Dump Mac Ram Contents

My company installed AV and I saw it had a password with it. I wanted to know what that was so I decided to dump my RAM. Using this:

http://cybermarshal.com/index.php/cyber-marshal-utilities/mac-memory-reader

I was able to dump my contents to disk and open it in a hex editor to look for the portion that had the password. I found the password like i expected to, and i'm glad it isn't THAT awful a password like i feared.

sudo: unable to resolve host loldongs

Apparently if you just change the hostname in /etc/hostname, sudo starts crying that it cant resolve the new hostname.

It looks like you can just add an entry in /etc/hosts for your new hostname to point to yourself (127.0.0.1) and then it gracefully shuts the fuck up.

woot.

SSH2_MSG_KEXINIT and ssh connections dropping

For some reason ssh was just choking when i was trying to connect to my BT5 install. ssh 192.168.1.107 -vv would result in the connection being reset. It turns out that the server didnt have the proper keys installed by default.

sshd-generate fixed the issue. everything worked afterwards

Bash trivia trick

If you want to feel smarter than someone else, try this little trick.

Challenge the other person to create a file on the filesystem by sending the shell only 3 characters.

Answer? super simple:

>a

1: >
2: a
3: 'new-line'

now if you do an 'ls' you can see the empty file 'a' was created in the current directory. This is a short way to create an empty file on the local system. Basically what is happening is you are redirecting nothing into a file, since that file didn't exist previously, it created it. Hence, creating an empty file.

Now you can reserve 'touch' for more fancy trickery (timestomping)

Disable FireWire completely on Mac

using inception, its super easy to dump a Mac's ram through the DMA feature of FireWire. This includes plaintext login passwords. I tried it, i saw my password, i wept.

Next step? obliterate firewire.

First step, move the firewire kext folder to you home directory for a backup:

sudo mv /System/Library/Extensions/IOFireWireFamily.kext ~

then make a placeholder directory for kicks and fun

sudo mkdir /System/Library/Extensions/IOFireWireFamily.kext/

then boot the mac using a system disk to set an openfirmware password.

once you set the password, the attack kind of stops working.

woot.

Apache Default File Layout

http://wiki.apache.org/httpd/DistrosDefaultLayout

Remove the Service fingerprint from nmap xml file

sed 's/servicefp=.*" //g' first-pn.xml > f.xml

simply matches the servicefp (including the tag itself) and replaces it with null, globally.
first-pn.xml is the source file, f.xml is the output

Hide users from net user

Cute, apparently you can hide users from the output of "net user" by appending a $ to the name. It still shows up if you look for it explicitly or if you go to control panel.

net user cats$ lolwutcats? /add

Homebrew and pianobar

PromyLOPh pushed a patch today to fix pianobar so it would be compatible with a recent protocol change. Apparently Pandora has changed from using TLS to not using TLS...Well thats all fine and great but I use homebrew for mac to maintain my packages. I wanted my pianobar updated NAOW. so i started looking around...

-First i ran "locate pianobar" to get an idea of where the files were located.
-"/usr/local/Library/Formula/pianobar.rb" caught my eye so i looked into it...
- The ruby file has a few entries in it, but towards the top is this code:
class Pianobar < Formula
url 'https://github.com/PromyLOPh/pianobar/tarball/2011.12.11'
version '2011.12.11'
homepage 'https://github.com/PromyLOPh/pianobar/'
md5 'c8573c133851ff54649d1ab45c7b855c'

-this obviously looks like where it tells homebrew to download and install the program. so what happens if I change those values to reflect the most current version?
-I opened the ruby file in vim and changed the settings:
class Pianobar < Formula
url 'https://github.com/PromyLOPh/pianobar/tarball/2012.01.10'
version '2012.01.10'
homepage 'https://github.com/PromyLOPh/pianobar/'
md5 'a703227c079cb0fe20ac4abbdfbc6f08'

-saved, and ran "brew upgrade pianobar"

==> Upgrading pianobar
==> Downloading https://github.com/PromyLOPh/pianobar/tarball/2012.01.10
######################################################################## 100.0%
==> make PREFIX=/usr/local/Cellar/pianobar/2012.01.10
==> make install PREFIX=/usr/local/Cellar/pianobar/2012.01.10
/usr/local/Cellar/pianobar/2012.01.10: 16 files, 176K, built in 3 seconds

-awwww yeahhhhh now i have my crack back in my spoon.

What Linux distro/version is running

Most people know about uname -a to get a good amount of information. However, if you want an easy way to discover the distro/version you can run:

cat /etc/issue

The problem is that /etc/issue was never meant to keep track of the release version. So it may not exist on certain machines. I believe the most reliable method would be to:

cat /etc/*release

or

lsb_release -a