Episode 524 – USB Multipass
Why carry around a dozen bootable USB drives when you could merge ’em all into one? On his episode we buld a USB Multipass complete with customized boot menu ready to launch any of favorite tools–including Backtrack, Ophcrack, Kon-boot, dban, freedos, and more. Plus Shannon reviews the Trinity Rescue Kit, the boot disc dubbed CPR for your computer.
It has been the dream of many to combine the pen-testing, forensics and recovery power of our favorite USB bootable linux distros into one drive complete with customized boot menu. Finally Frank Castle shares this digital mojo with us. I bring you the USB Muiltipass.
While the video walks you through the step by step I’ll provide an overview with links here.
Prepare the USB drive by formatting it with PeToUSB. With the drive plugged in run the PeToUSB executable, select the drive, check Enable Disk Format, Quick Format and Force Volume Dismount and click Start. If you are using a drive over 2 GB you will receive an error about dismounting — it’s no big deal — simply format the drive as Fat32 with the Windows Disk Manager.
Next run grubinst_gui. Select the disk option and pick your USB drive. Be sure to select the correct drive number. If you’re not sure which drive is your USB drive check with Windows Disk Manager. Once you are assured the correct drive is selected go ahead and click Install. No options need to be checked, the defaults are fine.
You will then need to copy the grldr file from the grub4dos package to the root of your USB drive. Finally finish off the install by creating a blank text file in the root of your USB drive called “menu.lst”.
You can now boot from this drive. Of course there aren’t any Linux distributions and utilities installed yet, so let’s move on to adding all the goodies.
When it comes to installing distros I’ll go ahead and quote Frank Castle as he puts it best.
For most of the distros I added, I started off with an iso version of it. I then extracted the isos either to my desktop or directly to the root of the thumb drive (or you could just copy the files from a burnt version of the distro, just as long as you get the files to the root of your thumb drive). Most Linux Distros come with 2 folders: a boot folder and another folder that actually holds the meat and potatoes of the distro. Since it would be impossile to have 6 or 7 different boot folders that don’t overlap on the same thumb drive (without multiple partitions…a route I tired to take for way too long) I simply renamed the boot folder to something like “bootbt3” or “bootknop” depending on the distro, and just left the other folder as is. I then added the appropriate information by using the information by either:
1) Looking at the information provided in the syslinux or isolinux file in most linux distros
2) Looking at a (now taken down) webpage with tons of examples (appropriatly added to this tutorial under Examples.txt)
3) Trial and Error
Most distros fell under the first of these options: Backtrack 3, Backtrack 4, Knoppix, and Trinity Rescue Kit all worked fine under these conditions
Some distros fell under the examples webpage: these included Ubuntu LiveCD (a different example because there is no boot folder and way more than two folders, but it ended up working without changing any folder names) as well as some others
Few Distros fell into the third option, but the ones that did were a bitch and a half to get working. These included Kon-Boot and OPHcrack.
OPHcrack (the latest version – 2.3.0), a tool I have known, loved, and depended on (at least until I met Kon-boot…thank you) was a apparently different than any of the other distros because just copying the files from the iso… blah blah blah didn’t work. It turns out that you have to burn the Distro to a spare thumb drive using tazusb (Slitaz installer) from http://www.objectif-securite.ch/slitaz/tazusb.exe. You then copy these files to the root of your thumb drive and so on and so on. The second challenge was to get both versions of OPHcrack (XP and Vista) on the drive, since ALL of the files overlapped. It turns out that the only difference in the two verisons were the tables provided so I just copied the tables from one cd to the other and proceeded forward as usual.
Kon-Boot was yet another bitch of a thing to get running via USB. No matter what I did it would boot, load, and promptly go back to the Grub bootloader. After a few hours of trial and error, I discovered I had to tell GRUB to tell the BIOS that the hard drive was the first boot device, even though it was obviously the thumb drive, because Windows apparently won’t run at all if it isn’t the first boot device. This reqiured a few extra lines. Also, for some reason the .iso file wouldn’t work (I could never extract or even see the raw files of Kon-Boot), so i was forced to use the Floppy image (.img)
When it comes to customizing Grub its simply a matter of creating a 640×480 – 14 color splash screen image. This is easy to accomplish with the Gimp. Once you’ve created a 640×480 image you can crunch the colors be selecting Image, Mode, Indexed and entering 14 ad the maximum colors. Save this file as a XMP, then gzip it. Copy the gz to the root of your USB drive and prepend “splashimage /image.xpm.gz” to your menu.lst file.
Further information on customizing the grub menu.lst file for your specific distros can be found in the grub manual. As an example I’ll provide my config here:
splashimage /jozette.xpm.gz color blue/black yellow/blue timeout 120 title BackTrack 4 BETA root (hd0,0) kernel /bootbt4/vmlinuz vga=0x317 ramdisk_size=6666 root=/dev/ram0 rw quiet initrd=/bootbt4/initrd.gz boot title Kon-Boot-test map --mem /FD0-konboot-v1.1-2in1.img (fd0) map --hook chainloader (fd0)+1 map (hd1) (hd0) map --hook rootnoverify (fd0) title Memtest86 kernel /memdisk initrd /memtestp.img title ntpasswd kernel /ntpasswd/vmlinuz rw vga=1 initrd=/ntpasswd/initrd.cgz /ntpasswd/scsi.cgz initrd /ntpasswd/initrd.cgz title DBAN kernel /memdisk initrd /dban.img title SystemRescueCD kernel /rescuecd initrd=initram.igz video=ofonly vga=0 scandelay=5 initrd /initram.igz title FreeDOS root (hd0,2) kernel /memdisk initrd /freedos.img floppy title Ophcrack kernel /bootoph/bzImage rw root=/dev/null vga=normal lang=C kmap=us screen=1024x768x16 autologin initrd /bootoph/rootfs.gz
I’m sure there will be many questions and further development of this project so as I’ll go ahead and point you the episode 524 release thread on the Hak5 forums. Share your thoughts!