Rebuild MiniPwner

Hi,

I just wanted to use my MiniPwner again after some months where it was just placed on my desk and unfortunately I forget the password and I also didn't wrote it in my KeePass File.

So I had to reinstall it. Luckily there is a rebuilding instruction of the MiniPwner in case there went something wrong with your MiniPwner (or you just forget about the password ;-) ).

In the rebuilding instructions it is mentioned to get the "squash-sysupgrade.bin". I couldn't get it on this URL as the folder is empty. So I used the latest firmware "openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory" for the TP-Link router from this directory on openwrt. The MD5Sum I got was:

root@Pulse:/tmp# md5sum owrt.bin
5d7bac7b467c42e215c60fcd0a00cc01

The image is available again.

On your Client where you've placed your openwrt image, you just start your netcat server.

# nc -l -p 3333 < openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin

On your TP-Link now just get the image via netcat:

# nc 192.168.1.2 3333 > /tmp/owrt.bin

The file should be on your TP-Link within a few seconds so you can abort the netcat session on it. After that just install the firmware:

# mtd -r write 703.bin firmware

After the installation of the firmware is done, which shouldn't take longer than one or two minutes, you need to configure your interface of the client that is connected to TP-Link to DHCP. The IP of TP-Link should be 192.168.1.1. You can now telnet to this IP:

$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------

BusyBox v1.19.4 (2012-08-26 12:49:54 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (12.09-beta, r33312)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/# 

You should now change your root password so that you can login via ssh in the future. Then you can ssh to your TP-Link and can continue the installation instructions on minipwner.org at step 12.

You can also navigate now to the Webgui under http://192.168.1.1/cgi-bin/luci.

IMPORTANT:

Right now it is not possible to execute "opkg update" as all the files in http://downloads.openwrt.org/snapshots/trunk/ are missing. There are several tickets about this issue, here and here.

But they are both almost 2 weeks old and it's not clear when the files are coming back. So here is what I did (thanks to flyingstar16, who posted this hint in one of the tickets):

1. Comment out the lines in /etc/opkg/xwrt.conf

root@Pulse:/etc# vim opkg/xwrt.conf
#src/gz X-Wrt http://downloads.x-wrt.org/xwrt/snapshots/trunk/ar71xx/packages

2. Comment out the line to http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages as it is not working and add the line "src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09-beta/ar71xx/generic/packages"

root@Pulse:/etc# vim opkg.conf

src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09-beta/ar71xx/generic/packages

#src/gz snapshots http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages
dest root /
dest ram /tmp
lists_dir ext /var/opkg-lists
option overlay_root /overlay

3. Now you can execute opkg update.


Some other hints:

When copying all the files in Step 19 in /etc/ to make a backup of them, I hadn't a firewall config and fstab. See my output:

root@OpenWrt:/usr/share# cp -f /etc/config/network /etc/config/network.orig
root@OpenWrt:/usr/share# cp -f /etc/config/wireless /etc/config/wireless.orig
root@OpenWrt:/usr/share# cp -f /etc/config/firewall /etc/config/firewall.orig
root@OpenWrt:/usr/share# cp -f /etc/profile /etc/profile.orig
root@OpenWrt:/usr/share# cp -f /etc/config/fstab /etc/config/fstab.orig
cp: can't stat '/etc/config/fstab': No such file or directory
root@OpenWrt:/usr/share# cp -f /etc/opkg.conf /etc/opkg.conf.orig
root@OpenWrt:/usr/share# cp -f /etc/config/system /etc/config/system.orig
root@OpenWrt:/usr/share# cp -f /etc/config/dhcp /etc/config/dhcp.orig
root@OpenWrt:/usr/share# cp -f ./network.1 /etc/config/network
cp: can't stat './network.1': No such file or directory
root@OpenWrt:/usr/share# cp -f ./wireless.1 /etc/config/wireless
cp: can't stat './wireless.1': No such file or directory
root@OpenWrt:/usr/share# cp -f firewall.1 /etc/config/firewall
cp: can't stat 'firewall.1': No such file or directory

But everything worked fine. I also skipped step 20 and 21 as the right MAC-Address for WiFi was already in the config. 

Here is a good explanation how to configure WiFi in OpenWRT.

Have fun.

Setup a Mailserver

Hy,

this post is not about pentesting, but this weekend I had to move a domain of a friend of mine to my Debian server. After moving the domain I needed also to setup a (IMAP-) mail server. I'm not so good into configuring a whole mailserver system, but I found this really great tutorial:

http://workaround.org/ispmail/squeeze/

It worked just like a charme. And even if you have a problem just look in the comments, there is for sure someone that already had the same problem. If not, look in /var/log/mail.log ;-)

Cheers.

Perl and https requests

Hi there,

today I was in the mood in writing some little perl script that I need for a project. To get the perl script running it was needed to execute some https requests.

First I was installing LWP::UserAgent and HTTP::Request via cpanm. Then I was writing a basis script that was executing a http request. I'm only interested in the header, so I don't want to print out the body content (I've found this litte code snippet here).

 #!/usr/bin/perl  
 use LWP::UserAgent; 
 use HTTP::Request;  

 my $URL = 'http://www.example.com/';  
 my $agent = LWP::UserAgent->new(env_proxy => 1,keep_alive => 1, timeout => 30);  
 my $header = HTTP::Request->new(GET => $URL);  
 my $request = HTTP::Request->new('GET', $URL, $header);  
 my $response = $agent->request($request);  

 if ($response->is_success){  
     print "URL:$URL\nHeaders:\n";  
     print $response->headers_as_string;  
 }elsif ($response->is_error){  
     print "Error:$URL\n";  
     print $response->error_as_HTML;  
 }  

This worked for me very well, but I needed to create a https request. When I was executing the same script with https instead of http I was getting the following error:

 Error:https://www.example.com/  
 <html>  
 <head><title>An Error Occurred</title></head>  
 <body>  
 <h1>An Error Occurred</h1>  
 <p>501 Protocol scheme 'https' is not supported (LWP::Protocol::https not installed)</p>  
 </body>  
 </html>  

So, I need to install LWP:Protocol:https, but this wasn't working:

 $ sudo cpanm LWP::Protocol::https  
 --> Working on LWP::Protocol::https  
 Fetching http://www.cpan.org/authors/id/G/GA/GAAS/LWP-Protocol-https-6.03.tar.gz ... OK  
 Configuring LWP-Protocol-https-6.03 ... OK  
 ==> Found dependencies: IO::Socket::SSL  
 --> Working on IO::Socket::SSL  
 Fetching http://www.cpan.org/authors/id/S/SU/SULLR/IO-Socket-SSL-1.76.tar.gz ... OK  
 Configuring IO-Socket-SSL-1.76 ... OK  
 ==> Found dependencies: Net::SSLeay  
 --> Working on Net::SSLeay  
 Fetching http://www.cpan.org/authors/id/M/MI/MIKEM/Net-SSLeay-1.48.tar.gz ... OK  
 Configuring Net-SSLeay-1.48 ... OK  
 Building and testing Net-SSLeay-1.48 ... FAIL  
 ! Installing Net::SSLeay failed. See /root/.cpanm/build.log for details.  
 ! Bailing out the installation for IO-Socket-SSL-1.76. Retry with --prompt or --force.  
 ! Bailing out the installation for LWP-Protocol-https-6.03. Retry with --prompt or --force.  

Openssl was installed, but I needed to install "build-essential libssl-dev" to get the installation of LWP:Protocol_https working:

 $ sudo apt-get install build-essential libssl-dev  

Now https requests can be made with perl:

 #!/usr/bin/perl  
   
 use LWP::UserAgent;  
 use HTTP::Request;  
   
 my $URL = 'https://www.twitter.com/';  
   
 my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 1 });  
 my $header = HTTP::Request->new(GET => $URL);  
 my $request = HTTP::Request->new('GET', $URL, $header);  
 my $response = $ua->request($request);  
   
 if ($response->is_success){  
     print "URL:$URL\nHeaders:\n";  
     print $response->headers_as_string;  
 }elsif ($response->is_error){  
     print "Error:$URL\n";  
     print $response->error_as_HTML;  
 }  
   

Response of twitter.com on port 443:

   
 $ ./hsts.pl   
 URL:https://www.twitter.com/  
 Headers:  
 Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0  
 Date: Thu, 06 Sep 2012 21:22:33 GMT  
 Pragma: no-cache  
 ETag: "f7a8e95e2978ac6f73209336152b9495"  
 Server: tfe  
 Vary: Accept-Encoding  
 Content-Length: 47126  
 Content-Type: text/html; charset=utf-8  
 Expires: Tue, 31 Mar 1981 05:00:00 GMT  
 Last-Modified: Thu, 06 Sep 2012 21:22:33 GMT  
 Client-Date: Thu, 06 Sep 2012 21:22:33 GMT  
 Client-Peer: 199.59.148.10:80  
 Client-Response-Num: 1  
 Content-Base: http://twitter.com/  
 Link: <http://a0.twimg.com>; rel="dns-prefetch"  
 Link: <http://api.twitter.com>; rel="dns-prefetch"  
 Link: </favicons/favicon.ico>; rel="shortcut icon"; type="image/x-icon"  
 Link: <http://a0.twimg.com/a/1346884958/t1/css/t1_core_logged_out.bundle.css>; media="screen"; rel="stylesheet"; type="text/css"  
 Link: <https://twitter.com/>; rel="canonical"  
 Link: <http://a0.twimg.com/a/1346884958/t1/css/t1_more.bundle.css>; media="screen"; rel="stylesheet"; type="text/css"  
 Refresh: 0; URL=/?_twitter_noscript=1  
 Set-Cookie: k=10.36.21.101.1346966553057924; path=/; expires=Thu, 13-Sep-12 21:22:33 GMT; domain=.twitter.com  
 Set-Cookie: guest_id=v1%3A134696655306150737; domain=.twitter.com; path=/; expires=Sun, 07-Sep-2014 09:22:33 GMT  
 Set-Cookie: _twitter_sess=BAh7CSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCOaBdp05AToMY3NyZl9p%250AZCIlNThkNmZkYjY2ODJjNTc0MzY0YTY2Y2M0YjI0OGU2NWE6B2lkIiUwMmUz%250AZTJjY2VkMjFiYWNmZjQ5MmI2MjQyNWU5ZTJiMw%253D%253D--7d08430b6a85e0006ac4c062a4218d5cf841f564; domain=.twitter.com; path=/; HttpOnly  
 Status: 200 OK  
 Title: Twitter  
 X-Frame-Options: SAMEORIGIN  
 X-Meta-Charset: utf-8  
 X-Meta-Description: Verbinde Dich sofort mit den Dingen, die für Dich am wichtigsten sind. Folge Freunden, Experten, Lieblingsstars und aktuellen Nachrichten.  
 X-MID: e88c4d8fc53fc1466f24f3cbc905d24fd89af901  
 X-Runtime: 0.07026  
 X-Transaction: 4998cc5789e9b2c0  
 X-UA-Compatible: IE=edge  
 X-XSS-Protection: 1; mode=block  
   

First step is done :-)

Vulnerable Web Applications

Hey there,

really a long time without a new post, but hopefully this will change in the future.

In this post I was listing some vulnerable VMs that can be used for pentesting at home. There are also several vulnerable Web Applications available, that can be used for pentesting. I've found a really great overview of vulnerable Web Applications.

I will use for local testing now Damn vulnerable Web Application (DVWA)

Here is a short description about DVWA copied from the DVWA website:

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

So the only thing you will need, after downloading DVWA is Apache/PHP/MySQL environment. This      can be easily realized with XAMPP, as it is a full package containing Apache Webserver with PHP and a MySQL Database and is available for a lot of plattforms (Mac OS X/ Windows / Linux / Solaris).

Hopefully I will have some time to execute a pentest against DVWA and to post some findings about it :-)

MiniPwner

Hey folks,

after waiting for two months my TP-Link Router has finally arrived yesterday. I'm not quite happy how the order was processed by volumerates.com. I ordered the TP-Link on 16th of January and volumerates gave an information in the automated E-Mail (after buying the router) that customers should write an E-Mail to them if they didn't get any response by volumerates.com within one week.
I didn't get any response within one week so I decided to write an E-Mail to them. => No Answer.
After another 4 weeks (I was in vacation abroad) still no answer. So I wrote another E-Mail => No Answer.
Then I openend a ticket on http://www.volumerates.com/. => No Answer.
I had no information at all for two months and there were also no E-Mails in my Spam Folder. Just one respond to my E-Mail that it will take one or two months would have been very good. I already thought my money is lost...

The happy part though is that it finally arrived and the installation instruction on MiniPwner.com worked as a charm.

Now I've got a fully working pentesting device with a RJ45 port, Wi-Fi and one USB-Port running OpenWRT. The USB-Port is already used by a 8 GB USB Flash-Drive.

Here a short overview of the installed tools so far:

root@OpenWrt:~# opkg list
aircrack-ng - 1.1-3
base-files - 104-r30857
base-files-network - 3
blkid - 1.42-1
block-mount - 0.2.0-7
busybox - 1.19.3-10
bzip2 - 1.0.6-1
crda - 1.1.1-1
dnsmasq - 2.59-2
dropbear - 2011.54-2
dsniff - 2.4b1-2
elinks - 0.11.7-1
firewall - 2-47
hotplug2 - 1.0-beta-4
iptables - 1.4.10-4
iw - 3.3-1
kernel - 3.2.9-1-7ca3c65ac3709dabad42d460596851da
kismet-client - 2010-07-R1-1
kismet-server - 2010-07-R1-1
kmod-ath - 3.2.9+2012-02-27-1
kmod-ath9k - 3.2.9+2012-02-27-1
kmod-ath9k-common - 3.2.9+2012-02-27-1
kmod-cfg80211 - 3.2.9+2012-02-27-1
kmod-crypto-aes - 3.2.9-1
kmod-crypto-arc4 - 3.2.9-1
kmod-crypto-core - 3.2.9-1
kmod-fs-ext4 - 3.2.9-1
kmod-gpio-button-hotplug - 3.2.9-1
kmod-ipt-conntrack - 3.2.9-1
kmod-ipt-core - 3.2.9-1
kmod-ipt-nat - 3.2.9-1
kmod-ipt-nathelper - 3.2.9-1
kmod-leds-gpio - 3.2.9-1
kmod-ledtrig-usbdev - 3.2.9-1
kmod-lib-crc-ccitt - 3.2.9-1
kmod-lib-crc16 - 3.2.9-1
kmod-mac80211 - 3.2.9+2012-02-27-1
kmod-nls-base - 3.2.9-1
kmod-ppp - 3.2.9-1
kmod-pppoe - 3.2.9-1
kmod-scsi-core - 3.2.9-1
kmod-tun - 3.2.9-1
kmod-usb-core - 3.2.9-1
kmod-usb-ohci - 3.2.9-1
kmod-usb-storage - 3.2.9-1
kmod-usb2 - 3.2.9-1
kmod-wdt-ath79 - 3.2.9-1
libblkid - 1.42-1
libbz2 - 1.0.6-1
libc - 0.9.33-104
libcom_err - 1.42-1
libext2fs - 1.42-1
libgcc - 4.6-linaro-104
libgdbm - 1.9.1-2
libip4tc - 1.4.10-4
liblzo - 2.05-1
libncurses - 5.7-5
libnet0 - 1.0.2a-8
libnids - 1.18-1
libnl-tiny - 0.1-2
libopenssl - 1.0.0g-1
libpcap - 1.1.1-1
libpcre - 8.11-2
libpthread - 0.9.33-104
libreadline - 5.2-2
librpc - 0.9.32-rc2-0a2179bbc0844928f2a0ec01dba93d9b5d6d41a7
libstdcpp - 4.6-linaro-104
libuci - 2012-02-24.1-1
libuuid - 1.42-1
libxtables - 1.4.10-4
mtd - 17
nbtscan - 1.5.1
netcat - 0.7.1-2
nmap - 5.51-3
openssh-sftp-client - 5.9p1-4
openvpn - 2.2.1-5
opkg - 618-2
perl - 5.10.0-7
ppp - 2.4.5-4
ppp-mod-pppoe - 2.4.5-4
samba2-client - 2.0.10-8
samba2-common - 2.0.10-8
snort - 2.8.4.1-3
swap-utils - 2.13.0.1-4
swconfig - 10
tar - 1.23-1
tcpdump - 4.2.1-1
terminfo - 5.7-5
uboot-envtools - 2011.06-4
uci - 2012-02-24.1-1
uclibcxx - 0.2.2-3
wireless-tools - 29-4
wpad-mini - 20111103-3
yafc - 1.1.1-2
zlib - 1.2.5-1

Pentesting Devices / Gadgets

There are three devices I have found, that can be very useful if you're executing a (physical) security pentest:

• Pwnie Express 
• The Plug Bot 
• Mini Pwner

All of these devices are just as big as a cigarette packet and to make a long story short they can be described like this:

They are designed as a small, simple but powerful device that can be inconspicuously plugged into a network and provide the penetration tester remote access to that network.
(Quote from "What is the Mini Pwner")


The great thing about the Mini Pwner is, that you can easily build one on your own. I just purchased yesterday the TP-Link TL-WR703N router and hopefully I will get it next week. When I have time, I will build it in the next week and post about it here in my blog.

An comparision between Pwnie Express and Mini Pwner can be found here.

Increasing virtual disk in ESX 3.5

My installation of BackTrack has only a 10 GB virtual disk, because I was using the default settings when I installed it. Now I want to increase it to 25 GB.

This can be done through opening the VMware Infrastructure-Client (only available for Windows). After it has started, you have to right-click on the virtual machine that needs a bigger virtual disk and choose "Edit Settings" in the context menu. Then you have to select "Virtual Disk" Now you can increase the size of the disk and confirm the new size with "Ok".

All the steps I just described can also be done, when the VM is still running. As a next step we need to increase the partition, so that the VM will recognize the new space and that the disk size has changed. For this task we will use GParted. We just need to download the GParted ISO and upload it to the ESX server so that we can select it in the VM settings as "Datastore ISO File". With this settings the VM will boot up GParted when the VM is starting:

If GParted won't boot (in my case I had this problem), you have to force the VM to go into the BIOS settings and change the boot order (CD-Rom should be first, at least before HD ;-)

After a new try to boot GParted, we can see now that GParted is actually booting :-)

After selecting the key-map I couldn't just start X. I had to configure it through the wizard first, otherwise I was getting this error (see also screenshot):

Virtual width (1184) is too large for the hardware (max 1180)
Screen(s) found, but none have a usable configuration.

You have to select "Run Forcevideo to config X manually" and click through the wizard. You should take a resolution of 800x600.

Now GParted should have started and you just have to make a right-click on the unused space and create a new partition with an ext4 filesystem.

After the changes have been applied, there is a new partition with 15 GB.

After a reboot we just need to modify /etc/fstab. With fdisk -l we can see all harddisks and partitions:

/dev/sda3 is my new partition with almost 15GB and will now be added to /etc/fstab as new partition for /root. We just need to find out the UUID to insert it into fstab:

That's it :-)


URL
VMware Increasing virtual disk size