RaiderSec Meeting 03/20/2012

Hey everyone!

I want to thank everyone who came to the meeting on Tuesday. I hope everyone enjoyed the introduction to memory corruption (specifically buffer overflow vulnerabilities), and next meeting we will cover how a buffer overflow vulnerability can be leveraged to by an attacker to execute code of his/her choice (our example being to create a shell on the system). As a reminder, our next meeting will be on Tuesday April 3rd, 2012.

Until then, you can find the slides from the last meeting here. I look forward to seeing everyone at the next meeting!

-Jordan

How to setup and configure snort for a Linux (Ubuntu spec.) System

Introduction

Note: This guide is not very stable, use at your own risk, do not go into this without some understanding of *nix, and the ability to solve problems and google and stuff. Also snort was not designed for wireless, this configuration will not work with wireless at all. There are hacky patches you could maybe apply to get snort to work with kismet or something (I didn't look too far into it) but honestly at that point it would much easier to choose a more light weight IDS

This is a post Jordan and myself had been talking about writing since the last meeting. Snort is a wonderful open source Intrusion Detection System (IDS) which is very effective as a first response system when your machine is being attacked, or as a line of defense in computer security related games like Capture the Flag (CTF)

I decided to set it up on my local machine for fun (since it's not very necessary on a machine not running services, but fun to have) as well as give me the ability to step through the process. I'm setting up the Snort IDS utilizing the postgres SQL database (because I already have it setup for metasploit interaction).

Introduction to Metasploit

The Need for Metasploit

As we saw in our first meeting, successful exploitation of a service requires three "parts":

• Vulnerability - A flaw in a system which can be utilized as an avenue of attack.
• Exploit - A program specifically designed to leverage a vulnerability.
• Payload - Code to be run on the system after the vulnerability has been exploited.

Usually, when a vulnerability is found in a service, an exploit is developed that directly contains a payload. For example, it is common that a shell may be produced from the exploited service. This means that when an exploit is used, the penetration tester would have no choice but to use the provided payload, unless he/she wanted to take the time necessary to create their own. This not only takes a substantial amount of time, but also quite a bit of skill. Also, one must consider that both exploits and payloads can be (and usually are) architecture specific, so a payload that works on a Windows machine will most likely not work on a Linux machine.

So, what security testers needed was a centralized framework to mix and match exploits with available payloads. Also, there was a strong need for a central repository of exploits and payloads that can be pre-loaded for quick use. This results in a flexible security testing environment, in which the desired results can be easily achieved.

Metasploit offers this functionality, and much, much more.

RaiderSec First Meeting

Hello Everyone!

I just wanted to thank everyone who came out to the first meeting of RaiderSec! It was great to see everyone there, and I hope the content was interesting and insightful!

If you missed the meeting, or would like the slides, you can find them here. I will also be posting a supplementary blog post describing the basics of Metasploit in more detail for anyone who would want to see it, or get a recap of what we went over in the meeting. Hopefully it will be up in the next week or so.

I know we covered quite a bit of content really quickly at our meeting, but if you ever, ever have any questions please don't hesitate to e-mail me, and I would be more than happy to answer any questions you may have! The goal of the meetings is to learn as much as possible about the field of security, so if there's something on which you may be stuck, or didn't quite understand during the meeting, let me know!

Also, since I was unable to have the disclaimers there today for everyone to sign, you can find them here. If at all possible, please sign and return them to me by the next meeting (scanning and e-mailing is perfectly fine).

I hope everyone has a great Spring Break, and I look forward to seeing everyone at the next meeting!

Brute Force Without a Dictionary Using John The Ripper

If you’re like me (Lance), and playing with, using professionally, or writing list requiring brute-forcing software. You don’t want to waste the hard drive space for massive all-encompassing password lists which have a limited chance of success. Luckily you don’t have to do that at all leveraging some john the ripper and (l/u)nix functionality.

Searching for Devices Using the SHODAN Search Engine

In this post, I'm going to discuss a very useful search engine called SHODAN, as well as introduce the API it offers for development. I will also include a link to a PHP API Wrapper that I wrote that can assist in easily accessing SHODAN from a web application.

Source: http://www.shodanhq.com 

ACM Presentation Slides

It was great to see everyone at the ACM meeting yesterday (Feb. 9), and thanks to all who signed up for the group! It's exciting to see such interest in the field of security!

I am working with the ACM officers to get the information of those who registered and will be sending out an e-mail to each of you shortly with information concerning the date and time of the first meeting, and I will also post it to the Meetings page.

After each meeting, I will be sure to upload any slides, notes, or code that I use in the presentation for anyone who would like them. As an example, the PowerPoint slides from last night's meeting can be found here.

Again, thanks to everyone who signed up! I'm excited to get things rolling, and to start exploring the vast field of security with each of you!

Jordan