Matt goes on to explain that in the vSphere product by VMware you can use the APIs to write, basically, a software based switch to compliment your existing deployments. Check out the Cisco Nexus 1000V. It’s a software implementation of a Cisco Nexus switch. I’d love to get my hands on it but at nearly $1000/year I’ll find something open source. Speaking of which, we’ve been meaning to play with a Cisco virtual network application but are in need of an ISO. If you’re privy to an open source alternative or can help out drop us a line.

Download HD Download MP4 Download XviD Download WMV

—
Title: Virtual Routers?
Time: 3:20
Keywords: virtual router, virtual machine, vm, virtualization, vmware, virtualbox, cisco, nexus, nexus switch, cisco nexus, nexus 1000v, nexus 1000

Joe Switch writes in to ask what the deal is with Virtual Routers and other such untangable networks. Matt has the answer. The way I understand it your more high end (read: expensive) Cisco and Juniper routers have virtual routers built in — much like you might have a virtual interface like eth0:1 in Linux — to manage VLANS, IP subnets and such.

Matt goes on to explain that in the vSphere product by VMware you can use the APIs to write, basically, a software based switch to compliment your existing deployments. Check out the Cisco Nexus 1000V. It’s a software implementation of a Cisco Nexus switch. I’d love to get my hands on it but at nearly $1000/year I’ll find something open source. Speaking of which, we’ve been meaning to play with a Cisco virtual network application but are in need of an ISO. If you’re privy to an open source alternative or can help out drop us a line.

Make your own Nintendo DS Games for free!

If it begins with a #include and ends in a semi-colon our friend Jason Appelbaum is all over it. This week he’s in studio covering a subject near and dear to our hearts — Nintendo DS Homebrew.

Let’s face it, the Nintendo DS is a happy little platform full of hacking potential. And with a well established homebrew community it’s the perfect device to start your next weekend project with. Jason takes you from Homebrew 101, including carts and roms, to getting the Dev tools and building your first Hello World app.

For more see JasonAppelbaum.com or email jason@hak5.org

Mac tunneling the free and easy way

Paul can’t hide behind the camera forever, and this week we’re pleased to have him break down the free and easy way to SSH Tunnel on a mac. After Hak5 viewer Lavi wrote in about SSHTunnel 1.6 Paul was happy to check out the program. Thanks for sending in your freeware picks!

SSH Tunneling the cross-platform way with Python and PHP

Another great bit of feedback from the SSH Tunneling segment in episode 614 was from Jan-Marten in The Netherlands. His Hak5 inspired cross-platform Python and PHP scripts, available from his blog johmanx.com allow you to easily configure and save SSH tunneling options. Awesome code Jan-Marteen, thanks for sending it in!

Of course if you have feedback for the show, code you’d like to send by, tips on legally acquiring a cisco IOS, freeware you want to let us know about, questions, or criticisms just write us: feedback@hak5.org

And don’t forget to check out the Hak5 Store for our holiday sale on all new Hak5 T-Shirts, hacked gadgets, pineapples, monkeys and more.

Download HD Download MP4 Download XviD Download WMV

Port Tunneling and Socks5 Proxies with a Secure Shell (SSH)

SSH Tunneling isn’t new to the show, we’ve done it before over DNS or in conjunction with VNC. Today we’re looking at two SSH tricks for tunneling just about any traffic.

First up, ssh -D. The -D option specified a local "e;Dynamic"e; application-level port forwarding. Any connection made to the specified port goes through the tunnel as a SOCKS4 or SOCKS5 proxy. Perfect for secure web browsing as demonstrated with Firefox in this segment.

Usage

ssh -D 8080 user@server

Second, ssh -L. The -L option enables port forwarding. Using this option tells the SSH client to listen to traffic on a specified port and forward it along through the tunnel. The server receives this data and points it to the specified destination, whether it be on the destination network or otherwise. In our example we use the -L option to securely connect to an open IRC server.

Usage

ssh user@server -L local-listen-port:destination-ip:destination-port

For more SSH-fu check out the ssh man page or Linux Journal’s interesting series on 101 uses of openssh.

Bypassing site-blocking firewalls with your own private web proxy

The age old scheme for bypassing restrictive firewalls, like those that block sites at school or work, has been to use a web proxy. Of course this is followed up by the network administrator blocking all mainstream proxies. But what if you could run your own? Well, you can and it’s really freaking easy. In this segment Darren demonstrates PHProxy

Cracking MS-CHAPv2 PPTP VPN handshakes & LM Hashes Followup from 6×12

On episode 612 we demonstrated a tool, asleap, designed to crack MS-CHAPv2, the authentication protocol commonly found in Microsoft PPTP VPNs. The final demo was unsuccessful due to the encoding of the handshake and response sniffed by Wireshark. Viewer Sc00bz was kind enough to post a PHP script that accepts the challenge, response and username and provides you with the proper asleap command to run with the properly encoded byte sequences. Sc00bz has well documented the code, which lives now on this Hak5 forum thread. Thanks Sc00bz!

Deploying Virtual Appliances in minutes the open source way

A Virtual Appliance can be though of as a software image containing a supporting stack designed to run inside a virtual machine. A quick look at vmware’s virtual appliance directory shows that there are hundreds of applications that can be quickly and easily deployed. In this segment I take the Dimdim open source virtual appliance, designed for vmware, and deploy it with VirtualBox (just becasue I can).

Download HD Download MP4 Download XviD Download WMV

Adding a touch screen to a LCD is pretty straight forward and fairy inexpensive. There are a few different places to get the touch screen kit, we got ours from ebay for around 80 bucks + shipping. Dealextreme.com has a small selection of smaller touch screen kit perfect for netbooks, because they come with a controller made to connect internally instead of external usb. When buying a kit to make sure it comes with the matching controller to avoid any head aches.

When it comes to desktop virtualization Matt and I think very differently. While I agree that VMware’s ESX and (free) ESXi solutions are killer, I can’t seem to justify the price of target=”_blank”>VMware Workstation when Sun’s Virtual Box is free, open source, full featured, super speedy and rock solid. Matt doesn’t agree.

Matt wouldn’t agree with my assessment, but he doesn’t write the show notes so I’ll just go ahead and link to this totally unbiased comparison.

Download HD Download MP4 Download XviD Download WMV

Matt Lestock uses VMware Converter to take that ugly power hungry idle beast and turn it into a sleek and slim virtual machine, piped stright into your ESXi host.

Send your questions and feedback to matt@hak5.org

Darren Kitchen is cooking up a Linux based Java servlet container and HTTP web server with Apache Tomcat. While never distributions and package repositories can make setting up a Tomcat server a breeze, it’s nice to have an understanding of the manual process.

Don’t forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.

Download HD Download MP4 Download XviD Download WMV

Show Notes

Internet Redirection

Corporate and university firewalls can be a particular PITA — especially if you’re a gamer. And while SSH tunneling (even over DNS)or VPN technologies are often preferred, it is quite possible to “bounce” your traffic off an Internet Redirection server. Like a fancy proxy, rinetd allows you to specify incoming and outgoing IP and port. It features basic client access rules based on IP and even supports logging. In my segment I demonstrate accepting traffic on port 80 and transmitting it to an IRC server on port 6667.

Granted this isn’t going to fool your more complex firewalls that actually inspect packets — but if you’re just looking to get traffic through an open port I highly recommend giving rinetd a try.

–Darren

Steghide

Download a copy of Steghide. Extract the zip.

You want to hide a file. First thing you need is a file to hide it in. Choose a file – whether that be a music file, jpeg, word document… whatever – and save it inside the steghide folder, which was extracted from the zip folder. Also, save your file that you want to hide inside that same folder as well.
Open up your command prompt and open the steghide folder directory. Open the steghide.exe file. The last few rows of type will tell you how to embed and extract your hidden file.

Embedding:
Type into the command prompt: ’steghide embed -cf file.jpg (this is your regular file) -ef hiddenfile.txt’ (this is the file you want to hide).
Choose a Passphrase and you’re done! You’ll notice the original photo or music file has changed it’s byte size now that you’ve embedded something inside it.

Extracting:
Type into the command prompt: ’steghide extract -sf file.jpg’ and enter the passphrase. Now, you’ll see the extracted hidden file appear inside the same folder.
Your done! Simple, eh?

–Shannon

Download HD Download MP4 Download XviD Download WMV

Show Notes

Common User Password Profiler

The Common User Password Profiler from Remote-Exploit is a password/passphrase generator specifically targeted as an individual user. Feed it some info like names, birth dates, spouce, children and pets and it will generate individually, or along with an existing dictionary, thousands of potential passwords. Just add water, feed to your favorite brute forcer and enjoy.

From personal experience I can vouch that, while simple sounding, this would have a HIGH success rate on some of my _former_ (L)users. Administrators take note and enforce BOFH password requirements

netcat – “The Swiss-army knife for TCP/IP”

When it comes to sending and receiving TCP and UDP any which way from the console nothing is more versatile or easy to use than netcat.

With a few simple commands you can use netcat to initiate chat, file transfer or even shell access in either direction between a “server” and a “client”.

The tool can be set to listen or broadcast on any port and tied together with some shell-fu almost anything is possible.

Some listener favorites include cloning hard drives over a network with dd and netcat, tailing a log across the network, port scanning, IP redirecting, or even spoofing user-agents and referrers. Internet Explorer 22 anyone?

Digininja points to this great netcat cheat sheet (PDF 128K).

What kind of crazy stuff have you done with netcat? Feedback@hak5.org

Shannon’s Wordpress Plugin Picks

Twitme

This plugin allows you to automatically post your new posts on the twitter website. This is good because the iPod and iPhone for example have a large amount of twitter clients to pick from. Your blog posts will arrive to people while they are walking the streets.

Socialite

Socialite allows your Wordpress posts to publish to Twitter, Facebook, and MySpace. Each social networking site can be enabled or disabled for publishing, and each is configured separately with their own options. Support for Short URL services such as zz.gd and Tinyurl.com is also supported.

Sociable

Automatically add links to your favorite social bookmarking sites on your posts, pages and in your RSS feed. You can choose from 99 different social bookmarking sites!

MobilePress

MobilePress is a WordPress plugin that will render your WordPress blog on mobile handsets, with the ability to use customized themes. The plugin also allows specific themes for specific devices / mobile browsers, such as iPhone, Opera Mini, Windows CE Mobile and other generic handset browsers.

Resize at Upload Plus

The plugin will automatically resize an image upon upload, depending on the maximum width and height that you define. Gone are the days when you, or your client, will ruin a site’s layout by uploading a huge file with 25 megapixels. Be advised: there is no backup, no copy of the originally uploaded image.

WP-Cache 2.0

WP-Cache is an extremely efficient WordPress page caching system to make your site much faster and responsive. It works by caching Worpress pages and storing them in a static file for serving future requests directly from the file rather than loading and compiling the whole PHP code and then building the page from the database. WP-Cache allows to serve hundred of times more pages per second, and to reduce the response time from several tenths of seconds to less than a millisecond.

Wordpress Backup

Backup the upload directory (images), current theme directory, and plugins directory to a zip file. Zip files optionally sent to email.

WP Security Scan

Scans your WordPress installation for security vulnerabilities and suggests corrective actions.

WP Ban

It will display a custom ban message when the banned IP, IP range, host name or referer url trys to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recordered on how many times they attemp to visit your blog. It allows wildcard matching too.

pixelstats

Count every viewer and every article view for each blog entry, no matter how and where it is read: pixelstats tracks views of each blog post or page, not only on a single article page but also on each other page where the complete article is shown, i.e. the blog front page, category pages, search result page, archive pages and even RSS fee

Thanks for watching, subscribing, and most of all supporting the show. Custom commissioned WiFi Pineapples running Jasager are still available.

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

Virtualization

So we’ve finally come to the point in which I’ve been worn down enough to begin highlighting some virtualization for you guys.

In this episode I kind of gave you a brief overview of a singular reason one would want to virtualize their infrastructure.

COST

Now more than ever I’m sure your CAPEX budgets are tightening or have vanished completely for this fiscal year.

Let’s take a real down and dirty look at the primary benefit of virtualization.

Last year I purchased a Dell server with the following specs for about $22,000

4x Quad-Core Xeon X7350 processors at 2.93GHz
128GB RAM
5x 15,000RPM 450GB SAS Hard Drives

Now as you can see this is a beast.

VMWare licensing costs for this server are about another $10,000. OUCH! However there’s more.

Right now I’m running 38 virtual machines on this server. With room for more.

Let’s say the average 1U server costs $1500. Where am I at from a pure cost perspective?

A) Virtual Environment – $32,000

B) Separate Physical machines – $57,000

This doesn’t take into account the virtual environment’s savings on things such as power consumption, or cooling.

Plus with another server, and a SAN you now have a Highly Available system for about the same cost as individual machines.

I know this was a brief overview of the primary benefits of virtualization, but I wanted to give you guys an idea of just what is accomplishable when you begin thinking virtually.

I’ll be bringing you a bunch more segments in the coming weeks ranging from SAN selection and implementation to building a cheap virtual environment at your house, so stay tuned for more!

–Matt Lestock

Contests

The Monkey Wallpaper contest is still going on. Entries are due by Friday, April 24th. The winner will be announced on next weeks episode, 511. You can find all the art work and submission details at Hak5.org/MonkeyContest. The winner will receive a deluxe sock monkey kit from SockMonkey.net!

This week we have a new contest — a code challenge. If you’re into PHP, Imagemagick, and gmail you’ll want to get involved. Entries are due by Friday, May 1st. The winner will be announced on episode 512. you can find all the details at Hak5.org/CodeChallenge. The winner will receive a copy of Mario Lurig’s PHP Book PHP Reference: Beginner to Intermediate PHP5.

Wii Homebrew News

Team Twiizers focus on BootMii

On the 16th Team Twiizers, the folks that brought us the Homebrew Channel, announced that they have shifted their focus to the BootMii project.

BootMii is system boots before the Wii System Menu and allows for complete low level control of the Wii, including launching the homebrew channel.

Team Twiizers expects to have a beta released within the coming weeks. So far it has been successfully installed on about a dozen Wiis.

We’ll have a hands on look when it becomes available.

USB Loader released

Earlier this month Waninkoko released USB Loader, an homebrew Wii app which allows you to backup game discs to USB Hard Drive or SD card run backed up games from said media without needing the original disc.

Obviously this tool has piracy potential written all over it but it’s also the fastest and most convenient option we’ve found for backing up games.

Last week we demoed nitrotux’s Wii Disc Dumper, a similar backup tool that took 10 hours to download a Dual-Layer Wii Disc in 6 parts.

The newly released USB Loader does that in 1/10th the time directly to a single ISO file. We’ll be using it today as part of our Wii 720p segment

Dolphin build 2962 released

On the 13th Dolphin build 2962 hit subversion. This latest build adds OpenAL audio support, the ability to frame dump to AVI, various bug fixes and a more powerful Xbox 360 controller rumble. Huzzah

Wii Homebrew Review

A lot has changed over the last four weeks since we started playing with Wii Homebrew so before we get into the latest — backing up Wii Games and playing them in HD on your PC — let’s review how we got here.

Currently the best method for installing Homebrew on your Wii is through a technique known as the Twilight Hack. This involves loading a special save-game for Zelda: Twilight Princess that causes a buffer overflow and code execution.

This method was thwarted by Nintendo’s recently released System Menu 4.0. If you haven’t updated your Wii already we advise you steer clear until the homebrew scene can come up with a new hack.

If you already have homebrew installed, such as the Homebrew Channel or DVD-X, updating to 4.0 doesn’t break those but we still advise against it.

The most essential homebrew app is the Homebrew Channel. It’s a breeze to install with the twilight hack and once installed you can use it to launch other homebrew apps from your SD card — no need to pull off the twilight hack every time you want to play a different homebrew app.

The Homebrew Browser is another essential as it allows you to download homebrew apps, games, utilities and demos right from your Wii’s Internet connection and onto your SD card.

A great list of homebrew apps can be found at the WiiBrew.org wiki. Details for pulling off these hacks can be found in our show notes and previous episodes.

USB SD Loader

The USB SD Loader from waninkoko is, IMHO, the easiest way to backup Wii games — far superior to the disc dumper we showed off on 509. That said, it should be known that in order to use the USB SD Loader you must modify your Wii using a wad manager — but you’ve already voided the warranty anyway right? It is also worth noting that as of writing it does not backup gamecube discs. For that you’ll need to stick to the disc dumper mentioned on 509.

In order to use the USB Loader you’ll need to install the USB Loader wad file using a wad manager. Once installed you’ll need to run the cios36 rev10 installer. Then ensure that the IOS36-64-v1024.wad file is in the root of your SD card and start the USB Loader from the new channel item in system menu.

You’ll have the option to format either an SD card or USB drive in WBFS. This will be the medium for storing and running backed up games. It’s probably not a good idea to format your regular homebrew SD card for this . I took the USB route opting to format a portable 320GB HDD. Once formatted, installing games is as simple as inserting the disc, pressing (+) on the wii remote and following the prompts. Typical single-layer discs take about an hour to copy.

In order to get the game off your removable hard drive and onto your computer in ISO form you’ll need to install the (windows only) WBFS Manager program. This program lets you select your removable drive and extract games as ISO images. You can also copy any ISOs you may have on your computer to the removable drive with this tool.

Dolphin Emulator

Once you have a legally copied ISO file on your computer you’ll want to install and configure Dolphin in order to play it.

The important bits to note about getting Dolphin to run properly is that you’ll need Microsoft Visual C++ 2008 Service Pack 1 (x86 or x64) installed. You’ll also need the DirectX March 2009 Runtime. Use the Microsoft DirectX Updater. It’s probably also a good idea to update your video drivers while you’re at it.

Dolphin itself is pretty easy to use. Like most emulators it features a plethora of control configurations and convenient save state options.

Thanks for watching, subscribing, and most of all supporting the show. Custom commissioned WiFi Pineapples running Jasager are still available.

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.