MAC ADDRESS SPOOFING :: WINDOWS && LINUX

In the noon time i was chatting with one of my friend while he was at an airport in Paris, during the chat he mentioned that he paid some bucks to access wifi for half an hour.
Well that lead to a spark in my brain. On some basic quick thinking it reminded me about the same situation that i faced while travelling too,
but in my scenario, i only faced two types of policies used by admins at airport that restricted wifi access.

1-- MAC ADDRESS CROSS CHECK.
2-- SUPPLYING USER WITH A TEMP KEY THAT EXPIRES IN A TIME PRE-DEFINED TIME PERIOD.

On collecting info from him it showed that they are surely using the first case.
That just reminded me of something similar i went through while helping a friend in china,
basically there university was using a a client software, that assigns ip address by checking mac add.

so access to other systems except the university registered laptop/pc was restricted, so we used the similar trick for of spoofing the mac address n voila it worked.
so just for explaining that part created to vidz of tools n there how tos for spoofing it on both win and a Linux system.

tools used are :: win : macshift :  link
Linux : macchanger :: link

## on any debian based distro like ubuntu just
## apt-get install macchanger
##if you guys using backtrack or any other security distro i should probably be there in it.


So here are the videos to get you start up fast and easy.





mac address spoofing Linux

mac address spoofing Windows

Thanks for reading.
For any queries or suggestions plz comment below.
Yinsain.

EFFECTS OF MONDAY MALWARE EXPLAINED.

Hey guys this is yash aka yinsain here,if you are reading this then you are surely not infected with it. I was getting a bit curious about all this news i was getting from my friend about a new malware hitting the web, well as i looked into it, it looks nothing new, just the old skool technique to redirect victims to a malicious server for there own good.

Methods are still the same but the techniques to achieve that has really evolved from years till now. As this name is a bit eye catchy you might be interested but do you really know what it is and what will it do.

Lets start with the name, Monday malware was given to it because it will knock you off the internet on monday that is today 9/7/2012 as most of the agencies are saying.

Well its actual name is still not defined but people have given its so many names, and some are from gov agencies also to classify it.

Other name is 'Alureon/DNS Changer bot'.

So lets dig into its working, as i dont hold a working executable or its source code. So i will be demonstrating the effect of this malware in a controlled enviroment via some network tools.

To understand the basic working of this malware you should be aware of some of the working principles of internet. The one we are focusing on in this blog post is DNS. For a basic explanation, this is the service which manages the juggling of ip addresses and the host names, wrong info of ipaddress will lead you to a wrong page, that is what that malware do but in a stealthy manner, most probably redirecting the victim to thr own server for malicious purposes. for further details you can read this.


Here i am using a virtual machine to depict a victim and using a linux(ubuntu) host machine to create an infected scenario.
Tools :: dsniff-suite, Virtualbox.


Setup ::

Getting the softwares,
------------------------------------------------------------------------------------------------------------------------------------

apt-get install dsniff

for virtualbox

either download a installer file for your o.s. or follow the linux way.

-------------------------------------------------------------------------------------------------------------------------------------



This suite consists of many great tools, the ones we will be using are

>> arpspoof
>> dnsspoof

NOTE :: arpspoof requires packet forwarding on the host system.


So first we need to enable packet forwarding on your linux host.



-------------------------------------------------------------------------------------------------------------------------------------

# echo 1 > /proc/sys/net/ipv4/ip_forward

please note you will require root priviledges to do this.
-------------------------------------------------------------------------------------------------------------------------------------

And now for the dnsspoof, this tool reads out the domains from a file which we can provide.


edit it the way you feel, just maintain the structure it recognizes.


here is mine.

so we are ready..

i have just added three entries for the common sites that people open.
>> paypal
>> facebook
>> google

So the setup for the tool is ready,

 Now you need a victim, here in our example we are using a virtual victim
so you can google it to get a detailed instruction to get a virtual machine all set with o.s. of your choice for this.

Our victim here is windows xp user.

NOTE :: THIS DEMO WORKS ON ALL THE O.Ss INCLUDING WINDOWS, MAC OS AND LINUX. BUT THE REAL MALWARE WAS REPORTED TO JUST WORK ON WINDOWS  AND MAC OS TILL NOW. LINUX STILL SURVIVES HUH.


So lest fire up our virtual machine.

lets open up our websites....

as you can see, all the three seems to opening fine..

and even the dns_cache is fine.

So lets start the attack to create an infected scenario....


I will try to keep it least complicated so open up three different instances of terminal.

and issue these commands.

-------------------------------------------------------------------------------------------------------------------------------------

I terminal

# arpspoof -i eth0 -t 192.168.1.16 192.168.1.14
                                 victim ^          gateway^

II terminal

# arpspoof -i eth0 -t 192.168.1.14 192.168.1.16
                                            gateway^       victim^

-i [ interface name ]
-t specify targets

and start them


III terminal

#dnsspoof -i eth0 -f int.txt  host 192.168.1.16 and udp port 53
                                ^file with host names we created earlier

-------------------------------------------------------------------------------------------------------------------------------------

so this is how it may look

So lets open up a browser on the victim machine,,

here i am opening facebook..

As you can see the url was valid, but due to the infected victim machine,
 request got redirected to the host mentioned in the spoof file for dnsspoof.

Be careful while logging in any of your accounts or buying any stuff online, if you are infected you may endup in a bad situation.

This is how a dns spoofing can occur, this is extremely dangerous for day to day users, as they may get redirected to fake pages and innocently give up their login credentials without any suspicion.

PREVENTIVE MEASURES::

>> do get your system cleaned by a valid tool like avira dnschanger bot remover if your windows or mac is infected.

>> contact your isp to get a valid list of dns servers' ipaddresses which are owned by the isps.

Again thanks for reading.
plz leave comments or message me for any query.

Setting up metasploit framework on any linux the easy way !!

In this post i will be guiding you through an easy method of setting up your exploitation framework and this tool is nothing else than the superior metasploit framework..

GUYS THIS TUTORIAL IS FOR LINUX OS, IF YOU WANT THE SAME FOR WINDOWS COMMENT, MESSAGE ME.

So lets start out,

tools required :: a linux os

its upto you which one you prefer, im using arch linux but you can use ubuntu. Its a newbie-friendly distro as compared to arch.
www.ubunut.com

Assuming that your os in installed, doesnt matter on disk or virtually and updated (if not do it, and if you dont kno how, check below).

This whole framework is dependent on ruby language,
so first of all we require to resolve the required dependencies.
------------------------------------------------------------------------------------------------------------------------------

apt-get update && apt-get upgrade
//this will do the update part

now the dependencies

$ sudo apt-get install ruby libopenssl-ruby libyaml-ruby libdl-ruby libiconv-ruby libreadline-ruby irb ri rubygems

this will install the necessay packages
-------------------------------------------------------------------------------------------------------------------------------


Now the method we will using to fetch metasploit for our system is using subversion.
to kno more about it.
http://subversion.apache.org/

So install this also


-----------------------------------------------------------------------------------------------------------------------------------
$ apt-get install subversion
-----------------------------------------------------------------------------------------------------------------------------------

And now some other deps also to build native extensions

------------------------------------------------------------------------------------------------------------------------------------
$ sudo apt-get install build-essential ruby-dev libpcap-dev
------------------------------------------------------------------------------------------------------------------------------------

Now the minor things are done now comes the important part

Subversion is a version control system, basically what it does is it synchorises your local folder with the remote folder being used as a developement base

The remote url we will be :: https://www.metasploit.com/svn/framework3/trunk/

this is from where subversion will fetch all the files

So first to check your subversion setup issue this command

-----------------------------------------------------------------------------------------------------------------------------------
$ svn ls https://www.metasploit.com/svn/framework3/trunk/

svn >> acronym for subversion this is used for commands
-----------------------------------------------------------------------------------------------------------------------------------

something like this should be visible, it will list down the remote folders and files

If you get something similar that means you are ready to go.

now, do
------------------------------------------------------------------------------------------------------------------------------------
$ svn checkout https://www.metasploit.com/svn/framework3/trunk/ msf
or
$ svn co https://www.metasploit.com/svn/framework3/trunk/ msf

both are same, co is for checkout same as svn for the whole
--------------------------------------------------------------------------------------------------------------------------------------
This will create a folder named msf with all the files in your current directory.

This a big download and takes few seconds to initiate so wait for it,

soon it will start and your screen will be filled with data transfer details

So now you are back with all the downloaded files.

if you now issue ls command you will surely
see all the files

This is it this your framework succesfully installed.

 UPDATE

Now to update it this command can be used, for that you have to come to this directory everytime, as subversion checks the current directory to recognize the point of last update

------------------------------------------------------------------------------------------------------------------------------------
$ svn update
------------------------------------------------------------------------------------------------------------------------------------
//As you have just installed it you wont be requiring any update but i would recommend you keep updating it in a day or two for latest exploits, me myself usually do it everyday, you can automate this also with crontab.

After each update there is a revision no. left to keep track like this

Now you can test your main tool, in this all of these msf* tools are extremely useful and if used in a combined manner can render a desired exploitation.



issue this command
------------------------------------------------------------------------------------------------------------------------------------
$ ./msfconsole
------------------------------------------------------------------------------------------------------------------------------------
if it loads up without any errors with ruby interpreter then you are good to go and it should look like this, and you will be welcomed with a msf> prompt

EXTENSIONS

Now comes the part for installing extensions, not a priority but it is required to enable raw sockets and wifi modules.


Raw sockets,
go to your dir where you installed msf and then into external and then

----------------------------------------------------------------------------------------------------------------------------------
$ cd /opt/metasploit3/msf3/external/pcaprub/

$ ruby extconf.rb
$ make && make install

----------------------------------------------------------------------------------------------------------------------------------

Wifi modules

-----------------------------------------------------------------------------------------------------------------------------------

# cd  /opt/metasploit3/msf3/external/ruby-lorcon2/
# svn co http://802.11ninja.net/svn/lorcon/trunk lorcon2
# cd lorcon2
# ./configure --prefix=/usr && make && make install
# cd ..
# ruby extconf.rb
# make && make install

-------------------------------------------------------------------------------------------------------------------------------------

And we are done so go on test out your new framework.

Thanks for reading and plz comment for any help

B-)

Setting up your android tools ;]

Guys im again informing you this is not a tutorial for development, only things covered in this post will be about setting up your android tools.
Further posts may even dig deeper in android forensics.

So for even starting up with your setup you should first decide about your platform. I would recommend mac or a linux box, and this tutorial is also following the same. But windows guys dont feel bad, comment below and i will respond with solutions and help.

So guys if you are familiar with Linux then its a plus point, if you dont then also its not a major issue, you can catch up any time you want. Download any iso of a Linux distribution of your preference. I would recommend Ubuntu, its a bit rookie friendly.
heres the link download
These distros are available in livecd format but you will require a system with installation done because you want your changes to be persistent.

Daring new guys can surely install it on a system, but if you are scared of blowing of your close-to-your-heart windows installation then virtualization solutions are always present.

You can try out virtual-box or vmware-player both are excellent.

I wont be guiding for with a linux installation, so google it.

So, lets assume now you have a working linux distribution on a disk or virtually, or maybe you are on the classier side and giving a smirk with a mac.
But mac guys take care and check out the documentation because im not helping.

linux guys now fire up your terminal.
If you are on an older version of ubuntu say before 11.04, then you probably on gnome2 enviroment so go to applications under accesories  or system tools there will be terminal, on a newer distro, guys just hit your windows key and type in terminal it will be there.


so you have your terminal opened up.

now lets resolve the dependencies required to run our sdk.

----------------------------------------------------------------------------------------------------

apt-get install default-jre

&& and if you are on a 64 bit machine like me then also

apt-get install ia32-libs

------------------------------------------------------------------------

Now we require our sdk
you can get it from

http://developer.android.com/sdk/index.html

As we are working on linux so fetch the required tar file and place it in a
folder of your choice.

Usually additional installation are done under /opt directory but you can feel free to put it anywhere, for the rest of the post i wil be keeping it in /opt.

gain the required priviledges for that folder and continue to extract it.

for newbies please just right click and follow it.
for guys who are comfortable and wanna learn do this
----------------------------------------------------------------------------------------------------------------
reach your directory and

do

tar zxvf android-sdk_r18-linux.tgz

the no. after r may vary for you depending on when are you viewing this
-----------------------------------------------------------------------------------------------------------------

now cd into the directory issue ls command

now some of the sub-directories are visible.
first and the most important utility require is adb, but unfortunately, it has been shifted to platforms folder that means we have to download it.
For that go into tools directory and enter ./android.

Another screen will pop up showing a gui like this select Android platform tools and then click on install package.

let it download the required package.

After its done, go back to upper directory and then into platform-tools and issue ls command.

So here we are, our two of the most important tools that we require are here.
adb and fastboot.

Now you can issue command ./adb devices but no devices will be shown if not

connected in debugging mode,

here is how you can put your android in debugging mode go to settings/application/development and then select Android debugging.

so now your device is ready,
now try again, it should show it now.,

now you can issue ./adb shell command too, as tis the only device connected it will drop down its shell only,
now its upto you how you explore into.

and we have the android shell..


Plz do follow the post nxt post regarding android will go into forensics of its filesystem.

Thanks for reading
B-)