Category:

Kali Linux

Kali Linux is a Debian-derived Linux distribution designed for digital forensics and penetration testing. It is maintained and funded by Offensive Security Ltd. It was developed by Mati Aharoni and Devon Kearns of Offensive Security through the rewriting BackTrack, their previous forensics Linux distribution

How to

Browse anonymously in Kali Linux with Anonsurf

by blackMORE October 17, 2016

written by blackMORE

anonsurf allows you push your whole system via TOR network. It’s very easy to configure and possibly less hassle than setting up a VPN. Of course you will have slower connection speed than VPN as you are using TOR network.

Anonsurf works in the background (you can close the terminal), and changes automatically every few IP.

Step 1: Download Anonsurf

First download the package and extract it (if you put the folder /home is more comfortable):
Download: https://github.com/parrotsec/anonsurf

Step 2: Install TOR

Now, you have to install TOR on Linux, from a terminal enter the command:

apt-get install tor

Step 3: Edit torrc

Change to the directory /etc/tor/, edit the file torrc, adding the following lines:

VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 53

Now you’re all set. launch “anonsurf.sh”.

Step 4: Start anonsurf

To start anonsurf, and pass all under TOR, give the following command:

./anonsurf.sh start

To stop, just give the command:

./anonsurf.sh stop

We thank the author of the tool “Anonsurf” >> EclipseSpark <<

October 17, 2016 16 comments

Database

Run Kali Linux in Microsoft Azure on SSD for free

by blackMORE September 14, 2016

written by blackMORE

Big news for Kali Linux users, now you can run Kali Linux in Microsoft Azure cloud and that’s on super fast SSD! It seems Microsoft Azure Marketplace is adding more and more Linux distro including FreeBSD images in their repo. Just to make things better, you can technically run it freely for 1 month if you are willing to cough up your credit card details. Yeah, I know what you are thinking, but this is probably for the White Hats… I’ve added those details at the end of this post.

Kali Linux and Offensive Security team has been working on building and implementing Kali 2016.2 in the Azure Marketplace for some time and it seems they have finally done it. Also, as much we say those nasty things about Microsoft, it seems they are more than willing to accommodate Linux users requirements than some other Operating systems. Case in point: Bash shell integration with Windows 10.

Either way, you can now spin up a Kali machine from the Azure Marketplace and it takes a few seconds for it to be deployed and you can have a full penetration testing toolset at your fingertips for no additional cost (other than the standard Azure pricing). In fact as I said, if you are a new Azure customer, you can create a free account (or integrate your Hotmail/live account) with it and receive $200 credit.

I however recommend reading through Azure Testing Request for T&C before you do something they might not like!

@KaliLinux team announced it via Twitter and their website today. Microsoft Azure also updated their website with this announcement.

Kali in the Azure marketplace, weekly ISO builds and more – https://t.co/jJyVdCFJuk

— Kali Linux (@kalilinux) September 13, 2016

Microsoft Azure actually added some nice description and details regarding Kali Linux.

Kali Linux is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools aimed at various information security tasks, such as Penetration Testing, Forensics and Reverse Engineering. Kali Linux is developed, funded and maintained by Offensive Security, a leading information security training company.

Installation defaults

Azure Kali doesn’t allow you to login as root straightaway, so you need to create a standard user (which got sudo access), deploy the VM and then set root password. SSH service runs on standard port 22 but you can use SSH Public Key instead.

Kali Linux 2016.2-x64 xfce
Credentials: User generated and root password is not set.
Services: SSH
Ports: 22

Basic configuration

Microsoft Azure added some basic configuration details (I believe these info were provided by @KaliLinux team). Two things that are important, creating new ssh keys (to avoid the system generated ones) and setting PasswordAuthentication to NO in sshd_config.

SSH into your deployed machine with the user account you created during setup.
Set a root password: sudo passwd root
Create SSH keys: ssh-keygen -t rsa
Set PasswordAuthentication to no in the SSH configuration: /etc/ssh/sshd_config
Restart the SSH Server: systemctl restart ssh

Azure and Kali Linux legal terms

When you finally click on the Create button you will be agreeing to the following ToS/T&C:

By clicking the Create button, I acknowledge that I am getting this software from Kali Linux and that the legal terms of Kali Linux apply to it. Microsoft does not provide rights for third-party software. Also see the privacy statement from Kali Linux.

Depending on what you plan to use Kali for in the cloud, I would say, review these carefully if you are going to invest on cloud penetration environment.

Free Azure Trial

Microsoft Azure offers a one-month free trial for any new customer and provide credits of $200 of Azure at no charge.

When you sign up, you will receive $200 Azure credits. The choice is now yours on how you use your Azure credits. Use them on any Azure service based on your needs including, Virtual Machines, Websites, Cloud Services, Mobile Services, Storage, SQL Database, Content Delivery Network, HDInsight, Media Services, and many more.

Azure requires a credit card or debit card to authenticate you when you sign up, so this might not be viable option for everyone, but like I said, Azure’s Kali is for White Hats, but either way; I am sure it will open up a whole new business opportunity for pentesters as now you can spin up thousands of Kali installation in few seconds to do some serious pentesting. What’s more? I think as this is an Azure offering, you can simply call Microsoft and ask for support:

“Hello, I can’t hack into my own server, can you help?”

Won’t that be fun!

September 14, 2016 7 comments

Building an updated Kali Linux ISO - blackMORE Ops -4

AMD

Building updated Kali Linux ISO

by blackMORE August 9, 2016

written by blackMORE

Are you tired of downloading Kali Packages every-time you re-install? Kali Linux 2016.1? I know I am. The 2.6G ISO file was released back in January 2016 and since then it hasn’t been updated. This is an easy and quick way for building updated Kali Linux ISO for Kali 2016.2 and escape downloading same packages over and over and over again.

Ohh, yes, in case you missed it, Kali Linux 2016.2 has been in the wild since 2016-07-21, there just wasn’t any official announcement as it seems like an internal build-name/code. This also means, if you were like me who tries way too much and breaks system and keeps re-installing it, you are constantly doing the same apt-get update, upgrade and dist-upgrade to update you old Kali Linux 2016.1 to 2016.2. Here is the version info for Kali 2016.1

root@kali:~# cat /proc/version 
Linux version 4.3.0-kali1-amd64 (debian-kernel@lists.debian.org) (gcc version 5.3.1 20160101 (Debian 5.3.1-5) ) #1 SMP Debian 4.3.3-5kali4 (2016-01-13)
root@kali:~#

and here’s is the version info for Kali 2016.2

root@kali:~# cat /proc/version 
Linux version 4.6.0-kali1-amd64 (devel@kali.org) (gcc version 5.4.0 20160609 (Debian 5.4.0-6) ) #1 SMP Debian 4.6.4-1kali1 (2016-07-21)
root@kali:~#

So, Kernel is updated from 4.3.0 to 4.6.0 and build/release date is changed from (2016-01-13) to (2016-07-21). That’s 6 months worth of updates or i.e. 2 GB of download and no I am not even worried about the download. Personally, I am concerned about the time and effort. This post will also help those with slower Internet and/or download cap limited users. You do this once, keep that ISO and the only packages you will need it from that day ono. Sounds fair? I bet it does. Lets do it!

Building an updated Kali ISO is actually very easy and if you read Kali documentations, you probably do it already. If not, here’s some dot points to convince you:

This process creates an ISO with the latest packages, so you don’t need to download any (or too many) in coming weeks.
You can configure various desktop environments (such as KDE, Gnome, E17, I3WM, LXDE, MATE and XFCE) and create multiple ISO’s. Same deal for these ISO’s. They will have the latest and greatest packages already in.
You can control meta-packages in your build and only download the packages you need to build your custom ISO. This fits perfectly for those who work in minimal environment or works using a particular application. Also less download, smaller ISO.
You do use live-build hook scripts in various stages of the Kali ISO live build.
You can include additional files or scripts in your build and create ISO with it. This helps when you are building it for a particular organization.

You can configure virtually any aspect of your Kali ISO build using the Debian live-build scripts. These scripts allow developers to easily build live system images by providing a framework that uses a configuration set to automate and customize all aspects of building the image. The Kali Linux development team has adopted these scripts and they’re used to produce the official Kali ISO releases.

Requirements

Ensure that your system meets the following requirements to avoid issues:

About 20G free disk space.
A decent Internet connection.
Existing Kali environment.

Disk space seems to be the most important of all. This total process used about 17G space (I assume the system will use some swap for slower systems). You need the disk-space as this process will download all the packages, uncompress those and then create an ISO. I had around 55GB dedicated on my Samsung 850 EVO – 500GB SSD drive for Kali, so had absolutely no issues.

Getting Ready — Setting up the live-build system

We first need to prepare the Kali ISO build environment by installing and setting up live-build and its requirements with the following commands:

root@kali:~#  apt-get install curl git live-build cdebootstrap

root@kali:~#  git clone git://git.kali.org/live-build-config.git

Now you can simply build an updated Kali ISO by entering the live-build-config directory and running our build.sh wrapper script, as follows:

root@kali:~# cd live-build-config

root@kali:~/live-build-config# ./build.sh --distribution kali-rolling --verbose

The build.sh script will take a while to complete, as it downloads all of the required packages needed to create your ISO. Good time for a coffee. Yeah nah, go away for a about an hour or two.

and the final result?

root@kali:~/live-build-config# ls -ltrah images/
total 2.8G
-rw-r--r--  1 root root 2.8G Aug  4 23:18 kali-linux-rolling-amd64.iso
-rw-r--r--  1 root root 1.2M Aug  4 23:19 kali-linux-rolling-amd64.log
drwxr-xr-x 12 root root 4.0K Aug  4 23:19 ..
drwxr-xr-x  2 root root 4.0K Aug  4 23:19 .
root@kali:~/live-build-config#

a 2.8G Kali Linux rolling ISO for 64-bit systems. Nice!!!

Building a Kali Linux ISO for Older i386 Architectures

The Kali Linux i386 ISO has PAE enabled. If you require a default kernel for older hardware with PAE disabled, you will need to rebuild a Kali Linux ISO. The rebuilding process is much the same as described above, except that the 686-pae parameter that needs to be changed to 586 in auto/config as follows. First, install the prerequisites.

apt-get install git live-build cdebootstrap debootstrap
git clone git://git.kali.org/live-build-config.git

Next, make the change in auto/config for the appropriate architecture:

cd live-build-config
sed -i 's/686-pae/586/g' auto/config

Finally, run your build.

./build.sh --distribution kali-rolling --arch i386

Conclusion

I think this is a great idea. It really helps if you have a custom wifi card or hardware that requires more packages (i.e. kernel-headers and drivers etc.). You can simply bundle those in your pre-defined build and create an ISO that will just WORK without any hassle.

Thanks for reading. If you’ve found this article helpful, do bookmark and share it. Any issues, let us know via comments section. As usual, commenting doesn’t require any registration and will always remain open.

Source:

August 9, 2016 10 comments

Hacking

Hacking QNX systems over QCONN

by blackMORE June 2, 2016

written by blackMORE

This is a simple user submitted guide on Hacking QNX systems over QCONN port(8000). In case you are wondering what is a QNX system, QNX is a mobile operating system that was originally developed for embedded systems. The operating system’s developer, QNX Software Systems, was acquired by Research in Motion (RIM) and the OS adapted for use in the BlackBerry Playbook tablet. At the Geneva Motor Show, Apple demonstrated CarPlay which provides an iOS-like user interface to head units in compatible vehicles. Once configured by the automaker, QNX can be programmed to handoff its display and certain functionality to an Apple Carplay device.On December 11, 2014, Ford Motor Company stated the company would be replacing Microsoft Auto with QNX.

I guess that is enough intro. Let’s get into the real interesting part.

Requirements:

QNX system 650SP1 target ISO, running on VMware or Virtual Box.
Qconn daemon running on the system
Kali Linux (or any other having netcat)

Qconn – It’s a daemon which provides visibility for looking at File System and System Processes and a lot more, via the QNX Momentics IDE.

QNX-Momentics-Target-Process-Navigator QNX-Momentics-Target-Fike-System-Navigator

The above two are snapshots of what the QNX Momentics IDE shows.

Hacking QNX systems over QCONN

The thing with QNX Momentics IDE is that it does not require password to authenticate incoming qconn request. This is a fundamental flaw which QNX Systems should look at.

In our case, we will take advantage of this flaw of Qconn, to obtain root privilege shell on attack machine, using the below simple steps. We will use everybody’s favorite “netcat” utility to gain access or communicate. Run the following commands shown in the screenshot:

QNX-Pwing-Sequence-Over-Qconn-and-Netcat

and you in as a privileged user. This is very straightforward and does not require any complex buffer overflows or code vulnerabilities/exploits. It’s just the way QNX system is and is a pretty big flaw. However, in production level systems “QCONN” is generally not enabled or blocked.

As per my research I could not find a single open Qconn port(8000) on shodan.io for any device in the world, probably some smart hacker can figure that out as well.

Troubleshoot

In some cases, you will need to change the location of the shell i.e instead of “/bin/sh” the shell on the system could be located at “/usr/bin/sh” or /bin/ksh” or “/sbin/sh”, make necessary changes to the command on “nc” input line.
Remember do not press enter, before the command is finished. Also, if you get the shell location wrong or press enter before EOC, then you may have to restart.
Better way write a python script to automate.

References and further reading (existing ones)

https://www.exploit-db.com/exploits/21520/ ( I found it the other way to do it)
https://www.optiv.com/blog/pentesting-qnx-neutrino-rtos
http://illmatics.com/Remote%20Car%20Hacking.pdf

Where this can be used?

University Systems for the curious hacker in you
Front End Industrial systems(This should not work here, if it does, you found a gold mine)
Routers etc.

As stated earlier, this is a user submitted post. Please visit Original article link submitted by Abhijit:

https://abhijitlamsogeblog.wordpress.com/2016/05/04/pwninghacking-qnx-systems-over-qconn/

[toggle title=”User submission Notes: by Abhijit” state=”close”]
Hi Blackmoreops,
Your site has always been a great reference point for me, so I thought I would contribute some to it.
This is an article I wrote on how to hack QNX systems’ QCONN port for fun.
It is a simple article just for fun, which if you like can put up on your website.

Thanks

Abhijit

Disclaimer:- Submitter or BMO is not responsible for anybody using this hack in illegal ways*.

[/toggle]

June 2, 2016 0 comments

Set up a honeypot in Kali Linux - blackMORE Ops - 12

Browser

Setup honeypot in Kali Linux

by blackMORE May 6, 2016

written by blackMORE

The Pentbox is a safety kit containing various tools for streamlining PenTest conducting a job easily. It is programmed in Ruby and oriented to GNU / Linux, with support for Windows, MacOS and every systems where Ruby is installed. In this small article we will explain how to set up a honeypot in Kali Linux. If you don’t know what is a honeypot, “a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.”

Download Pentbox:

Simply type in the following command in your terminal to download pentbox-1.8.

root@kali:~# wget http://downloads.sourceforge.net/project/pentbox18realised/pentbox-1.8.tar.gz

Uncompress pentbox files

Decompressing the file with the following command:

root@kali:~# tar -zxvf pentbox-1.8.tar.gz

Run pentbox ruby script

Change directory into pentbox folder

root@kali:~# cd pentbox-1.8/

Run pentbox using the following command

root@kali:~# ./pentbox.rb

Setup a honeypot

Use option 2 (Network Tools) and then option 3 (Honeypot).

Finally for first test, choose option 1 (Fast Auto Configuration)

This opens up a honeypot in port 80. Simply open browser and browse to http://192.168.160.128 (where 192.168.160.128 is your IP Address. You should see an Access denied error.

and in the terminal you should see “HONEYPOT ACTIVATED ON PORT 80” followed by “INTRUSION ATTEMPT DETECTED”.

Now, if you do the same steps but this time select Option 2 (Manual Configuration), you should see more extra options

Do the same steps but select port 22 this time (SSH Port). Then do a port forwarding in your home router to forward port external port 22 to this machines’ port 22. Alternatively, set it up in a VPS in your cloud server.

You’d be amazed how many bots out there scanning port SSH continuously. You know what you do then? You try to hack them back for the lulz!

Here’s a video of setting up honeypot if video is your thing:

May 6, 2016 6 comments

Newer Posts

Older Posts