Tag Archives: backtrack 5

Posts

Weaponizing the Nokia N900 – Part 4.0 – A Three Year Anniversary!

35 Comments

“Remember that the most valuable antiques are dear old friends.” H. Jackson Brown, Jr.

I felt that this was an appropriate quote for my aging Nokia N900. What should I do with this phone? Should I throw it in the “Electronic Wasteland” in China and should I become just another Android user? Hell, I can even run Backtrack 5 on Android now! There are even reports that hackers have been able to get monitor mode and packet injection to work on Android devices!

However, what if I want to run a wide array of Linux based programs locally using my phone’s operating system without depending upon a chroot environment? What if I want a phone/device that has been known to be able to do packet injection, monitor mode, hostmode and not have to sign up for any large corporation’s software market like “Google Play” or Apple’s “App Store” to install software? Maybe I just want to use apt-get to install my programs for Christ’s sake! What if I just want to whip a device out of my pocket that I can quickly run mtr from to troubleshoot a client’s wireless network issues?

It is also nice to have a phone/device that has a physical keyboard versus a touch screen since in my humble opinion, I believe that touchscreen devices are meant for consuming than being productive.

I still believe the best phone for hackers is the Nokia N900 and it is a shame that Nokia decided to go the way of Microsoft. I personally believe that Nokia should have gone the route of an Android/Linux hybrid mobile operating system, but that’s just my opinion. We will have to see how well the Firefox OS or the Sailfish OS take off.

Android is a great mobile operating system but to me it is kind of a bastard version of the Linux operating system. Another problem with the Android platform is the sheer vast amount of different hardware manufactures there are. So by the time independent developers are able to get features like monitor mode working on one phone, chances are there are a dozen of other phones that have been released while the phone that the developers were able to get monitor mode working on will be given hardly much credence to.

Part of the beauty of the Nokia N900 is that it has ‘staying power’. This phone was released over 3 years go to this date. I still receive e-mails asking for support or giving me compliments on my work for the N900 which I appreciate dearly. There still is an active, smart and driven community around the world who develop applications and provide support for this phone, which I am very thankful for.

So what am I to do with this beloved device? A device that can be overclocked to 1.0GHZ, can run the OSX , can run Backtrack 5, do myriad of other tasks and is available for about $200.

Sadly, my Nokia N900 will no longer be used as a phone but as an MP3/Multimedia player that I can use for penetration testing! With about 32GB of internal storage and a MicroSD slot that can be use to extend the storage of the N900 from 32GB to 48GB, DLNA client/server support, a FM Transmitter, and Pandora client support, why would I want to shell out the extra cash for a new MP3 player that most likely won’t be able to run Metasploit locally and an OpenSSH Server?

This is why for the three year anniversary of the Nokia N900, I have written a bash shell script that helps automate weaponizing the Nokia N900 to save myself and I’m hoping many other individuals time for weaponizing the Nokia N900.

Before you download and run the this shell script, please read the following:

Firstly, I am not responsible if this program bricks/damages your N900 (but I can assure you as long as you follow my instructions you SHOULD be safe). For best results make sure you have flashed your N900 firmware to version pr1.3 (also for best results my shell script works BEST on freshly flashed N900s). I was not able to get my shell script to work properly with the pr1.2 firmware.

Plug your wall charger into your N900. Make sure you also have strong signal strength to your wireless network.

Once you have your N900 flashed, please root your N900 and install bash4. Then pull up the terminal on your N900 and as root do this:

ln -s /bin/bash4 /bin/bash

Next download this following script to your N900:

http://zitstif.no-ip.org/weaponizen900.tar

(sha1sum: c3699aea31c8ac91684e89bfdda7901bcc7f042e  weaponzenizen900.tar)

(Source code for main script is publicly viewable here: http://pastebin.com/4UXmAEQx )

Extract it via:

tar -xvf weaponizen900.tar

Then cd into the newly created folder called “n900project” and run as root:

bash weapoinzen900.sh

MAKE SURE TO FOLLOW AND PAY CLOSE ATTENTION TO ALL THE PROMPTS FROM THIS PROGRAM! Installation typically for me took about 2 hours. If your Internet connection drops out for whatever reason, for the most part it is safe to run this program again!

For a list of tools that weaponizen900.sh installs for native use, please see this: http://zitstif.no-ip.org/listweapons.txt. You can also list the installed tools by typing on your N900 ‘listweapons’. It also installs this following kernel: http://talk.maemo.org/showthread.php?t=85665. With this kernel you can do monitor mode, packet injection, and hostmode with the N900. With hostmode on the Nokia N900, you can use an OTG cable and do forensics with your N900 with tools like testdisk!

PLEASE DO NOT USE THE GUI TO UPDATE YOUR N900! Do this at your own risk! TO SAFELY UPDATE YOUR N900 PLEASE USE A SCRIPT I CREATED CALLED “update”. To update programs that have been installed by your package manager run as root:

update modded

To update programs that have been installed by your package manager and programs like Metasploit, SET, Nikto, and etc run as root:

update modded scripts

I hope this script is of great use to anyone who decides to use it. If you have any issues with this program or need any help with this program feel free to contact me via e-mail. I want to thank the Maemo forums for support on this project.

Posts

Firefox Add-On Cocoon – Its strengths and weaknesses

5 Comments

What is Cocoon? According to https://getcocoon.com/support/faq, it is:

“Cocoon is a service that protects your computer and your privacy when you are on the Internet. It’s a virus-free, secure, and private web experience. We shield your computer from the bad guys, and we protect your identity from prying eyes. It’s that simple.”

I would like to argue how ‘secure’ Cocoon is, but year after year, I think most information security specialists would agree that most things aren’t necessarily 100% secure. Semantics aside, I am still relatively impressed with this Firefox add-on, which can be obtained here.

Strengths of Cocoon:

Using tools like ettercap, sslstrip, webmitm, dnsspoof, and wireshark, I was not able to retrieve the login credentials that were used to sign on to Cocoon’s privacy service. The way they have implemented SSL with this plugin is probably one of the best SSL implementations I’ve seen in my humble opinion. (Although, it does use TLS version 1, which I think you should read about here.)

Even using webmitm and creating a self signed certificate pretty identical to the one that *.vworldc.com used, I was not able to log in to the service and I received this error message:

Cocoon Cert Error

The implementation of SSL that the Cocoon developers have used is simply wonderful. For people who are on the road and have to bear using public wifi on a regular basis and don’t have access to a VPN server or using a socks5 proxy server via SSH, I believe that using HTTPS Everywhere and Cocoon in tandem would be a great defense against attackers who are on the same network.

Weaknesses of Cocoon:

Cocoon’s proxy service has an AV solution implemented. For instance, when you go to download an executable file when you’re using Cocoon, you will be prompted that the file has either passed the virus scan or hasn’t. In the case of if it has passed the scan, you are still given a warning about what kind of file it is. If the file has failed the AV scan, you won’t be able to download the file while using Cocoon.

With that being said, I thought I would put Cocoon’s AV solution to the test. Firstly, I tried accessing a benign but universally known ‘virus’ file that triggers all AV solutions:

http://www.eicar.org/download/eicar.com

Not so surprisingly, this file was flagged and I was warned. My next test was to try a meterpreter PE hosted on my own website, which I created using:

msfpayload windows/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=443 R | msfencode -t exe -e x86/shikata_ga_nai -c 5 -o test.exe

(prior to running this string, I ran msfupdate of course). To my surprise, this file passed the AV scan done by Cocoon’s AV services. My next test was done using no encoders and yet again this passed the AV scan provided by Cocoon!

I even tried sbd.exe which is in the /pentest/windows-binaries/tools directory of BackTrack without modifying the file, yet it still passed Cocoon’s AV solution.

With Linux and OSX payloads from the Metasploit project, they passed the AV solution as well, but I was still warned that they were executable. Other file types that can trigger Cocoon’s AV solution are zip and tar.gz files. Yet .rar files triggered no alerts or prompts.

“We shield your computer from the bad guys”, pertaining to AV solutions, this is where Cocoon falls extremely short.

Network attacks against Cocoon:

As of the moment, the only attack I could do against Cocoon was a DOS attack. I simply used dnsspoof or ettercap (and the dns_spoof plugin)  and setup a hosts file with *.vworldc.com pointing to my IP address or a non-existing one.

What this means is that someone who’s in the same network as me and if I know they use Cocoon, I could do a DOS attack against them so they cannot access Cocoon’s services and then they would be forced to access the web ‘naked’.

Offensive uses of Cocoon:

One could use Cocoon for ex-filtrating data out of an organization to a foreign entity. For instance, if I’m agitated employee X at employer Y, I could install and use Cocoon to e-mail an attachment containing company private information to an out of jurisdiction web server.

Closing Words:

For those of you who people come to for information security related solutions, I would highly recommend that you check this Firefox add-on. As of the moment, it is free and free to use their service. Weaknesses aside, I still believe that this is a great defensive tool.

Posts

Backtrack 5 Tools List

16 Comments

From http://www.backtrack-linux.org/

Where can I find a complete list of all the tools installed in BackTrack ?

No such resource currently exists, however you can see a list of all packages installed on your BackTrack system by running:

dpkg –list 



Now such a resource does exist! 🙂

I have taken the time to create a list and it can be found here:

http://zitstif.no-ip.org/bt5/toolslist.txt

Please see the NOTE section at the top of the txt file.

	

	
	




	
	

				

			Posts
		

			
Weaponizing the Nokia N900 – Part 3.8 – Backtrack 5 on N900

		

			 			14 Comments
						

	


		

		
First and foremost I am not taking credit for the act of this. There are other posts on getting Bactrack 5 (ARM) onto the N900. My post mostly pertains to my experience with Backtrack 5 on the N900 and how viable of a offensive information security tool it is.


If you’re curious as to how to get Backtrack 5 running on your N900, you want to thank SuperDumb from the Maemo forums, and take a look at this forum thread. Observe that the default Backtrack 5 (arm) image will not copy over to your vfat microSD external or internal cards. vfat has a file size limit


There are some guides that advocate using ext2/3 on flash devices, but I do not condone you doing this, please see:


http://www.linux.com/archive/feature/114295


To circumvent this issue you can download an image that will work on vfat here, or if you would prefer to re-size the image yourself, follow these steps that SuperDumb graciously gave me via a PM:


Must be done under linux :

Just an example, change the dirs how you want them :


First you need to get the bt5.img out of the downloaded file from backtrack :






gunzip bt5.img.gz




These are the steps to get a img that is small enough :






mv bt5.img bt5.old.img


dd if=/dev/zero of=bt5.img bs=4k count=900000

mke2fs -F -i 8192 bt5.img


mkdir bt5old bt5new

mount -o loop bt5.old.img bt5old

mount -o loop bt5.img bt5new

cd bt5old

cp -rp * ../bt5new




After that just umount bt5old & bt5new and you should have a working img.


Once you have a working img, you will need to have qchroot on your N900 along with gainroot. Then to get Backtrack 5 running on your N900 via the non-GUI way, you simply do as follows:


1.) sudo gainroot


2.) mkdir /mnt/bt5


3.)qchroot /location/to/bt5.img /mnt/bt5


One important note I would like to add with regards to the location of the bt5.img file, is that if you’re like me and you have a bootable linux distro on mmc1, you will not want to have the bt5.img on mmc1. Once your computer mounts the mmc1 card, your mmc1 card will not be accessible via your phone.


You can get VNC up and running, however the N900 keyboard and the Backtrack 5 GUI (at least using gnome) do not get along that well. Additionally, it is resource intensive and if you ask me, to truly utilize Backtrack or almost any Linux distribution, you want to use the command line interface. This is where the power lies. There are a few exceptions to this rule but exceptions don’t necessarily make the rule.


In my humble opinion having Backtrack 5 running on your N900 is not really worth it. My reasoning is due to my experience with it. Here are a couple instances of annoyances that I ran into:


– It is unstable. There were a few times that I would make an attempt to edit sources.list, via:  ‘vi /etc/apt/sources.list’ and my phone would randomly reboot.


– The GUI does not work well at all.


– There are packages that are easily available under the N900, that aren’t easily available under Backtrack 5 (ARM). (kismet for example.)


– Some packages are just broken. For example, miredo does not work at all. (More on miredo later…)


– Nmap’s version under BT5 arm is 5.00 and you can get Nmap for maemo on the N900 at version 5.50.


– easydebian seems like a better alternative and is more stable.


I’m going to go on a bit of a tangent here that I hope is informal and useful.


With miredo not working under BT5 on the N900, that was kind of a big annoyance to myself because miredo for the Maemo even appears to be broken as well.  To get miredo working on your N900 you will want to install and use easydebian.


What is beautiful with miredo, is that you can get an IPv6 address assigned to your N900. You could then use your N900 as a hardware based trojan in a network. The whole concept is very similar to what Mubix did here. You could setup your N900 on a victim network and have ssh listing on your public IPv6 address and then log in to your N900 from an outside network over IPv6. You wouldn’t even have to do any port forwarding on the victim’s firewall/gateway/router.


I will tell you that miredo does not work on all networks and does not appear to work over the gprs0 interface on the N900 (at least with my carrier). Though it works just fine on the wlan0 interface.


Readjusting back from that tangent, summarily I would like to state that the fact that you can get Backtrack 5 working on your N900 is wonderful. Consequently, due to my experience with running BT5 on the N900, I would just advise to use easydebian over BT5 and then customize easydebian to the point that it is essentially a ‘Backtrack’ version. It will be a more stable route to go and you can learn about the tools as you install them, versus having a plethora of tools at your disposal that you may not get around to learning.