Hak5 - Technolust since 2005 » VM

Episode 704 – Malware Analyzis Sandbox and PC Remote Control over Twitter

Darren — Wed, 10 Mar 2010 23:05:06 +0000

Following up with last week’s desktop sandboxing challenge Darren’s taking a look at another kind of sandbox — one for malware analysis. Shannon thinks your VNC and SSH servers are pretty spiffy, but how about controlling your computer over twitter? Free text messaging to your PC anyone?

Download HD Download MP4 Download XviD Download WMV

Malware Analysis Sandbox

CWSandbox is an automated malware analysis sandbox. It works by running suspected malware samples in a simulated Windows OS. So as opposed to trying to break into the malware code to see what it does, we simply run it in a live environment. That way we can monitor all the network traffic that the malware generates. All of the processes that are created, the DLLs that are loaded, any changes to the Windows registry and even what it’s doing to the file system.

This is achieved by using a technique called API hooking. That basically means that when the malware calls the Windows application programmers’ interface to say something like “connect to this IP address” or “modify this file” it’s actually going to CWSandbox’s monitoring software, which logs the action and goes ahead and makes the change.

It’s kind of like an operating system man-in-the-middle. For malware.
So once a suspected malware sample is run through the tool you get a computer generated report of what the executable is actually doing. And this can be fed into anti-virus and intrusion detection systems to monitor for similar behavior.

PC Remote Control over Twitter

While there is no denying the power of running your own SSH, VNC server at home for remote access, wouldn’t it be nice if you could simply text message your computer something simple like “Hey, what’s your external IP address” or “Send me a screenshot” or “Go download this file”

And if Robin Wood has taught us anything with KreiosC2 – commanding your computer, or even a large botnet for that matter, over social networks is quite possible.

But now it’s time for something a lot more user friendly. This week Snubs investigates TweetMyPC

First look at Google Chromium OS

Darren — Mon, 14 Dec 2009 07:13:33 +0000

Last week the news was a buzz about Google’s Chrome OS, and while we typically don’t cover tech news on the show I freaked out in my usual open source, cloud lovin’ Linux-y sorta way. So this week we’re taking a first look at Chromium OS — the FOSS project that Chrome is built on.

Virtual Routers Explained

Darren — Mon, 14 Dec 2009 06:51:59 +0000

Joe Switch writes in to ask what the deal is with Virtual Routers and other such untangable networks. Matt has the answer. The way I understand it your more high end (read: expensive) Cisco and Juniper routers have virtual routers built in — much like you might have a virtual interface like eth0:1 in Linux — to manage VLANS, IP subnets and such.

Matt goes on to explain that in the vSphere product by VMware you can use the APIs to write, basically, a software based switch to compliment your existing deployments. Check out the Cisco Nexus 1000V. It’s a software implementation of a Cisco Nexus switch. I’d love to get my hands on it but at nearly $1000/year I’ll find something open source. Speaking of which, we’ve been meaning to play with a Cisco virtual network application but are in need of an ISO. If you’re privy to an open source alternative or can help out drop us a line.

Episode 616 – Make your own Nintendo DS Games for free! Tunneling on a Mac and Virtual Routers.

Darren — Wed, 02 Dec 2009 21:09:52 +0000

Cheap mod chips plus free dev tools equals hello world on the Nintendo DS! Jason Appelbaum joins us to geek out about code up the dual screen’d programmers playground that is NDS homebrew. Matt has answers to your questions about Virtual Routers, Paul comes out from behind the camera to school us on SSH Tunneling for the Mac, and Darren’s featuring some pretty Python & PHP to tunnel cross platform.

Download HD Download MP4 Download XviD Download WMV

—
Title: Virtual Routers?
Time: 3:20
Keywords: virtual router, virtual machine, vm, virtualization, vmware, virtualbox, cisco, nexus, nexus switch, cisco nexus, nexus 1000v, nexus 1000

Make your own Nintendo DS Games for free!

If it begins with a #include and ends in a semi-colon our friend Jason Appelbaum is all over it. This week he’s in studio covering a subject near and dear to our hearts — Nintendo DS Homebrew.

Let’s face it, the Nintendo DS is a happy little platform full of hacking potential. And with a well established homebrew community it’s the perfect device to start your next weekend project with. Jason takes you from Homebrew 101, including carts and roms, to getting the Dev tools and building your first Hello World app.

For more see JasonAppelbaum.com or email jason@hak5.org

Mac tunneling the free and easy way

Paul can’t hide behind the camera forever, and this week we’re pleased to have him break down the free and easy way to SSH Tunnel on a mac. After Hak5 viewer Lavi wrote in about SSHTunnel 1.6 Paul was happy to check out the program. Thanks for sending in your freeware picks!

SSH Tunneling the cross-platform way with Python and PHP

Another great bit of feedback from the SSH Tunneling segment in episode 614 was from Jan-Marten in The Netherlands. His Hak5 inspired cross-platform Python and PHP scripts, available from his blog johmanx.com allow you to easily configure and save SSH tunneling options. Awesome code Jan-Marteen, thanks for sending it in!

Of course if you have feedback for the show, code you’d like to send by, tips on legally acquiring a cisco IOS, freeware you want to let us know about, questions, or criticisms just write us: feedback@hak5.org

And don’t forget to check out the Hak5 Store for our holiday sale on all new Hak5 T-Shirts, hacked gadgets, pineapples, monkeys and more.

Episode 615 – Linux Hacking the Zipit, SMS Scripting Google Voice, and Chrome OS

Darren — Wed, 25 Nov 2009 18:26:25 +0000

Nothing makes us happier than hacking an inexpensive gadget to run just about any Linux app — and that’s exactly what Shannon Morse is doing this week on Hak5. We’re also joined by Jason Appelbaum for a little Google Voice SMS scripting with Java or PHP libraries, and Darren Kitchen has gone googly for Chrome OS. Prepare the popcorn it’s technolust time!

Download HD Download MP4 Download XviD Download WMV

First look at Google Chromium OS

–Darren Kitchen

Google Voice SMS Scripting with Java and J-Bomb

Google voice is a powerful multi-use tool that could be used as a free SMS aggregator, that could be leveraged for anything you could come up that would fit into 140 charters, like a text based adventure game or a sms bbs. There are several different libraries that people have developed to take full advantage of Google voice’s features: Java Libary, PHP Libary, or for those who just want the raw unofficial API. The sky is the limit with this, the code that was showed is up on the forums, so head over there and get those idea up there.

–Jason Appelbaum

PS: Doesn’t J-Bomb sound like some sort of netbeans module?

Unlocking Linux on the Zipit Z2, a $50 hacktop

The Zipit Z2 is an inexpensive wireless handheld instant messaging device by Zipit Wireless. It sports WiFi, a color 320×240 display, backlit keyboard and similar CPU and memory to that of a last-gen smart phone.

It’s also a prime candidate for some hacking. In this segment we’ll unlock the device and install Debian, X, and Pidgin. The Z2 also has potential for emulators, video streaming and more.

Rather than repeat what has already been well documented we’ll link to these helpful Zipit Z2 hacking resources:

Hunter David’s blog – A bunch of well documented ZipIt hacks, many with videos

The Zipit Wireless Yahoo Group

Quantum Lime’s step by step Zipit Z2 Debian guide

Episode 609 – Touchscreen Mod and VirtualBox vs VMware

Darren — Wed, 14 Oct 2009 08:00:35 +0000

This time on the show Jason Appelbaum joins with a touchscreen LCD mod that’s a lot easier than one might think. Then Darren and Matt pit their desktop virtualization platforms, Virtual Box and VMware Workstation, against eachother over a game of Halo.

Download HD Download MP4 Download XviD Download WMV

Adding a touch screen to a LCD is pretty straight forward and fairy inexpensive. There are a few different places to get the touch screen kit, we got ours from ebay for around 80 bucks + shipping. Dealextreme.com has a small selection of smaller touch screen kit perfect for netbooks, because they come with a controller made to connect internally instead of external usb. When buying a kit to make sure it comes with the matching controller to avoid any head aches.

When it comes to desktop virtualization Matt and I think very differently. While I agree that VMware’s ESX and (free) ESXi solutions are killer, I can’t seem to justify the price of target=”_blank”>VMware Workstation when Sun’s Virtual Box is free, open source, full featured, super speedy and rock solid. Matt doesn’t agree.

Matt wouldn’t agree with my assessment, but he doesn’t write the show notes so I’ll just go ahead and link to this totally unbiased comparison.

Episode 602 – Grub2 and VM-fu

Darren — Wed, 26 Aug 2009 10:00:49 +0000

Managing ESX(i) with a cross platform adobe air application. Matt reviews BlueBear’s Kodiak. Want to boot ISO files directly from USB? Darren explores the options with Grub Legacy and Grub2, plus tweaks for Persistent installations, nested menus, notes and more.

Download HD Download MP4 Download XviD Download WMV

Matt Lestock reviews BlueBear’s Adobe Air-based application for managing mixed virtualization environments. Kodiak currently supports VMware ESX servers with Citrix XenServer and Microsoft Hyper-V compatibility coming soon. This cross platform management application is pretty slick!

Darren Kitchen discusses the evolution of his favorite boot loader, Grub, and points out USB installation options and Grub2’s loopback option. He also discusses persistent changes, nested menus, and notes.

Darren also checks out LiveUSB, a tool that promises to automate the process of building a USB Multi Boot tool. Note: The site and application are all in French.

Episode 523 – Return of the Matt: Physical to Virtual and Apache Tomcat3

Darren — Wed, 22 Jul 2009 05:31:11 +0000

Matt Lestock returns and brings us the skinny on converting physical servers into virtual servers and piping ‘em right into your ESXi box while Darren takes the scenic route on a Linux Apache Tomcat install with some Java and bash lovin’.

Download HD Download MP4 Download XviD Download WMV

Matt Lestock uses VMware Converter to take that ugly power hungry idle beast and turn it into a sleek and slim virtual machine, piped stright into your ESXi host.

Send your questions and feedback to matt@hak5.org

Darren Kitchen is cooking up a Linux based Java servlet container and HTTP web server with Apache Tomcat. While never distributions and package repositories can make setting up a Tomcat server a breeze, it’s nice to have an understanding of the manual process.

Don’t forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.

Episode 519 – Building the Ultimate White Box for under $2000

Darren — Wed, 24 Jun 2009 16:55:46 +0000

Building the ultimate white box ESXi server for under $2000! Can it be done? Darren and Matt grab the company credit card and answer that question.

Download HD Download MP4 Download XviD Download WMV

Building the Ultimate White Box Server for under $2000

When it comes to building a white box server for ESXi your best resources are vm-help.com, UltimateWhiteBox.com, the VMware Compatibility Guide, and the VMware community.

We carefully selected ESXi supported components based on reliability and value. If this were the ultimate $3000 white box server we might have picked a server board with dual Xeon’s and ECC memory, but to keep it under that magic $2000 price point we went with beefy “desktop” components such as the Intel Core i7 920, the ASUS P6T Deluxe, and 12 GB of Corsair XMS3 memory.

Drive wise you can’t go wrong with the 3ware 9650SE-4LPML. It supports four SATA II drives in RAID 0, 1, 5, 10 or JBOD. It’s bigger brother the 9650SE-16ML sixteen channel SATA II controller is hot too — just at three times the price. The 9650SE isn’t supported out of the box by ESXi, however 3ware provides a knowledge base article and drivers necessary to add support for the card after your ESXi box is built.

Drive wise we picked up four Western Digital Caviar Black 1TB drives since they’re cheap and reliable.

To make things easy when installing all these components in our Rosewill RSV-Z4000 4U rackmount case we picked up a 4 Drive trayless how swap sata backplane from StarTech. IcyDock makes one too. This was the only $100 spent for convenience over performance/value, but anyone who has dealt with 5.25″ to 3.5″ mounting brackets will agree it’s worth every penny.

Rather than installing ESXi on the RAID, we used a 4GB USB drive from Patriot. The Xporter XT. It boasts really fast read/write times. I’m sure any old 1gb or larget USB drive would have done but they’re so cheap, why not?

We’re doing a little white box server contest. Winners will get all sorts of swag from the Hak5 Store. Check out all the details in the episode release thread at Hak5.org

Episode 518 – Hacking WPA, ESXi and iSCSI, Bypass Windows Passwords

Darren — Wed, 17 Jun 2009 05:42:27 +0000

Darren’s Hacking WPA-PSK keys using the recently updated Cowpatty and some damn fine lookup tables. Connecting ESXi to iSCSI targets — Matt breaks it down with FreeNAS. And Shannon completely bypasses local Windows logins with a Kernel modifyin’ boot cd? w00t!

Download HD Download MP4 Download XviD Download WMV

Cracking WPA Keys with Cowpatty

A lot has changed since I last talked about WPA Cracking on Hak5. Specifically Joshua Wright, author of CowPatty has released a new version that dramatically changes the way one thinks about cracking WPA and WPA2 TKIP keys.

The most notable new feature in Cowpatty 4.5 is the “-2″ option, which only requires the first two frames of the 4-way handshake to start attacking.

By removing the need for the third and fourth frames of the handshake, an attacker is now more likely to successfully crack WPA keys when channel hopping. Furthermore, the lack of the third and fourth frame opens up a world of possabilities when it comes to trapping targets with rogue access points, or “honey pots”.

An example scenario illustrated on Wright’s blog details how an attacker may pose as a victim’s corporate wireless access point. Since it doesn’t matter if the target associates with the honey pot, anything from hostap to a spare WPA supporting access point with a bogus key will due.

Of course this has our friend Robin Wood pondering a Jasager plugin. Pineapples anyone?

As for carrying out the attack it’s pretty straight forward. I BackTrack as my hacking OS of choice coupled with an eee PC or Acer Aspire One. When it comes to Wireless I’m a big fan of the ALFA AWUS036H 500mW USB Wireless Adapter.

Other tools needed to carry out the attack include WPA tables like these SSID specific Cowpatty WPA Tables from Offensive Security and the Aircrack-ng suite.

The commands are pretty straight forward and well highlighted in the episode. There are a number of ways to go about this so if you’ve got another method you’d like to share with me, questions about this, or suggestions for future topics drop me a line. darren[at]hak5=dot=org.

Excerpt Darren Kitchen’s blog

ESXi & iSCSI

So the series I’ve been doing on ESXi has been getting nothing but great feedback, and I’m glad that I can share what I’ve learned over the course of the last couple years with everyone.

On episode 518 of Hak5, we show how truly easy it is to add iSCSI storage to a free deployment of ESXi.

So what is iSCSI?

In computing, iSCSI (pronounced /??s’k?zi/), is an abbreviation of Internet Small Computer System Interface, an Internet Protocol (IP)-based storage networking standard for linking data storage facilities. By carrying SCSI commands over IP networks, iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. iSCSI can be used to transmit data over local area networks (LANs), wide area networks (WANs), or the Internet and can enable location-independent data storage and retrieval. The protocol allows clients (called initiators) to send SCSI commands (CDBs) to SCSI storage devices (targets) on remote servers. It is a popular storage area network (SAN) protocol, allowing organizations to consolidate storage into data center storage arrays while providing hosts (such as database and web servers) with the illusion of locally-attached disks. Unlike traditional Fibre Channel, which requires special-purpose cabling, iSCSI can be run over long distances using existing network infrastructure.

In simpler terms, using some free software, it’s stupid easy to create a large amount of storage which is not tied to the physical adapter of the host server (in this case, the server ESXi is running on).

So what do we need?

Functioning ESXi Installation
Server capable of running FreeNAS
Gigabit connectivity between ESXi server and FreeNAS

Now let’s get started. While it’s recommended to separate your iSCSI traffic from your other internet networking, for the purpose of this instruction, we’re just going to use the same IP subnet for all of our LAN and iSCSI traffic.

Our ESXi server sits at 10.10.1.55 and our newly installed FreeNAS server is located at 10.10.1.66

Connect to your FreeNAS server through the WebGUI using your favorite browser. In the top menu select Disks, then click Management.
Click on the plus sign in the lower right corner to add drives.
Next to Disk, choose the drive you want to add from the drop down, and if you want enter a description for it next to Description.
When you go back to the Disk Management screen you will be asked to confirm the addition by clicking on Apply changes, go ahead and do that now.
From the top menu choose Services, then iSCSI Target.
Click on the plus sign in the Extent area.
The Bolded fields are required, so place a name in the Extent name field, leave the Type as Device, and then choose the Device you want in the dropdown.
When you get back to the iSCSI Target page click on Apply changes.
Click on the plus sign in the Target area.
As before the Bolded fields are required. Here is a breakdown of the fields:
Target name: Add your own or leave the default

Flags: RW for Read/Write or RO for Read Only

Storage: Will have the extents listed that were setup, choose the one you want to use

Authorized Network: Enter the IP network that can access this drive. For us we’re going to enter 10.10.1.0 and we’ll leave the /24 as our subnet is 255.255.255.0

Once you fill in all the info click on Add.
Back at the iSCSI target page you need to click on Apply changes once again.
Now place a check in the box next to Enable in the top right corner and then click Save and Restart in the bottom left.
The iSCSI Target drive is now setup and ready for use.

Now we need to setup ESXi to connect to our newly created iSCSI target.

Start by logging into your your host by using the Vitrual Infrastructure Client.

Click on your host, and then click the configuration tab.

Click Storage adapters, and then select your VMHBA32 iSCSI storage adapter.

Click properties and configure, then check the enabled box.

Goto the dynamic discovery tab, and add your FreeNAS IP address (in this case, 10.10.1.66)

Click ok, then close, and then rescan the HBA.

At this point you should see your storage, now we need to format the new storage.

So click back to the storage option on the left.

Then click Add Storage.

Select Disk / Lun, and click next.

Select your new disk on the FreeNAS iSCSI target, and next, next, finish.

DONE!

Questions? Post em in the comments!

Excerpt Matt Lestock’s blog

Bypass Windows Local Logins

Kon-Boot

Kon-Boot is an prototype piece of software which allows to change contents of a linux kernel (and now Windows kernel also!!!) on the fly (while booting). In the current compilation state it allows to log into a linux system as ‘root’ user without typing the correct password or to elevate privileges from current user to root. For Windows systems it allows to enter any password protected profile without any knowledge of the password. It was acctually started as silly project of mine, which was born from my never-ending memory problems Secondly it was mainly created for Ubuntu, later i have made few add-ons to cover some other linux distributions. Finally, please consider this is my first linux project so far Entire Kon-Boot was written in pure x86 assembly, using old grandpa-geezer TASM 4.0.

So basically, Kon-Boot enables you to log into any Windows or Linux password protected computer without knowing the password or anything about it.

The tech behind it? Kon-Boot basically latches onto parts of the memory and starts patching parts of the kernel (the Brain!), mainly the parts that have to do with the log-on auth and security. These patches let you logon without a password. Then, the bootkit does it so quickly that it leaves no footprints behind after you leave.

DUDE!

To do this:

Go to the website above and download Kon-Boot, open the zip file, and burn the .iso to a disc. I use ImgBurner because it is fast, easy, and FREE.

Shut down the computer you intend to get on to. When booting up, if it isn’t already set to boot from CD (or flashdrive, or whatever Kon-Boot is on), go into the BIOS and set it. You should see the Kon-Boot splash screen for a few seconds, then the username/password screen will appear with the main username already set if they have it saved. If not you need to know the username ahead of time. Press enter or type in some random characters (it doesn’t really matter) and press enter. You’re in!

Now party, snoop around, and get that file you wanted. Get your flashdrive or CD out, then shut the computer back off like usual.

Protecting yourself:

Password protect your BIOS!

True Crypt your entire harddrive!

Excerpt Shannon Morse’s blog

Episode 517 – Packet Injection, WPA Attacks, Virtualization

Darren — Wed, 10 Jun 2009 15:35:31 +0000

The gang gathers at a dive in Hoboken, NJ during their trip to NYC for the live diggnation and discuss wireless packet injection with airpwn, advancements in WPA-PSK attacks and of course, virtualization.

Download HD Download MP4 Download XviD Download WMV

In an effort to thwart hangovers the gang drops by DC’s Taven in Hoboken to geek out about Wifi and Virtualization over shots and cold ones.

Darren is excited about the recent improvements to both Airpwn and Cowpatty.

Edit: Mubix points out these awesome WPA Tables from Offensive-Security (You know ‘em as the BackTrack guys).

Best WPA Tables out there for us with CoWPAtty. (And another little + is they posted the password list they used to generate the tables, which is also an AWESOME password list for cracking all kinds of passwords.

Matt answers some viewers questions and encourages more for an upcoming special.

Shannon has all the deets on this week’s contest and LAN party.