Kitty to Replace Putty

Just switch from Putty to Kitty recently, for a few reasons:

• Available in Portable format (like Putty).
• Built-in transparency.
• Quick start of duplicate session (ctrl+shift+click).
• kscp integration (drag and drop or ctrl+F3).
• hidden text editor (shift+F2).

ShellShock Attack Vectors

Shellshock attack is popular, and wormable too. However, it requires an attack vector for it to works. Here're some of the common attack vectors for shellshock to work:

• (Apache/etc) httpd - If the CGI script calls Bash, the script could execute arbitrary code as the httpd user. mod_php, mod_perl, and mod_python do not use environment variables and we believe they are not affected.
• (Secure Shell) ssh -  It can be used to execute any command, via ssh, scp, git, rsync, etc.
• dhclient - The Dynamic Host Configuration Protocol Client (dhclient) is used to automatically obtain network configuration information via DHCP. This client uses various environment variables and runs Bash to configure the network interface. Connecting to a malicious DHCP server could allow an attacker to run arbitrary code on the client machine.
• CUPS - It is believed that CUPS is affected by this issue. Various user supplied values are stored in environment variables when cups filters are executed.
• sudo - It could still be possible for the running command to set an environment variable that could cause a Bash child process to execute arbitrary code.
• Firefox - No detail about it as of now.
• Postfix - While the Postfix server does call Bash in a variety of ways, the Postfix server will replace various characters with a ?, and may allow an arbitrary environment variable be set by the server. It is however possible that a filter could set environment variables.

ShellShock Testing

Patch your /usr/bin/bash  NOW. The 'Shellshock' bug blasts OS X, Linux systems wide open. The attack vectors are the CGI scripts to DHCP clients (and maybe more), which will lead to remote-code execution.

Proof of Concept - at local system
A simple test to check if your Bash is vulnerable is available publicly.

$ env var='() { :;}; echo vulnerable' bash -c /bin/true  

Upon running the above command, an affected version of bash will output "vulnerable". Once the patch has been applied, the same test will return the following result.

bash: warning: var: ignoring function definition attempt  bash: error importing function definition for 'var'  

Proof of Concept - to a remote server.

curl -A "() { ignored; }; echo Content-Type: text/plain ; echo  ; echo ; /usr/bin/id" 

A vulnerable web CGI will return uid=48(apache) gid=48(apache) groups=48(apache), and follow by HTML page. A non-vulnerable should return just the HTML page.

Touch Screen Display for RPi

I got this from http://www.ebay.co.uk/itm/301239157191

3.5" Raspberry Pi Touch Screen Display Monitor 480x320 LCD + Case + Heatsinks
This 3.5 inch touch screen module is designed especially for Raspberry Pi. It transmits data though GPIO, SPI (Serial Peripheral Interface) on the P1 interface. The CPLD on the display module controls display content according to the data transmitted from the SPI interface.

Specification

• Easy to setup and use
• Physical Resolution: 480x320 pixels，16bit，65K color
• 3.5 inch resistive touch screen
• LCD Display transmits data through SPI (clock maximum speed: 125Mhz)
• Touch panel transmits data through SPI (clock maximum speed: 16Mhz)
• No external power supply needed
• Built-in EEPROM storage unit
• Open source Linux driver

The display module is built with a high speed CPLD chip (EPM3032), a SPI interfaced 4-wire resistive touch screen control chip (XPT2046), and an I2C interfaced EEPROM memory storage unit (AT24C02).

/boot/config.txt

# uncomment if you get no picture on HDMI for a default "safe" mode
hdmi_safe=1

# uncomment this if your display has a black border of unused pixels visible
# and your display can output without overscan
disable_overscan=0

# uncomment the following to adjust overscan. Use positive numbers if console
# goes off screen, and negative if there is too much border
#overscan_left=16
#overscan_right=16
#overscan_top=16
#overscan_bottom=16

# uncomment to force a console size. By default it will be display's size minus
# overscan.
framebuffer_width=960
framebuffer_height=640

# uncomment if hdmi display is not detected and composite is being output
hdmi_force_hotplug=1

# uncomment to force a specific HDMI mode (this will force VGA)
hdmi_group=1
hdmi_mode=5 hdmi_ignore_edid=0xa5000080
# uncomment to force a HDMI mode rather than DVI. This can make audio work in
# DMT (computer monitor) modes
#hdmi_drive=2

# uncomment to increase signal to HDMI, if you have interference, blanking, or
# no display
#config_hdmi_boost=4

# uncomment for composite PAL
#sdtv_mode=2

#uncomment to overclock the arm. 700 MHz is the default.
#arm_freq=800

# for more options see http://elinux.org/RPi_config.txt


Package Include:

• 1*Tontec 3.5 inch Touch Screen
• 1*Raspberry Pi Transparent Enclosure
• 1*Raspberry Pi Heatsinks - set of 3

Kali Linux 1.0.9 Raspberry Pi image

Downloading the Kali Linux custom ARM image for my Raspberry Pi, at http://www.offensive-security.com/kali-linux-vmware-arm-image-download/

Kali Linux 1.0.9 Raspberry Pi image    Download Image    SHA1SUM: 714a6fbefc6df51b83826f93d46a36f31d54c5d1