED by inept.py

#!/usr/bin/python
#Quick script to figure out digest authentication for challenge
#By DeBuG
#reference:http://en.wikipedia.org/wiki/Digest_access_authentication
#reference:http://www.hackthissite.org/forums/viewtopic.php?f=28&t=6212

import hashlib

#auth variables

pwdlist = ("password", "hmiviewonly", "L3tmein", "fm3y3r-hmi")

user="fmeyer"
realm="PeakHMI"
uri="GET:/SCRSI/ID=1"

nonce="fFqnLp3940DcScVE/9iALjhEmL/EoUf7"
cnonce="fe7e04332e51a126acf8d41b26a8d934"
nc="00000001"
qop="auth"

#response found in packet, you need to get this if you have the right password
correct_response="a4b130581acb8bf85d92a5a1d6a9c8b5"



#algorithm

for password in pwdlist:
print "\n---Attempting " + password +" ---"
print "MD5:(" + user + ":" + realm + ":" + password + ")"
HA1=hashlib.md5()
HA1.update(user+":"+realm+":"+password)
dHA1=HA1.hexdigest()
print dHA1

print uri
print "MD5:(" + uri + ")"
HA2=hashlib.md5()
HA2.update(uri)
dHA2=HA2.hexdigest()
print dHA2

response=":"+nonce+":"+nc+":"+cnonce+":"+qop+":"
print "MD5:("+str(dHA1)+response+str(dHA2)+")"
respHA=hashlib.md5()
respHA.update(str(dHA1)+response+str(dHA2))
finalHA=respHA.hexdigest()

print "\nfinal: "+finalHA
print "response: "+correct_response

if (finalHA==correct_response):
print "FOUND!"
break

Snort Rules for Evilgrade

I put together a python script to create snort rules for evilgrade.  With this you can look for any updates you might want to intercept. The script points to a directory containing evilgrade (.pm) modules. It uses the default backtrack 5 directory which is /pentest/exploits/isr-evilgrade/modules/ but you can change this. It extracts the name of the module and the dns name trying to be resolved. It takes these two items and puts them into snort dns rules. If you can see their traffic you can then run snort with these rules to see which machines may be vulnerable to an evilgrade attack.

./egtosnort.py > evilgrade.rules

test it with

snort -T -c evilgrade.rules

and run it with

snort -A console -c evilgrade.rules

#!/usr/bin/python
#egtosnort.py
#create snort rules for potential evilgrade modules
#by DeBuG

import re, os
import glob

msg="notepad"
content="google.com"
sid=6660000

ruleshell='alert udp any any -> any 53 (msg:"%s update detected"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"%s"; nocase; distance:0; sid:%d; rev:1;)'

path="/pentest/exploits/isr-evilgrade/modules"
emodules=glob.glob(path+"/*.pm")

for m in emodules:
        file=os.path.join(path,m)
        print "#" + file
        for line in open(file):
                if re.match("(.*)('name')(.*)", line):
                        #print line
                        ename=re.findall(r"'[^']*'",line)
                        msg = ename[-1].strip("'")
                #else break
                if re.match("(.*)('vh')(.*)", line):
                        evh=re.findall(r"'[^']*'",line)
                        content = evh[-1].strip("'")
                        content = content.strip("(")
                        content = content.strip(")")
                        clist = content.split("|")
                        #print len(clist)
                        for c in clist:
                                #print "msg = " + msg
                                #print "content = " + content
                                #print "sid = " + str(sid)
                                if len(c)==0:
                                        print "# EMPTY vh in evilgrade module, skipping\n"
                                        break
                                #Get the right bytes for DNS requests
                                req=c.split(".")
                                request=req.pop(0)
                                for x in req:
                                        request = request + "|"+hex(len(x))[2:].zfill(2)+"|"+x.rstrip()
                                request=re.sub('-','|2d|',request)
                                c = request
                                print ruleshell % (msg,c,sid) + "\n"
                                sid+=1

Also a script to pull all dns names from the evilgrade modules

./egtodns.py > dns.txt

once you have snort listening you can run a test

while read line; do nslookup "$line"; done; < dns.txt

#!/usr/bin/python
#egtodns.py
#pull dns from evilgrade modules
#by DeBuG

import re, os
import glob

path="/pentest/exploits/isr-evilgrade/modules"
emodules=glob.glob(path+"/*.pm")

for m in emodules:
        file=os.path.join(path,m)
        for line in open(file):
                if re.match("(.*)('vh')(.*)", line):
                        evh=re.findall(r"'[^']*'",line)
                        content = evh[-1].strip("'")
                        content = content.strip("(")
                        content = content.strip(")")
                        clist = content.split("|")
                        #print len(clist)
                        for c in clist:
                                #print "msg = " + msg
                                #print "content = " + content
                                #print "sid = " + str(sid)
                                if len(c)==0:
                                        break
                                print c

Packet Party II

Good news! We will be having another packet party on:
Thursday September 22nd at 7pm at ReverseSpace in Herndon, Va.

We will be working through some packet analysis challenges that were give at Defcon. These are different challenges than the ones we did last month.

If you didn't make it the first time, now is your chance to make up for it.
If you did come out last time, your skills++ should be helpful in this weeks challenges.

Last month I think we all learned something and had fun doing it. It was definitely a good refresher course on picking apart network traffic.

OSWP

passed.
moving on to OSCP.
Next!

Packet Party at Reverse Space

Thursday August 25th at 7pm at ReverseSpace in Herndon, Va.

We will be working through some packet analysis challenges. There are 6 levels. The challenges can be seen here:

http://forensicscontest.com/2011/08/16/puzzle-9-anns-deception-defcon-2011
(I have a dvd with the challenges as well as the answers)

Contest was held at Defcon and created by:
http://lakemissoulagroup.com/

 Come and work by yourself or get together with a group and try all 6 challenges!

Pcap newborns - come by and give it a shot, I can help you with what I know
Hardcore sniffmasters - stop by, try to beat all levels, and maybe help out the newer folks

Don't know what your missing?

Don't have time to scroll through all of your rule files?  Here are a couple of command line quickies to look through your snort rules and pull out the msg description:

look for commented out rules
grep msg emerging-policy.rules | grep  ^# | sed  's/^.*msg\+:\"\([^"]*\).*/\1/'

look for rules that are not commented out

grep msg emerging-policy.rules | grep -v ^# | sed 's/^.*msg\+:\"\([^"]*\).*/\1/'

look for all rules

 grep msg emerging-policy.rules | sed  's/^.*msg\+:\"\([^"]*\).*/\1/'

802.11 Hacking Lab Tonight

Tonight I will be hosting an 802.11 wifi hacking lab at ReverseSpace in Herndon, Va from 7pm-9pm.

Come out if you are new to 802.11 security testing and want to try your hand at:
understanding the security protocols and how they work
cracking WEP a thousand different ways
client side attacks (ie Cafe Latte)
WPA/WPA2 wordlist attacks

There will be a brief talk followed by some basic challenges with hands on training. We will also be trying out some of Vivek's Challenges from the WiFi Security Megaprimer. (Vivek is the man!)

We will be primarily be using the aircrack-ng tool suite. Please bring something to hack with (laptop with Backtrack should be fine).

IMPORTANT:
THE PURPOSE OF THIS CLASS IS TO HELP YOU UNDERSTAND WEAKNESSES IN 802.11 WIRELESS SECURITY PROTOCOLS. DO NOT ATTEMPT TO GAIN UNAUTHORIZED ACCESS TO NETWORKS THAT DO NOT BELONG TO YOU AS THIS IS MOST LIKELY ILLEGAL DEPENDING ON WHERE YOU LIVE.

Please come out and join us at the lab tonight at 7pm!
13505 Dulles Technology Drive
Suite 3
Herndon, Virginia


(No ethernet cables necessary:)

WiFi Training

For the past 3 weeks I have been watching Vivek Ramachandran's Wireless LAN Security and Penetration Testing Megaprimer  This is actually currently set as my homepage.  His videos are very clear and descriptive.  Vivek does a nice job in breaking down wireless attack concepts and presenting them so they are easy to grasp.  I would highly recommend this to anyone who is interested in learning about 802.11 (in)security.

Just signed up for OSWP to reiterate and drill these ideas home.  I am interested in seeing how this training ($350 to include one certification attempt) compares to Vivek's free videos.

Backtrack 5 on Katana

Upgrading Backtrack 4 to Backtrack 5 on Katana by .ronin
http://bit.ly/muyiD5  <- I saw this about 10 minutes after I finished doing this manually. Nice and easy way to upgrade by Katana's author, .ronin.

Adding Backtrack 5 to Katana manually (the hard way)
Note that .ronin's method above seems to be alot easier.  But this method may give you some insight on how to add distros in the future.
I tried creating an installation script for Forge but ran into some issues.  I followed the ADD_NEW.txt file from the /forge/linux/scripts/ folder.  I created the folder, copied in the templates and made the appropriate edits.  However, after running the script, I was not getting a backtrack 5 folder on the root of my Katana drive.  So I decided to follow the script and do it manually.  Here is a down and dirty way to get it running.  I am using Ubuntu 11.04 The steps were:

mount katana in rw ("/dev/sd1" will vary)

mount /dev/sd1 /mnt

mount my backtrack5 iso

mount -o loop BT5-KDE-32.iso /media/cdrom

cd /mnt
mkdir /mnt/bt5
cd /forge/linux/scripts

Read this file ADD_NEW.txt

mkdir /forge/linux/scripts/bt5
cp /forge/linux/scripts/template/* /forge/linux/scripts/bt5/
cd /forge/linux/scripts/bt5
vi install.sh

I changed the DISTRO variable to bt5 in the install.sh file
you then need to create your distro's cfg file

mv template.cfg bt5.cfg
vi bt5.cfg

I made the changes in step 3 of the ADD_NEW.txt file
First I copied in the LABEL, MENU, KERNEL, APPEND lines from my backtrack 5 iso image /media/cdrom/boot/isolinux/isolinux.cfg

Then, make sure you:

"     Prepend the 'distro' directory name to the beginning of all paths.  Also delete
'cdrom' if its in path. The following is an example of these modifications from

    LABEL cooldistro
    MENU LABEL Cool Distro
    KERNEL /casper/vmlinuz
    APPEND file=/cdrom/preseed/custom.seed boot=casper initrd=/casper/initrd.gz

    to

    LABEL cooldistro
    MENU LABEL Cool Distro
    KERNEL /cooldistro/casper/vmlinuz
    APPEND file=/cooldistro/preseed/custom.seed boot=casper initrd=/cooldistro/casper/initrd.gz"

Once I finished getting these two files I tried step 4 in the ADD_NEW.txt file.
The script ran, but nothing would write to the root of my katana drive.  However, I was seeing the temp files in the scripts/bt5 folder.
So I looked at the install script and:

copied the cfg file into the menus folder

cp -f -v -r /forge/linux/scripts/bt5/bt5.cfg /mnt/boot/menus/

copied the content of my iso into the /mnt/bt5 folder

cp -f -v -r /media/cdrom/* /mnt/bt5/

Then I recreated the initrd.gz file.

mkdir /media/init
cd /media/init
gzip -dc ../cdrom/casper/initrd.gz | cpio -id

this should extract initrd.gz from your backtrack5 iso into this temporary init folder

You then need to change the path in the casper file. This was a little different than the default script, because they use a variable for "casper" in the actual casper file
So instead of:

cd scripts
cat casper | sed "s/\$path\/casper/\$path\/$DISTRO\/casper/g" | \
sed "s/\$path\/.disk\/casper-uuid/\$path\/$DISTRO\/.disk\/casper-uuid/g" | \
sed "s/\$directory\/casper/\$directory\/$DISTRO\/casper/g" > casper_new
mv -f casper_new casper

I wrote the following casp.sh script to be ran from within the scripts folder
cd scripts
______________________________________________________________

#!/bin/bash

var1=\$LIVE_MEDIA_PATH

cat casper | sed "s/\$path\/$var1/\$path\/bt5\/$var1/g"  | \
sed "s/\$directory\/$var1/\$directory\/bt5\/$var1/g" | \
sed "s/\$path\/.disk\/$var1-uuid/\$path\/bt5\/.disk\/$var1-uuid/g" > casper_new

______________________________________________________________

and ran that
then you replace the casper file with casper_new
mv casper_new casper

cd ../
find . | cpio --quiet --dereference -o -H newc | gzip -9 > ../initrd.gz
cd ../

rm -rf /media/init

then I went into my /mnt/bt5/casper folder and replaced initrd.gz

cd /mnt/bt5/casper
mv initrd.gz initrd.gz.orig
mv /media/initrd.gz .

then you need to add your distro and the bt5.cfg file to the boot menu
# Add to main menu

echo -e "\n\nLABEL bt5 \n\
MENU LABEL bt5 \n\
KERNEL /boot/vesamenu.c32 \n\
APPEND /boot/menus/bt5.cfg\n\
TEXT HELP\n\
                      More about currently selected:\n\
              \n\
ENDTEXT" >> $1/boot/menus/main.cfg

After that you should be able to scroll to the very bottom of the menu and see BT5.  Please let me know if you have any questions or issues with this.  Again this is a pretty rough way to do it. Thanks .ronin for Katana!

getting aircrack-ng suite to run on backtrack 5

I was initially getting errors when trying to bring up a monitor sub interface with
#airmon-ng start wlan0

PID Name
10681 dhclient3
10683 dhclient3
14167 dhclient
Process with PID 10683 (dhclient3) is running on interface wlan0"

I could kill these processes, but it would just hang if I tried the same command.

I saw here to do a reinstall of the software
http://bit.ly/l4X4lS

navigate to

/pentest/wireless/aircrack-ng

make uninstall
make clean
cd ..

either move the directory or rm it
rm aircrack-ng

download the drop from aircrack

wget http://download.aircrack-ng.org/aircrack-ng-1.1.tar.gz
tar -zxvf aircrack-ng-1.1.tar.gz
cd aircrack-ng-1.1
make
make install

When I tried to reinstall aircrack-ng, I was getting the following errors:

crypto.h:12:26: error: openssl/hmac.h: No such file or directory
 crypto.h:13:25: error: openssl/sha.h: No such file or directory
 crypto.h:15:25: error: openssl/rc4.h: No such file or directory
 crypto.h:16:25: error: openssl/aes.h: No such file or directory

So I ran:
#apt-get install libssl-dev 

Then reran:

#make

#make install

After this I was able to run the entire suite of aircrack-ng tools

I'm back.

It has been 3 years to the day since my last post. Strange that I decided to sign back in today.