EXPLOIT-DEV : Quick TFTP Server Pro 2.1 Case Study

Quick TFTP Server Pro is a multi-threaded tftp server and telnet server for Microsoft Windows . It designed to allow network administrators and users to save and write files from various network equipment , and allow users to login to the server to execute various commands, such as listing file and directory information, reverse ping network equipment.

The current version 2.1 is vulnerable to Buffer Overflow which is announced on March 26, 2008 and Directory Traversal Vulnerability which is announced on November 5, 2011.

I only focus on the Buffer Overflow vulnerability. This piece of software does not fix the problem since 2008 after the vulnerability is discovered. I wonder to know the reason why.

Then I make up my mind to investigate. After the enquiry, it is confirmed that this piece of software is only exploitable on Windows XP SP2 and below. Windows XP SP3 or up cannot be exploited even it is vulnerability. Why?

I find out that this piece of software comes with no dll file and it is a standalone executable file. After the Windows XP SP3, Microsoft implemented Data Execution Prevention (DEP) and it enforces non-executable pages on the stack that prevent the execution of arbitrary shellcode.

In addition, this software has no other modules file (dll) that is not compiled with SafeSEH and all the system files are SafeSEHed. Although you can find a pointer at unicode.nls but because of null byte there is no chance to make the shellcode to work.

At least, I find out that so far. If anyone find out any method to exploit this software on Windows XP SP3 or up, please let me know. By the way, the ret2libc and ROP methods I have not been tried yet.

Therefore, it is only affect Windows XP SP2 and below. Since Windows XP SP2 is not supported by Microsoft any more, I think the developer of the software think that it is not necessary to fix the vulnerability.

That's all! See you.

HOWTO : Back|Track 5 r3 on Gigabyte TouchNote T1028X/M1028

Gigabyte TouchNote T1028X/M1028 equipped with Intel Atom N280 and eGalax touch screen. It runs Back|Track 5 r3 flawlessly except touchpad. This tutorial is telling you how to overcome this problem.

The kernel version of Back|Track 5 r3 is 3.2.6 and the touch screen is functioning flawlessly.

Touchscreen Hardware

"lsusb" shows the following :

Bus 005 Device 002: ID 0eef:0001 D-WAV Scientific Co., Ltd eGalax TouchScreen

Step 1 :

Boot up the 32-bit version of Back|Track 5 r3 USB stick which is created by Unetbootin or DVD-ROM. On the menu screen, press "Tab" and append the following to the end of the line.

i8042.noloop=1 reboot=b

Then install as usual and then reboot.

Step 2 :

After login, enter the following :

nano /etc/default/grub

Append "i8042.noloop=1 reboot=b" to "GRUB_CMDLINE_LINUX_DEFAULT".

It will look like this :

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash i8042.noloop=1 reboot=b"

Save and exit.

Then execute the following commands :

update-grub
fix-splash

Then power off the computer and switch it on again.

That's all! See you.

HOWTO : Encrypt the Home Directory in Ubuntu

You may want to encrypt the home working directory or any user's working home directory if you have not been set it up during the installation of Ubuntu.

Step 1 :

sudo apt-get install ecryptfs-utils

Step 2 :

adduser tempuser admin

Logout and re-login as tempuser.

Step 3 :

sudo ecryptfs-migrate-home -u samiux

Logout and re-login as samiux. But DO NOT reboot your system.

If you are not asking for the "Passphrase", you should enter the following command :

sudo ecryptfs-add-passphrase

Step 4 (Optional) :

You can check the Passphrase at any time by the following command :

sudo ecryptfs-unwrap-passphrase

Save the "Passphrase" somewhere and keep it safe for manual recovery.

Step 5 (Optional) :

I suggest you to encrypt the swap too.

sudo ecryptfs-setup-swap

Step 6 :

Then, if everything is working fine, you can delete the ramdonized file and delete the tempuser.

sudo rm -rf /home/samiux.*
sudo deluser --remove-home tempuser

That's all! See you.

Torified Ubuntu VPN Server

Tor allows you to anonymity online. It protects your privacy and defend yourself against network surveillance and traffic analysis.

The setup of Tor is very complicated and sometimes you will fail to make it to work. The most easy way is to download Tor Browser. However, it has some limitations and the main problem is that it is for web browsing only.

The drawback of using Tor is the speed. It is quite slow as the traffic passes a lot of nodes in order to hide your IP address and traffic. Your IP will be changed every 10 minutes. The IP is not belonged to your home country.

Learn more about Tor.

I created a Torified Ubuntu VPN Server in order to overcome some limitations of Tor but except the speed. It is still under heavy development. The final product will be released soon.

Update

NightHawk - Torified Ubuntu VPN Server is released on August 3, 2012. You can download it at official site.

NightHawk in Action



Installation and Configuration



That's all! See you.

The Corrs - Full acoustic concert

00:23 Only When I sleep
04:55 What Can I do?
09:48 -Radio
14:25 Toss The Feathers
17:56 Everybody Hurts
23:50 Dreams
27:48 Runaway
32:40 Forgiven, Not Forgotten
38:00 At Your Side
43:00 Little Wing
48:00 No Frontiers
52:48 Queen of Hollywood
57:40 Old Town
1:01:00 Lough Erin Shore
1:05:38 So Young

The Corrs - What Can I Do

Lyrics

I haven't slept at all in days
It's been so long since we've talked
And I have been here many times
I just don't know what I'm doing wrong

What can I do to make you love me
What can I do to make you care
What can I say to make you feel this
What can I do to get you there

There's only so much I can take
And I just got to let it go
And who knows I might feel better
If I don't try and I don't hope

What can I do to make you love me
What can I do to make you care
What can I say to make you feel this
What can I do to get you there

No more waiting, no more aching
No more fighting, no more trying

Maybe there's nothing more to say
And in a funny way I'm calm
Because the power is not mine
I'm just gonna let it fly

What can I do to make you love me
What can I do to make you care
What can I say to make you feel this
What can I do to get you there

Love me

VEGA - Web application vulnerabilites scanner

Vega is an open source platform to test the security of web applications. Vega can help you find and validate SQL Injections, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.



That's all! See you.

Get Windows systems password without hash decyption

Almost all the Windows system versions are affected. The following video is not made by me and it shows you how.



That's all! See you.

Why you need to learn hacking skills?

System Administrator and Programmer can be an Ethical Hacker too, not just only Penetration Tester.

Ethical Hackers and Hackers are speaking the same language, using the same tools and playing the same game.

Learn to hire a thief to try to steal something but don't hire a cop.



That's all! See you.

Enterprise WiFi Worms, Backdoors and Botnets for fun & profit

Windows 7 has a feature to create a Wifi access point on your laptop. Hackers will take advantage this feature to leverage to compromise your networks by mean of worms and/or backdoors with social engineering technique to build a botnet.

Vivek Ramachandran is going to show you the concept and how it works.



That's all! See you.

Revolution OS

What is GNU? What is Open Source? What is Linux and how it grows?

Want to know? Just watch this video.



That's all! See you.

Web Warriors

This is another a little bit out-dated video (around the year of 2003) that worth to watch.

This video is talking about virus and the damage. The victims are almost Windows systems. The video also talking about botnets and DDoS. They also think that some powerful virus are created by China.

By the way, this video also introduces what is Black Hat, Grey Hat and White Hat.



That's all! See you.

Hackers : Outlaws and Angels

This an inside story about hackers on the both sides - outlaws and angels which is talking about hackers (White Hat and Black Hat). It is a bit out-dated (around the year of 2002) but it is still worth to watch, in my opinion.

Hacking means finding out weaknesses in a computer or computer network, though the term can also refer to someone with an advanced understanding of computers and computer networks. Hackers may be motivated by a multitude of reasons, such as profit, protest, or challenge. The subculture that has evolved around hackers is often referred to as the computer underground but it is now an open community. While other uses of the word hacker exist that are not related to computer security, they are rarely used in mainstream context. They are subject to the long standing hacker definition controversy about the true meaning of the term hacker. In this controversy, the term hacker is reclaimed by computer programmers who argue that someone breaking into computers is better called a cracker, not making a difference between computer criminals (black hats) and computer security experts (white hats). Some white hat hackers claim that they also deserve the title hacker, and that only black hats should be called crackers.

"Learn to hire a thief to try to steal something, don't hire a cop." (at 16:50)

"The battle between the angels and outlaws seem sat to continue. But hackers on the both sides know that like many conflicts, they between both of the people speak the same language, use the same tools and play the same game." (at 47:58)



That's all! See you.

NEWS : Latest message from LulzSec

I think someone out there should heard about LulzSec.

The below statement is copied from Wikipedia :

"Lulz Security, commonly abbreviated as LulzSec, is a computer hacker group that claimed responsibility for several high profile attacks, including the compromise of user accounts from Sony Pictures in 2011. The group also claimed responsibility for taking the CIA website offline."

The following is believed to be the latest message from LulzSec :

LulzSec: All your base are belong to us



Just for information. Nothing else.

That's all! See you.

HOWTO : Protect you from being ARP spoofing

Updated on Dec 4, 2014.

ARP spoofing is a kind of Man-in-the-Middle (MiTM) attack and it affects the machines in the subnet.

Who will affected? Almost all. Free wifi connection even it is encrypted by WPA/WPA2. Your local network. The machines inside a subnet.

How about using SSL and SSH as well as VPNs? No, those cannot protect you from being attacked by ARP spoofing. Even a switch cannot protect you from being attacked. Please refer to this presentation.

ARP security often ignored and nobody cares about lower layer security nowadays. ARP attacks are real threat with high impact.

How can I protect myself from being attacked? Yes, you can. The following tools will alert you when the attack is taking place.

If you are Linux users, you can use ArpON. If you are Windows users, you can use XARP - Advanced ARP Spoofing Detection.

For Ubuntu or Debian users, you can install it by the instruction at ArpON on Kali Linux 1.0.9a.

If you are Mac OS X users, you can use ARP Guard. ArpON on Mac OS X Yosemite 10.10.1

If you are Android users, you can use WiFi ARP Guard.

ArpON for Linux can protect you from the attacks and the others are just alert you for the attacks only. In addition, ARP Guard costs money while the others are free of charge.

Or, if you do not want to install the captioned software and your router can set static ARP, do it and your subnet is protected upon set.

Please note that ARP Guard for Mac OS does not do the job well. It cannot detect any ARP spoofing when I test it on Mac OS X 10.10.1.

There is another way to protect your from ARP spoofing attack if you are a Linux user and do not want to install the captioned software. You can follow the instructions in the following video which was created by xiedi01 :



Want to see a demo how ARP spoofing works? Yes, the demo is by Hak5 and it starts at 07:24 for the first demo.





The following demo is conducted under Back|Track 5 R2 by MasterButcher68.



There are some tools that make this attack automatically and the attackers requires no skill to do so. Even a script kiddies can handle it. The following is one of the tools, namely YAMAS - Yet Another Man in The Middle Automation Script.



That's all! See you.

HOWTO : BackTrack 5 R2 on Intel X79 Express and nVidia display cards (The better way)

Uninstall the manual installed driver

Previous HOWTO is here.

If you followed the previous HOWTO to install the nVidia driver, you can uninstall it by the following command :

./NVIDIA-Linux-x86-295.20.run --uninstall

The better way to install nVidia driver

Step 1 :

add-apt-repository ppa:ubuntu-x-swat/x-updates

apt-get update
apt-get install nvidia-current nvidia-current-modaliases nvidia-settings

Step 2 :

Reboot your system.

After reboot, you issue the following command :

nvidia-xconfig
splash-fix

Then, reboot your system again.

If you install the nVidia driver this way, you are not required to reinstall the driver after the kernel is updated.

You can follow the other parts of tutorial in the previous HOWTO for sample code of CUDA and Pyrit.

That's all! See you.

HOWTO : VPN (PPTP) on BackTrack 5 R2

Step 1 :

apt-get update
apt-get dist-upgrade

apt-get install network-manager-gnome network-manager-pptp

Step 2 :

cp /etc/network/interfaces /etc/network/interfaces.bak

nano /etc/network/interfaces

Delete all entries but left the first two lines behind.

auto lo
iface lo inet loopback

Step 3 :

service network-manager start

Step 4 :

System >> Startup Applications >> Network Manager

Append "&" on the end of the Command. It will be looked like this :

nm-applet --sm-disable &

Make sure Start dhclient is enabled in the menu of Startup Applications.

Reboot the system and then configure your VPN (PPTP) as usual.

Make sure Advanced >> Use Point-to-Point encryption (MPPE) is enabled in the Configuration of PPTP.

That's all! See you.


HOWTO : Flash-Aid 2.2.3 for Ubuntu

Do you encounter blue faces or wrong colour displayed on the YouTube videos on your Ubuntu 12.04 box? If yes, I recommend you to install Flash-Aid which can solve the problem.

Open your Firefox and go to here to install the plugin. Once the plugin is installed, you can click on the icon on the right top hand corner to install the correct Flash.

The official wording of Flash-Aid :

Remove conflicting flash plugins from Ubuntu/Debian Linux systems, install the appropriate version according to system architecture and apply some tweaks to improve performance and fix common issues.

That's all! See you.

UPDATED on May 23, 2012 :

If your problem is still there and you have nVidia display card with "libvdpau1" installed, you should follow the steps below to solve the problem.

sudo add-apt-repository ppa:tikhonov/misc
sudo apt-get update
sudo apt-get install libvdpau1

This solution is workable on Ubuntu 12.04 LTS with flashplugin-installer 11.2.202.235ubuntu0.12.04.1 but not with Flash-Aid 2.2.3.

HOWTO : Cracking WPA/WPA2 without dictionary

This video is not created by me. It is created by Kardipapa. The original video is here.

I upload here for my reference only.

That's all! See you.

UPDATED on May 22, 2012 :

The following links are my Proof of Concept (PoC) that written on April 16, 2010 and May 22, 2011 respectively. Kardipapa confirmed my Proof of Concept is workable.

Using John the Ripper (which is written by me on April 16, 2010 for my Proof of Concept) :

HOWTO : Crack WPA/WPA2-PSK with John the Ripper

Using Crunch and Pyrit (which is written by me on May 22, 2011 for my Proof of Concept) :

HOWTO : WPA/WPA2 cracking with Back|Track 5

HOWTO : Scapy 2.2.0 on Ubuntu 12.04 LTS

To install Scapy

sudo apt-get update sudo apt-get install python-scapy python-pyx python-gnuplot

To run Scapy interactively

sudo scapy

The scapy shell will be displayed :
WARNING: No route found for IPv6 destination :: (no default route?)
Welcome to Scapy (2.2.0)
>>>

To quit Scapy

>>>quit()
That's all! See you.