Wicd Applet in Backtrack

All of you who had installed backtrack would notice that at default wicd network manager applet won't shown in the panel. Well this won't affect the stability of the system but it would be quite annoying when you have to open it from the main menu everytime you want to connect to a WiFi network.

Follow this steps to fix it.

- Click System > Preferences > Startup Application

Metasploit ~ Upgrade Command Shell into Meterpreter

As I said in my post about meterpreter. It is an advanced payload that can do a lot of advanced task after a system is exploited. But why if we can only get a normal command shell after exploitation? Its rather difficult of course to do the post exploitation step. But that doesn't matter now, because one of the newer features in the Metasploit Framework is its ability to upgrade a command shell payload to a Meterpreter shell payload once the sytem has been exploited. This can be done by issuing "sessions -u <selected session>". This is usefull if we use a command shell payload as an initial stager and then find that this newly exploited system would make the perfect launching pad for further attacks.

Ok, let get started. I'll use a metasploit console version and the system that will be exploited is a Windows XP SP3 machine in my Virtualbox.

Upgrading to BackTrack 5 R2

A while ago, the best linux pentesting distribution, "BackTrack" had released its update that is BackTrack 5 R2.

With a new 3.2.6 kernel, a huge list of new and updated tools and security fixes, BackTrack 5 R2 will provide a more stable and complete penetration testing environment than ever before. For you who doesn't want to reinstall your backtrack to get the R2. You can perform these steps to upgrade your Backtrack 5 R1 to R2. 

Digital Forensic Analysis

After a week of hibernation, its time to move again..  >:)

So, in this post I'll try to perform a simple digital forensic analysis on an image of a floppy disk. You can download it here :

http://www.linuxleo.com/Files/practical.floppy.dd

I use Backtrack OS in this post, because in Linux, there are some basic forensic analysis tools that have been already included.

BASIC LINUX FORENSIC TOOLS

As I told before, linux have been integrated with some basic forensic analysis tools such as :

Exploit Combo ~ BeeF & Metasploit

Exploitation is so much fun and exciting for me..  :D

In this post I'll try to combine BeeF and Metasploit to create an Attack. BeeF, browser exploitation framework is a great tool to exploit the XSS Vulnerability on a site. My target for the attack is still my XP SP3 Machine.

Lets get started..  >:)

- First, start your BeeF-ng services..

Working With Metasploit Auxiliary

Metasploit is a powerfull framework to do an exploitation. There are a lot of thing we can do with it. Exploits, Payloads, Encoders, and Auxiliaries are ready to be used to do an exploitation. In this post I'll explain a little about metasploit auxiliary and how to use it. 

Auxiliary is a set of tools developed to perform reconnaissance like scanning, sniffing, fingerprinting and the other security tasks. With this auxiliary, we can use metasploit to do the earlier hacking framework without other tools, just metasploit and its auxiliary and the other modules, this will make our security tasks far more easier.

So, here's an example the use of an auxiliary..

Linux Exploitation : Stack Overflow

After a week full of Windows exploitation. This time I'll try to explain about Linux Based Stack Overflow Exploitation. There are no big difference between exploitation in windows and in linux. We still have to deal with memory registers, addresses, and payload.

Ok, lets begin..

- First, we must turn off the ASLR on Linux. ASLR stands for Address Space Layout Randomization, it is a computer security method that can make the positions of key data areas to be randomly positioned. Usually including the base of the executable and position libraries, heap, and stack in a process's address space. To turn it off, execute this command.

SEH Based Buffer Overflow : File Sharing Wizard

In this post, I'll try to exploit a software called "File Sharing Wizard" version 1.5.0 build 26-8-2008. This software have a SEH protection. So, I'll use the technique like when I exploit BigAnt server. 

Lets get started..  

- First thing to do is install the software on your xp machine.

- This is a file server, so we will use a remote exploit for our fuzzer.

- Searching what port this software is running.

SEH Based Buffer Overflow - BigAnt Server

This time, I'll try to explain how to exploit a software that have a SEH protection on its system called BigAnt Server. SEH is an exception handler to protect the EIP to be overflowed by the abnormal flow on the software. This will force us to use different attack vector and technique because if we use the same technique as in the Direct Return Exploit the attack won't work because of SEH.

BigAnt server is an Internet Messenger server. The version of the software that used in this post is 2.52 Service Pack 5.

Lets get started..  >:D

Buffer Overflow - VUPlayer

Again, in this post I will try to exploit a software using the Buffer Overflow technique. The software is called VUPlayer.

Lets do some testing first to make the software crashed. That will be my attack vector. 

Alhamdulillah, this morning I'm succeeded to make the software crashed in the first try. Here's what I did.

- Of course installing VUPlayer in my Windows XP machine.

- Okay, I want to try adding url. (of course the url is not the valid one..  :P  )

- Making 1000 'A' character in notepad.

Reverse Engineering Mini-Stream RM-MP3 Converter

Reverse engineering is an interesting advanced hacking technique to be learned. Once we knew the technique I'm sure that when there is a bug in a program, although the bug is only a little, we can exploit that vulnerable point to hack our target machine. 

So, at the other post we've already do a reverse engineering technique against WarFTP. In this post we will try to do it with a software called Mini-Stream RM-MP3 Converter.

Lets get started.

- First, Install the software on your XP machine.

- I'll search for some information in www.exploit-db.com/search.

Reverse Engineering WarFTP

Finally, after preparing OllyDbg and WarFTP on our machine, its time to put reverse engineering in action.

What I do in this post is based on my sensei's book titled "Harmless Hacking". Lets get started. 

- Start your Windows XP machine.

- Open WarFTP and start its service by clicking Properties > Start Service

Setup OllyDbg

Ok, my sensei give me a task to do a Reverse Engineering on a software called WarFTP. Before do that I must install OllyDbg first to debug the software. I'm using Windows XP SP3 in VirtualBox. So, lets get started.

1. Start up your XP machine.

2. I'll transfer the OllyDbg master to my machine using web server. So I put the master into /var/www/files on my backtrack. (If you haven't downloaded the master, you can go here)

Information Gathering Task

Here's my link.

http://www.mediafire.com/?kucf47iwatvrr57

Bypassing Login Screen

Ok, Lets try to bypass the login screen on my testing webpage located in /var/www/fbip.

1. Open the browser and type in the address bar

localhost/fbip

A simple, ugly web page will appear.

DVWA : SQL Injection

DVWA(Damn Vulnurable Web Application) is a web that have a lot of security issues inside. 

Lets try to Inject it with sqlmap.

1. Start your mysql and apache2 service.

# service apache2 start

# service mysql start

2. Open your browser and type the url of your dvwa.

Using "mkfifo" to Bypass Netcat's OpenBSD Limitation

There are two version of Netcat, traditional and openbsd. 

The traditional version is the one that I've been used in my previous post. It have more function than the openbsd version.

In the openbsd version we can't add -e command. This because the openbsd version is designed to prevent the hacker who want to make a backdoor use it. This way, we can't create a shell.

But, there's a way to bypass it using mkfifo. Mkfifo help us to create a pipe connection. Pipes allow separate process to communicate without having been designed explicitly to work together. This allows tools to combine their function in complex ways.

Mkfifo takes one or more file names as arguments or commands for the specified task and creates pipes with those names.

Ok. Lets start..

1. Remove the netcat-traditional and install netcat-openbsd to your ubuntu machine.

# apt-get remove netcat-traditional

# apt-get install netcat-openbsd

Injecting Cymothoa to Ubuntu using Netcat

So, in my other post we've been learned how to inject cymothoa to ubuntu using the web server to transfer the cymothoa. In this post I'll try to explain how to transfer and injecting cymothoa using Netcat.

Okay, lets get started.

1. Start up your ubuntu.

2. Start the nc server on the ubuntu

# nc -l -p 4321 -e /bin/bash

Injecting Cymothoa to Ubuntu

Cymothoa is a backdoor that can inject itself into the running process.

Here's a way to Inject a cymothoa backdoor to ubuntu in virtualbox.

1. I will use a webserver in /var/www to transfer the cymothoa to ubuntu.

# cd /var/www

# mkdir cymo

# cp /pentest/backdoors/cymothoa/cymothoa /var/www/

Privilege Escalation (Part 2) : Cracking Password Encryption Using John The Ripper

Okay, on the previous post we've already get to see the content on /etc/shadow file. Now, lets try to dechiper the password encryption using John the Ripper.

1. Go to the john folder.

# cd pentest/passwords/john

2. Lets copy content of the shadow file to the gedit and then save with the same directory as john for easier access, or if you want to tidy it up, make a new folder to save a temporary file that will be cracked by john. Delete all text other than the username and the encrypten password.

3. Lets crack it. Basically when you're not specify the attacking method, John wil use "Single Crack Mode" then "Wordlist Mode" and the last is "Incremental Mode".