Download HD Download MP4 Download XviD Download WMV

Hacking into the Kindle Bootloader Part 1

This week, I’m introducing the bootloader Kindle 1st gen hack.

Equipment:
Kindle 1st Generation
A computah!
USB to Serial TTL Cable
20 pin 0.5 mm flat cable
1 pin Jumper cables

Programs:
Putty

Igor Skochinsky explains how to hack into the bootloader of the Kindle very nicely on his blog, Reverse Everything. He includes screenshots, photos, and descriptions of everything you need to know to do this hack.
Part 1
Part 2

If you have any questions, you can email me at snubs@hak5.org!

Windows VPN Servers

In this segment I demonstrate setting up a VPN server in Windows XP which is rather limited at 1 concurrent connection. I also demonstrate building a Routing and Remote Access VPN server in Windows Server 2003.

Open Source VPN Server

I’m a big fan of open source. I’m also an overwhelmed systems administrator that likes easy. And when it comes to VPNs in Linux, OpenVPN is the go to solution. That’s why I’m excited about OpenVPN Access Server — an set of installation and configuration tools that simplifies rapid deployment of a VPN solution.

In this segment I demonstrate setting up this nifty, lightweight and powerful server in a typical home user scenario. I also speak to the fact that it can integrate with Active Directory via LDAP or even a RADIUS server for authentication. The web based backend makes administration a breeze and the web frontend makes client setup even easier. All the clients have to do is login to a website and download a prepackaged and configured connection app for Windows, Mac or Linux.

This package makes it incredibly easy to deploy a VPN server. But it comes at a cost. OpenVPN-AS requires a license key for each concurrent connection. Two are provided for free and additional licenses are $10 ea. Still a far cry from a windows Client Access License!

In future segments we’ll be getting our hands dirty with OpenVPN standard as well as some other interesting VPN technologies so be sure to send your feedback, requests and flames to darren@hak5.org

Download HD Download MP4 Download XviD Download WMV

There is plenty to do on the Kindle that isn’t in the user manual. Read on for details!

At the Home screen use ALT-SHIFT-M for Minesweeper. It’s a little slow in response time, but still fun.

Free Books and PDF’s on your Kindle can be accessed through sites like Mnybks.Net and Feedbooks.
Mobipocket creator converts pdf’s to kindle files for all of your needs. If you don’t want to use Mobipocket, check this out- for free conversions, email a document to “name”@free.kindle.com and have it emailed back to you in kindle format.

Bypassing Paying for Blogs
Check out sites like Kindle Feeder to read your favorite blogs and news sites for free, instead of paying for the subscription version. From your browser, go to kindlefeeder.com and sign up or just search for your favorite feed.

Try accessing a site that isn’t compatible with mobile through proxy sites like mowser.com.

Google Maps
Under browser mode, click Alt-1 to access google maps quickly. Alt-2 shows gas stations and Alt-3 shows restaurants.

For email and useful messengers, use the following:
Gmail: m.gmail.com
Yahoo Messenger: us.m.yahoo.com/p/messenger/
Google Reader: google.com/reader/m
Google Calendar: google.com/calendar/m

SMS messages to your friends cell phone can be accessed by simply emailing the 10-digit cell phone number at the appropriate gateway. e.g. for AT&T cell customers would be 1234567890@txt.att.net.
This is a (unverified) list of gateways for various cell services.
AT&T: @txt.att.net
Alltel: @message.alltel.com
Nextel: @messaging.nextel.com
Powertel: @ptel.net
Sprint: @messaging.sprintpcs.com
SunCom: @tms.suncom.com
T-Mobile: @tmomail.net
US Cellular: @email.uscc.net
Verizon: @vtext.com
Virgin Mobile: @vmobl.com

To view personal pictures on your Kindle, plug your Kindle into it’s mini USB to a computer. Add a folder called ‘pictures’ in the root of the Kindle or SD card. Create another folder inside the Kindle folder ‘pictures’ called whatever you like. In the Home screen, hit Alt-Z to refresh and your new ‘book’ should appear with the name of the folder you chose. Open it and page back or forward to view your pictures. Press Alt-Shift-0 to set the current picture as a screensaver.

And here are a couple of tips for the Kindle 2:
Tether your Kindle 2 via a USB port so you don’t have to use WhisperNet or create a custom screensaver with your own pictures.

Download HD Download MP4 Download XviD Download WMV

It has been the dream of many to combine the pen-testing, forensics and recovery power of our favorite USB bootable linux distros into one drive complete with customized boot menu. Finally Frank Castle shares this digital mojo with us. I bring you the USB Muiltipass.

While the video walks you through the step by step I’ll provide an overview with links here.

First you’ll need three programs, PeToUSB, grubinst and grub4dos.

Prepare the USB drive by formatting it with PeToUSB. With the drive plugged in run the PeToUSB executable, select the drive, check Enable Disk Format, Quick Format and Force Volume Dismount and click Start. If you are using a drive over 2 GB you will receive an error about dismounting — it’s no big deal — simply format the drive as Fat32 with the Windows Disk Manager.

Next run grubinst_gui. Select the disk option and pick your USB drive. Be sure to select the correct drive number. If you’re not sure which drive is your USB drive check with Windows Disk Manager. Once you are assured the correct drive is selected go ahead and click Install. No options need to be checked, the defaults are fine.

You will then need to copy the grldr file from the grub4dos package to the root of your USB drive. Finally finish off the install by creating a blank text file in the root of your USB drive called “menu.lst”.

You can now boot from this drive. Of course there aren’t any Linux distributions and utilities installed yet, so let’s move on to adding all the goodies.

When it comes to installing distros I’ll go ahead and quote Frank Castle as he puts it best.

For most of the distros I added, I started off with an iso version of it. I then extracted the isos either to my desktop or directly to the root of the thumb drive (or you could just copy the files from a burnt version of the distro, just as long as you get the files to the root of your thumb drive). Most Linux Distros come with 2 folders: a boot folder and another folder that actually holds the meat and potatoes of the distro. Since it would be impossile to have 6 or 7 different boot folders that don’t overlap on the same thumb drive (without multiple partitions…a route I tired to take for way too long) I simply renamed the boot folder to something like “bootbt3″ or “bootknop” depending on the distro, and just left the other folder as is. I then added the appropriate information by using the information by either:

1) Looking at the information provided in the syslinux or isolinux file in most linux distros

2) Looking at a (now taken down) webpage with tons of examples (appropriatly added to this tutorial under Examples.txt)

3) Trial and Error

Most distros fell under the first of these options: Backtrack 3, Backtrack 4, Knoppix, and Trinity Rescue Kit all worked fine under these conditions

Some distros fell under the examples webpage: these included Ubuntu LiveCD (a different example because there is no boot folder and way more than two folders, but it ended up working without changing any folder names) as well as some others

Few Distros fell into the third option, but the ones that did were a bitch and a half to get working. These included Kon-Boot and OPHcrack.

OPHcrack (the latest version – 2.3.0), a tool I have known, loved, and depended on (at least until I met Kon-boot…thank you) was a apparently different than any of the other distros because just copying the files from the iso… blah blah blah didn’t work. It turns out that you have to burn the Distro to a spare thumb drive using tazusb (Slitaz installer) from http://www.objectif-securite.ch/slitaz/tazusb.exe. You then copy these files to the root of your thumb drive and so on and so on. The second challenge was to get both versions of OPHcrack (XP and Vista) on the drive, since ALL of the files overlapped. It turns out that the only difference in the two verisons were the tables provided so I just copied the tables from one cd to the other and proceeded forward as usual.

Kon-Boot was yet another bitch of a thing to get running via USB. No matter what I did it would boot, load, and promptly go back to the Grub bootloader. After a few hours of trial and error, I discovered I had to tell GRUB to tell the BIOS that the hard drive was the first boot device, even though it was obviously the thumb drive, because Windows apparently won’t run at all if it isn’t the first boot device. This reqiured a few extra lines. Also, for some reason the .iso file wouldn’t work (I could never extract or even see the raw files of Kon-Boot), so i was forced to use the Floppy image (.img)

When it comes to customizing Grub its simply a matter of creating a 640×480 – 14 color splash screen image. This is easy to accomplish with the Gimp. Once you’ve created a 640×480 image you can crunch the colors be selecting Image, Mode, Indexed and entering 14 ad the maximum colors. Save this file as a XMP, then gzip it. Copy the gz to the root of your USB drive and prepend “splashimage /image.xpm.gz” to your menu.lst file.

Further information on customizing the grub menu.lst file for your specific distros can be found in the grub manual. As an example I’ll provide my config here:

splashimage /jozette.xpm.gz
color blue/black yellow/blue
timeout 120

title BackTrack 4 BETA
root (hd0,0)
kernel /bootbt4/vmlinuz vga=0x317 ramdisk_size=6666 root=/dev/ram0 rw quiet
initrd=/bootbt4/initrd.gz
boot

title Kon-Boot-test
map --mem /FD0-konboot-v1.1-2in1.img (fd0)
map --hook
chainloader (fd0)+1
map (hd1) (hd0)
map --hook
rootnoverify (fd0)

title Memtest86
kernel /memdisk
initrd /memtestp.img

title ntpasswd
kernel /ntpasswd/vmlinuz rw vga=1 initrd=/ntpasswd/initrd.cgz /ntpasswd/scsi.cgz
initrd /ntpasswd/initrd.cgz

title DBAN
kernel /memdisk
initrd /dban.img

title SystemRescueCD
kernel /rescuecd initrd=initram.igz video=ofonly vga=0 scandelay=5
initrd /initram.igz

title FreeDOS
root (hd0,2)
kernel /memdisk
initrd /freedos.img floppy

title Ophcrack
kernel /bootoph/bzImage rw root=/dev/null vga=normal lang=C kmap=us screen=1024x768x16 autologin
initrd /bootoph/rootfs.gz

I’m sure there will be many questions and further development of this project so as I’ll go ahead and point you the episode 524 release thread on the Hak5 forums. Share your thoughts!

Don’t forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.

Download HD Download MP4 Download XviD Download WMV

Show Notes

While Matt’s away on business Eighty of Dual Core fills in with an awesome segment on extracting Windows executables from packet captures using tcpxtract.

Darren’s features some of the Gmail Badges from our recent Code Challenge.

Plus we’ve got a walk-through on winning the Easter Egg Hunt. Only *four* of over 300 submissions completed the puzzle. We’ve learned a bunch of lessons from this first hunt and will be sure to put together an even more in-depth hunt next time.

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

HakHouse Rover – Web Enabling a RC Tank

There comes a time in every geeks life when building a web enabled, crowd sourced, remote controlled vehicle is an imperative. For us that time is now.

The HakHouse rover project kicks off this week with the basics of controlling our inexpensive RC Tank. The toy itself was a mere $15 locally and this is important because cheap RC toys usually have cheap controls. Namely micro switches to control forwards, backwards, left and right. In this segment we break open the controller and solder leads to the board that correspond to movement.

Next we connect the leads with a Phidget Interface Kit. This little board talks to our PC via USB and has programming APIs for C/C++, Python and Java.

With a little hacked together C code in Linux we’re able to control the vehicle. If you’re a C coder we’d greatly appreciate your input on the code. It’s not very pretty at the moment.

Next we toss in a little PHP on Apache and control it from the web. I had originally slapped together a simple page with a form directed at php_self with an if isset and a case switch that initiated exec but it’s already been replaced by jzman’s sweet ajaxy code.

This projected is intended to be open source so I’ve got all the code, hardware and other details on our wiki. If you’d like to build one yourself or contribute ideas, code or otherwise it’s appreciated.

In the next installment of the HakHouse Rover project we’ll be installing a wireless web camera and laser turret to annoy our cat Kerby.

–Darren Kitchen

IP Renumbering w/PHP And A Compiler

In episode 424 a viewer question led to Darren and Matt discussing renumbering a whole subnet of Windows machines using the netsh command in a script, but how would you specify an IP for each machine with only one script? PHP to the rescue, because it’s not just for web pages anymore.

Since most Windows workstations don’t have PHP installed a compiler will let you prepare your code to run on systems that don’t have PHP installed.

First we have Roadsend PHP, which is available for Linux, FreeBSD, Mac OS X and Microsoft Windows. It’s released under GNU GPL, and it’s runtime libraries are GNU LGPL so compiled programs may be used for both open source and commercial projects.

Roadsend PHP is not just to package up your PHP into nice friendly bundles, it comes with Roadsend Studio, a full development environment (IDE) with support for the Glade interface builder (*nix/Win32), to give your PHP a GUI front end.

It supports PHP 4 and 5, and so far all the code I’ve compiled with it runs just as it would if launched from the command line using the php command. The only drawback to it is the compile process seems to take a while even on relatively small projects, and the file sizes are a little large (simple scripts weighing in at over 3MB); but if you want to stay in one environment from start to finish Roadsend will do the job.

Second is the Bambalam PHP EXE Compiler/Embedder, which as the name implies is for Windows only. Like Roadsend PHP, Bambalam PHP is free to use as it’s released under the PHP license, generates code that will run without a full PHP install, and with the use of the WindBinder library can produce programs with GUI front ends. That is about where the similarities end.

Bambalam is small, consisting of a hand full of files, and is only for the actual building of the executable code. Bring your own editor, debugger, GUI builder, and project manager. That’s not what Bambalam is for. What it is for, though, is producing small, fast programs out of any PHP that will run under PHP 4.4.4. The same +3MB code that Roadsend produced came in at just over 1MB with Bambalam, and under 700KB with compression turned on.

The problem my code solves is how to write one script to renumber a whole group of machines without having to issue a different version of the script to each machine. As this is more of a proof of concept we will assume that only the last octet of the IP address will be changing.

The command is issued with the following options:

<new IP> <subnet mask> <default gateway> [DNS] [WINS]

The new IP is given as the first three octets in xxx.xxx.xxx format, subnet and gateway will be a full four octets a peice. IP, DNS, and WINS can each be assigned as DHCP (using DHCP for IP preclueds the need for subnet and gateway). DNS and WINS can also be assigned as NONE so long as IP is not DHCP. Furthermore specifying WINS requires that some value be given for DNS.

If a new first three octets are given without specifying DNS or WINS and those values were already staticly assigned then the new first three octets will be used for those values as well. Also if IP is currently assigned via DHCP that can’t not be changed at this time.

Full source and future updates are available at http://www.elder-n00b.org/2009/02/ip-renumbering-wphp-and-compilers.html

Thanks to those who’ve contributed to the success of Hak5. Your donations are greatly appreciated!

Watch

Show Notes

The hacker zombies are back with failcocktails. Matt gets excited about the VMware ESX 4 beta screenshots. Shannon and pizza delivery? HakHouse gets a facelift including an adobe air app.

Our next deathmatch will be HalfLife 2 Deathmatch on Saturday, December 13 at game.hak5.org. Prepare to get smack in the face with a flying toilet!

Mad props to TheX1le, Post_break, applecrisp and Codedninja

Web Controlled USB Missile Launcher

Can a hacker crowd source annoying their cat with frickin lasers? Darren invesigates. The Striker II USB Missile Launcher seems like the perfect platform for flying foam mayhem. After pulling his hair out trying six different control applications including Roy Solberg’s Java implementation, David Wilson’s mac app, mfire, Scott Weston’s Python version and Luke Cole’s simple C implementation, Darren finally settles on Alex Suzuki’s Striker-II C++ code as the base for the soon to be web enabled app. As it turns out there is a difference in control protocol between the Striker and the Striker-II which was the root of much frustration. Jason Appelbaum came to Darren’s aid and whipped up a sexy java client/server for the Striker-II. We’ll have him on the show shortly! Until then Darren shows off some of the Java applet code in Eclipse and the sweet plugin JFormDesigner. You can play with the Hak5 USB Missile launcher right now over at HakHouse.com or head over to the Hak5 Forums (Look for the USB Missile Launcher board) and get involved in the development, testing, or find out how to build your own.

–Darren

Cell Phone Emulators

Perfect for the holidays are cell phone emulators. Try your choice of mobile OS before you actually buy them in store so you dont get stuck with your new smartphone and a two year contract with your wireless company. Using these emulators can introduce you to many, many different smart phone OS. You can compare and choose your favorite and your least favorite easily.
The ones I tried were Windows Mobile 5, Palm Centro, and Blackberry Storm emulators. All three run on different programs made by completely different people, and take a little bit of practice to learn each emulator. via Hak5 forums.

–Shannon

Congrats to SWFu and KirbyPPC who correctly answered last week’s trivia. Answer: Death-ray.

Custom Linux commands using Webmin and Usermin

Talking about making your life easier if you’re a linux system admin I demonstratred the great and free tools Webmin and Usermin available from http://webmin.com/

Installing the package is as easy as RPM -i webmin-1.441-1.noarch.rpm
Once installed goto https://yourserver.com:10000 and login with a user like root. After you’ve logged in you can just start clicking through the menus and see what you can do with this great piece of software.

During the show I explained how to create custom commands and deploy them to users with the webmin addon (http://webmin.com/usermin.html).

If you have any questions, feel free to post a comment or send me an email: matt@hak5.org.

–Matt

Questions

Ustreamer-28589 (if that is your real name) asks if there is a way to burn ISOs to USB drives and boot off them. The answer is a beautiful little cross platform application called UNetbootin — the Universal Netboot Installer. This little guy rocks. It’ll download the latest live ISO of many popular linux distros (including our favorites Backtrack, Gparted, and Ubuntu) and “burn” them to your removable media. Best of all you can specify your own disk images (ISO or Floppy) or specify a custom kernel! Darren swears by this app.

JennyGo asks if there is a way to put her PC into some sort of Kiosk mode running only an SNES emulator for a party she’s having. She doesn’t want noobs effing with her rig. Matt suggests Windows Steady State to lock down the system state but the guys turn up empty when it comes to making the machine run ONLY the SNES emulator. Darren recalls some experimental hacks like replacing shell=explorer.exe in win.ini with shell=snes9x.exe but hasn’t tested this. We’re looking for your input on this one so if you’ve got a great idea on how to lock down this box hit up at feedback@hak5.org.

Until next week we welcome your feedback and remind you to Trust your Technolust

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

Production Notes

Special thanks to Ashley Witt for the awesome new Hak5 Theme Song, and Pronobozo for the additional music, it really makes the episode shine!

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.