Metasploit presentation for CTF

We had a CTF training at the labs today, where I tried to present a brief introduction to metasploit. I seriously doubt I did the tool any justice, but a colleage has requested a copy of the sides as a PDF document. I have uploaded the slides to http://www.kush.com.fj/resources/metasploit-presentation.pdf. The presentation was mostly a demo using metasploitable. Perhaps in future there may be an opportunity to do a complete walk through of the metasploitable image posted here. I started I started work on a metasploit walkthrough, its still incomplete but its a star. You can find the walk through here http://nkush.blogspot.com/2011/09/metasploitable-walkthrough.html

Installing Metasploit 4.0.0 on Apple Mac OS X 10.6.8

The installation instructions are quite well documented on the Rapid7 documentation site[1]; But in my usual style of duplicating data on the Internet, I have documented my efforts below. The key requirements of Xcode and macports was already addressed on this particular machine :)

Note: It's important to ensure that any anti-virus (AV) software is temporarily disabled and appropriate scanning exceptions added, this is to prevent the AV from quarenteening the exploits and payloads that some with metasploit.

1. sudo bash
2. port selfupdate
3. port install ruby19 +nosuffix
4. echo $PATH # Ensure that /opt/local/bin appears before /usr/bin, else edit ~/.bash_profile file and source it; ". ~/.bash_profile" or "source ~/.bash_profile"
5. port install mysql5-server
6. gem install mysql
7. cd /opt
8. wget http://updates.metasploit.com/data/releases/framework-4.0.0.tar.bz2
9. bunzip2 framework-4.0.0.tar.bz2
10. tar xvf framework-4.0.0.tar
11. cd msf3
12. svn update
13. ln -s /opt/msf3/msf* /opt/local/bin/

References:

1. https://community.rapid7.com/docs/DOC-1037
2. http://www.metasploit.com/download/

WikiCFP

WikiCFP is a useful wiki site that collates CFP.

However am a bit disappointed that it does not automatically track to the following year for the same events, e.g. once a conference is over and the dates for the following year announced, it should link to the following years conference details, instead of manually searching for it.

There is also an iPhone Application called WikiCFP that links to the site. Although functional, the application is not very intuitive, for the relatively high price of the application I was expecting more out of it, e.g. calendar integration, etc.

Runtime on notebooks

Got an Apple MacBook Pro towards the start of the year. Issue was that closing the lid only puts the machine in stand by mode which still consumes power, so I wasn't getting as long a runtime as I would on my old HP nx6120 with a travel battery.

A Google search led me to Todd Huss's[2] page below. This identified the pmset[1] command as being quite useful. I followed the instructions and now have the MacBook hibernating when I close the lid. Since then I have been asked by a number of colleagues about this, so thought I better document it here.

I rebuilt the old HP nx6120 to run Ubuntu 10.04 LTS. Again noticed that I wasn't getting reasonable runtime, instead of the usual 8-10 hrs, I only got around 3-4hrs. A discussion with a colleague led me to Linux Laptop Tools. Again some "Googling" led to the Ubuntu power management[3] which seemed to increase the runtime.

References

1. http://en.wikipedia.org/wiki/Pmset
2. http://gabrito.com/post/hibernate-with-the-macbook-pro
3. https://wiki.ubuntu.com/PowerManagement

securingSCADA.info

The securingSCADA.info site was launched earlier this year, it now boasts the wiki, that is slowly being populated with resource information on penetration testing, security compliance, etc.

It's targeted towards individuals and organisations from academia and industry working in relation to SCADA, smart grid and related security areas. Of course everyone is welcome to sign up and contribute as the site is driven to providing security through collaboration.

The site is located at http://www.securingscada.info

Installing joomscan on Ubuntu 10.04 LTS

OWASP Joomla! Security Scanner that "detects file inclusion, sql injection, command execution vulnerabilities of a target Joomla! web site." However it appears to have been neglected, but is promised to be updated soon.

1. cd /opt
2. sudo apt-get install -y libtest-www-mechanize-perl
3. svn co https://joomscan.svn.sourceforge.net/svnroot/joomscan joomscan
4. cd joomscan
5. chmod 755 trunk/joomscan.pl
6. trunk/joomscan.pl update

Installing Metasploit 4.0.0 on Ubuntu 10.04 LTS

Installing metasploit is quite easy. I have documented the installation instructions that I used below, however its just as simple to follow the more comprehensive instructions from the Rapid7/Metasploit site[1] (https://community.rapid7.com/docs/DOC-1296).

1. sudo apt-get install -y ruby libopenssl-ruby libyaml-ruby libdl-ruby libiconv-ruby libreadline-ruby irb ri rubygems
2. wget http://updates.metasploit.com/data/releases/framework-4.0.0.tar.bz2
3. sudo mkdir /opt/metasploit4
4. sudo bunzip framework-4.0.0.tar.bz2
5. sudo tar xvf framework-4.0.0.tar
6. sudo mv msf3 /opt/metasploit4
7. sudo chown -R root:root /opt/metasploit4/msf3
8. sudo ln -s /opt/metasploit4/msf3/msf* /usr/local/bin
9. cd /opt/metasploit4/msf3
10. sudo svn update
11. sudo crontab -e -u root # Enter "1 * * * * * /usr/bin/svn update  /opt/metasploit4/msf3/ >> /var/log/msf3update.log 2>&1"
12. sudo apt-get install -y mysql-server
13. sudo apt-get install -y rubygems libmysqlclient-dev
14. sudo apt-get install -y ruby-dev
15. sudo gem install mysql

References:

1. https://community.rapid7.com/docs/DOC-1296

Ubuntu apt-get error

When performing an "apt-get update" I got the following error

Reading package lists... Error!

E: Dynamic MMap ran out of room. Please increase the size of APT::Cache-Limit. Current value: 25165824. (man 5 apt.conf)

E: Error occurred while processing xxx

E: Problem with MergeList /var/lib/apt/lists/xxx

W: Unable to munmap

E: The package lists or status file could not be parsed or opened.

Am unsure why this is happening, but suspect it has something to do with the cache size allocated for the repositories. A quick Google search revealed a debian bug1 that helped.

sudo echo 'APT::Cache-Limit "125829120";' > /etc/apt/apt.conf.d/30cache

Seems to have fixed the problem, a quick sudo apt-get update and sudo apt-get upgrade had me happily hacking away again.

References:

1. https://bugs.launchpad.net/debian/+source/apt/+bug/24626

Ramblings...

I cannot speak for other students, but I find feedback and constructive criticism very useful to my education and overall performance. Unfortunately I am finding the latter increasingly absent from the current academic environment, esp. when it comes to submitting official forms to QUT. It seems like a black hole at times

Oh well, “Such is life”. I seem to be quoting this a lot recently. Perhaps as a subconscious resignation to my lot in life. Just realised I have the same initials as Ned Kelly, but unfortunately his proper name was Edward Kelly, so I guess not...

Cisco 857W Router - Upgrade ADSL Firmware

To upgrade the ADSL firmware you need to get the latest .bin firmware file from Cisco. You will need a CCO and a valid contract to download the file.

One you have this, copy the file to flash using a TFTP server. Then rename the file to remove the version number, then make a backup of the configuration file just in case and reboot the router. The reboot should force the new firmware to be loaded. Once rebooted verify the version of the firmware

Check the version of the firmware current running
show dsl interface ATM 0

Init FW:         init_xxx-x.x.xxx.bin
Operation FW:    xxx-x.x.x.bin
FW Source:       xxxxxxxx
FW Version:      x.x.x


Check the amount of space available on flash for the firmware, ensure that the bytes free is greater than the size of the firmware .bin file
show flash

19353600 bytes total (5369856 bytes free)

Copy the firmware .bin file to flash
copy tftp://xxx.xxx.xxx.xxx/adsl_alc_20190.x.x.x.bin

Rename the file on flash to adsl_alc_20190.bin
rename flash:adsl_alc_20190.x.x.x.bin adsl_alc_20190.bin

Reboot the router
reload