GnackTrack

GnackTrack is a Live (and installable) Linux distribution designed for Penetration Testing and is based on Ubuntu. Although this sounds like BackTrack, it is most certainly not; it's very similar but based on the much loved GNOME!

wifite - Mass WEP/WPA Cracker

wifite is created to to attack multiple WEP and WPA encrypted networks at the same time. This tool is customizable to be automated with only a few arguments and can be trusted to run without supervision. wifite is available in BackTrack4.

Features:

• sorts targets by power (in dB); cracks closest access points first
• automatically deauths clients of hidden networks to decloak SSIDs
• numerous filters to specify exactly what to attack (wep/wpa/both, above certain signal strengths, channels, etc)
• customizable settings (timeouts, packets/sec, channel, change mac address, ignore fake-auth, etc)
• all WPA handshakes are backed up to wifite.py’s current directory
• smart WPA deauthentication — cycles between all clients and broadcast deauths
• stop any attack with Ctrl+C — options: continue, move onto next target, skip to cracking, or exit
• switching WEP attack methods does not reset IVs
• intel 4965 chipset fake-authentication support; uses wpa_supplicant workaround
• SKA support (untested)
• displays session summary at exit; shows any cracked keys
• all passwords saved to log.txt
• built-in updater: ./wifite.py -upgrade

References:

• Download wifite at Google Code

ASCII Art in BackTrack

Someone asks me how do I create the ascii art for my /etc/motd and /etc/issue. Easy:

$ echo -e Google\\nBackTrack\\npentester > motd

$ figlet -cf smslant < motd >> /etc/motd

$ figlet -cf smslant MySeq >> /etc/issue

False Positive Generator - inundator

Inundator is a multi-threaded, queue-driven, anonymous intrusion detection false positive generator with support for multiple targets.

It can be used:

• before, during and after a real attack to bury any IDS by flooding with false positives attack.
• mess with an IDS analyst and keep the CIRT busy for investigation.
• test the effectiveness of an IDS/IPS. (Less alerts mean a better product; more alerts mean a horrible product)

Inundator is part of the BackTrack. However, if you prefer to add it to your manually:

• Add repository to /etc/apt/source.list:

deb http://inundator.sourceforge.net/repo/ all/

• Then, download and install GPG key:

wget http://inundator.sourceforge.net/inundator.asc

apt-key add inundator.asc

• Then you can automatically pull in Inundator and all its dependencies:

aptitude update

aptitude install inundator

Change Your MAC Address (Quick)

Sometime, I need to change my MAC address quickly in order to get a new IP address from DHCP. Here's how I do it:

ifconfig eth0 down 

ifconfig eth0 hw ether 001122AABBCC

dhcpcd eth0

Enjoy the fun!

Terminal in BackTrack

What's the terminal you use in BackTrack normally? Konsole? Terminator?

Today, I found a cool one for me, Yakuake. Having a cool terminal to type command is very important, especially for pentesters!

To use it, press a shortcut key, such as F12, it pops up the terminal; press again it goes hiding.

Build initrd Manually

The initial RAM disk (initrd) is an initial root file system that is mounted prior to when the real root file system is available. The initrd is bound to the kernel and loaded as part of the kernel boot procedure. The kernel then mounts this initrd as part of the two-stage boot process to load the modules to make the real file systems available and get at the real root file system.

The initrd image contains the necessary executables and system files to support the second-stage boot of a Linux system. It contains a minimal set of directories and executables to achieve this, such as the insmod tool to install kernel modules into the kernel.

The initrd image can be created during the Linux build process. Normally, the initrd is a transient file system. Its lifetime is short, only serving as a bridge to the real root file system. In embedded systems with no mutable storage, the initrd is the permanent root file system.

To build your initrd manually, do this:

mkinitramfs -o initrd.img-2.6.34 2.6.34

Linux Kernel Support initrd
For the Linux kernel to support the initial RAM disk, the kernel must be compiled with the CONFIG_BLK_DEV_RAM and CONFIG_BLK_DEV_INITRD options.

File System Used By initrd Image
While ext2 is a common Linux file system format, there are alternatives that can reduce the size of the initrd image and the resulting mounted file systems. Examples include romfs (ROM file system), cramfs (compressed ROM file system), and squashfs (highly compressed read-only file system).

Linux Distribution by initrd
Minimax is an interesting open source project that was designed to be a Linux distribution that fits within an initrd. It's 32MB in size and uses BusyBox and uClibc for its ultra small size. Despite its small size, it's a 2.6 Linux kernel with a large array of useful tools.To build your initrd manually, do this:

BackTrack Console Font

I use a lot of command lines. Thus I need a cool font for my console.

Check you current console font setting: showconsolefont -i
By default, you should get 8x16x256

To change your console font, edit two lines (CODESET and FONTSIZE) in the file below:

/etc/default/console-setup:


#CODESET="Lat15"
CODESET="Uni1"


FONTFACE="VGA"
#FONTSIZE="16"
FONTSIZE="14"

Once it is done, reboot and you can type the command command again to check the console font settings. And you should get 8x14x512 now.

You may use others. Check out at /usr/share/consolefonts folder.

Setting Up WPA2 Connection in BackTrack

The next thing is to setup my Internet connection. Since I'm using WPA2 at home, and here is the content of my /etc/network/interfaces

auto lo
iface lo inet loopback


auto wlan0
iface wlan0 inet dhcp
wpa-driver wext
wpa-ssid < ssid >
wpa-ap-scan 1
wpa-proto RSN
wpa-pairwise CCMP
wpa-group CCMP
wpa-key-mgmt WPA-PSK WPA-EAP
wpa-psk < hex key generated by wpa_passphase ssid passphase >

My BackTrack's GRUB Menu

The first thing I start customizing my BackTrack is the GRUB Menu. Here's the final copy:

# Grub Menu
default         0
timeout         5


vga=0x317                    # 64k/16b,1024x768
splashimage=/boot/grub/bt4.xpm.gz
foreground e3e3e3
background 303030
share 1


title           BackTrack 4 Final, kernel 2.6.34
uuid            206c1cc6-a916-4de2-b061-b993e710e73c
kernel          /boot/vmlinuz-2.6.34 root=UUID=206c1cc6-a916-4de2-b061-b993e710e73c ro splash vga=0x317
initrd          /boot/initrd.img-2.6.34


title           Ubuntu 8.10, memtest86+
uuid            206c1cc6-a916-4de2-b061-b993e710e73c
kernel          /boot/memtest86+.bin

Updating My BT4 to 2.6.34

Start by updating and upgrading BackTrack as usual.

apt-get update

apt-get dist-upgrade

 When comes to kernel updates, typing "n". Next, install drivers as needed and kernel sources:

apt-get install madwifi-drivers broadcom-sta r8187-drivers linux-source-2.6.34

apt-get clean

depmod -a

Last, prepare to update kernel sources:

cd /usr/src/

rm -rf linux linux-source-2.6.30.9*

rm -rf /lib/modules/2.6.30.9/

tar jxpf linux-source-2.6.34.tar.bz2

ln -s linux-source-2.6.34 linux

cd linux

cp /boot/config-2.6.34 .config

ln -s /usr/src/linux /lib/modules/2.6.34/build

make scripts && make prepare

apt-get clean && updatedb 

reboot # dont forget to reboot!

 Complete!

Remote Desktop Connection from Linux

During the pentest,  we may sometime need to perform rdp to a Windows server. This can be done using "rdesktop" command. Here is how I do it with my backtrack.

rdesktop -E -z -g 90% [Windows Server IP address]

• -E : disable encryption from client to server (to speed up the connection).
• -z : enable rdp compression
• -g 90% :  desktop geometry at 90% of your current monitor.