Hak5 - Technolust since 2005 » sniffing

School firewall evasion with SSH & Proxies

Darren — Mon, 14 Dec 2009 07:36:03 +0000

Never again have your curious Google searching or social networking adventures be thwarted by your school or office firewall. Darren show off free and easy ways to bypass the filters using SSH or your own homegrown web proxy.

SSH Tunneling isn’t new to the show, we’ve done it before over DNS or in conjunction with VNC. Today we’re looking at two SSH tricks for tunneling just about any traffic.

First up, ssh -D. The -D option specified a local "e;Dynamic"e; application-level port forwarding. Any connection made to the specified port goes through the tunnel as a SOCKS4 or SOCKS5 proxy. Perfect for secure web browsing as demonstrated with Firefox in this segment.

Usage

ssh -D 8080 user@server

Second, ssh -L. The -L option enables port forwarding. Using this option tells the SSH client to listen to traffic on a specified port and forward it along through the tunnel. The server receives this data and points it to the specified destination, whether it be on the destination network or otherwise. In our example we use the -L option to securely connect to an open IRC server.

Usage

ssh user@server -L local-listen-port:destination-ip:destination-port

For more SSH-fu check out the ssh man page or Linux Journal’s interesting series on 101 uses of openssh.

Episode 614 – Firewall evasion, SSH and virtual appliances!

Darren — Wed, 18 Nov 2009 14:49:32 +0000

Got a restrictive firewall blocking sites at school or work? Evade ‘em easily with your own private web proxy. Want to securely tunnel any port through an SSH session? Darren’s got just the trick. Wondering how to properly use Asleap to crack MS-CHAPv2 PPTP VPN handshakes & LM Hashes? Interested in trying out neat free enterprise applications but don’t feel like spending hours in a terminal? Try deploying a virtual appliance in minutes, the free and open source way.

Download HD Download MP4 Download XviD Download WMV

Port Tunneling and Socks5 Proxies with a Secure Shell (SSH)

SSH Tunneling isn’t new to the show, we’ve done it before over DNS or in conjunction with VNC. Today we’re looking at two SSH tricks for tunneling just about any traffic.

Usage

ssh -D 8080 user@server

Usage

ssh user@server -L local-listen-port:destination-ip:destination-port

For more SSH-fu check out the ssh man page or Linux Journal’s interesting series on 101 uses of openssh.

Bypassing site-blocking firewalls with your own private web proxy

The age old scheme for bypassing restrictive firewalls, like those that block sites at school or work, has been to use a web proxy. Of course this is followed up by the network administrator blocking all mainstream proxies. But what if you could run your own? Well, you can and it’s really freaking easy. In this segment Darren demonstrates PHProxy

Cracking MS-CHAPv2 PPTP VPN handshakes & LM Hashes Followup from 6×12

On episode 612 we demonstrated a tool, asleap, designed to crack MS-CHAPv2, the authentication protocol commonly found in Microsoft PPTP VPNs. The final demo was unsuccessful due to the encoding of the handshake and response sniffed by Wireshark. Viewer Sc00bz was kind enough to post a PHP script that accepts the challenge, response and username and provides you with the proper asleap command to run with the properly encoded byte sequences. Sc00bz has well documented the code, which lives now on this Hak5 forum thread. Thanks Sc00bz!

Deploying Virtual Appliances in minutes the open source way

A Virtual Appliance can be though of as a software image containing a supporting stack designed to run inside a virtual machine. A quick look at vmware’s virtual appliance directory shows that there are hundreds of applications that can be quickly and easily deployed. In this segment I take the Dimdim open source virtual appliance, designed for vmware, and deploy it with VirtualBox (just becasue I can).

Episode 513 – Extract Windows Executables from Packet Captures, PHP Gmail Badges, Winning the Easter Egg Hunt, and special guest Eighty of DualCore

Darren — Wed, 13 May 2009 17:29:26 +0000

Eighty of Dual Core comes down to the HakHouse to share with us a technique for extracting Windows executables from packet captures. Darren’s featuring some of the Gmail badge submissions and a walkthrough of the Easter Egg hunt. Plus be sure to stick around as Eighty treats us to a live performance off his upcoming album.

Download HD Download MP4 Download XviD Download WMV

Show Notes

While Matt’s away on business Eighty of Dual Core fills in with an awesome segment on extracting Windows executables from packet captures using tcpxtract.

Darren’s features some of the Gmail Badges from our recent Code Challenge.

Plus we’ve got a walk-through on winning the Easter Egg Hunt. Only *four* of over 300 submissions completed the puzzle. We’ve learned a bunch of lessons from this first hunt and will be sure to put together an even more in-depth hunt next time.

Episode 506 — Wii Homebrew, 3CX meets PSTN and Interceptor Linux client

Darren — Wed, 25 Mar 2009 04:12:22 +0000

In this episode Shannon hacks the Wii and shares her favorite homebrew with us. Matt connects 3CX to the PSTN and Darren sets up a network monkey client in Linux.

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

Twilight Hack

Wii Homebrew

You need a few things:

wii
wii mote controller
computer
internet access
small sd card formatted as FAT.
Zelda Twilight Princess for Wii

The Wii Brew Wiki
Homebrew Channel

How to install the Wii Homebrew Channel on your Wii using the Twilight Hack.

Download the Twilight Hack. There are two versions, one for Wii system 3.3, and one for 3.4. I haven’t updated mine, so I’m still on 3.3.

Download the Homebrew Channel zip file.

Also, if you want, go ahead and download some apps from the HackMii website. I suggest the Homebrew Browser so you dont have to copy apps to the SD card every time you wanna download something new.

You’ll need a small SD card 2 gig or smaller. Make sure to format your SD card as FAT. Do to this, right click on the SD card, and choose format. Simple!

Put the SD card in your Wii, then turn it on. Go to the Wii Options–>Data management–>Save Data–>Wii section of the menu. Find your Zelda: Twilight Princess saved file, and copy it. If you havent played it yet, you might not have a saved file, so go ahead and play a bit. Put your SD card in your computer and copy the “Private” folder from the card to your comp, just in case you may need it in the future.

Move the homebrew executable that you extract from the zip file to your SD card root directory and save it as boot.dol or boot.elf.

Also, save the Twilight Hack Private folder from the extracted zip file to your SD card.

Now, check out your Twilight Princess game CD. It should have some hard to read serial numbers inscribed on the inner circle. Match this serial with the corresponding “Save slot”.

Region	Inner circle text	File	Save slot
Europe/Australia	RVL-RZDP-0A-0 JPN	/private/wii/title/rzdp/data.bin	Twilight Hack
Asia (JPN)	RVL-RZDJ-0A-0 JPN	/private/wii/title/rzdj/data.bin	Twilight Hack
America (USA)
America (USA)
America (USA)

Inside the private–>wii–>title folder are 3 folders with letters corresponding to the serials. Delete the two that don’t match your cd.

Put your SD card back in the Wii. Go to Wii Options–>Data management–>Save Data–>Wii and erase the Zelda save now. Open the SD card menu and choose Twilight Hack. Copy to the Wii.

Stick your game CD in your Wii and boot up Zelda! Choose the save slot that corresponds with your serial. Mine was TwilightHack0. Go ahead and skip the intro, it doesn’t hurt the hack. Once you see Link as a playable character, either walk backwards or talk to the guy in front of you. This will start up the hack install process, so just choose “Agree” to everything.

You’re done! Now you can play on the homebrew channel. Yay!

Get the homebrew browser so you can download apps straight from the channel instead of shuffling your SD card around.

To do that, simply stick the sd in your computer and create a folder called apps. Copy the homebrew browser folder and its contents over to the sd and back it goes to your wii!

If you have some cool homebrew for the Wii, tell me about it or ask me any questions at Snubs@hak5.org.

Don’t forget to submit your questions@hak5.org and feedback@hak5.org and thanks for your contributions.

Episode 505 – Introducing Interceptor: The network tap and rogue wireless access point

Darren — Wed, 18 Mar 2009 18:13:15 +0000

The perfect primate for pen testers is none other than network monkey. Introducing Robin Wood’s Interceptor — on this episode we hack the Fon+ and turn it into a network tap and rogue wireless access point. Sniff the LAN from across the street or hack the network from the inside out! Learn how Network Monkey Pirates your Packets today!

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

Our friend digininja is at it again. On this episode we feature Robin Wood’s latest hack based on none other than the Fon+ wireless router.

Interceptor is a wireless wired network tap. Simply put you place it in line on an ethernet cable, then connect to it via a special wireless access point. Once connected and running the Interceptor scripts you’ll be able to sniff all of the traffic passing across the wire.

Interceptor doesn’t affect TTL and adds minimal latency to packets. It doesn’t associate to the target network so discovering an active Interceptor on your LAN isn’t trivial.

This tool is perfect for pen testers. The device inexpensive, based on the Fon+ router and using open source software. It is small enough to fit behind a network wall plate, inside a plush monkey, or even inside a network switch or other gear.

In this episode we demonstrate the usage, illustrate the installation and speak with the developer Robin Wood.

You can download the software and play with it yourself from digininja.org/interceptor and find support and discussion at the Hak5 Interceptor Forum.

Thanks for watching, subscribing, and most of all supporting the show. On a related note custom commissioned WiFi Pineapples running Jasager are now available.

We return next week with a regular format show. Don’t forget to submit your questions@hak5.org and feedback@hak5.org and trust your technolust!

Episode 426 — Shmoocon 2009

Darren — Wed, 11 Feb 2009 22:28:24 +0000

We head out to DC for Shmoocon, our favorite hacker conference on the east coast, to talk to some of the brightest minds in security. Dave Kennedy on his project FastTrack. Michael Ossmann about sniffing bluetooth. Joshua Abraham on his software GIS-Kismet. Mister X, author of Aircrack-ng and Johnny Long, author and security guru on Hackers for Charity.

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

Dave Kennedy talks about Fast Track, a python based open-source project aimed at helping Penetration Testers in an effort to identify, exploit, and further penetrate a network.

Michael Ossmann and Dominic Spill presented on Building an All-Channel Bluetooth Monitor using the USRP and a lot of awesome code. It turns out listening to 79 channels at once is harder than you think.

Joshua Abraham spoke to us about wireless network mapping with his tool GIS Kismet

Mister X, author of Aircrack-ng shares with us a glimpse of the future of wireless network cracking.

Johnny Long, security expert and author, talks to us about Hackers for Charity

Don’t forget to take the Hak5 Survey. This is the last week it’s running so please if you haven’t already take a moment to fill it out as it really helps us out.