Archangel Amael's Blog: BT4

Showing posts with label BT4. Show all posts

Saturday, July 24, 2010

MySQL Security Assesment Script in BT4

So this is a short write up on using the MySQL security Assessment Script
by Carlos Perez

Of course you will need a mysql database to target.
If you want a pre-made setup then get the metasploitable package.

Grab some shell and navigate to the /pentest/database/mysqlaudit/ directory.
Then just run the command with no options.

-----------------------------CODE---------------------------------------

root@bt:/pentest/database/mysqlaudit#./mysqlaudit.py

MySQL Security Assesment Script Version 1.0

By: Carlos Perez, carlos_perez[at]darkoperator.com
USAGE:
python ./mysqlaudit.py Targer IP User Password Report

Target : The system you whant to do the assement on, port 3306 should be open.
User : User account with DBA privelages on the server to use for the assesment.
Password : password for the user account.
Report : Name of text file to wich to write the report.

-----------------------------CODE--------------------------------------

Simple enough the only thing you will need of course is the log-on credentials.
This time we will run the scan against our metasploitable setup and see what happens.

-----------------------------CODE--------------------------------------

root@bt:/pentest/database/mysqlaudit# ./mysqlaudit.py 192.168.2.103 root root /tmp/msqlauditreport.txt
root@bt:/pentest/database/mysqlaudit#

-----------------------------CODE--------------------------------------

So in order to see what our report shows we can either open it with a text editor or we can cat the output back to the screen.
Since the report is quite long I will only show a little of it here.
-----------------------------CODE--------------------------------------

root@bt:/pentest/database/mysqlaudit# cat /tmp/msqlauditreport2.txt | less

Severity: High

Description:

MySQL authentication is based on usernames and passwords stored in a table

called mysql.user. To create a user, a row is added to this table. MySQL
also supports wildcards and blank values in the USERNAME and HOST fields of
the table. By indicating a blank username and a blank password, you allow
anonymous access to the MySQL database.
Solution:

To remove the anonymous user, run the following commands:
shell> mysql -u root [password]
mysql> DELETE FROM mysql.user WHERE User = '';

Anonymous user was found

User Connection Location
anonymous ---->localhost
anonymous ---->ubuntu804-base

-----------------------------CODE-------------------------------------

As you can tell there is a high level flaw in our setup.
So this tool will allow the Penetration tester to target mysql databases and will determine some basics when it comes to the security of the system.

Have fun.

Wednesday, July 21, 2010

Update bt4-customise.sh script

So after someone noticed on the forums that the bt4-customise.sh script needs to be edited in order to work with the new .iso, I decided to make this post with what needs to be changed.

First grab the script and open it with your favorite editor.
------------------------------CODE-------------------------------------
# nano bt4-customise.sh
------------------------------CODE------------------------------------
Then at the top around line 3 change
------------------------------CODE------------------------------------
btisoname=bt4-pre-final.iso
------------------------------CODE------------------------------------
To the new .iso name.
So for the BT4 final you will need bt4-final.iso
------------------------------CODE------------------------------------
So btisoname-bt4-final.iso
------------------------------CODE------------------------------------

Save, exit and that's it.

Have fun.

Monday, July 19, 2010

how-to, brutessh.py in BT4

Fast and simple guide to using brutessh.py in BT 4

Standard disclaimer applies, Don't be stupid and do things that will get you put in jail etc.

Ok as the name implies brutessh.py is a python based brute force tool for ssh
So what it does is takes target data on the command line and uses a dictionary to try and brute ssh. Pretty simple.

Grab a shell
-------------------------------------CODE------------------------------------------------------------------

root@bt:/pentest/passwords/brutessh#

-------------------------------------CODE----------------------------------------------------------------
Check out the readme for more info.
-------------------------------------CODE----------------------------------------------------------------

root@bt:/pentest/passwords/brutessh# cat README

-------------------------------------CODE----------------------------------------------------------------
An easy and safe way to run the tool is to simply make a small dictionary in the same directory put a few words and your ssh password into the list.

Now run it.
-------------------------------------CODE----------------------------------------------------------------
root@bt:/pentest/passwords/brutessh# python brutessh.py -h localhost -u root -d dict

*************************************
*SSH Bruteforcer Ver. 0.2 *
*Coded by Christian Martorella *
*Edge-Security Research *
*laramies@gmail.com *
*************************************

HOST: localhost Username: root Password file: dict
===========================================================================
Trying password...
Times -- > Init: 0.15 End: 3.35
Auth OK ---> Password Found: 123abc$$
root@bt:/pentest/passwords/brutessh#
-------------------------------------CODE----------------------------------------------------------------
Of course that's not the real password!

It obviously didn't take that long, 3.35 seconds.

So there you have it. Quick, fast, and easy. Actually I don't believe it gets easier than that.

Sunday, May 23, 2010

SSLScan in BT

SSLScan in BT4

No need to write a description since the intro below already has one as well as usage details.
In order to use grab some shell or find it in the menu structure under:
BT> NetworkMapping> ALL> sslscan

Running the command without any options returns the following.

root@dorkness~:# sslscan

_
___ ___| |___ ___ __ _ _ __
/ __/ __| / __|/ __/ _` | '_ \
\__ \__ \ \__ \ (_| (_| | | | |
|___/___/_|___/\___\__,_|_| |_|

Version 1.6
http://www.titania.co.uk
Copyright (C) 2007-2008 Ian Ventura-Whiting

SSLScan is a fast SSL port scanner. SSLScan connects to SSL
ports and determines what ciphers are supported, which are
the servers prefered ciphers, which SSL protocols are
supported and returns the SSL certificate. Client
certificates / private key can be configured and output is
to text / XML.

Command:
sslscan [Options] [host:port | host]

Options:
--targets= A file containing a list of hosts to
check. Hosts can be supplied with
ports (i.e. host:port).
--no-failed List only accepted ciphers (default
is to listing all ciphers).
--ssl2 Only check SSLv2 ciphers.
--ssl3 Only check SSLv3 ciphers.
--tls1 Only check TLSv1 ciphers.
--pk= A file containing the private key or
a PKCS#12 file containing a private
key/certificate pair (as produced by
MSIE and Netscape).
--pkpass= The password for the private key or
PKCS#12 file.
--certs= A file containing PEM/ASN1 formatted
client certificates.
--xml= Output results to an XML file.
--version Display the program version.
--help Display the help text you are now
reading.
Example:
sslscan 127.0.0.1

Ok here is a generic run without any flags, against our target website.
Of course the output has been truncated and a little bit munged.

root@bt:~# sslscan www.examplewebsite.net

Testing SSL server www.examplewebsite.net on port 443
Supported Server Cipher(s):
Rejected SSLv2 168 bits DES-CBC3-MD5
Rejected SSLv2 56 bits DES-CBC-MD5
Rejected SSLv2 40 bits EXP-RC2-CBC-MD5
Rejected SSLv2 128 bits RC2-CBC-MD5
Rejected SSLv2 40 bits EXP-RC4-MD5
Rejected SSLv2 128 bits RC4-MD5
Rejected SSLv3 256 bits ADH-AES256-SHA
Accepted SSLv3 256 bits DHE-RSA-AES256-SHA
Rejected SSLv3 256 bits DHE-DSS-AES256-SHA
Accepted SSLv3 256 bits AES256-SHA
Rejected SSLv3 128 bits ADH-AES128-SHA
Accepted SSLv3 128 bits DHE-RSA-AES128-SHA
Rejected SSLv3 128 bits DHE-DSS-AES128-SHA
Accepted SSLv3 128 bits AES128-SHA
Rejected SSLv3 168 bits ADH-DES-CBC3-SHA
Rejected SSLv3 56 bits ADH-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-ADH-DES-CBC-SHA
Rejected SSLv3 128 bits ADH-RC4-MD5
Rejected SSLv3 40 bits EXP-ADH-RC4-MD5
Accepted SSLv3 168 bits EDH-RSA-DES-CBC3-SHA
Rejected SSLv3 56 bits EDH-RSA-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-EDH-RSA-DES-CBC-SHA
Rejected SSLv3 168 bits EDH-DSS-DES-CBC3-SHA
Rejected SSLv3 56 bits EDH-DSS-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-EDH-DSS-DES-CBC-SHA
Accepted SSLv3 168 bits DES-CBC3-SHA
Rejected SSLv3 56 bits DES-CBC-SHA
Rejected SSLv3 40 bits EXP-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-RC2-CBC-MD5
Accepted SSLv3 128 bits RC4-SHA
Accepted SSLv3 128 bits RC4-MD5
Rejected SSLv3 40 bits EXP-RC4-MD5
Rejected SSLv3 0 bits NULL-SHA
Rejected SSLv3 0 bits NULL-MD5
Rejected TLSv1 256 bits ADH-AES256-SHA
Accepted TLSv1 256 bits DHE-RSA-AES256-SHA
Rejected TLSv1 256 bits DHE-DSS-AES256-SHA
Accepted TLSv1 256 bits AES256-SHA
Rejected TLSv1 128 bits ADH-AES128-SHA
Accepted TLSv1 128 bits DHE-RSA-AES128-SHA
Rejected TLSv1 128 bits DHE-DSS-AES128-SHA
Accepted TLSv1 128 bits AES128-SHA
Rejected TLSv1 168 bits ADH-DES-CBC3-SHA
Rejected TLSv1 56 bits ADH-DES-CBC-SHA
Rejected TLSv1 40 bits EXP-ADH-DES-CBC-SHA
Rejected TLSv1 128 bits ADH-RC4-MD5
Rejected TLSv1 40 bits EXP-ADH-RC4-MD5
Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA
Rejected TLSv1 56 bits EDH-RSA-DES-CBC-SHA
Rejected TLSv1 40 bits EXP-EDH-RSA-DES-CBC-SHA
Rejected TLSv1 168 bits EDH-DSS-DES-CBC3-SHA
Rejected TLSv1 56 bits EDH-DSS-DES-CBC-SHA
Rejected TLSv1 40 bits EXP-EDH-DSS-DES-CBC-SHA
Accepted TLSv1 168 bits DES-CBC3-SHA
Rejected TLSv1 56 bits DES-CBC-SHA
Rejected TLSv1 40 bits EXP-DES-CBC-SHA
Rejected TLSv1 40 bits EXP-RC2-CBC-MD5
Accepted TLSv1 128 bits RC4-SHA
Accepted TLSv1 128 bits RC4-MD5
Rejected TLSv1 40 bits EXP-RC4-MD5
Rejected TLSv1 0 bits NULL-SHA
Rejected TLSv1 0 bits NULL-MD5

Prefered Server Cipher(s):
SSLv3 256 bits DHE-RSA-AES256-SHA
TLSv1 256 bits DHE-RSA-AES256-SHA

SSL Certificate:
Version: 2
Serial Number: -4294967123
Signature Algorithm: sha1WithRSAEncryption
Issuer: /OU=Extended Validation CA/O=GlobalSign/CN=GlobalSign Extended Validation CA
Not valid before: Sep 16 16:14:35 2009 GMT
Not valid after: Sep 17 16:14:32 2010 GMT
Subject: /2.5.4.15=V1.0, Clause 5.(b)/serialNumber=32123374/1.3.6.1.5.7.311.60.2.1.3=DK/C=DK/ST=Oerum Djurs/L=Oerum Djurs/streetAddress= Main 6/OU=FairSSL/O=Not Yours v/Some Name /CN=www.examplewebsite.net
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit): truncated
00:99:2b:cf:e4:f8:e3:40:88:41:58:8a:41:16:1f:
f3:09:01:99:e5:f3:09:02:89:e4
43:93:7c:6a:3c:bb:c5:cf:
43:df
Exponent: 65421 (0x10001)
X509v3 Extensions:
X509v3 Authority Key Identifier:
keyid:34:B1:E0 truncated

Authority Information Access:
CA Issuers - URI:http://secure.globalsign.net/cacert/extendval1.crt
OCSP - URI:http://ocsp.globalsign.com/ExtendedSSL

X509v3 CRL Distribution Points:
URI:http://crl.globalsign.net/ExtendVal1.crl

X509v3 Subject Key Identifier:
87:D2:7C:2B:D1:B0 truncated
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.4146.1.1
CPS: http://www.globalsign.net/repository/

Netscape Cert Type:
SSL Client, SSL Server
X509v3 Subject Alternative Name:
DNS:www.examplewebsite.net, DNS:examplewebsite.net
Verify Certificate:
unable to get local issuer certificate

root@dorkness~:#

So a generic run returns a lot of information. We learn the properties such as validity, CN CDP OSCP even the EV attributes are returned.

Note: This information is all publicly available. This tool just presents said info in a nice format such as .xml files, using the --xml=file flag, where file is the name to save as.

The other flags above can be used to further refine the output. One of the more important ones is the --no-failed flag which only lists accepted ciphers (see output above), the default of course is to list them all. The ssl2, ssl3, and tls1 flags of course will check for and list only those ciphers defined. If you have several servers to check on then you can also pass a list to sslscan using the --targets=file flag. The other flags are pretty self explanatory.

So the question become "Why is any or all of this important?" Well easy. When auditing servers you may find ones that use weak cypher or protocols, think NULL cipher, or SSLv1.

Well that's about all there is to it, have fun and enjoy.

Friday, April 30, 2010

Install WhatWeb 0.4.2 in BT4

Quick guide to get Whatweb going in BT4
WhatWeb is a "Next generation web scanner. Identify what websites are running."

First and foremost grab some shell in BT, and get the tar.gz:

root@dorkbox:/pentest/enumeration# wget http://www.morningstarsecurity.com/downloads/whatweb-0.4.2.tar.gz

Next unpack the archive:

root@dorkbox:/pentest/enumeration# tar xvf whatweb*

Remove the archive, and change into the new directory:

root@dorkbox:/pentest/enumeration# rm -f whatweb-0.4.2.tar.gz
root@dorkbox:/pentest/enumeration# cd whatweb*
root@dorkbox:/pentest/enumeration/whatweb-0.4.2#

Next read the Install file.

root@dorkbox:/pentest/enumeration/whatweb-0.4.2# cat INSTALL | less

As you can see by the install file it mentions using ruby 1.9
Well BT4 comes with Ruby 1.8.7 I am not sure if this will make a difference since there is no mention in the documentation nor the website of any type of dependencies. So far during my experiments with WhatWeb, I have not seen any problems. YMMV. There is also mention to a couple other packages but these are already included in BT4 so no problems there.

As for using the program see also the readme.
The readme will contain a good bit of info on using whatweb.

root@dorkbox:/pentest/enumeration/whatweb-0.4.2# cat README | less

But as an example of some generic output:

root@bt:/pentest/enumeration/whatweb# ./whatweb examplewebsite.com
http://examplewebsite.com [301] title[301 Moved Permanently], server-header[Apache], redirect-location[http://www.examplewebsite.com/], md5[0670664f17b872398a96c6a58e812c2d], header-hash[0671564f07b972398a96c6a58e812c2d]
http://examplewebsite.com/ [200] Google-Analytics-GA[791888], Joomla[1.4], server-header[Apache], meta-generator[Joomla! 1.4 - Open Source Content Management], title[Example Websites Design], md5[fcb3ec0df12e54dfdef2e991a24f1c1], footer-hash[a19d726fa5771113aceaec0c61b1bf8ea7], div-span-structure[e56dd07d6f482ee11342e4ea99a9e6a8], header-hash[4379923363b07114470bde23484214e3f]
root@bt:/pentest/enumeration/whatweb#

As a side note the above is not a real website.
Thanks to http://www.morningstarsecurity.com and Andrew Horton aka urbanadventurer
Have fun and remember don't mess with networks that you don't have permission for.

Saturday, February 27, 2010

Adding SwiftFox to BT4

Ok so a quick guide on adding another browswer to BT4
Swiftfox is based off of Firefox and it is designed to be faster.
There are different builds to take advantage of different processors.
Use at your own discretion.
First add the repo to your sources.list.
--------------------code------------------------------
root@dorktest:~# nano /etc/apt/sources.list
--------------------code------------------------------
add the following :
--------------------code------------------------------
deb http://getswiftfox.com/builds/debian unstable non-free
--------------------code------------------------------
Then install it:
--------------------code------------------------------
root@dorktest:~# apt-get update && apt-get install swiftfox-yourprochere
--------------------code------------------------------
where yourprochere is your processor.
The different versions available are:
swiftfox-i686 (Older AMD & Intel)
swiftfox-athlon64 (AMD64 users on a 64bit OS)
swiftfox-athlon64-32bit (AMD64 users on a 32bit OS)
swiftfox-prescott (Intel Prescott and newer)
If you are not sure use this chart for more info.

Friday, February 26, 2010

Install Airdrop-ng

So the TheX1le released (to the general populace) airdrop-ng today.
You can visit the aircrack-ng site for more info. There is a video of the talk here.

So this one is so easy a itard can do it.
Grab a shell in BT4
Then
---------------code--------------------------------------
root@dorktest:~# cd /pentest/wireless/
root@dorktest:/pentest/wireless# svn co http://trac.aircrack-ng.org/svn/trunk/scripts/airdrop-ng
---------------code--------------------------------------
Second line above should be all on one line.
Once it completes then:
---------------code--------------------------------------
root@dorktest:~# cd /pentest/wireless/airdrop-ng/
root@dorktest:/pentest/wireless/airdrop-ng/ cat README
---------------code--------------------------------------
And Read it.
Then:
---------------code--------------------------------------
root@dorktest:/pentest/wireless/airdrop-ng/python install.py
---------------code--------------------------------------
to run the installer.
See how easy that was.

Friday, February 5, 2010

Installing ecryptfs in BT4.

Installing ecryptfs in BT4.
This guide is a simple one to get encryption setup. This is not the best way of doing things
However it is probably the quickest and easiest to do.
First things:
-----------------code------------------------------
root@bt:~# apt-get install ecryptfs-utils
Reading package lists... Done
The following NEW packages will be installed:
ecryptfs-utils libecryptfs0 libtspi1
0 upgraded, 3 newly installed, 0 to remove and 19 not upgraded.
Need to get 331kB of archives.
After this operation, 1212kB of additional disk space will be used.
Do you want to continue [Y/n]? y
-----------------code------------------------------
After the install is complete before you go on READ THE MAN PAGE and the faq
-----------------code------------------------------
root@bt:~# man ecryptfs
root@bt:~# /usr/share/doc/ecryptfs-utils/ecryptfs-faq.html
-----------------code------------------------------
See also the web page at http://ecryptfs.sourceforge.net/
This is important for your security.
Next run the setup
-----------------code------------------------------
root@bt:~# ecryptfs-setup-private
Enter your log in passphrase: enter your actual log in info here
Enter your mount passphrase [leave blank to generate one]:
************************************************************************
YOU SHOULD RECORD THIS MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:
a706b05233346537fa28121a40e2040ce
THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.
************************************************************************
Done configuring.
Testing mount/write/umount/read...
Testing succeeded.
-----------------code------------------------------
Once this is done there will be a new directory created called Private
Since I did this with the root user account it is stored in /
Inside this directory is a readme read it before proceeding.
So in order to use your new encrypted directory you will need to log out and back in.
Now your log in passphrase along with the aforementioned mount passphrase will be used to mount the directory Private. There are caveats to using this type of system. Only data you store in Private is encrypted. Any data saved or collected while browsing the internet that is stored elsewhere on the system will be not be encrypted. If you have a swap partition it will not be encrypted either. As with most encryption systems if you leave physical access or access to the encrypted container open (suppose you leave the computer and go out for a coffee, without logging out) then again the data would be accessible. Also when you log out the folder will show that there is encrypted data in the directory.

Archangel Amael's Blog