jetlib.sec » Tags » blah-blah

Feeds

133341 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

4 items tagged "blah blah"

Related tags: wlan [+], quot [+], jobby [+], ghz [+], channel 11 [+], channel [+], unicornscan [+], sweep run [+], script logs [+], metasploit [+], exec grep [+], Support [+], Pentesting [+], Newbie [+], General [+], BackTrack [+], Area [+]

• May 11, 2012
• 5:00

  From LOW to PWNED [7] HTTP PUT/WebDAV/SEARCH

   » ‎ Carnal0wnage
  Post [7] HTTP PUT/WebDAV/SEARCH
  
  Man I love mis-configured WebDAV, I have put a foot in many a network's ass with a writable WebDAV server.  Like the browsable directories thing, its *usually* not writable, but it occurs often enough that you really have to make sure you check it each time you see it.
  
  LOW?
  
  
  IIS5 is awesome (not) because WebDAV is enabled by default but web root is not writable. Wait who still runs Windows 2000?! i know i know app cant be rewritten...accepted risk...blah blah...no one will ever use this to pwn my network...its ok if that DA admin script logs into it daily....
  
  The "game" is finding the writable directory (if one exists) on the WebDAV enabled server.
       *Dirbusting and ruby FTW*
  
  I find that its usually NOT the web root, so honestly it can be a challenge to find the writable directory.  VA scanners can help, Nessus will actually tell you methods allowed per directory...still a challenge though.
  
  Once you have a directory you want to test you can use cadaver to manually test, davtest, or Ryan Linn's metasploit module for testing for WebDAV.
  
  
  I've also done some posts on webDAV in the past
  
  http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html
  http://carnal0wnage.attackresearch.com/2007/08/creating-http-options-auxiliary-module.html
  
  hdm had done a post on it in the past in relation to the asp payload, i cant find it on the R7 site but its mirrored here: http://meta-sploit.blogspot.com/2010/01/exploiting-microsoft-iis-with.html
  
  Decent writeup here:
  http://www.ubersec.com/downloads/WEBDAV_Exploit_example.pdf
  
  HTTP PUT
  
  HTTP PUT/SEARCH usually gets rolled into
  
  
  
  Web scanners are better about alerting on PUT as an available method and most will attempt the PUT for you.  I don't think any vuln scanners do, i'm sure someone will correct me if i'm wrong.
  
  Writable HTTP PUT is rare (least for me) although some friends say they see it all the time.
  
  metasploit has a module to test for PUT functionality as well.  http://www.metasploit.com/modules/auxiliary/scanner/http/http_put
  HTTP SEARCH
  HTTP SEARCH can be fun. When enabled, will give you a listing of every file in the webroot.
  Mubix did a post on it http://www.room362.com/blog/2011/8/26/iis-search-verb-directory-listing.html
  
  
  

  Tags:  script-logs blah-blah metasploit Pentesting  

• January 09, 2011
• 8:37

  Installing Unicornscan on a current Ubuntu Distro

   » ‎ Carnal0wnage
  So get unicornscan from here :
  
  http://unicornscan.org/ -- current version I could find is 0.4.7
  
  you'll need some depenedencies
  
  apt-get install flex bison
  
  apt-get install libpcap0.8-dev libgeoip-dev libltdl3-dev libdumbnet1 libdumbnet-dev
  
  * you may need texlive-extra-utils if you are on a headless system like slicehost or linode, otherwise it will bomb out when it tries to make the documentation :-(
  
  apt-get install texlive-extra-utils
  
  Fix up weird lib issues see at the bottom for where i got this:
  
  blah@blah:$ sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h
  
  blah@blah:$ for i in `find ./ -type f -exec grep -l 'ldnet' '{}' \;`; do sed -i bak -e 's/ldnet/ldumbnet/g' $i; done
  
  apply this patch
  
  https://www.pentoo.ch/pentoo/browser/portage/trunk/net-analyzer/unicornscan/files/unicornscan-0.4.7-configure.patch
  
  ./configure CFLAGS=-D_GNU_SOURCE
  make
  make install
  
  after that it woud compile and run.
  
  I did have to really crank down the pps to get it to actually run, default is 300 i had to use around 75-100
  
  sudo unicornscan -m U -Ir 75 --show-errors -v externalrange.net/24
  
  Lets test ...
  
  host #1
  
  sudo unicornscan -m U -Ir 75 -v 192.168.1.143
  
  adding 192.168.1.143/32 mode `UDPscan' ports `7,9,11,13,17,19,20,37,39,42,49,52-54,65-71,81,111,161,123,136-170,514-518,630,631,636-640,650,653,921,1023-1030,1900,2048-2050,27900,27960,32767-32780,32831' pps 75
  using interface(s) eth0
  
  UDP open domain[ 53] from 192.168.1.143 ttl 50
  UDP open netbios-ns[ 137] from 192.168.1.143 ttl 50
  UDP open unknown[51468] from 192.168.1.143 ttl 50
  
  msf auxiliary(udp_sweep) > run
  
  [*] Sending 10 probes to 192.168.1.143->192.168.1.143 (1 hosts)
  [*] Discovered NTP on 192.168.1.143:123 (NTP v4)
  [*] Discovered NetBIOS on 192.168.1.143:137 (INEEDAFW01::U :INEEDAFW01::U :INEEDAFW01::U :__MSBROWSE__::G :WORKGROUP::U :WORKGROUP::G :WORKGROUP::G :00:00:00:00:00:00)
  [*] Discovered DNS on 192.168.1.143:53 (BIND 9.4.2-P2)
  [*] Scanned 1 of 1 hosts (100% complete)
  [*] Auxiliary module execution completed
  
  sudo nmap -sU 192.168.1.143
  PORT STATE SERVICE
  53/udp open domain
  69/udp openfiltered tftp
  123/udp open ntp
  137/udp open netbios-ns
  138/udp openfiltered netbios-dgm
  
  *took approx 13 min for results
  
  Host #2
  
  sudo unicornscan -m U -Ir 75 -v 192.168.1.94
  UDP open sunrpc[ 111] from 192.168.1.94 ttl 50
  UDP open shilp[ 2049] from 192.168.1.94 ttl 50
  
  
  msf auxiliary(udp_sweep) > run
  
  [*] Sending 10 probes to 192.168.1.94->192.168.1.94 (1 hosts)
  [*] Discovered Portmap on 192.168.1.94:111 (100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(35483), 100024 v1 TCP(34855), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(51021), 100021 v3 UDP(51021), 100021 v4 UDP(51021), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(32771), 100021 v3 TCP(32771), 100021 v4 TCP(32771), 100005 v1 UDP(54730), 100005 v1 TCP(50729), 100005 v2 UDP(54730), 100005 v2 TCP(50729), 100005 v3 UDP(54730), 100005 v3 TCP(50729))
  [*] Scanned 1 of 1 hosts (100% complete)
  [*] Auxiliary module execution completed
  
  sudo nmap -sU 192.168.1.94 -v
  PORT STATE SERVICE
  111/udp open rpcbind
  639/udp openfiltered unknown
  2049/udp open nfs
  
  *took approx 14 min
  
  Quick notes:
  unicornscan sucks for NTP, the metasploit udp_sweep is better even though the port is in the scan list it fails to locate NTP servers
  
  you'll probably want to add some port to the /usr/local/etc/unicornscan/unicorn.conf file in the UDP section, namely 1434,1604,5093,& 523 to be consistent for what metasploit is sending probes for.
  
  you may also want to update the ports list in the above folder to be les stupid as well.
  
  In this case nmap gave consistent results, just took forever
  
  
  compile stuff from here:
  http://itbloggen.se/cs/blogs/olle_lindgren/archive/2009/01/08/unicornscan-on-ubuntu-8-10-intrepid-ibex.aspx?CommentPosted=true#commentmessage
  
  http://geek00l.blogspot.com/2009/01/ubuntu-unicornscan-revisit.html

  Tags:  blah-blah sweep-run exec-grep unicornscan  

• January 28, 2010
• 14:34

  making my drivers see channels 12-14 ??

   » ‎ remote-exploit & backtrack
  Hello im having trouble with some wifi cracking im trying the target networks are all on channel 13 i have 2 wifi cards on my laptop a IPW3945 built in jobby and a USB f5d7050b both are working fine on wlano and wlan1. However they wont go to a channel above 11 in airmon or airodump etc.. even using the channel flags i dont get an error but it just uses channel 11.
  when i get to using aireplay-ng i get the error " WLAN0 is on channel 11, but the AP uses channel 13"
  
  ive traced this error back to a driver issue the drivers built into bt4 are the US version and they only have 11 wifi channels here in the UK we use channel 13 all the time for some reason ( mainly as BT defaults to that on their equipment they give free with the broadband)
  anyway i thought i had found the fix to this Quote:

  The key piece to sorting this out was adding this line to my /etc/modprobe.d/options and then re-starting my system (simple - brute force!): options cfg80211 ieee80211_regdom="EU" "iwlist wlan0 channel" previously only reported channels 1 to 11, but now shows all of them. No problems connecting to the AP now on channel 13: steve@steve-laptop:~$ iwlist wlan0 channel wlan0 13 channels in total; available frequencies : Channel 01 : 2.412 GHz Channel 02 : 2.417 GHz ( blah blah blah blah ) Channel 11 : 2.462 GHz Channel 12 : 2.467 GHz Channel 13 : 2.472 GHz Current Frequency=2.472 GHz (Channel 13)

  i did all the above and besides the fact i have 32 channels available none of them are 12 13 and 14
  
  
  what am i doing wrong does anyone know ?? has anyone done this before to get to use channel 13 ?
  
  thanks for your replies please keep them simple i am a total noob
  
  oh forgot to add in windows both these cards work fine in the EU channel bands ..

  Tags:  quot channel wlan ghz jobby blah-blah channel-11 BackTrack General Support  

• 14:34

  making my drivers see channels 12-14 ??

   » ‎ remote-exploit & backtrack
  Hello im having trouble with some wifi cracking im trying the target networks are all on channel 13 i have 2 wifi cards on my laptop a IPW3945 built in jobby and a USB f5d7050b both are working fine on wlano and wlan1. However they wont go to a channel above 11 in airmon or airodump etc.. even using the channel flags i dont get an error but it just uses channel 11.
  when i get to using aireplay-ng i get the error " WLAN0 is on channel 11, but the AP uses channel 13"
  
  ive traced this error back to a driver issue the drivers built into bt4 are the US version and they only have 11 wifi channels here in the UK we use channel 13 all the time for some reason ( mainly as BT defaults to that on their equipment they give free with the broadband)
  anyway i thought i had found the fix to this Quote:

  The key piece to sorting this out was adding this line to my /etc/modprobe.d/options and then re-starting my system (simple - brute force!): options cfg80211 ieee80211_regdom="EU" "iwlist wlan0 channel" previously only reported channels 1 to 11, but now shows all of them. No problems connecting to the AP now on channel 13: steve@steve-laptop:~$ iwlist wlan0 channel wlan0 13 channels in total; available frequencies : Channel 01 : 2.412 GHz Channel 02 : 2.417 GHz ( blah blah blah blah ) Channel 11 : 2.462 GHz Channel 12 : 2.467 GHz Channel 13 : 2.472 GHz Current Frequency=2.472 GHz (Channel 13)

  i did all the above and besides the fact i have 32 channels available none of them are 12 13 and 14
  
  
  what am i doing wrong does anyone know ?? has anyone done this before to get to use channel 13 ?
  
  thanks for your replies please keep them simple i am a total noob
  
  oh forgot to add in windows both these cards work fine in the EU channel bands ..
  
  thought i spotted a mistake as the "EU" is in quotes in his text and i found the same instructions elsewhere without the quotes round the EU and you can also use JP but no its still only does 1-11

  Tags:  quot channel wlan ghz jobby blah-blah channel-11 Newbie Area