Your MD5 is wrong

This is an annoying display of ignorance on the part of many people at certain conferences. They will enter a contest and often times the answer must be submitted in the form of an md5 hash. So they will solve the puzzle and the secret key to give them points will be "kittens". They need the MD5 of the string "kittens" so they run the following:

echo 'kittens' | md5sum
f261adc7c891836ecc58c62fb80c6e34

They submit that hash to the scoring engine and it says INCORRECT, TRY AGAIN. "Well wtf...lets check our answer again". *1 minute later* "yeah its definitely right, their scoring engine must be broken or something"

I've heard that muttered all too often at contests and it makes me cringe. Here is what went wrong, and the scoring engine is working perfectly fine, you just dont understand how echo works. It helps if we look at things with our hexray vision.

echo 'kittens' | xxd -p
6b697474656e730a

you see that? whats that last character? '0a' - if you look up what '0a' means in the ascii table (man ascii), you will see that it represents  the new line. echo, BY DEFAULT, appends a new line to whatever string you wrote. That folks, is what fucked up your hash.

echo -n 'kittens' | xxd -p
6b697474656e73

now the 0a is gone. now pipe your new echo command into md5sum and you have the correct hash the scoring engine was expecting.

you could avoid the whole issue if you used printf instead of echo. To visualize this:


printf kittens | md5sum
84169a8d5b3289e8ece00d7735081b53  -

echo kittens | md5sum
f261adc7c891836ecc58c62fb80c6e34  -

echo -n kittens | md5sum
84169a8d5b3289e8ece00d7735081b53  -

just an fyi: apparently bsdutils of 'md5' have a -s for string argument that does it all in one go:


md5 -s kittens
MD5 ("kittens") = 84169a8d5b3289e8ece00d7735081b53

Bad Passwords and Password Complexity

I've heard this time and time again: "We are ok, we require password complexity". lulz, are you serious? I'm not even going to get into how bad windows "password complexity" or the rest of their policies are. I'm just going to remind people of this one simple truth:

Password policies only apply on new passwords.

Which means, if you had accounts before you enabled the policies, you may still be at risk for accounts with password of password, or same as username, or other really retarded "it would never happen to me" passwords.

This is the exact reason why I STILL find weak passwords in environments where password complexity is on, minimum password length of like 20. jimbob's password is still jimbob, because he created that password before the policies were enacted.

Solutions?

Well you could set every person's password to require a change on next login. and then set the password change interval for every 30 days. But, thats not enough. Because you could force every user to reset their password on login, but if there are accounts not being actively used, they will simply ask the attacker to change their password.

What I would do is this:

1. Temporarily turn off the account lockout threshold on the domain.
2. get a list of every user on every domain
3. use metasploit or medusa to try a decently sized dictionary file against all the users
4. make a note of all the users with weak passwords and either disable that account or change the password yourself
5. reenable the lockout threshold to something reasonable, like 3 or 4
6. make sure password complexity is on
7. make sure minimum password length is on, I would make it 15 to kill all chances of LM hashes being stored.
8. disable LM hashes ery'where

You also want to make sure to write up a basic "dont be a idiot with your passwords" email to distribute. Make it humorous so that its memorable, this way when someone is breaking the policy, it will be funny to their coworkers to belittle them. Make the minions do your policing for you.

Some simple "Human Password Policies"
1. Never write down your password anywhere - thats what your brain is for
2. Never give out your password to anyone, you dont give you safe combination to anyone do you?
3. You no longer have a Pass-"word", you have a Pass-"phrase", make it a sentence, a lyric, something funny only you will remember.
4. Like your wife said, the longer the better.

How to mount a drive as another user

This was a case of one of those issues where you constantly search for an answer to only have it staring you in the face the whole time *facedesk*

if you want to mount a drive as another user or have its group as something else, simply place uid=xxxx and/or gid=xxxx in the mount options.

for example:
     mount -t vfat /dev/sdb1 /mnt/kittens
will mount with root permissions (BOOOOOOO)
     mount -t vfat /dev/sdb1 /mnt/kittens -o uid=1000,gid=1000
will mount as the user that is uid=10000 with group permissions of gid=1000

now my hacked appletv will properly read that mounted drive for all my media crap. sweetities.

Persistent SSH Tunnel

I always have a box reverse ssh to one of my other boxes. This tunnel needs to stay up at all times and it need to come back after restarts. This is the solution:

Firstly I need to know exactly what command I will use for the reverse connection. This is mine:

• ssh loldongs@loldongs.info -i /home/loldongs/.ssh/lin -N -T -R 4510:localhost:22

Great, now i need a "watcher" script that will constantly check if the connection is up; if so, do nothing; if not, start the damn thing.

#!/bin/bash
#make-run.sh
#make sure a process is always running.

export DISPLAY=:0 #needed if you are running a simple gui app.

process='ssh loldongs@loldongs.info -i /home/loldongs/.ssh/lin -N -T -R 4510:localhost:22'
makerun='ssh loldongs@loldongs.info -i /home/loldongs/.ssh/lin -N -T -R 4510:localhost:22'

if ps ax | grep -v grep | grep "$process" > /dev/null
        then
                exit
        else
        $makerun &
        fi
exit

I found this somewhere on the internet, i'm loving it. I mainly love it because all i have to do is call this script from cron every minute and i will ensure that the connection is never down for more than 60seconds.

Synchronizing torrent downloads

    I dual boot between win7 and ubuntu. The problem is when i log into one of those, typically i will sit in it for quite a long time. I'm also an impatient man so I dont want to only be able to download torrents while in only one or the other.
    I want to be able to download the same torrent whether im in linux, windows, or your mothers arse. I noticed that the majority of torrent clients will/can ask for 3 different folders.

• A "completed" folder where the files will be moved upon full completed download
• A "session" folder where the client stores files letting it know where the torrent is in the download
• A "watch" folder that the client will constantly look at to integrate new torrents

I have many harddrives so I decided to allocate one of them to my torrent downloads where i can later organize into the different categories after download (read: bored).

This drive is mounted on my machine at /media/tdrive/
I created the following commands in that drive to hold all torrents and the such.

1. mkdir /media/tdrive/torrents; cd !^
2. mkdir torrents-watch
3. mkdir torrents-completed
4. mkdir torrents-session

Now that the folders are set up, you will have to configure your torrent clients to point to those directories. You can easily do so with .rtorrent.rc


# Default directory to save the downloaded torrents.
directory = /media/tdrive/torrents/torrents-completed


# Default session directory. Make sure you don't run multiple instance
# of rtorrent using the same session directory. Perhaps using a
# relative path?
session = /media/tdrive/torrents/torrents-session


# Watch a directory for new torrents, and stop those that have been
# deleted.
schedule = watch_directory,5,5,load_start=/media/tdrive/torrents/torrents-watch/*.torrent 




Now when I start rtorrent on linux, it will scan through the dirs and pick up the ones that still need to be downloaded. The same happens with utorrent in windows.

shablooie.

Dump Mac Ram Contents

My company installed AV and I saw it had a password with it. I wanted to know what that was so I decided to dump my RAM. Using this:

http://cybermarshal.com/index.php/cyber-marshal-utilities/mac-memory-reader

I was able to dump my contents to disk and open it in a hex editor to look for the portion that had the password. I found the password like i expected to, and i'm glad it isn't THAT awful a password like i feared.

sudo: unable to resolve host loldongs

Apparently if you just change the hostname in /etc/hostname, sudo starts crying that it cant resolve the new hostname.

It looks like you can just add an entry in /etc/hosts for your new hostname to point to yourself (127.0.0.1) and then it gracefully shuts the fuck up.

woot.

SSH2_MSG_KEXINIT and ssh connections dropping

For some reason ssh was just choking when i was trying to connect to my BT5 install. ssh 192.168.1.107 -vv would result in the connection being reset. It turns out that the server didnt have the proper keys installed by default.

sshd-generate fixed the issue. everything worked afterwards

Bash trivia trick

If you want to feel smarter than someone else, try this little trick.

Challenge the other person to create a file on the filesystem by sending the shell only 3 characters.

Answer? super simple:

>a

1: >
2: a
3: 'new-line'

now if you do an 'ls' you can see the empty file 'a' was created in the current directory. This is a short way to create an empty file on the local system. Basically what is happening is you are redirecting nothing into a file, since that file didn't exist previously, it created it. Hence, creating an empty file.

Now you can reserve 'touch' for more fancy trickery (timestomping)

Disable FireWire completely on Mac

using inception, its super easy to dump a Mac's ram through the DMA feature of FireWire. This includes plaintext login passwords. I tried it, i saw my password, i wept.

Next step? obliterate firewire.

First step, move the firewire kext folder to you home directory for a backup:

sudo mv /System/Library/Extensions/IOFireWireFamily.kext ~

then make a placeholder directory for kicks and fun

sudo mkdir /System/Library/Extensions/IOFireWireFamily.kext/

then boot the mac using a system disk to set an openfirmware password.

once you set the password, the attack kind of stops working.

woot.