Everyday Carry PenTest Edition

This is an everyday carry but not in my pockets, in my man-purse, or briefcase as some have taken to calling it. The "bag" in question being a Kenneth Cole Reaction briefcase.

Within that I keep an Apple MacBook Book Air Early 2014 with MacOS Sierra. You may think that's insufficient power but it has proven that the lack of weight and the SSD certainly compensate for anything to be desired. In fact the only thing I noticed after ditching my (Debian) Dell XPS, is that a lost a lot of weight but lost practically no computational power. And further Within is yet another small case, and within that is where the magic lies:

So the tools most notably in here are USB rubber ducky( for quickly injecting malware in hypothetical within reach machines), Yardstick One( for hypothetically jamming wireless signals within it's rating or hypothetically intercepting rolling encryption car fob door opens, and starts), usb SDR( for playing with Software Defined Radio, and not cell signals), Ubertooth(For bluetooth operations), a host of usb fobs, and that concludes one side of the bag.[Most of these can be purchased at Hak5] On the other side of the bag* I have various antennae for the aforementioned devices, an RFID card reader, some blank cards and keychains, and a set of door shims of varying thickness.

Within the briefcase I also have a black tie, because why not. And a mechanical keyboard. The keyboard may seem like overkill but your fingers will thank you, and with the weight loss from upgrading to the apple from the Dell, I don't notice the extra weight.

*Forgot the Turtle Lan Shell

For less potato, but more linux / hacking pics, check out my instagram.

Language And Manipulation

When I was a child I read Dale Carnigie's, "How to Win Friends and Influence people", since then I have always felt that language is the most powerful tool in anyone's arsenal. That belief only became reinforced as I learned more and more about communication. Today on a web2.0 security blog I read, there was an interesting post about this.

Bowling Green, Kentucky Security / Networking / IT Support and Consulting

If you would like to hire me for the purpose of security consulting, web development, server, network support, or penetration testing. I can telecommute or if you are near the Bowling Green area, I can commute. If you just need to know what direction to take your IT you can get a free consultation. For a resume or phone number:
bsdpunk@gmail.com

Unix and Linux Servers
Windows Servers
Active Directory
General LAN and WAN problems
Backups and Disaster Recovery Plans
Cisco Routers and Switches
Web Development( Perl PHP Javascript )
Wireless Networks
PC troubleshooting
A+ Certified
Network+ Certified
MCP

Easy System Administrator Security Blunders

Fatal System Administrator Mistakes
System Administration can be a stressful job and tedious. This leads admins who are either poorly educated or over work to make some very simple mistakes out of convenience, franticness, or frustration.

In a large enough environment, most companies take use of Active Directory. This cuts down on the amount of work a sys admin has to do for shared resources through centralized authentication. Which means most boxes in the corporate environment have two administrators(3 if you count the domain admin). One is the normal user who comes in and authenticates through AD transparently on his/her box. The other is the local Administrator of the box that was used to set up the machine, most sys admins do not remove or disable this account. And most sys admins use the same password for this account consistently, and it's usually not a really sophisticated password.

Consider looking at:
http://ophcrack.sourceforge.net/
http://www.mininova.org/tor/183001
http://wiki.hak5.org/wiki/USB_Hacksaw
**Can't vouch for the torrent sites**


In a small to medium business, some times there is a crunch for budget and either the IT guy is really crunched for time, or there is no IT guy so the responsibility of the web server falls to either a web developer or a web designer. Most of these guys know what they are doing but there's a portion of them, that when they here security they think I don't have any mySQL injection points on my webpage, not maybe I shouldn't just set the webserver outside the firewall. I lot of web guys put servers outside of firewalls, or just forward enough ports to make the firewall ineffective, because it makes there job easier. Now a hardened FreeBSD box sitting outside a firewall, is on thing, but a Windows server 2000 box with the majority of ports turned to the internet is quite another, particularly if that box is doing more than web serving. Being that it's a web server there is probably a reluctance to update becuase of down time as well.

Consider looking at:
http://www.metasploit.com/
Core Impact(If someone finds a torrent for this let me know so I can post it)
Canvas(If someone finds a torrent for this let me know so I can post it)
**Can't vouch for torrent sites**

Not training employees to understand when it is ok to disclose there password and when not to can be a problem as well. We have all heard the example of the sticky note with the password right by the computer, however other helpfuls in social engineering are just reading the site and looking at the staff directory. Maybe visit the site to see how the physical security is, imagine if there was an rj45 port exposed, just hook up and set a small ap behind a chair and your in. And if you are into it, go ahead and do some trashing, just grab some bags from there dumpster see if anyone threw out one of those sticky notes you here so much about.

Consider:
Visiting Web site
Visiting Physical Site

So there's three mistakes you might look for that an overworked or underworking IT pro might make.

True Crypt for n00bs.

http://www.truecrypt.org/
The truecrypt install is straight foreword and similar to the install of most other applications. The first install screen will ask whether to install or extract, and the default which is install is fine. Again on the next page most likely the defaults are fine and then click install. It will ask if you want to see the release notes, click no. Then click finish. Now to open truecrypt. Double click on the true crypt icon on your desktop.


Click create volume. Now for this tutorial we will choose to create a file container then click next and then click create a standard true crypt volume.

Choose where to save your encrypted file volume. The default of AES and RIPEMD-160 are sufficient. You will need to remember what encryption scheme you used so either make a mental note or write it down. I like to make my truecrypt file 600 megs, so if I need to archive it or send it somewhere to be archived(like a lawyer), then it will fit on a cd.

Your password is important and you must remember it, it needs to be a strong password. Strong passwords are denoted by five characteristics. They need to have Upper Case and Lower Case letters and Symbols and numbers. Length is the other factor. Ie@Tpietw1ce@d4Y, is a strong password. You can use a key file if you want but it will complicate things if you want to use your encrypted file on another computer or if that keyfile is corrupted. As far as volume format the defaults are fine. Now to mount your file as a volume go to the main truecrypt screen.


Choose a drive letter like H: . Hit the select file button. Choose your file. Hit the mount button. You will be prompted for your password. Your file will be mounted as the h: drive and anything you put in it will be encrypted. Remember to dismount the drive with the dismount all button whenever you are not using it.

Finding and Executing wireless intruders

Finding and executing Wireless intruders.

Finding the intruder.

The easiest way to check is to go into your router and check the dhcp clients table and see what ip’s on your network are being used. Routers can be very different from one another to get to yours type ipconfig in the command prompt your router will be at the address that is the default gateway. Type that address in your address bar of your web browser(this works assuming you have a consumer grade router in your house not like a cisco 2611). A login screen should pop up. If you do not know your router’s username and password find it on the default password list

https://www.bestvpn.com/default-router-login-details/

Some people will appreciate this list more than othersJ. On a Linksys you will click the status button, and then local network and then dhcp client table list. If you don’t have control of the router on your network you can use angryIP to scan your network for IP’s, typically your range will be 192.168.1.0 to 192.168.1.254. Or you can use an arp scan tool like cain and abel(oxid.it). Anyway wants you have one of these lists eliminate the IP’s that belong to your devices. If you can eliminate all the ip’s you have no intruder if you can not, you may have an intruder.

Eliminating the intruder.

First and easiest thing to do is see if he has simple file sharing enabled. To do this hit start->run then type \\ipaddress and yes you do have to have the right slashes. A good way to think about it is \ is a windows slash and / is a *nix slash. Ok let’s say that doesn’t bring up any shares or times out. Next we want to nmap the target.

http://nmap.org/download.html

After the install use the cmd line interface to nmap by hitting start->run then typing cmd. Now you are at the command line and you want to use nmap so type:

Nmap targetip –P0 –O

That’s a p and a zero and then the second one is an uppercase letter o. It means it won’t ping first and it will try to id the os as well. Ports you want to be open are 22(for ssh on *nix comps), 3389(rdp on windows comps), or any of the vnc ports. Hydra THC can brute force ssh and tsgrind can brute force RDP.

http://www.hammerofgod.com/download.html

But remember brute force is just brute force. It’s really unskillful and oafish. You probably would rather try something more subtle like sniffing.

Please look at one of my earlier posts on password sniffing.

So by now you have enough knowledge to own the box.

You may also just want to enumerate data on your victim. If you want you could just boot him from the network by enabling 802.1x on your router.