The DMZ

AviD

01:14

For @ThomasPornin....

Adam McKissock

03:36

Anyone around?

Scott Pack

Gods no. It's nearly midnight in the proper time zone.

Adam McKissock

3:42am here

Trying to pop a box and having no luck :(

Scott Pack

Nobody gets it right the first time.

3

Adam McKissock

Been on the go for about 24 hours now

Scott Pack

The joys of youth to be sure.

Adam McKissock

03:45

Heh

Its really starting to piss me off

Its a bloody windows box aswell

Terry Chia

04:05

@CodesInChaos It's pretty decent for passing time IMO. Good mindless slaughter.

Adam McKissock

ARRRGHGHH!!

Terry Chia

@AdamMcKissock Go get some sleep and attempt it again.

Adam McKissock

@TerryChia Tried sleeping earlier, kept thinking about it

theres only three bloody ports open

Jeff Ferland

04:22

yawn

@Adam: go run five miles, that'll get you some sleep.

Adam McKissock

@JeffFerland five /miles/? I couldn't run five meters

Scott Pack

05:10

Well there's your first assignment.

Terry Chia

09:03

To any students hanging around in this chat room: microsoft.com/security/gssd/contest.aspx

Antony Vennard

11:58

@TerryChia I wonder if a part time student, full time employed person counts?

@ThomasPornin not sure if this ping will reach you, but if possible could I ask some questions about smart cards at some point please?

Specifically, do you have any experience/recommendations on SC for Linux.

Anyone else who knows, also feel free to answer :D

Lucas Kauffman

12:35

@AdamMcKissock so any luck popping that cherry?

Terry Chia

@AntonyVennard Heh, dunno.

0

Q: HOTP with as HMAC hashing algoritme a hash from the SHA-2 family

I'm looking into using a OTP solution. HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way. But... SHA1 (as we know) has been broken. So, now i'm looking into using a hashing algoritme from the SHA-2 family as the hash for my HOTP ...

Uggggggh.

CodesInChaos

13:33

@TerryChia hm?

Terry Chia

14:05

@CodesInChaos The whole "I heard this is broken although it's really not, what can i do to fix it???" thing is a drag sometimes.

Scott Pack

in The Comms Room, Feb 12 at 20:24, by voretaq7

Hm. So. I have a situation where I want to be able to pass multiple arguments to a bash subroutine, some of which may not be used.

AviD

@ScottPack you should use jquery.

Scott Pack

In perl I would put them in a hash and pass the hash.

@AviD Get back to SO plebe.

AviD

hahaha

@ScottPack you can do the same thing in Ruby.

Terry Chia

@AviD Because Ruby is a better version of perl apparently.

Scott Pack

14:20

The best I can come up with is start_test X${file} X${speed} and then if the variable is only X then I can assume it wasn't used.

The only ruby I've had to deal with so far is by way of puppet. Largely erb

AviD

@ScottPack I'm going to go out on a limb here, and suggest that I probably would not be very helpful here.

I only popped in for the jquery comment.

Scott Pack

@AviD As expected.

I think I have a hackish workaround, but I don't know if there is a better way or if I'm hitting the edges of bash script complexity.

Gilles

14:33

@ScottPack there's a site for that

Scott Pack

jerkface

Gilles

and even a chatroom, I've stopped boycotting the U&L chat

Scott Pack

Seriously dude. That's like totally effort.

Google didn't tell me on the first page.

Gilles

I don't understand what you're trying to do anyway

@ScottPack why the X anyway?

Scott Pack

I'm grabbing command line arguments using getopts. Both $file and $speed are optional.

So when I start grabbing $1 and $2 in start_test the actual content of those locations may be inconsistent.

So sometimes $1 may be the filename and sometimes it may be $speed

Gilles

14:38

are you using getopts (myscript -f FILE -s SPEED), or positional arguments (myscript [FILE [SPEED]])?

see, that's why you should ask a question: it would force you to write down all your requirements

Adnan

Has anybody seen the new httpOnly cookie exposure exploit?

Scott Pack

I was using the X to force that argument to be not empty

Adnan

Damn it! It's not as new as I expected!

Scott Pack

@Gilles I'm using the former

Gilles

@ScottPack using an empty argument to indicate that it's missing is the usual thing. Why aren't you doing that?

Scott Pack

14:41

Well, I'm using the former on the command line. I was doing positional on the subs.

Terry Chia

@Gilles Where will bash scripting questions be more on-topic, U&L or SO?

Scott Pack

I hadn't actually considered using getopts on the subs. My gut is that it seems awfully heavy, but it may be the "best" method.

Gilles

@ScottPack usually you wouldn't. Pass an empty argument if you want the function to fill in its default value

I still don't understand where you're running into trouble

@TerryChia either

Scott Pack

I don't understand how I can pass an empty argument to a sub and have it recognize that an argument was empty.

Gilles

um, by passing an empty argument?

then if [ "$1" = "" ]; then echo "got an empty first argument"; fi

You might see [ x"$1" = x ] or the like sometimes, but that's only required on a few ancient Bourne shells

anything that shipped this millennium, including Solaris /bin/sh, will cope with [ "$1" = "" ] reliably

Scott Pack

14:45

But if I'm passing 3 arguments, and the second one is empty?

Gilles

if [ "$2" = "" ], what's the difficulty?

Scott Pack

so mysub $file $num $speed, where $num is empty, will actually result in $1 = $file, $2 = "", and $3 = $speed ?

Gilles

oh, I see

No, you need to write mysub "$file" "$num" "$speed"

Always use double quotes around variable substitutions

Scott Pack

That makes sense.

Gilles

If you don't put double quotes, the value of the variable is split into words, and each word is treated as a glob pattern

so if $file is hello *, and you write mysub "$file", then mysub received one argument, which is a 7-character string

Scott Pack

14:48

Sure. I've never actually had a situation where I didn't know the values would be split.

Gilles

but if you write mysub $file, then mysub receives the argument hello, and then one argument per file name in the current directory

Scott Pack

So it's a practice I never really needed to think about, so I never did.

Gilles

it's extremely rare to need the split and expansion to happen, actually

it's bad design in the Bourne shell really

Scott Pack

I suppose we need a baash.

Gilles

but no successor shell has dared to fix it except zsh

Scott Pack

14:50

That does make a lot of sense, though. Certainly a practice I should get myself into.

Gilles

@ScottPack If you don't do that, give me a way to name files on your machine and I can probably root it

Scott Pack

I'd rather not. :)

This is really the most complicated bit of bash I've ever written. Normally they're just quick throwaways.

Do you have any opinions on $var versus ${var}?

Gilles

23

Q: $VAR vs ${VAR} and to quote or not to quote

I can write VAR=$VAR1 VAR=${VAR1} VAR="$VAR1" VAR="${VAR1}" the end result to me all seems about the same. Why should I write one or the other? are any of these not portable/POSIX?

shell shell-script environment-variables posix quoting

Scott Pack

So I had in my head you were a mod on unix. Was that ever correct?

Gilles

@ScottPack no

I'm the biggest answerer, biggest retagger, biggest flagger, ... but I've never been a mod

Scott Pack

14:55

@Gilles Good, it appears that I had that one correct.

Whenever I think of that site you are, of course, what I think of. I suppose it's natural.

Unless you don't have a beard. In which your Unix accumen would be exceptionally unnatural.

TildalWave

Is it just me or does @ThomasPornin give the best answers when OP angers him somewhat with blatant misconceptions? HMAC/SHA-1 one is yet another example.

Gilles

@TildalWave link?

TildalWave

1

Q: HOTP with as HMAC hashing algoritme a hash from the SHA-2 family

I'm looking into using a OTP solution. HOTP is a OTP solution that is based on a HMAC with as hashing algorithm SHA-1. The standards defines it this way. But... SHA1 (as we know) has been broken. So, now i'm looking into using a hashing algoritme from the SHA-2 family as the hash for my HOTP ...

hmac otp

was posted before by @TerryChia here, I was just reading what's new in DMZ

I think that it's the case of him trying to adjust his answer to OP's level of understanding, which forces him in giving more explanations. From the readability standpoint, I find these answers by far the best, and sometimes (if he's angered badly) the funnies too

Terry Chia

@TildalWave Heh. His snark is always funny.

Unlike @ScottPack's.

TildalWave

@TerryChia there there

Scott Pack

15:02

@TerryChia I do shave my neck every few days.

Terry Chia

@ScottPack Is there a particular reason why whatever you are doing must be done in bash?

I try to stay as far away from writing bash scripts as possible since most Linux/Unix boxes comes with python anyway.

TildalWave

That was a rhetorical question , right?

Scott Pack

@TerryChia It's an automation script to run tests for my thesis. So two reasons: 1) It started out in bash because it's really just putting logic around a bunch of shell commands. 2) I'm doing enough shell commands that I don't want to have to deal with something that just calls system all the time.

CodesInChaos

@TerryChia Well SHA-1 is broken, just not in that case

TildalWave

@ScottPack oh c'mon that had a lot funnier answer

CodesInChaos

15:05

It's natural to wonder if its broken in the scheme you want to use

Scott Pack

@TildalWave meh

TildalWave

@ScottPack Bash & Python comparison? You can resist? :O

Terry Chia

@TildalWave python/ruby/perl/whatever >>>>>>>>> bash.

Scott Pack

Python makes me feel skeezy and I get lost trying to read it. I can't really say anything else about it.

2

TildalWave

@TerryChia sure, but I wasn't really thinking of real comparisons, I meant more in a sense what meaning can be constructed by using their names ;)

Scott Pack

15:07

I honestly don't really like programming. If I can get something done then I'm ok with it. I don't care enough to super optimize the language to the task.

Terry Chia

@TildalWave Ahhh. Right.

@ScottPack This. But I wouldn't really call bash/python scripting programming.

Scott Pack

@TerryChia Call it what you will. It's programming enough.

Gilles

I wrote 20 short programs in Python yesterday. It was wonderful. Perl, I'm leaving you.

3

TildalWave

@ScottPack I'd call myself a programmer but I don't like programming either. I think that's quintessential to good programming and lazy programmers in general write better code anyway. When I say lazy I don't mean in a sense not to do anything, but it often pays to think about something twice before actually writing it. And... I hate those that just write without thinking about it

Terry Chia

Meh, I don't mind throwing together a few lines of codes to do whatever I have to do. Writing an application with OOP, unit testing and what not just annoys me.

Scott Pack

15:11

@TildalWave That's largely me. I would rather go back and refactor than plan it out. Primarily because if I'm going to write something it is to accomplish a very specific task. Generally right fucking now.

Terry Chia

I heard IPython is actually pretty nice if you are calling a lot of shell commands. Haven tried it out myself though.

Scott Pack

@TildalWave Granted, I will put extra effort into readability and will try to follow some semblance of good practice. I want someone else to be able to pick if up if they need to, and I don't want to be embarrassed by something I produce, but I also don't care enough for it to be impressive.

TildalWave

@ScottPack OK but that would be for completely different needs. Scripting is fine if it does the job. But it doesn't sell very well. And that's what I have to cater to also.

Scott Pack

@TildalWave Oh sure. That also goes back to our personal viewpoints. You call yourself a programmer. I actively reject that title. :)

Lucas Kauffman

@ScottPack That's because you are The Pack

Scott Pack

15:15

@LucasKauffman That usage makes me wish I had a more awesome name. :(

TildalWave

@ScottPack I guess it all boils down to with how limited applicability you're ready to live with. And how much resources you're ready to spend on generic solutions that might cater other needs as well. It's a fine balance and honestly, with me the money decides which one is better

Scott Pack

@TildalWave Exactly. I'm not paid to produce generic solutions. I will sometimes automate the work I'm paid for with a script.

On second reading If that at all sounds judgey or condescending please remove any relevant undertones.

TildalWave

@ScottPack I barely ever write generic code for myself even, it's just too time demanding... and I can't afford myself to do it any other way than scripted LOL

@ScottPack I didn't read it like that at all... I agree completely... just don't read this as if I'm trying to be nice with you, b'cos I'm not! :P :P

Scott Pack

Whatevs.

TildalWave

@ScottPack (joking)

Scott Pack

15:20

I have respect for people who program for a living, I just have no interesting in doing that job and don't like when people who can't even do basic scripting refer to me as one.

People seem to think that because I have a CS degree that I must be a coder. Poor saps.

TildalWave

What was you first programming language that you learned and how much do you still use it? Just curious.

Scott Pack

AmigaBASIC, and none at all.

After that C, and none at all.

After that perl, and somewhat. I find it quite useful for automation and text processing.

TildalWave

I started with ASM and still use it, but really rare... then of course all kinds of BASIC variants but mostly for fun on Amigas and 8080... use sometimes VB but that's kinda completely different. Then moved to Pascal/Fortran and later Object Pascal. Still trying to write as much as possible in OP, I love it. Then all hell broke loose and used (or had to) a lot of other languages, with some languages no one here probably even heard of, such as Avenue for GIS. I kinda hate C, though.

And all other languages that are commonly mentioned here... Perl, Python, Java, JS,... these I don't use often but there's nothing to it once you've written in so many languages they're all much the same. The rest is then just what IDEs and compilers you have available and in which of these you feel most comfortable.

Terry Chia

15:38

@TildalWave I think Visual Studios is still one of the best IDEs I have used.

That's the primary reason I like writing C# code now.

TildalWave

@TerryChia To me it's Delphi, but the older versions from Borland, now it's much the same as VisualStudio... I use Eclipse IDE now most often. Oh, and Notepad++ :)))

Terry Chia

@TildalWave Heh. I wouldn't really consider Notepad++ an IDE.

TildalWave

@TerryChia Delphi and Kylix (Linux version)

Terry Chia

I gotta spring for PyCharms soon though, since I write python code the most.

Scott Pack

Aye. That's definitely an opinion I hold. A language is just a tool and syntax. A programmer, as opposed to a coder, should use whichever tool is most appropriate and should be able to switch between them.

TildalWave

15:43

@ScottPack If you're a good programmer, you should be using F1 key the most. If you're not, chances are you don't have much of a life when away from the keyboard. :)

Gilles

@TerryChia I like its debugger integration, but boy does the editor suck

Rory McCune

@TerryChia I'm trying out Sublime text at the moment as a potential cross-platform Notepad++ a like...

Terry Chia

@RoryMcCune That looks interesting... I need a decent editor for OS X anyhow...

Gilles

@TerryChia If you'll take a good editor, Emacs is available everywhere

If you're targetting decent, vim is available everywhere

Rory McCune

@TerryChia I'm liking it so far, although like most things it'll take time to get used to the keyboard shortcuts..

Terry Chia

15:48

@Gilles Really? Why? Can't say I use a wide variety of tools before.

@Gilles I'm a vim guy more than emacs. Always open to alternatives though. Gonna evaluate sublime when I have the time.

Rory McCune

@Gilles I've found that I don't really spend enough time in an editor to make the learning curve on either of those practicable...

I'm barely ok in vim

Terry Chia

@RoryMcCune Interesting, the goto feature seems a lot like vim.

Scott Pack

@TildalWave eh?

Rory McCune

@TerryChia see that's why I'm still on GUI editors, with them I can look at a menu option if I don't use it a lot, then if I use that option loads I can take the trouble to learn the shortcut..

Scott Pack

From what I recall vim? is more universally installed, but emacs is also universally available.

These days I wouldn't be surprised to hear that emacs is installed by default, along with vim, on 90% of systems.

TildalWave

15:52

@ScottPack Too many things to remember, and if you try it'll go nasty :) I use F1 all the time, even for function calls I've been using for 10 years or more. I just find it worth more remembering some anniversaries than what arguments some API function takes

Terry Chia

@ScottPack I see quite a few systems that come with vi by default. Horrible, horrible vi.

Scott Pack

@TildalWave Care to save me the trouble of goggling what F1 is supposed to do?

Gilles

@ScottPack contextual help, presumably

TildalWave

@ScottPack Ah... sorry, F1 key for help LOL

Scott Pack

@TerryChia That's kind of my point. One can always assume vi is installed. If it's newish then you'll have vim.

Terry Chia

15:53

@ScottPack Help in most things.

Scott Pack

So does F1 send a signal that automagically opens a man page for you?

I've never heard of SIGMAN

On that note, time for me to eat lunch and move onto ironing. Gentlemen.

TildalWave

@ScottPack In most IDEs yes. Delphi is really good at that, but some others enable help file imports so they work contextually

@ScottPack Enjoy! ;)

OT, I need to draw blog overlay icons... one for blog itself, and one for individual posts... what would be good representatives for blog? I kinda don't like those generic blog icons that I found via google search.

Oh, and I already have news and announcements, so they have to be different than those. Any suggestions?

I have these so far... what items could represent blog that aren't any of these?

but I don't want to use any like this one:

Lucas Kauffman

16:28

@ScottPack perl? PERL? I should slap you with a wet fish!

@ScottPack The problem with emacs is that it's basically an operating system on its own

Scott Pack

17:53

@LucasKauffman Children are cute when they get indignant over a personal preference that doesn't agree with theirs. :)

Lucas Kauffman

@ScottPack :P

I prefer Eclipse for all my development, but for scripting I mostly use vim with some plugins to have auto completion

TildalWave

18:38

how does this one look?

and a test case

Lucas Kauffman

any assembly experts here?

0

Q: Floating Point Exception when dividing in x86 nasm

I'm busy with learning Assembly and was looking at dividing, however I ran into a pickle with the following statement: mov edx,0x00000001 mov eax,0x00000000 mov ecx,0x00000002 idiv ecx GDB: 0x08048071 <+17>: mov edx,0x1 0x08048076 <+22>: mov eax,0x0 0x0804807...

linux x86 nasm

TildalWave

wow how did the answer get 2 upvotes in 10 seconds? buy yeah you're overflowing it

Lucas Kauffman

18:57

yea forgot I can only go up to 2147483647

TildalWave

next lesson, handling exceptions :)))

Thomas Pornin

19:13

@AntonyVennard Professionally, I deal with smartcards on Windows, not on Linux. They're all full-Microsoft here.

Lucas Kauffman

@TildalWave there is a try catch in assembly?

@ThomasPornin needed to ask you something, suppose an implementation would check a smart card for identity, (extract name or personal id from the card) BUT the software checking this data does not verify the CA used by the card. How would you be able to set up a PoC that proofs this is a risk?

I was thinking about making my own smartcard with the data or using an emulator, unfortunately I haven't found any emulators :/

Thomas Pornin

@LucasKauffman As much as there is a throw...

The typical implementation of throw (in languages which have such things) is the equivalent of C longjmp(): jump to an address read from a given structure. A try..catch is then translated to setting and resetting the address in the conventional slot where throw will look the address to look for.

Now of course @TildalWave was talking of something different

There are two meanings for "exception" in that case:

1. a situation which differs from the general case. Here, this means making some tests on the operands before doing the idiv

Lucas Kauffman

aha I see

Thomas Pornin

2. the "exceptions" triggered by the CPU itself, and handled by the kernel (it uses the table of interrupts, thus it is kernel-level business). For your idiv, the CPU triggers a specific exception, which the kernel traps and translates into something else, e.g. a SIGFPE on Unix-like systems.

@LucasKauffman For that, simplest would be to use a real smartcard but load a handmade certificate in it (basically a self-signed certificate, OpenSSL can do that).

I don't know of emulators for Windows (CryptoAPI), but on Linux smartcards are usually processed through the PKCS#11 API: the application only sees a DLL. You could write a PKCS#11 DLL which emulates a smartcard.

Some googling should find some references.

Firefox embeds something like that in its code, if I remember correctly.

Lucas Kauffman

19:31

@ThomasPornin yea the problem was it only worked on IE

do you need special hardware to make your own smart card?

or is a reader enough?

Thomas Pornin

@LucasKauffman IE uses Microsoft's CryptoAPI, hence the "Base Smartcard CSP" which itself feeds on a smartcard-specific driver (called a "MiniDriver")

@LucasKauffman there is a standard for how I/O with cards is done (it is called APDU) but this is only formatting. The APDU contents tend to be specific to each smartcard

which is why there is a driver from the smartcard vendor

Lucas Kauffman

aha

Thomas Pornin

Windows will download the driver when it sees the smartcard, but it will do so only when seeing the real hardware, and the driver will have to be signed by Microsoft.

Antony Vennard

@ThomasPornin Ah okay, hmmm, shame. Do you think most of the smart cards on Windows would have decent PKI implementations on Linux?

I'm looking to using smartcards for a project of mine, and I did think about just buying a reader and a couple of cards, but wondered if there was card better suited (i.e. supported) by Linux distributions.

Lucas Kauffman

@ThomasPornin Also I see there are different types of smart cards: smartcardworld.com/SLE5528.htm

how can I know what card would be best suited for me?

TildalWave

20:10

@LucasKauffman BTW you said in the comment to the answer "Ah stupid mistake"... not stupid at all and we've all been there. In our class assignment doing much the same you are, not a single one in the class got it on their own, that would be including me. And yes, we took integer ranges and signed/unsigned before, we all just forgot due to being overwhelmed by ASM itself.

Lucas Kauffman

@TildalWave yea I had asm about 3 years ago, it's all far :/

TildalWave

@LucasKauffman @ThomasPornin answered that already, but specifically for NASM you can find safe structured exception handling example here: nasm.us/xdoc/2.10.07/html/nasmdoc7.html#section-7.5.2 But I'd warn against jumping forward and go by the book. This is section 7 for a reason, and you should first master sections 4-6 in the manual before dealing with it AND understanding it.

Lucas Kauffman

ow boy, I need more time

TildalWave

@LucasKauffman hehe think of it as binding DNA structures... this is what love is all about and you can't hurry love ;)

Lucas Kauffman

@TildalWave except assembly doesn't come with boobies :(

TildalWave

20:22

@LucasKauffman wait, that's in section 18+

Lucas Kauffman

"I want you to overflow me hard"

3

TildalWave

this is "ASM porn" nasm.us/xdoc/2.10.07/html/nasmdo10.html ... as you can see, you can do it the wrong or the right way... it's all in the way you push

Thomas Pornin

20:47

@AntonyVennard It really depends on what you want your smartcard to do.

Antony Vennard

@ThomasPornin Mostly store key data. I'd be looking to use it in the same way firefox does, for storing passwords.

Thomas Pornin

Do you want it to just store a secret value ? Or to do crypto with it ? Maybe asymmetric crypto ?

Antony Vennard

@ThomasPornin I think probably it should do crypto onboard, right? Otherwise you may as well store the key on disk, because the key still touches the OS, which is what I

was really hoping to avoid

Thomas Pornin

@AntonyVennard Smartcards are not very good at storage. What is typically done is that the data is encrypted with a key which is in the smartcard, but the encrypted data itself is not stored on the card.

Antony Vennard

Unless I'm missing something?

@ThomasPornin Ah sorry, I mean as a way to encrypt the passwords like the firefox software security device.

I understand you can use smartcards in place of passwords for storing firefox passwords. I'd be looking to do the same thing but in my own application.

At the moment, this is only a conceptual thing - the password manager I'm working on currently does pbkdf to encrypt things for storage (or it will do when the bugs in the file code are ironed out). I thought supporting smartcards would be a nice addition, but I know zero about them!

Thomas Pornin

20:52

@AntonyVennard For instance, this one should work: safenet-inc.com/products/data-protection/…

It claims to be compatible with Linux

It can apparently do 2048-bit RSA (store the key but also use it)

Antony Vennard

@ThomasPornin Okay thanks! I'll take a look and see if I can pick one up - I'll let you know how I get on if you're interested?

Thomas Pornin

@AntonyVennard Yes, I am interested

Antony Vennard

I found a recommended reader for a decent price mentioned on the OpenSC project website.

@ThomasPornin Okay. I'm going to see about ordering one tomorrow AM, then whenever it arrives, I'll have a play and report back. Thanks!

TildalWave

21:34

1

Q: Is it possible to detect infection in PSP Go game console?

My PSP is acting like it could possibly be infected. It is locking up and then turns off during game play. There are also problems during games that could be related. This is a replacement PSP machine because I thought my old one was defective but now this one is doing the same thing. Someone...

malware

I was investigating possible answers for this question, and then found this gem.

It's hilarious, but the best part is in post from user Massa :)))

and if that didn't tickle your fancy... here's another gem

Lucas Kauffman

22:26

ist the main site broken?

Thomas Pornin

@LucasKauffman Not from here. However, I do have trouble reaching tools.ietf.org. Maybe the Internet is just dying.

Lucas Kauffman

they broke the internet? Godamnit!

Adam McKissock

Right, this is annoying me now.

Lucas Kauffman

22:41

@AdamMcKissock still trying to get in that windows box?

Adam McKissock

@LucasKauffman Aye

@LucasKauffman I'm starting to get really depressed

Lucas Kauffman

before we proceed, is this legal and can you get passed it?

Adam McKissock

@LucasKauffman Yes of course it's legal

Lucas Kauffman

alright then and the box is vulnerable :p?

Adam McKissock

@LucasKauffman I have been told that it is, yes

Lucas Kauffman

22:44

alright what services did you discover?

@AdamMcKissock also get yourself a cup of camille tea and listen to this: youtube.com/watch?v=JMPYmNINxrE

Adam McKissock

80/TCP - IIS 6.0 Install with Frontpage Extensions
110/TCP - Microsoft Windows 2003 POP3 Service 1.0
3389/TCP - MS TerminalService

Lucas Kauffman

alright ms08-067 would probably be too easy :p

are you allowed to throw nexpose against it?

Adam McKissock

Anything is fair game

Lucas Kauffman

throw nexpose at it

Adam McKissock

Just grabbing it

Tea: Aquired

taking its sweet time

Lucas Kauffman

22:52

it takes a while to start up

Adam McKissock

i mean to download

Lucas Kauffman

but it's like a giant sledgehammer

Adam McKissock

afaik its not included with BT5

Lucas Kauffman

nope

Rory McCune

@AdamMcKissock it's a bit old-school but there was a buffer overflow in frontpage extensions back in 2003

Lucas Kauffman

22:54

it's payware

up to 32 ips it's free :p

Adam McKissock

@LucasKauffman Only need the one :)

Rory McCune

@AdamMcKissock metasploit.com/modules/exploit/windows/isapi/… hmm looks like W2K only for that one

Lucas Kauffman

maaybe you need to rewrite the exploit?

Adam McKissock

@RoryMcCune Yeah, that one doesnt work for 2003

unfortunatelly

Rory McCune

TBH my money would be on a hidden file on the IIS6 web site. 3389 doesn't (AFAIK) have any buffer overflow exploits and I'm not aware of any for POP3 either...

Adam McKissock

22:57

@RoryMcCune Yeah, I had a feeling about FP, but after trying multiple exploits for it, none of which were working...

the IIS install appears to have PUT enabled, but there arent any dirs with write access

Rory McCune

so if you've not already I'd use nikto/DirBuster to see if you can find any content on it

Lucas Kauffman

@RoryMcCune MS08-067 is on 3389 iirc

Rory McCune

@LucasKauffman nope 445

it's an SMB exploit

Lucas Kauffman

ah

I thought there was an RDP exploit as well a few years ago

or even last year

Rory McCune

@AdamMcKissock ahh what about WebDAV and the encoding bypass

@LucasKauffman MS12-020 is theoretically a remote code exec. but there's no public code for that, just the DoS

Adam McKissock

22:59

@RoryMcCune Tried the one in metasploit, didnt seem to work

@RoryMcCune Yeah, that one works but its DOS-only

Lucas Kauffman

@AdamMcKissock so you DOS the damn thing until it crashes

Adam McKissock

@LucasKauffman I need to get into the box

Lucas Kauffman

it won't give you any points but at least it will help you get less frustrated :D

Adam McKissock

@LucasKauffman Aye, blue screened it a few times with 12-020

Rory McCune

@AdamMcKissock you could try this skullsecurity.org/blog/2009/…

just to make sure it's not the metasploit module being lame

Adam McKissock

23:02

rgr

Rory McCune

BTW you checked for UDP ports?

SNMP with default community strings is always a fav.

Adam McKissock

@RoryMcCune Yup, nothing

Lucas Kauffman

my favorite one so far was root root on a vshpere

Adam McKissock

@RoryMcCune Also checked all the TCP's up to the stupid high 65000~ number

Rory McCune

@AdamMcKissock blech.

Adam McKissock

23:06

_http-iis-webdav-vuln: WebDAV is ENABLED. No protected folder found

Rory McCune

Hmm wonder how it finds folders. If it can get a directory listing then that's a dead end there are no folders there, but if it's just brute-forcing, a better brute-force to discover folders might be useful (e.g. DirBuster)

BTW have you tried just brute-forcing the RDP login, or is that out of scope?

Lucas Kauffman

@RoryMcCune if that's the answer I think he will eat his hat :p

Adam McKissock

tried dirbuster, all it could find was /images/

@RoryMcCune havent tried it, and it isnt out of scope

Rory McCune

@LucasKauffman well ya know never hurts to try the obvious :)

Adam McKissock

Literally been told to go nuts

Lucas Kauffman

23:10

@RoryMcCune yea indeed

@AdamMcKissock maybe that's the idea, it's completely secure and you will go mad

Rory McCune

@AdamMcKissock worth a punt then, you never know hit up the administrator account see if you get somewhere. I was thinking there might be an user enumeration possibility via POP3

so you can use that to get valid account names

then brute force the password over RDP

I've not tried user enum over POP3 recently but it seems like it could be plausible

Adam McKissock

can you enumerate with POP3?

Rory McCune

well Metasploit has an aux scanner for pop3...

I've not tried it mind, but if it gives different error for valid/invalid usernames it would be handy

either way you can try common username/password combos...

worst it'll do is lock the account and as it's a test system users shouting at you isn't a concern :)

(that problem is why I don't usually do brute-force attacks, locking out all the users on a live system tends to end badly....)

and with that I'm off to sleep, lovely day of report writing ahead of me tomorrow :)

Lucas Kauffman

@RoryMcCune that's a finding :P

yea me too :(

good night!

Adam McKissock

@LucasKauffman :(

Gilles

23:36

0

Q: How to download a file via SSH without an illegal move

If you ever go to an url from google for example. google will warn that it is a possible hacking web site given that the url looks like : user_name:pass_word@web_site_url this is considered an illegal hacking web site by google browsers even by Apple browsers such as safari. they display a wa...

ssh sshd

do we want this on Sec.SE?

Scott Pack

23:51

I don't know.

It certainly seems more topical here than SO, but...

Transcript for