pentesting, pci, red team

Ubuntu 14.04 Lockscreen Bypass

April 27th, 2014 by admin in Linux, News

A bug was found that allows you to bypass the lockscreen on the latest version of Ubuntu. Seems all you need to do is hold down the Enter key until the screen freezes and the lock screen crashes. After that the computer is fully unlocked. It has been patched so make sure you upgrade.

3 Tricks to bypass an Android lockscreen

September 20th, 2012 by admin in cracking, Linux, Mobile

It can be extremely frustrating when you’ve forgotten the pattern you use to lock your smartphone, and even more so if someone has managed to prank you by changing it. Luckily, there’s an easy fix if you know the username and password for the Gmail account you used to set up the lock.

If you’ve somehow forgotten your Gmail info, it’s a bit trickier to bypass the lock screen. As a last resort, there’s always resetting your phone to factory settings, but no one wants that hassle. So, here are a couple of ways to avoid starting from scratch, if you can.

Cracking WPA/WPA2 with Reaver

January 24th, 2012 by admin in Linux, Privilege Escalation, Wireless

The WiFi Protected Setup (WPS) protocol is vulnerable to a brute force attack that allows an attacker to recover an access point’s WPS pin, and subsequently the WPA/WPA2 passphrase, in just a matter of hours, using the open source tool called Reaver. Think your 32 character alpha-numeric password is uncrackable? If your wireless router is using WPS then your router may be spit back your password in plain-text to the attacker in less than 10 hrs. WPS allows users to enter an 8 digit PIN to connect to a secured network without having to enter a passphrase. When a user supplies the correct PIN the access point essentially gives the user the WPA/WPA2 PSK that is needed to connect to the network. Reaver will determine an access point’s PIN and then extract the PSK and give it to the attacker. When we tested Reaver in our labs we were able to recovery the WPA password in 1.5hrs and the longest run was 7.5hrs Reaver Test

The new threat

February 12th, 2011 by admin in Apple, cracking, Linux, Privilege Escalation, Uncategorized, windows

Programmable embedded devices have the capability of being detected as a HID device , just like a keyboard or mouse. So if you have physical access and a minute alone you can compromise a system with something the size of your thumb. The possibilities are endless, HTTP/FTP download, injecting binaries into debug or Powershell etc.. Also this device is cross platform which means Windows,Linux,UNIX and Apple are all vulnerable.

Here’s an example project we made for a Windows7 box that adds a new Admin user to the system and hides that user from the logon screen. the whole process takes about 16 seconds , with most of the time taken by the device being detected as a keyboard and the driver installed. The device costs about $20 and can be found here


February 5th, 2011 by admin in cracking, Linux

MAPDAV is designed to use what is known about a user or users (ex, username, first name, middle name, last name, etc) on a unix/linux system from a /etc/passwd file and tries to come up with probable combinations that could be the user’s password. An administrator could run the output through a cracker and see if their user’s passwords are anything easy to guess.

For example, if we had a passwd file entery such as:
chrisa:x:107:102:Chris Anderson:/home/chrisa:/usr/bin/bash

We could have MAPDAV derrive some possible passwords, such as chrisa, chrisanderson, andersonchris, canderson, ChrisAnderson, Anderson Chris, CHRIS, plus any other combinations you entered. It has quite a few other features you can use to modify the output to have arbitrary characters, be in reverse, and other useful things.

Out of a sample of 30192 users, MAPDAV 1.0p8 cracked 4.7% of the passwords on the default settings, 1.2% of which were NOT the same user/pass. This combind with a good conventional wordlist could give good crack results.

More info:

Unix crypt(3) Rainbow Tables

December 22nd, 2010 by admin in cracking, Linux

Darth Null had a nice writeup on how to make crypt(3) rainbow tables. After being told that the salt made it impossible to generate Rainbow Tables, unless you went through the trouble to create 4096 different tables (one for each salt) the reason cited was the presence of the two-character salt at the beginning of the hash. He went out and devised a solution couple of nights later, it was able to actually read, write, and process crypt(3) hashes in their native form (as opposed to a flat hexadecimal dump of the hash). He wanted to submit it for schmoocon but didnt get accepted , so rather than sit on the information, he decided to release it on his blog.

  1. Instead of generating 4096 tables of 1-8 character passwords, just create 1 table of 3-10 character passwords, and use the 1st two characters of the plaintext passwords as the salt. (That part will make more sense if you read the paper.)
  2. It’s still kind of slow: 9x slower than LM hashes, for example. But CPUs are much faster than they were in 2003, when people first started building tables for LM hashes.
  3. It also takes a lot of storage. But storage, likewise, is much cheaper than it was seven years ago.

The whitepaper can be found here:

How to Crack a Wi-Fi Network’s WEP Password with BackTrack

July 2nd, 2009 by Dev Team in Linux, Wireless had an article the other day that pretty much held your hand on steps to crack a WEP password using BackTrack3. Check it out ::HERE::

10 ways of resetting a lost linux root password

April 22nd, 2009 by Dev Team in Linux, Privilege Escalation


A good password has the problem of being difficult to remember. And sometimes you might need to get in to a system where the root password is long forgotten (or left with the system administrator before you).
Luckily there are ways of getting access to systems without having the password. This is of course in a sense also a security risk. That’s why you should always be aware that having unattended physical access to a computer system means the same as having root access to the operating system. Unless the information on a system is encrypted, it’s only as save as the room it’s in.

The method to use to reset the password if you lost the root (or only) password depends on the configuration of your system. But it mostly comes down to two separate tasks:

– get write access to the root partition

– change the password/circumvent control

Here are some things you can try from easy to more complicated. (more…)

Weak Passwords on Extensions = Hacked SIP/PBX

March 27th, 2009 by admin in Linux, News

An unknown organization is systematically checking for open SIP ports and then trying common extension usernames and passwords. If they find weak passwords, they are then into the PBX and can make thousands of calls in a matter of minutes. Protect yourself. Some were Asterisk and some were SIP-based VoIP PBX. Itappears that the hack has nothing to do with any sort of Asterisk vulnerability, but with insecure passwords set for extensions.


KeyCarbon USB Keylogger

October 8th, 2008 by admin in Apple, Linux, News, windows

I had a chance to review the Keycarbon USB Home Mini this week. I’ve been wanting to try one of these to see how they would compare to a PS/2 keyboard logger, PS/2 is still pretty popular as far as cheaper keyboards but the shift in technology is going more towards USB keyboards. I was pretty impressed by the quality of the keylogger and its simple installation.

Who would need a device like this?

  • Business owners needing to monitor employees
  • Parents needing to monitor children
  • People who might need backups of things they type (writers etc)
  • Private investigators, law enforcement, hackers, James Bond 🙂

Why would someone want a hardware keylogger as opposed to a software based one? Well this question has it’s pros and cons:

The pros are:

  • It’s dead simple to install , just unplug the keyboard,plug this device in , and plug the keyboard into the device ,that’s it!
  • No need for root/admin level permissions to install
  • It can be installed on any system that has a USB port (Windows,Mac,Linux etc)
  • Since it’s hardware-based it wont be detected by antivirus/malware programs ever
  • It picks up EVERYTHING typed, even bios password passwords and log-ons

The cons are:

  • Since it doesn’t interact with the operating system it can’t get the name of windows where the text was typed so it makes it a chore to scan the logs for the juicy information
  • Easy to prevent logging by just removing the logger form the computer (which most people won’t be aware of anyhow, who actually crawls behind their computer everyday?)
  • Recovery of logs might be more difficult because they are stored physically on the device and not sent to a remote location. But if you were able to install it in the first place , then recovering it shouldn’t that much harder.
  • If the person has a PS/2 keyboard you can’t use an adapter because the device needs power from the USB port to work

Recovering the logs from the device can be done on any computer even though they offer the software to recover the logs faster, it’s not needed which makes this device a good tool to have in your arsenal. To recover the logs alls you you need to do is open any text editor (notepad etc…) and type in the password (default password is phxlog) and the device goes into menu mode, where you have a few options to choose
you have open so it’s best to open notepad or wordpad or any *nix/MAC equivalent before typing this. This menu will give you various options for the device ,which are:

  1. Partial/Full Log download
  2. Erase logs (quick or thorough)
  3. Setting the default password (alphanumeric only,under 17 chars)
  4. Firmware upgrade
  5. Diagnostics
  6. Speed (that the logs are typed)

Once you choose read the logs it starts auto typing the logs onto whatever window is open has the main focus (which is why you need to open a text editor).  If you don’t like to wait for it to auto-type (you might have days of saved logs) you can get the software to download it in one swoop. The only problem with the software that as of now it’s only compatible with windows.

Detection of the Device:

Because the device doesnt install into the operating system its pretty much insvisible to the normal user. Only a trained computer expert would notice the device it because the only sign it’s there is that it is seen as a USB hub by the OS. It shows up as a “generic 4 port hub Vid_0451&Pid_2046” Vendor id of 0451 and a product id of 2046, which comes up as a generic Texas instruments device which wont raise many eyebrows. Because it’s a USB 1.1 hub it is possible that it may be discovered if someone plugs a USB 2.0 keyboard inline with it. (They might get a warning message telling them that their device can perform at a higher speed if they use a different port.) But the chances are slim of someone needing to replace their keyboard.

All in all this device is a stable tool to use, it logged with no problems at all with every keyboard/OS i used with it.  Although the price is a little high for most people, it’s well priceless for businesses who need to keep an eye on employees, or a parent who needs to monitor their children’s internet activity. I want to thank Keycarbon for giving me the opportunity to review and test this device. Check out their site for other devices they offer that I didn’t get to review , but are another great alternative to stealth hardware logging.

Next Article »