SEC560/EthicalHacker.Net

At the end of March, I will be experiencing my first SAN class, SEC560! I was awarded this chance by ETHICALHACKER.NET.  On the site, they hold monthly prizes for their registered users. I have been on the site since 2009 I do believe.  They have had discussions on Google, LulzSec, Anonymous, Breaches, FBI, etc.  It is where you can find and discuss IT security issues currently happening today.  It is a very informative site with some of the top security professionals posting articles from time to time.  If you want more information, check out this link (http://www.ethicalhacker.net/content/view/405/8/).  It was definitely a surprise since I usually do not win anything.  I guess it points out even further, that everyone has a chance to win the monthly prizes hosted at EthicalHacker.net. If you have time, try to check out the DIY Career article from Don Donzal if anything else (http://www.ethicalhacker.net/content/view/236/24/). 

Well, I just wanted to give a shot-out to the site before I take the SANS course. The SANS course will be all online which works out well for me.  It will be instructed by Ed Skoudis which I have heard is a great instructor by security professionals.  It will focus on network security and pen testing.  I like the fact that it will include the soft skills needs to be an effective penetration tester.  I have heard Mike Murray press on the fact that a pentester should have equally strong soft and technical skills to be beneficial to the client that you are pentesting.  WIN! The web application scanning looks good but I wonder how far they go.  Also, it looks like it has a CTF event too which I have never been in either.  I think this course (and the OSCE exam) will give me a good gauge to my progress in InfoSec. 

Once I am done, I want to do a review of the SANS course compared to the three Offsec security courses I have taken, OSWP, OSCP and OSCE.  I think the Offensive Security team are on their way to making courses that will set the standard for information security education.  Right now, C|EH by EC-Council, seems to be the standard, (at least for HR) which does not seem right to me.  When I did the self study for the C|EH course, and then, passed the exam, I had never even used netcat.  Uh, yeah that will not fly when you take a OffSec course.  I am not saying that they are perfect, but I would suggest to anyone that is serious about their security career, find a way to start taking the offsec courses.  Soon,  I will know if I need to include the SANS courses as well to that last statement.  From what I hear already, I should.  I will have the review by the end of April hopefully.   

FileFuzzer

While going through the OSCE course, I have created a number of fuzzing templates and files.  One that comes in handy, the python file fuzzer I made.  It is not mind blowing, but I have found some overflows with so it is nice to have for me at least.


#!/usr/bin/python

# File  Fuzzer
# By Agoonie
# Dated created 2/26/2012
# Kind of basic and wordy, but hey it works for me....

print "--------------------------------------------------------------------------------"
print "                                      Fuzzer Template                                   "
print "                                      Agoonie FileFuzz                                 "
print "--------------------------------------------------------------------------------"




fuzzchoice = raw_input('Do you want to create one file with a specific buffer size? yes or no. ')
if (fuzzchoice == 'y') or (fuzzchoice =='yes') or (fuzzchoice == 'Yes') or (fuzzchoice == 'Y'):
buff = raw_input('What is the buffer size for the file you want? ')
newextension = raw_input('What is the extension for the file you want? ')
print "Next, think of the character(s) you want to use in the buffer.  For example, A, B, C, %, *, X, &, ), (, #, @, !, etc. "
bchar= raw_input('What is the character(s) that will file the buffer in the file? ')
print "The filename will be: "
filename = "stest."+newextension
print filename
newbuff = int(buff)
if (newextension == 'm3u'):
junkchar = "#EXTM3U\n"
  junkchar += "#EXTINF:123,Agoonie - A goonie was here\n"
junkchar += bchar*newbuff
else:
junkchar = bchar*newbuff
bigbang = junkchar
bangcount = len(bigbang)
print "Just a reminder, this is the number of characters you have in your buffer: "
print bangcount
textfile = open(filename,"w")
textfile.write(bigbang)
textfile.close()
elif (fuzzchoice == 'n') or (fuzzchoice =='no') or (fuzzchoice == 'No') or (fuzzchoice == 'N'):
print "Buffer starts at 200 bytes and increments by 200 bytes "
buffsize = raw_input('What is the MAX buffer size for the file you want? ')
mbuffsize = int(buffsize)
cbuff = 200   # Current buffer size; starts at 200
num = 1
extension = raw_input('What is the extension for the file you want? ')
print "Next, think of the character(s) you want to use in the buffer.  For example, A, B, C, %, *, X, &, ), (, #, @, !, etc. "
bcharacter= raw_input('What is the character(s) that will file the buffer in the file? ')
while (cbuff <= mbuffsize):
print "The buffer size for the file is: "
print cbuff
snum = str(num)
filenames = snum+"_test."+extension
print filenames
junk = bcharacter*cbuff
num = num + 1
cbuff = cbuff + 200
exploit = junk
textfile = open(filenames,"w")
textfile.write(exploit)
textfile.close()
else:
print "I didn't understand your answer. Please run again. ./filefuzzer.py "

Laptop Rebuild

I am taking the OSCE course.  The first thing I did, besides saving major capital was to get some new hardware.  I built a new desktop and bought a new laptop.  I wanted to make my desktop a cheaper version of the computer here [http://pauldotcom.com/2010/10/your-password-cracking-system.html].  However, the desktop as of this moment needs to be redone.  I need a motherboard that can handle 4-way SLI with better video cards.  I want to use the desktop for password cracking using the GPUs' and SSD drives.  That is going to take some serious cash so it may take me a minute.  Moving on.  I got the ASUS G74SX RH71 laptop.  I grabbed another 4GB RAM stick and my 2 SSD hard drives from my older laptop.  I setup the usual dual-boot of Windows 7 and Backtrack 5 R1.  (And yes, I know Backtrack 5 R2 is officially going to be released in a few days.  I am sure I am going to have to do this whole process again.  Meh, I would have done it again anyway at some point).  Both installed were x64 bit since I wanted to use all of the RAM without any issues.  It worked out great in the long run. I was able to add addition programs to help with every work too. I was able to save my bookmarks and shortcuts from old Chrome and Firefox clients along with the usual addons. However, I did run into the usual problems that I found solutions for, for the most part anyway.

Added Apps:
VLC
Hexeditor
OpenOffice
Synaptic
UFW/GUFW
WireShark
KCalc
TouchPad Indicator
NoteCase
Compiz
Gimp
Evince
Tsclient
Xchat
Elinks
xscreensaver-gl
rss-glx

KeyPad issues:
sudo add-apt-repository ppa:atareao/atareao && sudo apt-get update   
sudo apt-get install touchpad-indicator

Gnome: waiting for audio system to respond
Go to System->Preferences -> Startup Applications
Make sure you’re in the tab ‘Startup programs’
-> Click on "Add"
Name: Pulseaudio daemon
Command:/usr/bin/pulseaudio
Comment: Start the sound daemon
Now logout, then login again.

System Beep:
In the terminal:
run 'alsamixer'
move to PC Beep
press m to mute
press escape

Disable ASUS touchpad:
sudo add-apt-repository ppa:atareao/atareao
sudo apt-get update
sudo apt-get install touchpad-indicator
******xinput needs to be installed.

VMware 7.1:
chmod +x VMware-*.bundle
./VMware-*.bundle

mkdir /tmp/vmware && cd /tmp/vmware
cp -R /usr/lib/vmware/modules/source/ .
cd /tmp/vmware/source
for i in ./*.tar; do tar -xf $i; done
for i in ./*.tar; do mv $i $i.orginal; done
patch -t -f -p1 < /root/vmware2.6.39fixed.patch
tar cf vmblock.tar vmblock-only
tar cf vmci.tar vmci-only
tar cf vmmon.tar vmmon-only
tar cf vmnet.tar vmnet-only
tar cf vsock.tar vsock-only
cp -vf *.tar /usr/lib/vmware/modules/source/

Give me CHROME!!:
Installing and running Google Chrome
Download chrome from http://google.com/chrome 
and then do:
dpkg -i ./google-chrome-stable_current_amd64.deb
You may get a complaint about running this as root, so either create an account for browsing, or start the browser with the following command:
/opt/google/chrome/google-chrome %U --user-data-dir
**** I just added a shortcut with the parameters already set. 

FLASH:
wget http://samiux.volospin.com/flash/install_flash_player_10_linux.tar.gz
tar xvfz install_flash_player_10_linux.tar.gz
mkdir ~/.mozilla/plugins
mv -f libflashplayer.so ~/.mozilla/plugins/

Credit Due:
Now, I did not create these instructions, I just kept a list for an easier rebuild when I needed it.  Here are all the links I have on trying to make the rebuild quick and painless.  If I did not list it, my apologies, I was not trying to go all Zuckerberg on people:

http://rog.asus.com/forum/showthread.php?3220-Asus-G74SX-A1-Keypad-Problem/page6&s=5d5ad2019d4b8ffffaa73c10b18c66f3
http://www.backtrack-linux.org/forums/backtrack-5-fixes/44739-fix-vmware-workstation-vmware-player-compiling-2-6-39-x-kernel.html
http://insidetrust.blogspot.com/2011/08/backtrack-5-r1-some-things-fixed-some.html
http://www.backtrack-linux.org/forums/showthread.php?t=43954
http://www.backtrack-linux.org/forums/showthread.php?t=44739
http://www.backtrack-linux.org/forums/showthread.php?t=45100
http://www.backtrack-linux.org/forums/showthread.php?t=45314
http://www.backtrack-linux.org/forums/showthread.php?t=40271

I have not added these programs yet, but I still thought it was worth noting here, but I will update later if they are not working out too well.  I found these will searching for fuzzers and web application vulnerability hunters:

http://code.google.com/p/pyrats/
http://code.google.com/p/sprillis/
http://google-gruyere.appspot.com/


I cannot forget to add:
apt-get update
apt-get dist-upgrade

Agoonie Update

I have not posted anything in four months, but I have been busy in my defense.  Not only was I trying to manage my OffSec knowledge intake, but also trying to give my full effort to my family and job.  I have been doing my best so far. I have to come out and say it: I put off the CCNA again but I could not put off the OSCE.  The chance to learn more about fuzzing and debugging was too much. Come on, who could blame me. I will add individual posts later this weekend but I wanted to make a post that was a short rundown of my progress:

October
Passing the OSWP exam.
Amazon + OffSec books: Nuff Said

November
Rebuild Laptop (Backtrack 5 R1)
Amazon + OffSec books: Nuff Said
Practice Egghunters and MetaSploit Fuzzing







December
Amazon + OffSec books: Nuff Said
Signed up for the Cracking the Perimeter!
Time off (Star Wars: The Old Republic)
Studying the CTP material
Won SAN560 course from EthicalHacker.Net

January

Rebuild Laptop (ASUS)

Studying the CTP material

Time off (Star Wars: The Old Republic)

February
Scheduling the OSCE exam for March
Studying the CTP material
Creating Fuzzing files/scripts in Spike and Python
Practice Egghunters and Fuzzing

Batter Up! CCNA

I am now working on my CCNA.  This is 4 years in the making.  I should have had this in 2006 but I stopped for work.  Instead, I worked on getting my RHCT.  I do not regret it since it helped a lot with Linux education.  I have a firm grasp of redhat AS and centos because of it.  But it is 2011, I need to get this done.  I am definitely doing self study since I know I am not paying 3000 dollars for a class room and I know my company is not paying for it.  Something that held me up was the $500 or so that is needed for the equipment but I am going to use GNS3.  It is an emulator which can map out an entire environment full of routers and switches.  For further research, go to the site, http://www.gns3.net/.  Warning: you will need to have the cisco IOSs' already in your possession in order for you to use it.  I am sure people can find a way to get that.  I mean it is for your education.

I also bought the book, Cisco Certified Network Associate Study Guide, Sixth Edition, by Todd Lammle.  I also bought a book in 2008, Network Warrior, by Gary Donahue.  I remember liking the book very much but it was unfortuanate that I did not have enough hardware.  I want to read both books with the virtual environment I create.  I know I will still have to buy the hardware but I do not think it is necessary for this exam.  I know I will need it to do the CCNP which I do not mind.  I actually I want to do that. I will even buy a rack for it, I am sure.

This is the next step on my journey to become a great pen-tester and some day, a leader/CEO of a security firm.  The industry is changing.  It is becoming more and more perilous to ignore the dangers of technology.  I would love to be one of the good guys researching solutions to problems and using technology to warn people of the vulnerabilities of their home and organization. 

Anyway, enough dreaming, I am currently going through the commands since I have been through subnetting already.  I will try to keep my blog posts up during this process but no promises.  I want to get this done before December since the OSCE is calling me.  I still fuzz random software.  I want to some day work on 0-days too.  Have to start somewhere. I hope to follow this blueprint but maybe not to the letter: http://infiltrated.net/pentesting101.html.

OSWP Final

Well, I have finally taken the exam for the Offensive Security Wireless Professional.  It was definitely an eye opener.  I understand why so many people say it is outdated, but if you look at the SSID's of your neighborhood, you will see quite a few WEP authenticated/encrypted networks.  Anyway, before I took the exam, I practiced a lot from the labs till I got to the point I could identify what was needed without looking at anything.  In addition, my co-worker even gave me a network to try to crack: an ad-hoc network.  I could not seem to inject into the network but I could sniff the network long enough to crack it.  I could not even de-authenticate the clients of the ad hoc network.  However, it was fun to try every option to crack it. 

I cannot talk much about the exam but I can tell you that if you can do everything in the course, you can pass the exam in the 4 hours that they give you.  I stumbled on one section but eventually got it.  After you pass the exam, they give you the option to get access to their OSWP forum which is pretty cool.  It is the same access that you get when you pass the OSCP.  Overall, I love the course.  I do wish they had more on WPA2 (psk/enterprise) networks, rainbow tables, cowpatty, GPS options, bluetooth and access points attacks.  I did read that they are working on an update to the course.  I will give that a look in the future especially if it offers cracks for bluetooth.  For now, I would suggest this course to anyone who wants the fundamentals of wireless cracking.  You can always expand your knowledge with further research.  They even give you the links for it. 

OSWP Part 2

I have almost completed the OSWP course.  I have been watching videos, taking notes and practicing the exploits.  I did hit a snag, however, with my Linksys access point.  Apparently, there is an issue with the shared key authentication of WEP encryption.  You cannot create an XOR file when you are running airodump-ng and executing a de-authentication of a currently associated client using aireplay-ng.  You get a message of "Broken SKA".  It is very frustrating since I assumed it was my version of Backtrack or possibly my drivers for my ALFA (AWUS036H).  However, I found numerous links about the problem:

http://www.chris-mohan.com/2010/03/wifu-aireplay-ng-ska-attack-problem-with-linksys-wap54g/
http://trac.aircrack-ng.org/ticket/372
http://trac.aircrack-ng.org/ticket/703
http://www.backtrack-linux.org/forums/backtrack-5-experts-section/44327-wifi-ap-wrt45gl-linksys-cisco-broken-ska.html
http://forum.aircrack-ng.org
/index.php?PHPSESSID=dd18de1ba952d186cf749d7760f2643e&topic=233;prev_next=next


Of course, cracking WEP by bypassing SKA was one the last steps of the course.  However, I have another access point that I could use: Dlink-655.  I setup the new access point with the same ESSID and the same VICTIM, I mean client.  This time I was successful.  As soon as I de-authenticated the client, the XOR file was created.  I could then use the file to execute a fake authentication with the Wireless network.  The file was created instantly too.  There must be some bug with either airodump-ng or Linksys.  Possibly, it could be a combination that could be producing this weird behavior.  

Anyway, the only thing left in the lab is cracking WPA networks with the dictionary/custom wordlists.  That should be fine.  I also want to use a collaboration of cewl, crunch and the wordlists from Backtrack 5 R1 to use in the field.  I wonder what kind of results I would get during a security assessment.   


Before I forget, if people are having trouble using profile variables to make the commands shorter, I used the ".bashrc" file.  The /etc/profile was not working for me like the videos illustrated.  I just figured it was my fault since I am using Backtrack 5 R1. Fortunately,  I was able to use the variable $ESSID by adding to the file ".bashrc" for example: 
export ESSID=oswpexam