Voiphopper How To

This is a small howto on installing voiphopper version 0.9.7

"VoIP Hopper is the answer to all voip solution providers who make people believe that VLANS is all you need to secure VoIP" - Sachin Joglekar, Sipera VIPER Lab

"VoIP Hopper is a GPLv3 licensed security tool, written in C, that rapidly runs a VLAN Hop into the Voice VLAN on specific Ethernet switches. VoIP Hopper does this by mimicking the behavior of an IP Phone, in both Cisco and Avaya IP Phone environments."

(SOURCE = Voiphopper readme.txt )

This tool was released at shmoocon this past weekend.

voiphopper

Download and save( I saved mine to "/root") Then use:

Code:

bt ~# tar xvfz voiphopper-0.9.7.tar.gz

This will "untar" and "ungzip" the package.

Code:

bt ~ # tar xvfz voiphopper-0.9.7.tar.gz
voiphopper-0.9.7/
voiphopper-0.9.7/Makefile
voiphopper-0.9.7/arp.c
voiphopper-0.9.7/buildmsg.c
voiphopper-0.9.7/cache.c
voiphopper-0.9.7/client.c
voiphopper-0.9.7/dhcpconfig.c
voiphopper-0.9.7/mac.c
voiphopper-0.9.7/netinfo.c
voiphopper-0.9.7/peekfd.c
voiphopper-0.9.7/signals.c
voiphopper-0.9.7/udpipgen.c
voiphopper-0.9.7/voiphopper.c
voiphopper-0.9.7/buildmsg.h
voiphopper-0.9.7/client.h
voiphopper-0.9.7/dhcpcd.h
voiphopper-0.9.7/kversion.h
voiphopper-0.9.7/mac.h
voiphopper-0.9.7/maclist.h
voiphopper-0.9.7/netinfo.h
voiphopper-0.9.7/pathnames.h
voiphopper-0.9.7/signals.h
voiphopper-0.9.7/udpipgen.h
voiphopper-0.9.7/LICENSE
voiphopper-0.9.7/README

Next "cd" to the directory where you saved it

Code:

bt ~# cd/root/voiphopper-0.9.7 #

and then use "make" to install it

Code:

 bt ~# cd/root/voiphopper-0.9.7 # make

You should see the following as the output

Code:

INSTALLATION
bt  voiphopper-0.9.7 # make
gcc -c voiphopper.c
gcc -c dhcpconfig.c
gcc -c buildmsg.c
gcc -c cache.c
gcc -c udpipgen.c
gcc -c peekfd.c
gcc -c client.c
gcc -c arp.c
gcc -c signals.c
gcc -c mac.c
gcc -c netinfo.c
gcc voiphopper.o dhcpconfig.o buildmsg.o cache.o udpipgen.o peekfd.o client.o arp.o signals.o mac.o netinfo.o -lpcap -o voiphopper
bt voiphopper-0.9.7 #

Usage looks like the following:

1. To sniff for CDP and run a VLAN Hop into the Voice VLAN, simply run VoIP Hopper on the Ethernet interface, in the following way:

Code:

voiphopper -i eth1

2. VoIP Hopper also allows one to VLAN Hop to an arbitrary VLAN, without sniffing for CDP. If you already know the Voice VLAN ID, or would like to VLAN Hop into another VLAN (without sniffing for CDP), you can run it in the following way:

Code:

voiphopper -i eth1 -v 200

3. To Discover the Voice VLAN in an Avaya IP Phone environment:

Code:

voiphopper -i eth1 -a

4. To spoof the MAC Address of an IP Phone by sniffing for CDP (this changes the MAC address of default interface and new interface):

Code:

voiphopper -i eth1 -m AA:AA:AA:AA:AA:AA

5. To spoof the MAC Address of an IP Phone using an Avaya DHCP request (this changes the MAC address of default interface and new interface) :

Code:

voiphopper -i eth1 -a -m AA:AA:AA:AA:AA:AA

6. To spoof the MAC Address of an IP Phone by VLAN Hopping without CDP or DHCP (this changes the MAC address of default interface and new interface):

Code:

voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA

7. To spoof the MAC Address of an IP Phone without changing the MAC Address of the default ethernet interface (only spoof the new voice interface's MAC Address):

Code:

voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA -D

(SOURCE = Voiphopper readme.txt )

Well I hope that helps you get started
Have fun and play nice
This tutorial is not all of my own work credits to:
AUTHOR
Jason Ostrom
And the other Developers.

How to Using MTR

How to Using MTR

Background:

MTR combines the functionality of the traceroute and ping programs in a single net-work diagnostic tool.
As mtr starts, it investigates the network connection between the host mtr runs on
and HOSTNAME. by sending packets with purposely low TTLs. It continues to send packets
with low TTL, noting the response time of the intervening routers. This allows
mtr to print the response percentage and response times of the Internet route to
HOSTNAME. A sudden increase in packet-loss or response time is often an indication of
a bad (or simply overloaded) link.

(SOURCE MTR man pages)

Disclaimer: This information is for educational purposes only and not to commit a crime.
I stress the first part because this may get you into trouble with your ISP or Network Admins.
If you do something that causes you to hose your box don't come kicking and screaming on the forums!
All IP and MAC address' have been munged!

First off I did this using BT2 Final but the process is the exact same using BT3 the only change is now there is graphical front-end using GTK+
I am going to show a couple of examples of this tool and leave the rest up to you for now. I may add more later on.

The purpose of this tool is to provide a ping and traceroute utility in one package.
This is good for 1 allowing us to determine if a target is alive and 2 what hops our packets take in order to get to said target.
When Pentesting once we have identified a target on a network we try to learn about other networks that interact with it and this is one of the ways.
This will also help us what else may stand in our way.

To use mtr we need to open a terminal and type at the prompt

Code:

 bt ~ # mtr --help
usage: mtr [-hvrctglspni46] [--help] [--version] [--report]
               [--report-cycles=COUNT] [--curses] [--gtk]
               [--raw] [--split] [--no-dns] [--address interface]
               [--psize=bytes/-s bytes]
               [--interval=SECONDS] HOSTNAME [PACKETSIZE]
bt ~ #

This shows us the usage flags and options.
So in order to know more about the different flags we will take a look at them now:
OPTIONS
-h help
Print the summary of command line argument options.

-v --version
Print the installed version of mtr.

-r --report
This option puts mtr into report mode. When in this mode, mtr will run for
the number of cycles specified by the -c option, and then print statistics and
exit.
This mode is useful for generating statistics about network quality. Note
that each running instance of mtr generates a significant amount of network
traffic. Using mtr to measure the quality of your network may result in
decreased network performance.

-c COUNT --report-cycles COUNT
Use this option to set the number of pings sent to determine both the machines
on the network and the reliability of those machines. Each cycle lasts one
second.

-s BYTES --psize BYTES

PACKETSIZE
These options or a trailing PACKETSIZE on the commandline sets the packet size
used for probing. It is in bytes inclusive IP and ICMP headers

If set to a negative number, every iteration will use a different, random
packetsize upto that number.

-t --curses
Use this option to force mtr to use the curses based terminal interface (if available).

-n --no-dns
Use this option to force mtr to display numeric IP numbers and not try to
resolve the host names.

-g --gtk
Use this option to force mtr to use the GTK+ based X11 window interface (if
available). GTK+ must have been available on the system when mtr was built
for this to work. See the GTK+ web page at
www DOT gimp DOTorg/gtk/for more information about GTK+.

-p --split
Use this option to set mtr to spit out a format that is suitable for a split-
user interface.


-l --raw
Use this option to tell mtr to use the raw output format. This format is better
suited for archival of the measurement results. It could be parsed to be
presented into any of the other display methods.

-a IP.ADD.RE.SS

--address IP.ADD.RE.SS
Use this option to bind outgoing packets' socket to specific interface, so
that any packet will be sent through this interface. NOTE that this option
doesn't apply to DNS requests (which could be and could not be what you want).

-i SECONDS

--interval SECONDS
Use this option to specify the positive number of seconds between ICMP ECHO
requests. The default value for this parameter is one second.

-4
Use IPv4 only.

-6
Use IPv6 only.

Ok now we see that we have lots of options to play with here.

Ok back to the terminal we are going to look at a target computer with the -r (report mode) and -c (count) set to 1 packet

Code:

bt ~ # mtr -r -c 1 www.yourexampletarget.com

To see the output of this command click on the picture here:
output

NOTE: I had to use this picture in order to get the formatting to show up like it would in a shell.

NOTE: we can use both domain names like above or we can use IP address the result is the same.

Ok now let's see what we got back, we only care about the first two columns. The first is the name of the nodes along the route,and the second is the percent of packets that were lost. If we lose packets then the traceroute must find a new way to get to the destination. Sometimes nodes along our route will drop these packets.
So we see that in number 3 above it would seem we lost a packet however the node just dropped it.
But our trace continues until it gets to 13 and the same thing happens. Also this could be the result of a node not advertising itself blindly. Could be good or bad.
And last we arrive at 14 our target network. Remember just like any traceroute the first node returned is the closest to your box and the last is farthest away.
If we are Pentesting we can use a whois command and lookup the network node names above and may learn more about the route our packets take to our target.
This may help us determine if our target is sitting on the edge of the network or not.
Also when doing this if you do not specify the number of packets with the -c flag this process will continue to run until you stop it!
This can be bad depending on the TOS from your ISP or other networks along the route. Generally speaking most admins will not want you repeatedly pinging their networks. Sometimes one or two ping attempts may be ok. At a minimum it is plain rude to needlessly ping a node!


This tutorial should give you enough information to work with MTR.

How to Using Vinetto

How to Using Vinetto 0.06 (r56)
This is part of the Digital Forensics section of BT2 and 3
Note: If using BT3 and this tool doesn't work then please see the thread here: Possible bug

Some Background: Vinetto is a forensics tool to examine Thumbs.db files.
It is a command line python script that works on Linux, Mac OS X and Cygwin(win32).
Source: Vinetto

Disclaimer: This information is for educational purposes only and not to commit a crime.
If you do something that causes you to hose your box don't come kicking and screaming on the forums!

OK you may be asking your self "why would I need this tool?" This tool and the whole "forensics section" of BT is one that the average person is not going to use. Now on the other hand if you conduct forensics investigation as either some type of "police official" or as a pen tester, then this tool can come in very handy for you.
Now there are other tools that can do the same basic thing however if you need it it's included.

NOTE: When doing any type of forensic work it is imperative that we do not damage the target computer in any way. Having said that we should boot our BT disk over our target computer using the "bt nohd" boot option. If you don't know what this means then stop here and go read about it here: Cheats

Ok in order to get this to work we need to go to the command line or alternatively through K>Backtrack>Digital Forensics>All>Vinetto
Now lets have a look at the options that are presented when we do a --help

Code:

 bt ~ # vinetto --help
usage: vinetto [OPTIONS] [-o DIR] file

options:
 --version   show program's version number and exit
 -h, --help  show this help message and exit
 -o DIR      write thumbnails to DIR
 -H          write html report to DIR

Now the output shows us only two useful switches -o will write our thumbnail to a given directory and the -H creates a html report to a directory
and these two can be combined like so -Ho this will give us both the thumbs and and report in html format. This is useful if we have a lot of thumbs to go through.
So far so good right? OK now for my example usage.

I booted BT over my laptop that has Windblows XP next I opened a shell and did a:

Code:

# find / -name Thumbs.db
/mnt/hda1/Program Files/Windows NT/Thumbs.db
/mnt/hda1/RECYCLER/Thumbs.db
/mnt/hda1/WINDOWS/Thumbs.db
/mnt/hda1/Program Files/Microsoft Office Old/Office/Bitmaps/Dbwiz/Thumbs.db
bt ~ #

The above is a truncated version of the output, yours will be different. Our target file will be the last one, the "/Dbwiz/Thumbs.db"
So now you need to setup a storage device of some sort I used a usb stick seems to be the easiest. now go ahead and mount it and make a directory in it.
I used "thumbs" for mine. Ok now we have both a target directory and a "save location" we can go ahead and extract our thumbs to it.
so in a shell again give:

Code:

# vinetto -Ho  /mnt/sda1_removable/thumbs "/mnt/hda1/Program Files/Microsoft Office Old/Office/Bitmaps/Dbwiz/Thumbs.db"

** Warning: Cannot find "Image" module.
            Vinetto will only extract Type 2 thumbnails.


Root Entry modify timestamp : Tue Apr  4 02:15:03 2006

------------------------------------------------------

0001   Mon Mar 22 01:00:00 1999   ORDPROC.GIF
0002   Mon Mar 22 01:00:00 1999   ASSETS.GIF
0003   Mon Mar 22 01:00:00 1999   CONTACTS.GIF
0004   Mon Mar 22 01:00:00 1999   EVTMGMT.GIF
0005   Mon Mar 22 01:00:00 1999   EXPENSES.GIF
0006   Mon Mar 22 01:00:00 1999   INVENTRY.GIF
0007   Mon Mar 22 01:00:00 1999   LEDGER.GIF

------------------------------------------------------

7 Type 2 thumbnails extracted to /mnt/sda1_removable/thumbs/

hit enter and you should see the same basic output as above.
This shows us the thumbs that we have recovered and the time they were created on our target and as well as their respective names.
Now we can go to our "save location" to verify our files are there. Also check out the .html output file as this is easier to manage then all of the other files.
I have posted some photos of the output if you need look at them VinettoOutput

And that's it, a simple program that can help if you need it.
Please leave some feedback if this helped or hindered you, Thanks

NOTE: Credit to the author of this tool and to the authors of THE BOOK
This is where I got most of the information from as well as the vinetto website.
I did find in my experiments that you need to use the flags as "-Ho" and not "-oH" doing so I got a "vinetto: error: incorrect number of arguments" error each time.

How To get a Monitor Working in BT3 beta

This is the first tutorial I did for Back|Track this one is using xorgconfig to get a monitor working.

http://forums.remote-exploit.org/showthread.php?t=10407

How to using NetDiscover.

How to using NetDiscover.

Netdiscover is an active/passive address reconnaissance tool, mainly developed for those wireless networks without DHCP server, when you are wardriving. It can be also used on hub/switched networks. (Source NetDiscover )

Disclaimer: This information is for educational purposes only and not to commit a crime!
If you do something that causes you to hose your box don't come kicking and screaming on the forums!
All IP Address' MAC Address' etc. have been munged!

This tool will allow us to quickly gather IP address on a given network and as stated above work great in wireless networks that have no DHCP server.
I am using this tool in BT2 Final. However in BT3 the process is the same.
Ok so to gain access to this tool open a shell and type:

Code:

bt ~ # netdiscover -help

This will show us what flags we can use.

Code:

Netdiscover 0.3-beta6 [Active/passive arp reconnaissance tool]
Written by: Jaime Penalba 

Usage: netdiscover [-i device] [-r range | -p] [-s time] [-n node] [-c count] [-f] [-S]
-i device: your network device
-r range: scan a given range instead of auto scan. 192.168.6.0/24,/16,/8
-p passive mode do not send anything, only sniff
-s time: time to sleep between each arp request (miliseconds)
-c count: number of times to send each arp reques (for nets with packet loss)
-n node: last ip octet used for scanning (from 2 to 253)
-S enable sleep time supression betwen each request (hardcore mode)
-f enable fastmode scan, saves a lot of time, recommended for auto

If -p or -r aren't enabled, netdiscover will scan for common lan addresses

Ok so let's look at the flags so that we know what we are dealing with.
"-i" simply put is the network card
"-r" the range to scan that you will insert on the command later
"-p" send no packets out on the network
"-s" time to sleep between the arp requests simply means how long netdiscover should wait.
"-c" count is the number or arp requests to send each time
"-n" node again this is a number you will insert on the command latter.
"-S" this will prevent netdiscover from "sleeping" between arp requests"
"-f" fast as stated above

Ok now in order for netdiscover to work it needs to send out "arp requests" this is the Address Resolution Protocol request. Simply put we are asking the network for a host's address.
For more info about ARP go here
ARPWIKI

So now if you understand the above we can move on.
What we are doing is asking a host some basic info about the network.
"Who has 192.168.0.1? Tell 192.168.0.67"
This keeps going until all the nodes or ranges we specify have answered.
When using I used wireshark to help visualize the process however this is not needed.The pictures are located here:
Netdiscover


Now we are going to look at an example of netdiscover in action
with no flags set. This will cause ND to scan for common LAN address'

Code:

bt ~ # netdiscover

Hit enter and watch

Code:

 Currently scanning: 192.168.4.0/16   |   Our Mac is: 00:11:22:AA:BB:CC - 0

2 Captured ARP Req/Rep packets, from 2 hosts.   Total size: 120
_____________________________________________________________________________
 IP            At MAC Address      Count  Len   MAC Vendor
-----------------------------------------------------------------------------
192.168.1.1     00:11:22:AA:BB:CC    01    060   Cisco-Linksys
192.168.1.2     00:11:22:AA:BB:CC    01    060   Cisco-Linksys

In order to stop the scan you can hit control + c .

We see above that we have found 2 hosts and the IP and MAC address's as well as the Vendor of said MAC's

Ok now we will look at some sample commands

Code:

bt ~ # netdiscover -i ath0 -r 192.168.1.0/24

The above is Set to scan a class "C" network to see what hosts are alive

Code:

bt ~ # netdiscover -i eth0

The above is Set to scan "common networks"

Code:

 bt ~ # netdiscover -i ath1 -p

The above is Set to scan passively

This means that it will not send ARP packets out but will wait for them to come from another source.
This is useful when we don't want to make noise and set off the alarms! This will happen on any good network with a decent IDS/IPS in place
because we are sending multiple ARP packets.
Ok so I have provided a few pictures of the tool in action and wireshark showing what is going on.

Netdiscover

How To Using DNS-Ptr

How To Using DNS-Ptr

Disclaimer: This information is for educational purposes only and not to commit a crime!
If you do something that causes you to hose your box don't come kicking and screaming on the forums!
All IP Address' MAC Address' etc. have been munged!


DNS-PTR Is a tool that allows you to learn DNS names of IP address' This is like doing a reverse DNS lookup.
You have the IP address but want to know if there is a domain name associated with it.
Using this tool will allow us to do mass lookups rather quickly.
This is a very simple tool to use.

To access this tool K>Backtrack>InformationGathering>All>DNS-Ptr

OK opening this will give the following

Code:

Usage : ./Allhosts  
Mass DNS Query program for vicy, by crisk
bt dns-ptr #

OK so for some background for those that don't know. DNS the Domain Name System translates Domain Names like www.yourexampleofadomain.com into 192.168.1.100
Of course this address is for "internal or private use only".
Now we can use lots of tools to gain this info I will leave that alone.
If you have maybe the IP address and want to find a domain name that may be associated with the IP we can use DNS-Ptr
Using the IP to find an associated Domain name is called a Reverse DNS lookup.

To use the tool on the command line type the IP address that you want to lookup.

Code:

Usage : ./Allhosts  
Mass DNS Query program for vicy, by crisk
bt dns-ptr # dns-ptr 192.168.1.1

The output will show us.

Code:

Beginning DNS lookups
192.1.168.1.1
Ending DNS lookups.
bt dns-ptr #

If we want to see if other IP address' close to our start IP are associated then we can set the End IP and run it again.

In this example I used 5 (remember leave a space)

Code:

Usage : ./Allhosts  
Mass DNS Query program for vicy, by crisk
bt dns-ptr # dns-ptr 192.168.1.1 5

Code:

Beginning DNS lookups
192.1.168.1.1  : fac34-7-yourexampleofadomain.com
192.1.168.1.2  : fac34-7-yourexampleofadomain.com
192.1.168.1.3  : fac34-7-yourexampleofadomain.com
192.1.168.1.4  : fac34-7-yourexampleofadomain.com
192.1.168.1.5  : someotherexampleofadomain.com
Ending DNS lookups.
bt dns-ptr #

As you can see the first 4 IPs belong to www.yourexampleofadomain.com, but the 5th one belongs to someone else.
Again this is a simple tool to use.

Multipart PortScanning Tutorial Part 5

Multipart PortScanning Tutorial Part 5

In this edition we will be looking at the results of NULL Scans.
We are using Nmap

The other parts are located here:
Part1
Part2
Part3
Part4

Disclaimer: This information is for educational purposes only and not to commit a crime!
If you do something that causes you to hose your box don't come kicking and screaming on the forums!
All IP Address' MAC Address' etc. have been munged!

Ok first off a NULL Scan is a scan in which there are no TCP Flags set. This is normally something that doesn't happen or shouldn't happen in the "real world". If the scanned ports are closed then we should get a RST (Reset) packet back from our target.

The basic scan uses the -sN flag.

So it will look like the following on a windows box with a firewall in place.

Code:

 bt ~# nmap -sN -vv 192.168.1.4

As always we are using the -vv (very verbose) flags.
And the following is our typical output:

Code:

Starting Nmap 4.20 ( http://insecure.org ) at 2008
Initiating ARP Ping Scan at 11:35
Scanning 192.168.1.4 [1 port]
Completed ARP Ping Scan at 11:35, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:35
Completed Parallel DNS resolution of 1 host. at 11:35, 0.05s elapsed
Initiating NULL Scan at 11:35
Scanning 192.168.1.4 [1697 ports]
Completed NULL Scan at 11:36, 36.33s elapsed (1697 total ports)
Host 192.168.1.4 appears to be up ... good.
All 1697 scanned ports on 192.168.1.4 are open|filtered
MAC Address: 00:11:22:AA:BB:CC (Cisco-Linksys, LLC)

Nmap finished: 1 IP address (1 host up) scanned in 37.093 seconds
            Raw packets sent: 3395 (135.802KB) | Rcvd: 1 (42B)

And now the same scan without the firewall in place.

Code:

 bt ~# nmap -sN -vv 192.168.1.4

This time I will show only the info that is relevant.

Code:

Starting Nmap 4.20 ( http://insecure.org ) at 2008
All 1697 scanned ports on 192.168.1.4 are closed
MAC Address: 00:11:22:AA:BB:CC (Cisco-Linksys, LLC)

Notice the difference? The only thing is that now the ports are showing up as closed! This is a huge bit of information.
We also learned in both that the host is "up" as well as the network interface's MAC address.
But most importantly we probably didn't set off any alarms on the target network.
Because I did this on my network I know that it didn't.

Now lets look at one more scan, only this time we will do it against a *nix box.

Code:

 bt ~# nmap -sN -vv 192.168.1.101

Again the output shows only what is relevant.

Code:

Starting Nmap 4.20 ( http://insecure.org ) at 2008

Host 192.168.1.101 appears to be up ... good.
All 1697 scanned ports on 192.168.1.101 are open|filtered
MAC Address: 11:00:22:AA:BB:CC (Cisco-Linksys, LLC)

Nmap finished: 1 IP address (1 host up) scanned in 36.094 seconds
            Raw packets sent: 3395 (135.802KB) | Rcvd: 1 (42B)

This time we see that the *nix box showed the ports as being in a open or filtered state.

The advantage of doing a NULL Scan are no TCP sessions are created for this scan, it is normally quiet from the perspective of the remote device's applications. Therefore, none of these scans should appear in any of the application logs. This is a huge advantage when scanning a firewall or router that is facing the internet on a target network. These scans are also some of the most minimal port-level scans that nmap can do. For a closed port, only two packets are transferred. This is all that is needed to find an open port!

The Disadvantages of doing this type of scan are, Some implementations of the TCP stack will render this scan useless. For instance with Microsoft this scan will show all ports as closed regardless of their actual state. But even this can work to your advantage, since any device showing open ports must not be a Windows-based device!
There is another caveat to the above, Software based firewalls can override this rule, as shown in the first scan.

So now that we know what a NULL Scan can do for us or against us we should be able to better protect our networks.
Ideally and in my opinion we want our box to respond as being open | filtered as shown above. This makes it harder for an intruder to guess what the target is.