Recently a local privilege escalation vulnerability was found in Cisco’s VPN Client. When Cisco VPN Client is installed, a windows service “Cisco Systems, Inc. VPN Service” is created. The service runs the binary C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe as Local System. Therefore, if you replace cvpnd.exe with another executable, then that program will be ran at startup with root privileges! I fond this vulnerability interesting because it is used at my college to authenticate students when they connect to the wireless network. For that reason, almost every student with a laptop has this software installed, and students are allowed to borrow school laptops from the student center to use the wireless internet. Consequently, anyone could borrow a laptop, gain root access thought the vulnerability, and install a keylogger that sends every keystroke to the attacker’s email! Its been 5 days seen this vulnerability was discovered, and Cisco has already issued a patched version. However, how long will it take for the school to update all their computers? This is just another reason why you should be careful when using school computers!
Video Demonstration: (shows how to gain root access and change the Admin password with this vulnerability)
Local Privilege Escalation Vulnerability in Cisco VPN Client
Exploit Hacking
Since Infinity Exists hasn’t had time to release a new episode, I decided to revamp a two part series, Exploit Hacking and Exploit Hacking 2 - Privilege Escalation, that I made a year before Infinity Exists was created. It may be a little dated, but it provides great information on how a hacker can find an vulnerability on a remote computer and exploit it to gain remote access. Also, the video shows how a hacker can raise their privileges on the remote machine to administrator. I added text throughout the video to make it easier to understand. Furthermore, Infinity Exists plans to do a more up-to-date and more detailed series of episodes on “exploit hacking.”
Full Scale Video Here
Download Here
Tapping a 66 Block Telephone Network Interface
Awhile ago I was asked to rewiring a company’s 66 Block, a type of punchdown block used to connect sets of wires in a telephone system, because they wanted to replace their plain old telephone service (POTS) with multiple VoIP telephone lines. I had little knowledge on the 66 Block before doing this job, so I got out my trusty Beige Box to figure out how it was wired. Here’s a short video on how to tap a 66 Block. (Watch Episode 6 if you need help making a Beige Box)
Full Scale Video Here
Download Here
Windows SMB Relay Exploit
In this Underground video, Overide demonstrates how to obtain root access on a fully patched Windows XP SP3 Machine. He exploits a flaw in Windows Server Message Block (SMB) which is used to provide shared access to files between hosts on a network. Overide utilizes the Metasploits Framework to run the exploit. It works by relaying a SMB authentication request to another host which provides Metasploit with a authenticated SMB session, and if the user is an administrator, Metasploits will be able to execute code on the target computer such as a reverse shell. For this exploit to run, the target computer must try to authenticate to Metasploit. Overide forces the target computer to perform a SMB authentication attempt by using a Ettercap Filter. Full Scale Video Here
Download Here
Download Ettercap Filter Here
Beer Pong Table
The last few days I’ve been helping my friend Charlie construct his Illinois State University (ISU) Beer Pong Table. The legs and supports of the table are made from his roommate Brandon’s hockey sticks, and the table top is made of plywood with a 1/8″ sheet of Acrylic on top. Our friend Tyler etched ISU’s mascot, Red Bird, into the Acrylic; it was done free-hand with a dremel (Compare his etching to image). Tyler also did the text on the table: “ISU” and ” What you call Addiction … We call Dedication”. I did the LED array and the wiring; when the LEDs are lit, the light catches the etching in the acrylic. The LED controller I made allows you to switch between the LEDs being constantly on or controlled by an audio input. However, the LEDs we used are only lit at a specific voltage, so it doesn’t work very well. Full Scale Video Here
Download Here
Pre-Amp Schematic
Beer Pong Table
The last few days I’ve been helping my friend Charlie construct his Illinois State University (ISU) Beer Pong Table. The legs and supports of the table are made from his roommate Brandon’s hockey sticks, and the table top is made of plywood with a 1/8″ sheet of Acrylic on top. Our friend Tyler etched ISU’s mascot, Red Bird, into the Acrylic; it was done free-hand with a dremel (Compare his etching to image). Tyler also did the text on the table: “ISU” and ” What you call Addiction … We call Dedication”. I did the LED array and the wiring; when the LEDs are lit, the light catches the etching in the acrylic. The LED controller I made allows you to switch between the LEDs being constantly on or controlled by an audio input. However, the LEDs we used are only lit at a specific voltage, so it doesn’t work very well. Full Scale Video Here
Download Here
Pre-Amp Schematic
Password Phishing
Phishing is a method of obtaining sensitive information such as usernames and passwords by pretending to be a trusted website. Tehdead shows us a variety of password phishing techniques that enable an attacker to trick a user into giving up their login information. The first step is to create a fake login identical to the login on the trusted website. In order to not raise suspicion, Tehdead explains two methods to capture the victim’s password and then transfer them to the real website. One method is to sumbit the information to a php page that is disguised as a pop-up advertisment, and the other is to send the username and password to a simular php page that is contained in an iframe. Lastly, Tehdead describes how to use link manipulation with BBcode to social engineer a victim into going to the fraudulent website. Full Scale Video Here
Download Here
Installasi Program di Backtrack [ Part I ]
Setelah menginstall distro Backtrack di linuxbox yang saya gunakan, rasanya kurang menarik bila tidak menambahkan beberapa tools yang membantu saya dalam kegiatan tulis-menulis 
- Openoffice 2.2.1
- Abiword 2.4
- The Gimp 2.2.17
- Virtualbox 1.5.2
- Cedega 5.1
- Bluefish 1.0.7
- Kaffeine 0.8.1
- XMMS 1.2.10
- Xine-ui 0.99.5
Applikasi tersebut sudah saya coba dan berjalan tanpa hambatan, untuk menambah applikasi pada Backtrack, kita hanya memerlukan konverter module yang sama dengan distro Slax, ya karena Backtrack berbasis Slax, maka Anda dapat menggunakan tools untuk merubah file berektensi *.tgz, *.mo, *.rpm ke *.lzm, disini saya menggunakan tools seperti mo2lzm, rpm2lzm, tgz2lzm dan lzm2dir yang semua’a dapat di peroleh dari situs Slax.
Apabila tools tersebut sudah tertanam di Backtrack Anda, maka command yang dapat Anda jalankan seperti berikut :
bt ~ # mkdir /root/slax_modules/applikasi/chkrootkit-0.46a-6
bt ~ # mo2lzm chkrootkit_0_46a-6.mo chkrootkit_0_46a-6.lzm
bt ~ # lzm2dir chkrootkit_0_46a-6.mo.lzm /root/slax_modules/applikasi/chkrootkit-0.46a-6
Selanjutnya Anda hanya tinggal meng-copy paste file yang sudah di ekstrak saja
Referensi:
http://slax.hosting4p.com
http://slax.hosting4p.com/modules.php
TUTORIAL MENJEBOL PROTEKSI WEP
Ini adalah bagian kedua dari praktek Menjebol HotSpot. Jikalau pada artikel sebelumnya kita membahas bagaimana menembus batas proteksi MAC address, pada kali ini kita akan membahas bagaimana mendapatkan akses HotSpot yang menggunakan WEP (Wired Equivalent Privacy) Keys.
Alat yang kita butuhkan adalah :
1. Sebuah Laptop
2.Sebuah Wireless Adapter yang mendukung Mode Monitoring dan Injection.
3.Linux Live CD distro : Backtrack 2.0
Mengapa kita membutuhkan Laptop ? Tentu saja karena akses HotSpot biasanya diberikan untuk pengguna yang Mobile. Dan dengan laptop kita memiliki fleksibilitas yang tinggi pula.
Lalu apa yang dimaksud dengan Wireless Adapter yang mendukung mode monitoring dan injection ? Perlu anda ketahui, tidak semua Wireless Adapter yang ada dipasaran, maupun yang sudah built in dalam laptop, mendukung mode monitoring dan injection yang diperlukan untuk WEP hacking ini.
Yang perlu anda perhatikan adalah Chip dari Wireless Adapter anda. Chip terbaik dalam melakukan wireless hacking adalah Atheros dan Ralink. Namun Atheros adalah pilihan utama. Tidak banyak wireless adapter yang memiliki chip atheros di Indonesia, anda dapat mencari beberapa merk dibawah ini :
1. 3Com 3CRPAG175B
2.3Com 3CRXJK10075
3.DLINK DWL-G630 Rev C
4.Linksys WPC55AG
5.TrendNET TEW-441PC
6.TrendNET TEW-443PI
7.TP-LINK TL-WN610G
Jika anda telah memilikinya, maka anda dapat memulai Langkah pertama dalam Wireless Hacking ini 
Langkah kedua tentu saja, langsung buka console anda dan ketikkan command berikut(saya asumsikan wireless adapter anda berchipset atheros) :
airmon-ng stop ath0
airmon-ng start wifi0
Kedua command ini berguna untuk mengaktifkan mode monitoring dan injection pada wireless adapter anda. Kemudian lanjutkan dengan monitoring jaringan wireless dengan mengetikkan command berikut :
airodump-ng ath0
Akan tampil seluruh jaringan wireless yang terdeteksi seperti diatas. Tampak terlihat Access Point Rek-1 diproteksi dengan WEP Encryption. itulah korban kita. AP Rek-1 diset pada Channel 6 dan memiliki BSSID 00:19:5B:5C:62:92 . Sekarang saatnya melakukan penyerangan.Buka Console baru dan ketikkan :
airodump-ng –channel 6 –bssid 00:19:5B:5C:62:92 -w hasil ath0
Perintah diatas akan mengumpulkan paket data yang dibutuhan untuk proses Cracking.
Selanjutnya lakukan injeksi paket pada Client yang terkoneksi pada AP untuk mendapatkan paket ARP lebih cepat. Bukalah lagi Console baru tanpa menutup console yang sebelumnya dan ketik :
aireplay-ng –arpreplay -b 00:19:5B:5C:62:92 -h 00:19:D2:45:D0:EB ath0
Client yang diserang ini memiliki Mac address 00:19:D2:45:D0:EB (lihat pada screenshot diatas pada tabel station yang terletak dibawah) . Anda tidak menemukan Mac address 00:19:D2:45:D0:EB pada screenshot ? tentu saja karena saat dilakukan screenshot belum terdeteksi
Tidak sabar menunggu ? Untuk mempercepat lagi datangnya ARP , maka kita dapat melakukan serangan Deauthentication untuk memutuskan hubungan Client ke AP sehingga ARP yang biasanya didapat saat awal koneksi client dapat lebih cepat didapat. Bukalah console baru sekali lagi dan ketikkan :
aireplay-ng –deauth 5 -c 00:19:D2:45:D0:EB -a 00:19:5B:5C:62:92 ath0
Hasil dari ketiga perintah ini dapat anda lihat pada screenshot dibawah ini :
I Like this Screenshot
Sampai sejauh ini anda telah melakukan pengumpulan paket yang dibutuhkan untuk menjebol WEP Keys. Langkah terakhir yang harus anda lakukan adalah buka console baru lagi dan ketikkan perintah berikut :
aircrack-ng hasil*.cap
atau apabila anda memiliki aircrack versi terbaru anda dapat juga mengetikkan perintah seperti berikut :
aircrack-ptw hasil-01.cap
Dan tunggulah beberapa menit hingga anda mendapatkan key tersebut
Tertarik melakukannya ?
Read More......
