Critical System Files

Here are some critical system files that must be protected by applying correct file permission. Applying wrong file permission may result in complete system takeover by the hacker/cracker.

image source : www.linuxsecurity.com

"the quiter you become, the more you are able to hear.."

MP3 File Structure

File structure is something that make up a file. File is the smaller form of a filesystem. A file can't be called "file" when it is not structured. Structure of a file is important to make that file readable because when it is not properly structurized I bet the system won't be able to read it. And I think there's also a standarization of a file structure, so a pdf file named A will have the same structure as the B,C,D or the other pdf files. The file structure of each filetype is also different. An .avi files will have different file structure with a .doc file. 

In this post I'll try to explain about the structure of an mp3 file.   :)

Who don't know MP3? MP3 or to be more specific, MPEG-1 or MPEG-2 Audio Layer III, is a patented digital audio encoding format using a form of lossy data compression. It is a common digital audio format used widely in the world. When we talk about mp3, it cannot detached from music. I think everyday we always listen to music. And I think you already know, most of the music is encoded with this format.

The Magic Number

Hoho, In this post I'll explain a thing called "Magic Number". Can you guess already what it is? Some kind of number that have a magical spell in it? some kind of magic trick that use numbers as its media? or the others? 

Unfortunately, "magic number" in this post is not a thing related to magic itself literally. This magic number is a thing related about a file format. Originally, this kind of term was used for a specific set of 2-byte identifiers at the beginning of a file, but since any undecoded binary sequence can be regarded as a number, any feature of a file format which uniquely distinguishes it can be used for identification. Identify what? to identify a file format of course.

What is Unallocated Space?

When you're installing an operating system on a new harddisk, do you notice that the installer said that our disk status is Unallocated? Or when you want to divide a harddisk into two or more partition, after the split the newly created partition also in the "Unallocated" status. So what is this unallocated called thing?

Unallocated space, or in the other word "free space", is logical space on a hard drive that can be used by the system to put files on. Unallocated space is the opposite of "allocated" space, which means a place on the hard drive where there's already files written or stored in it. Unallocated space is different from Slack space. The difference, in the unallocated space the system can put files in it, where in the slack space the system can't put any files in it. Simple right?  :)

Slack Space

Again, in this post I'll try to explain a thing that related to Computer Digital Forensic that is Slack Space. 

In a Storage Device when a file is saved, it is stored in the beginning of a cluster. Cluster itself is like a directory in the storage. It consist of some sectors. Imagine a House fully contained with 50 cupboards that have 4 drawers each..
Get it?  :D
Lets say that this house is the harddisk, the cupboards is the cluster, while the drawers on each cupboard is the sector. So, we can say that this harddisk have 50 cluster and 4 sector on each cluster.
cmiiw..  :)

File System at Glance

When we want to learn about Computer Forensic, File System can't be excluded from our learning material. So, in this post I'll explain a little about File System.

File system is a method, how to deal with files on a computer. How the data organized, stored, updated, modified, as well as manage the available free space on the storage media. The type of a hardware filesystem is usually adjusted with the characteristics of the storage device. So, the filesystem of the Harddisk is usually different with the filesystem of a Flashdisk or a Floppydisk. Another adjustment is including an Operating System as its parameter. Windows filesystem (which usually is FAT or NTFS), is different with Linux filesystem (ext2,ext3,ext4), as well as Mac filesystem. Still, nowadays an Operating System able to use more than one filesystem.

MBR ~ Master Boot Record

Computer Forensic mostly dealing with a storage device like Flashdisk, Harddisk, CD, DVD, RAM, etc. There are two type of storage, volatile and non volatile. Dealing with volatile storage device like RAM is more difficult because when the Computer is turned off, the data inside will disappear and some evidence maybe would lost too. Dealing with non volatile memory like Flashdisk or Harddisk isn't easy too. False method will make an evidence found on the memory won't be valid anymore.

In the Harddisk, there is something called MBR or Master Boot Record. MBR contain a series of code which make the harddisk can boot the system. IBM is the one who make it well known by the world. Usually, MBR located in the first sector of the Harddisk. Some of MBR task are :

1. Record the partition table on the system, which contains the details of the partition of a storage device on the system. 

2. Bootstrapping an operating system. 

3. Identify individual storage media.

Meterpreter ~ Basic Usage

Here's some basic meterpreter commands you can practice..  :)

- help

Display all commands that can be executed by meterpreter.

- background

Return to the msf shell and send the current meterpreter session into background. To interact with it again, just type 'sessions -i [id]'

Meterpreter

Meterpreter (meta-interpreter), is an advanced payload included in the Metasploit Framework. In my opinion this is the best payload ever. It can upload/download victim's files, read stored password hashes, keylogging, and even run a vnc server on the victim's machine. 

Meterpreter compatible with most of the exploit and auxiliary on metasploit. Making it the most sophisticated and the most used payload by pentesters and hackers. The way that it accomplishes this is by allowing exploit developers to write their own extensions in the form of shared object (DLL) files that can be uploaded and injected into a running process on a target computer after exploitation has occurred. 

MSFpayload & MSFencode

Again, in this post I'll explain some of the metasploit features..  :)

- MsfPayload

msfpayload is the metasploit tool to generate a payload for the exploit. Its function is the same as msfweb that I use in my other posts, but this tool is in console, so its rather difficult for newbies to use. But with regular training, this tool is better than msfweb because it greatly save time and RAM space. 

# msfpayload -h

More About SEH and SafeSEH

As explained before, SEH (Structured Exception Handling) is the protection integrated on a system of a software to handle the abnormal flow of the program that can caused the program to act abnormal too (crash, hang, etc). SEH will prevent the EIP to be overwritten directly by the excess data sent by the fuzzer. SEH will fully control the memory used by the software. This protection definitely forcing hackers to develop a technique to bypass the SEH protection. When this protection can be controlled, the execution process on the CPU also can be controlled easily like in the Direct Return Exploitation.

Introduction to OllyDbg

In this post, we've learned about reverse engineering. What we will talk now is one of the tool used for that called OllyDbg.

Before discussing OllyDbg, we must know what is debugging. Debugging is a structured process to find and reduce the number of bugs or defects in a computer program and repair it. When there are a bug in a system, especially when there are lots of subsystem in it will make the debugging process become harder because a changes in one may cause bugs appear in the other.

Reverse Engineering at Glance

Lets talk about Reverse Engineering briefly, because this is also important thing to know when you want to become an expert hacker. 

Reverse Engineering is an activity to discover the material how a something is made, how something is works and what is its purpose. In the other word, discovering the technological principles of something by analizing its structure, function and operation. Usually the thing that want to be reverse engineered is taken apart from its original form then analyze each part one by one throughly.

Introduction to SQL Injection & Blind SQL Injection

MySQL is one of the most famous database server used by many people in the world.  However, many administrator don't set the MySQL correctly and that will make the database can be Injected by a hacker.

SQL Injection is a hacking technique that utilize the low security settings or poorly designed database on a server. SQL Injection usually done by inserting a series of code to the url or  a form of a website. The vulnerability appear when the user input is not filtered correctly, so when the user insert a SQL character into a form, that code will be executed by the database server. To know where is a site is injectable or not, simply put ' character after the url of the site. If an error appear like "You have an error in your SQL syntax, bla bla bla..." then the site is 99% injectable.

Buffer Overflow : Direct Return & SEH Based

At my other post we've known a little thing about buffer overflow. Now we will talk two cases that happened when we do a Buffer Overflow that is Direct Return Exploit and SEH Based Exploit and whats the difference between those two.

- Direct Return Exploit

Direct return exploit happened to a program that can't handle an exception. A condition where an application trying to execute a code outside its normal work cycle. As the results, when an application that can't handle an exeption buffer overflowed, the EIP registered in the buffer memory will directly overwritten by the rest of the data that we use to overflow the application.

Buffer Overflow at Glance

Buffer overflow is one of hacking technique to gain root/adminstrator privileges access by exploiting the weak application vulnerabilities installed/running in a system. How can this be done? The hacker make an application/program that will make the buffer memories provided by the system for the target application will overload and then overwrite the other buffer.

Introduction to Buffer Overflow : CPU Register

 If we want to master the Buffer Overflow technique, first we must have a knowledge in CPU Register. Register is the part of the processor's memory that can be accessed with a high speed and always used by microprocessor as the medium to do its work.

An x86 based CPU used 8 register : EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP. Each of them designed for a specific job that make the CPU process the information eficiently.

1. EAX Register

Used to perform calculations and store the value returned from the function call. Basic operations such ass add, subtract, and compare is optimized in EAX Register. Special operations such as multiplication and divide are done by EAX Register.

Metasploit at Glance

There're a lot of explanation of metasploit out there. Buy I'll try to explain it with my point of view.

Metasploit is the name of a project and a framework. 
a. Metasploit Project
Metasploit   project   is   an   open-source,   computer   security   project   that provides information about security vulnerabilities and aids in penetration testing. Some of its sub-projects are the famous metasploit framework, opcode database, shellcode archive, and security research. Simply, metasploit project is the procjet or activity around computer security section and the one that created metasploit framework.

b. Metasploit Framework

Vulnerability at Glance

Lets talk about Vulnerability..

Wikipedia : 
"In computer  security,  a vulnerability  is a weakness which allows an attacker to  reduce a system's information assurance. Vulnerability is the intersection of three elements : a system  susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness.   In this frame,  vulnerability  is also known as the attack surface."

ISO 27005 :

Information Gathering Task

Here's my link.

http://www.mediafire.com/?kucf47iwatvrr57