Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

14 March 2006 | 1,137,584 views

10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery)

Prevent Network Security Leaks with Acunetix

1. BackTrack

The newest contender on the block of course is BackTrack, which we have spoken about previously. An innovative merge between WHax and Auditor (WHax formely WHoppix).

BackTrack is the result of the merging of two Innovative Penetration Testing live Linux distributions Whax and Auditor, combining the best features from both distributions, and paying special attention to small details, this is probably the best version of either distributions to ever come out.

Based on SLAX (Slackware), BackTrack provides user modularity. This means the distribution can be easily customised by the user to include personal scripts, additional tools, customised kernels, etc.

Get BackTrack Here.

2. Operator

Operator is a very fully featured LiveCD totally oriented around network security (with open source tools of course).

Operator is a complete Linux (Debian) distribution that runs from a single bootable CD and runs entirely in RAM. The Operator contains an extensive set of Open Source network security tools that can be used for monitoring and discovering networks. This virtually can turn any PC into a network security pen-testing device without having to install any software. Operator also contains a set of computer forensic and data recovery tools that can be used to assist you in data retrieval on the local system.

Get Operator Here

3. PHLAK

PHLAK or [P]rofessional [H]acker’s [L]inux [A]ssault [K]it is a modular live security Linux distribution (a.k.a LiveCD). PHLAK comes with two light gui’s (fluxbox and XFCE4), many security tools, and a spiral notebook full of security documentation. PHLAK is a derivative of Morphix, created by Alex de Landgraaf.

Mainly based around Penetration Testing, PHLAK is a must have for any pro hacker/pen-tester.

Get PHLAK Here (You can find a PHLAK Mirror Here as the page often seems be down).

4. Auditor

Auditor although now underway merging with WHax is still an excellent choice.

The Auditor security collection is a Live-System based on KNOPPIX. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. Independent of the hardware in use, the Auditor security collection offers a standardised working environment, so that the build-up of know-how and remote support is made easier.

Get Auditor Here

5. L.A.S Linux

L.A.S Linux or Local Area Security has been around quite some time aswell, although development has been a bit slow lately it’s still a useful CD to have. It has always aimed to fit on a MiniCD (180MB).

Local Area Security Linux is a ‘Live CD’ distribution with a strong emphasis on security tools and small footprint. We currently have 2 different versions of L.A.S. to fit two specific needs – MAIN and SECSERV. This project is released under the terms of GPL.

Get L.A.S Linux Here

6. Knoppix-STD

Horrible name I know! But it’s not a sexually trasmitted disease, trust me.

STD is a Linux-based Security Tool. Actually, it is a collection of hundreds if not thousands of open source security tools. It’s a Live Linux Distro, which means it runs from a bootable CD in memory without changing the native operating system of the host computer. Its sole purpose in life is to put as many security tools at your disposal with as slick an interface as it can.

Get Knoppix-STD Here

7. Helix

Helix is more on the forensics and incident response side than the networking or pen-testing side. Still a very useful tool to carry.

Helix is a customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics.

Get Helix Here

8. F.I.R.E

A little out of date, but still considered the strongest bootable forensics solution (of the open-source kind). Also has a few pen-testing tools on it.

FIRE is a portable bootable cdrom based distribution with the goal of providing an immediate environment to perform forensic analysis, incident response, data recovery, virus scanning and vulnerability assessment.

Get F.I.R.E Here

9. nUbuntu

nUbuntu or Network Ubuntu is fairly much a newcomer in the LiveCD arena as Ubuntu, on which it is based, is pretty new itself.

The main goal of nUbuntu is to create a distribution which is derived from the Ubuntu distribution, and add packages related to security testing, and remove unneeded packages, such as Gnome, Openoffice.org, and Evolution. nUbuntu is the result of an idea two people had to create a new distribution for the learning experience.

Get nUbuntu Here

10. INSERT Rescue Security Toolkit

A strong all around contender with no particular focus on any area (has network analysis, disaster recovery, antivirus, forensics and so-on).

INSERT is a complete, bootable linux system. It comes with a graphical user interface running the fluxbox window manager while still being sufficiently small to fit on a credit card-sized CD-ROM.

The current version is based on Linux kernel 2.6.12.5 and Knoppix 4.0.2

Get INSERT Here

Extra – Knoppix

Remember this is the innovator and pretty much the basis of all these other distros, so check it out and keep a copy on you at all times!

Not strictly a security distro, but definately the most streamlined and smooth LiveCD distribution. The new version (soon to be released – Knoppix 5) has seamless NTFS writing enabled with libntfs+fuse.

KNOPPIX is a bootable CD or DVD with a collection of GNU/Linux software, automatic hardware detection, and support for many graphics cards, sound cards, SCSI and USB devices and other peripherals. KNOPPIX can be used as a productive Linux desktop, educational CD, rescue system, or adapted and used as a platform for commercial software product demos. It is not necessary to install anything on a hard disk.

Get Knoppix Here

Other Useful Resources:

SecurityDistros
FrozenTech LiveCD List
DistroWatch

Others to consider (Out of date or very new):

SlackPen
ThePacketMaster
Trinux
WarLinux
Network Security Toolkit
BrutalWare
KCPentrix
Plan-B
PENToo

New ones added from authors e-mail/slashdotters and diggers:

Arudius
The Gentoo Forensic Toolkit
Anonym-OS

Digg This Article



14 March 2006 | 15,697 views

Who is Darknet?

Well seen as though I tell the others to do some kind of introduction, probably I should do one for myself too.

Then
I started out with a Spectrum ZX-81 back in the olden days, typing whole games out of the Spectrum magazines I picked up from charity shops.

Spectrum ZX-81

Yah it had no tape drive, no disk drive, no hard drive..nothing. Once you powered it off, you lost everything. I missed the ugly white ZX-80 just by a few months.

It was a powerful beast.

  • Z80A Microprocessor clocked at 3.25MHz.
  • 1K RAM, expandable to 16K, 32K or 56K.
  • 8K ROM containing BASIC.
  • A single ULA for all I/O functions.

After that I quickly upgraded to a Spectrum 48K +, which was a little better and had an external tape deck.

Spectrum 48K +

This was where I learnt the basics of computers and programming..my friends had a mixture of things Commodore 64’s and Amigas for the rich kids with the odd Atari here and there.

After that was a Spectrum 128k + with an integrated tape drive.

Back in those days pirating games consisted of a hi-fi with tape-tape capability and a blank tape (plus half an hour of listening to some weird screechin noises).

At secondary school I learnt a bit more with some BBC Basic and a little DR-DOS on the RM Nimbus’s, I remember the beast of the school was a 486-DX66 with a 40mb hard drive or something like that.

I used to hack the network back then to try and play games like PGA Golf, Budokan and Lesuire Suit Larry!

Lesuire Suit Larry

After that I couldn’t afford a PC at home, so I went onto consoles, as that was all I could afford at the time (NES, SNES then PSX).

I kind of drifted away from computers until I had finished college and got back into them during my failed first year of a Electrical and Electronics Degree, I quickly shifted to Software Engineering..during my first year I got all my downloaded warez deleted because I had shared NetBIOS over TCP/IP so some random NBT scanner on the internet had deleted all my stuff.

After that I started learning about networking, security, file permissions and it went on from there.

A year or so later I founded Darknet with another friend on IRC network DALnet and around 1998 I setup this domain.

You can see the old page as it was 5 years ago HERE. There are no earlier versions (thankfully). Yah I know it doesn’t work in Firefox, embarassing eh?

Now it’s about 8 years later, and I know a fair bit about computer security.

Now.
I am now working in information security, my main role being a lead of the attack and penetration team. I also do various other things such as disaster recovery, digital forensics, security audits in compliance with various standards (including BS7799), on the side I do web design (like this site) and various other hobby sites.

My main job though is penetration testing/vulnerability assessment and keeping up with all the latest technologies. I am especially good in information gathering (what the media has labelled as Google Hacking).

After that my strongest suite is the network stack, I’m good down to the packet/header level, not so great at programming, but I can script do PERL/PHP/Bash etc.

I got a lot of experience doing system administation jobs and self-studying in a lab at home, also learnt a lot about Linux in a previous job doing a transition from Windows servers to Linux servers, all from my recommendations.

In my spare time I write about security, I read books, I hack PHP, I enjoy food and the countryside.

I have a few industry certifications, but I don’t really place much emphasis on them, so I won’t really be talking about those. Practical hands on experience is the best you can do.

Future?
I’m a general knowledge kind of guy, and my skills are in info gathering so a lot of my input is news articles and current trends/discussion. I also plan to write many articles about the various aspects and parts of penetration testing as started with my Rainbow Tables/Rainbow Cracking article and my discussion on Social Engineering in Penetration Testing.

Being in the business, I am up to date with the latest tools/exploits/developments so I’ll try and share that all with you.

If you have any questions, you can always contact the team.


13 March 2006 | 9,526 views

Donations Flood in for Guilty Security Researcher Guillaume Tena

This could be the end of reverse engineering in France sadly, I hope it doesn’t have repucussions in other parts of the world.

I think it’s the end of using reverse engineering tools to find flaws in France. Maybe the next step will be to forbid the possession of debuggers and disassemblers.

It’s a valid course of action to reverse engineer software you have bought to make sure it’s secure. If not make your software open source.

Security expert Guillaume Tena, who was last week ordered to pay a fine of 14,300 euros for breach of French copyright law after publishing information about security vulnerabilities in an anti-virus application, has already collected around half the money in donations after appealing for help on his Web site.

On 21 February, Tena lost his appeal in a case involving vendor Tegam and was ordered to pay a fine of 14,300 euros (around AU$23,000) for breaking French copyright laws. Tena appealed for donations on his Web site — to buy a new anti-virus application because asking for donations to pay a fine is also illegal in France — and within a week he has already collected over 8,000 euros.

I say good for him.

Source: Zdnet


13 March 2006 | 30,396 views

VMWare Rootkits, The Next Big Threat?

Lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and that can maintain control of a target operating system.

The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.

Subvirt certainly sounds like an interesting project.

I have heard about such a thing before in the blackhat community, but for Linux only, I didn’t know anyone had actually worked on a Windows variant.

Quite an amazing piece of technology, the thing is, it might already be out there..Blackhats tend to do it first, and do it dirty, but not talk about it to the media ;)

Using current methods, these root kits CANNOT be detected by the host machine.

Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system, according to documentation seen by eWEEK.

The prototype, which will be presented at the IEEE Symposium on Security and Privacy later in 2006, is the brainchild of Microsoft’s Cybersecurity and Systems Management Research Group, the Redmond, Wash., unit responsible for the Strider GhostBuster anti-rootkit scanner and the Strider HoneyMonkey exploit detection patrol.

The problem being the malware is a lower layer than the malware detection utilities available, so it runs under the level that it can be detected. The SubVirt project has implemented VM-based rootkits on two platforms “Linux/VMWare and Windows/VirtualPC” and was able to write malicious services without detection.

It is a very stealthy attack, and perhaps it could be used to also fight against malicious code and malware.

“We believe the VM-based rootkits are a viable and likely threat,” the research team said. “Virtual-machine monitors are available from both the open-source community and commercial vendors … On today’s x86 systems, [VM-based rootkits] are capable of running a target OS with few visual differences or performance effects that would alert the user to the presence of a rootkit.”

Hardware detection is one thing that could overcome this kind of subversion by virtual machines. Intel and AMD have discussed hardware based malware scanning (AMD Execution Protection to prevent buffer overflows).

Source: eWeek


12 March 2006 | 187,074 views

JTR (Password Cracking) – John the Ripper 1.7 Released – FINALLY

The new “features” this time are primarily performance improvements possible due to the use of better algorithms (bringing more inherent parallelism of trying multiple candidate passwords down to processor instruction level), better optimized code, and new hardware capabilities (such as AltiVec available on PowerPC G4 and G5 processors).

In particular, John the Ripper 1.7 is a lot faster at Windows LM hashes than version 1.6 used to be. (Since JtR is primarily a Unix password cracker, optimizing the Windows LM hash support was not a priority and hence it was not done in time for the 1.6 release.) John’s “raw” performance at LM hashes is now similar to or slightly better than that of commercial Windows password crackers such as LC5 – and that’s despite John trying candidate passwords in a more sophisticated order based on statistical information (resulting in typical passwords getting cracked earlier).

John the Ripper 1.7 also improves on the use of MMX on x86 and starts to use AltiVec on PowerPC processors when cracking DES-based hashes (that is, both Unix crypt(3) and Windows LM hashes). To my knowledge, John 1.7 (or rather, one of the development snapshots leading to this release) is the first program to cross the 1 million Unix crypts per second (c/s) boundary on a general-purpose CPU. Currently, John 1.7 achieves up to 1.6M c/s raw performance (that is, with no matching salts) on a PowerPC G5 at 2.7 GHz (or 1.1M c/s on a 1.8 GHz) and touches 1M c/s on the fastest AMD CPUs currently available. Intel P4s reach up to 800k c/s. (A non-public development version making use of SSE also reaches 1M c/s on an Intel P4 at 3.4 and 3.6 GHz. I intend to include that code into a post-1.7 version.)

Additionally, John 1.7 makes an attempt at generic vectorization support for bitslice DES (would anyone try to set DES_BS_VECTOR high and compile this on a real vector computer, with compiler vectorizations enabled?), will do two MD5 hashes at a time on RISC architectures (with mixed instructions, allowing more instructions to be issued each cycle), and includes some Blowfish x86 assembly code optimizations for older x86 processors (the Pentium Pro family, up to and including Pentium 3) with no impact on newer ones due to runtime CPU type detection.

Speaking of the actual features, John 1.7 adds an event logging framework (John will now log how it proceeds through stages of each of its cracking modes – word mangling rules being tried, etc.), better idle priority emulation with POSIX scheduling calls (once enabled, this almost eliminates any impact John has on performance of other applications on the system), system-wide installation support for use by *BSD ports and Linux distributions, and support for AIX, DU/Tru64 C2, and HP-UX tcb files in the “unshadow” utility.

Finally, there are plenty of added pre-configured make targets with optimal settings, including ones for popular platforms such as Linux/x86-64, Linux/PowerPC (including ppc64 and AltiVec), Mac OS X (PowerPC and x86), Solaris/sparc64, OpenBSD on almost anything 32-bit and 64-bit, and more.

Of course, all platforms supported by John 1.6 (including plain x86 running most Unix-like systems, Win32, or DOS) are still supported. Similarly, pre-compiled binary distributions of John 1.7 for Win32 and DOS are made available.

Source: Security Focus


11 March 2006 | 4,132 views

UK Could be Going TOO Far With Digital Laws

Types of activities that will become illegal under the proposed laws include making or supplying “hacking tools”- computer programmes or code that can help crack passwords or bypass security systems – and will be punishable by up to two years in prison.

Isn’t this legitimate action for any security enthusiast, hobbiest or professional involved in penetration testing or vulnerability assessment?

The law will also be clarified to make it illegal to hamper the operation of a computer, closing a loophole that has made it difficult to prosecute hackers for so-called “denial of service” attacks in which hackers bombard a computer system with hundreds of thousands of requests for information over the internet, so the servers are overloaded and cannot function.

I mean laws are all well and good, but the politicians have to wary and make sure they aren’t hurting people in the wrong places.

A major problem with the UK law at present (which called for this revamp) is under UK law DoS attacks (Denial of Service) are not illegal.

It can cost online companies millions of pounds in lost business when their websites are unavailable, but laws are not clear on whether simply stopping a computer from working is illegal.

Jeremy Beale, head of e-business at the CBI employers’ group, said: “There have been very few prosecutions under the Computer Misuse Act to date, but the new laws could give security a wider currency with businesses.”

I agree we need to protect legitimate business, but please, be reasonable with the laws and don’t punish us who are trying to educate and secure the world.

Source: Financial Times


10 March 2006 | 13,736 views

Post-Mortem Data Destruction

1. Introduction

This article describes and partly implements a method to delete or re-locate, potentially sensitive and / or incriminating information from your UNIX flavoured machine, after the sad event of your death.

An older version of this article has been published before, yet it has since disappeared from the Internet and the Google cache; hence this re-post.

Initially, the intent of the whole idea of Post-Mortem Data Destruction (PMDD), or Post-Life Data Destruction, was humorous. Thus, this document should be taken lightly.

Incidentally it can be of use to interested people as this article does contain some useful tips / pointers if one decides to build such a system. For some of you that lack common sense: any damage you might cause to your machine after reading this document is entirely your own fault.

Note that this article, obviously, assumes that the machine that the data is on, is under your own control. We will continue to look at various motivations for PMDD, below. Note that this whole theory does not apply when you are using remote storage systems (i.e. virtual drives) as the information is then stored on a remote location and we cannot be sure that the remote system really deletes your data. Their EULA might state that they do but the truly paranoid wouldn’t make the assumption that they really delete it. I sincerely wonder why one would actually ever use such a remote virtual drive — by definition these are un-trusted. But I slightly digress..

2. Motivation

You can have various motivations for wanting your data destroyed after your death:

  • You don’t want years of valuable research to fall into the wrong hands,
  • You don’t want your girlfriend or room-mates to find your collection of granny pr0n,
  • You are paranoid, or just uncomfortable with the idea somebody else will read your stuff after you have died.

Motivations for moving, i.e. sending out certain data upon the event of your death could be:

  • You are the maintainer of an important piece of software and you want the other people working on the project to have access to the latest modification you have made,
  • You suspect your elimination because of messing around with the wrong people, and want certain data (i.e. copies of emails) to be sent to, for instance, a newspaper.

After you have died, it’s too late: it will be virtually impossible to log in to your machine and delete data. Note that haunting is only reserved to a few (hurt) souls and such a state can not be guaranteed. Fat chance you’re able to sit behind a terminal in the after-life, too.

One could opt for encryption, making it hard for a person to recover the data — but that doesn’t really guarantee anything. In the event of your death, the partitions would be available to anyone that can get their hands on it. If the encrypted partitions are gone, they can never…

Let us continue by making a technical analysis of the problem at hand.

[...]


10 March 2006 | 22,804 views

SSL VPNs and OpenVPN – Part IV

4. Brief How-to …. Creating Multiple clients to Single site tunnels.

Example of using PKI to create a client-to-site VPN:

For a road warrior or roaming/multiple user scenario, static keys based VPNs don’t scale well. You will need to implement a PKI if you have Hub and Spoke architecture of VPN.

From the OpenVPN.net website:

Static Key advantages

  • Simple Setup
  • No X509 PKI (Public Key Infrastructure) to maintain

Static Key disadvantages

  • Limited scalability — one client, one server
  • Lack of perfect forward secrecy — key compromise results in total disclosure of previous sessions
  • Secret key must exist in plaintext form on each VPN peer
  • Secret key must be exchanged using a pre-existing secure channel

The following describes implementing PKI from OpenVPN.net’s OpenVPN 2.x How-to. For far more description and settings, please consult this howto.

If you want to use OpenVPN in a multiple client’s setup, then it’s recommended that you setup PKI first. A PKI will have;

– A certificate (Public key) and a private key for the server and each client

– A certificate authority (CA) certificate and key for signing server and client certificates.

Both server and client will authenticate the other by first verifying that the presented certificate was signed by the master certificate authority (CA), and then by testing information in the now-authenticated certificate header, such as the certificate common name or certificate type (client or server).

Generating the master Certificate Authority (CA) certificate and key:

For PKI management, we will use a set of scripts bundled with OpenVPN.

If you are using Linux, BSD, or a unix-like OS, open a shell and cd to the easy-rsa subdirectory of the OpenVPN distribution. If you installed OpenVPN from an RPM file, the easy-rsa directory can usually be found in /usr/share/doc/packages/openvpn or /usr/share/doc/openvpn-2.0 (it’s best to copy this directory to another location such as /etc/openvpn, before any edits, so that future OpenVPN package upgrades won’t overwrite your modifications). If you installed from a .tar.gz file, the easy-rsa directory will be in the top level directory of the expanded source tree.

If you are using Windows, open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):

init-config

Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don’t leave any of these parameters blank.

Next, initialize the PKI. On Linux/BSD/Unix:

. ./vars

./clean-all

./build-ca

On Windows:

vars

clean-all

build-ca

The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:

ai:easy-rsa # ./build-ca

Generating a 1024 bit RSA private key

............++++++

...........++++++

writing new private key to 'ca.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [KG]:

State or Province Name (full name) [NA]:

Locality Name (eg, city) [BISHKEK]:

Organization Name (eg, company) [OpenVPN-TEST]:

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:OpenVPN-CA

Email Address [me@myhost.mydomain]:

Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used “OpenVPN-CA”.

Generate certificate & key for server

Next, we will generate a certificate and private key for the server. On Linux/BSD/Unix:

./build-key-server server

On Windows:

build-key-server server

As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter “server”. Two other queries require positive responses, “Sign the certificate? [y/n]” and “1 out of 1 certificate requests certified, commit? [y/n]“.

Generate certificates & keys for 3 clients

Generating client certificates is very similar to the previous step. On Linux/BSD/Unix:

./build-key client1

./build-key client2

./build-key client3

On Windows:

build-key client1

build-key client2

build-key client3

If you would like to password-protect your client keys, substitute the build-key-pass script.

Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. "client1", "client2", or "client3". Always use a unique common name for each client.

Generate Diffie Hellman parameters

Diffie Hellman parameters must be generated for the OpenVPN server. On Linux/BSD/Unix:

./build-dh

On Windows:

build-dh

Output:

ai:easy-rsa # ./build-dh

Generating DH parameters, 1024 bit long safe prime, generator 2

This is going to take a long time

.................+...........................................

...................+.............+.................+.........

......................................

The final step in the key generation process is to copy all files to the machines which need them, taking care to copy secret files over a secure channel.

You can also generate the certificates and keys in their respective machines to bypass copying them over some secure channel.

Although your default installation will have sample client and server ovpn files, you can also find an excellent sample Client and Server configuration files here.

The sample files are pretty easy to understand and are common for Linux and Windows except for the part where config files look for "key" and "crt" files. On Windows, you will have to use double backslashes to quote a path. For example; "C:\\Program Files\\OpenVPN\\config\\foo.key" .

After configuring the files according to your network, you can put those "ovpn" files in the config directory of your installed path and start OpenVPN using these files.

That's it! Following these steps correctly will most probably have your VPN tunnel up and running. This translates into a VPN that's easy to implement, easy to maintain and dirt cheap. The choice doesn't get any easier than this.

4. OpenVPN in a Nutshell

OpenVPN is a free, open source GPL'ed software. Implementing it across your tunnel requirements not only is cheaper, but also easy to implement and maintain. It takes away the complexity of IPSec, and it introduces the security of SSL in VPN domain.

If you do face any problems; the OpenVPN.net mailing list and Mathias Sundman's website http://openvpn.de should get you all the help you require.

All the best SSL VPN'ing!!

Some excellent articles:

1. Meet OpenVPN By Hans-Cees Speel

2. Introduction to OpenVPN By David Bogen

3. OpenVPN GUI for Windows By Mathias Sundman

4. OpenVPN 2.0 TAP mini-HOWTO By cchee on forums.gentoo.org

5. To setup a VPN using OpenVPN on UIC.edu

Previously:

1. SSL VPNs and Using OpenVPN : What is an SSL VPN
2 .SSL VPNs and OpenVPN - Part II : Why OpenVPN?
3. SSL VPNs and OpenVPN - Part III : Brief How-to - OpenVPN and Site-to-Site Tunnels.


09 March 2006 | 17,689 views

Windows Rootkits

Windows Rootkits are a big rarity in this modern web hacking tehnology…
I won’t speak exactly about rootkits, because it’s impropriate to call them that way… why? Well rootkits are programs that aid you in getting access to root level users…

So in the case we are using Windows rootkits we should call them admkits (admin kits [©copyrighted to me of course])…. So let’s cut the **** and get down to serious business.

Note: the following admkits are from www.packetstormsecurity.org, there also could be others available on the net… not just the following 4

_ROOT_040

Windows NT Rootkit v0.04 alpha – Hides processes, files, directories, has k-mode shell using TCP/IP – you can telnet into rootkit from remote. Hides registry keys – (keyboard patch disabled in this build.) Includes execution redirection.

Fake Netstat

Fake Netstat is a windows copy of netstat which can hide certain network connections. Requires renaming the original netstat.

NT BindShell

Ntbindshell is a lightweight (24k compiled) cmd.exe backdoor for Windows. Full C source included. Provides two modes of operation – standard (listening mode) or reverse-connect mode. Includes the ability to install itself as a system service, providing a shell with LocalSystem privileges.

reverseTelnet

Reverse telnet redirector / port redirector and front end console for Windows. Perfect for firewall bypassing from inside out. Can be used for bouncing connections, piping or relaying data, or as a quick MIM chat server. Windows executable form only.

More information of course can be found in the readme files from the archive…


09 March 2006 | 21,437 views

SSL VPNs and OpenVPN – Part III

3. Brief How-to ….. OpenVPN and Site-to-Site Tunnels.

OpenVPN can be implemented either Site-to-site or client-server model. I will take example configurations of both models.

If you want to implement site-to-site configuration, the best way is to use static-keys instead of PKI. Using static keys, you can have your VPN tunnel up and running in a jiffy.

First, decide which Operating systems will be used for implementing VPN endpoints on your network. According to OS, download the OpenVPN software from these locations;

Linux: http://openvpn.net/download.html

I would recommend using Mathias Sundman’s “OpenVPN GUI for windows” for its sheer simplicity.

Windows: http://openvpn.se/download.html

Example of using static keys to create a site-to-site VPN:

In this example, a VPN tunnel will be created with a server endpoint of 10.33.66.1 and a client (peer) endpoint of 10.33.66.2. Encrypted communication between peers will occur over UDP port 1194, the default OpenVPN port.

First generate a static key using this command;

openvpn --genkey --secret static.key

Copy the static key to both peers over some secure channel. Heck, use a pen drive if you are paranoid and have access to both peers physically.

Copy the static key file in “config” directory of OpenVPN installation.

Create a configuration file named “server.ovpn” in the config directory of OpenVPN, and type this in the file;

dev tun

ifconfig 10.33.66.1 10.33.66.2

secret static.key

Now create a “client.ovpn” file in config directory of second peer which will effectively become a client for the server you created just now. Put the following in the client file;

remote remoteserverip

dev tun

ifconfig 10.33.66.2 10.33.66.1

secret static.key

The IP address of remote server will come in place of “remoteserverip” in the remote directive of client.ovpn.

Now start OpenVPN executables using these ovpn files that we created. If you get “Initialization Sequence Completed” in the window, most of your work is done. Now ping the other end of tunnel. If ping succeeds, you are done!

Always make sure that you have UDP port 1194 (or any port/transport protocol over which you plan to create a tunnel) open through the network. This may require manually opening the ports at the firewalls/routers at both ends.
If you want to access the networks behind the endpoint servers, there are two options. Either you use routing (TUN) mode or bridging (TAP) mode on your OpenVPN machines. For some obscure reasons if you want to allow non-routable protocols to be tunneled (like NetBIOS) then you will have to use OpenVPN in TAP mode. Bridging ensures that your VPN endpoints make a long reach Ethernet over your WAN.

If you decide that you want to use a routed (TUN) mode, then you must enable IP forwarding on the OpenVPN machine. The virtual interface can be made external interface and local area connection can be designated internal. It will basically become a router and you can do everything with this box that you could with Linux/windows based router.

Next: Creating OpenVPN tunnels for Clients-to-site scenario….

Read on in Part IV

Previously:

1. SSL VPNs and Using OpenVPN : What is an SSL VPN
2. SSL VPNs and OpenVPN – Part II : Why OpenVPN?