0

Echo Mirage and UHooker

-

It can get interesting to test the security of thick client applications. If you start debugging you could end up losing a lot of time with not too many results. Of course, time is always at a premium when you pen testing in a week long gig. There are a couple of tools that can really help you to gain insight into a thick client (i.e., an application written in a binary format such as an executable, ActiveX control, flash object, etc.) and communicating to a server using the client/server model.
The need for a proxy to hook into the communications is a prime need and EchoMirage can do a great job of hooking into function calls related to win32 sockets, openssl functions. You have to select an active process for Echomirage to inject into or you can even spawn a process from the menu options in EchoMirage itself. It’s a great tool with a built-in editor so you can edit the traffic. However, sometimes you have to be careful because it’s binary data that you are editing so while editing it is easy to mess up a few flags, etc.
Another great tool is actually a plugin for OllyDbg called UHooker that can let you specify which functions you want to place a hook into. You have to configure a binary editor of your choosing and the functions to be hooked into in a .cfg file. The documentation for Uhooker is located here.

0

GtkImage.c: line 572 java error on Kubuntu

-

I installed KUbuntu “Breezy Badger” on my new Laptop (Dell Inspiron 700m) but none of my java based tools seemed to be working.

The errors I was getting were as follows:


** ERROR **: file ../../../src/libjava/jni/gtk-peer/gnu_java_awt_peer_gtk_GtkImage.c: line 572 (createRawData): assertion failed: (data_fid != 0)

aborting…


The trick is to use the Sun JVM and not the gcj (GNU Java Compiler). Apparently in Debian threads (on which KUbuntu is based) has this error in gcj-4.0. They promise that it will be fixed in version gcj-4.1 (which comes with gcc-4.1).

So follow these steps to get burp / paros etc working:
1. Goto java.sun.com and install the latest jvm for linux. Choose an appropriate location, mine was installed on /opt/jdk1.5.0_06/.
2. rm /usr/bin/java /usr/bin/javac /usr/bin/javah. (you remove symbolic links in /usr/bin which point the version of java to /etc/alternatives).
3. Create new symbolic links

# cd /usr/bin
# ln -s /opt/jdk1.5.0_06/bin/javac javac
# ln -s /opt/jdk1.5.0_06/bin/javah javah
# ln -s /opt/jdk1.5.0_06/bin/java java

Now you should be good to go!

-Rajat.

1

Brand New Day

-

It’s a brand new day with no novelty! Back to the lab today trying to now get access to the packet data to calculate the hash values. I suspect that inside netfilter’s sk_buff structure there’s an unsigned char* data field. This probably is exactly what I need to get the hash values. There’s this awesome link which has great information about sk_buff structure. The unsigned int len; has the size of the complete input data including the headers. I guess if this len value == size of the actual data for the IP header (which could be TCP header / UDP header / ICMP header) then if we are using chunks of this data to find hashes then the following algorithm could be used:

no_of_chunks = len / BYTE_SIZE_FOR_SIGN;

addendum = len % BYTE_SIZE_FOR_SIGN;


for (int i = 0; i < no_of_chunks; i++)
{
storeInTable(hashRabin(data,i*BYTE_SIZE_FOR_SIGN,
(i+1)*BYTE_SIZE_FOR_SIGN - 1 ,0));
}
storeInTable(
hashRabin(data,no_of_chunks*BYTE_SIZE_FOR_SIGN,
no_of_chunks*BYTE_SIZE_FOR_SIGN+addendum, 0)
);


This are my initial thoughts let’s see how it works out!

-Rajat.
Rajat’s Homepage

0

ASA Fails to parse certificates

-

Last night I was trying to get a VeriSign issued SSL certificate installed on my ASA using Cisco ASDM 6.2. I installed the Intermediate CA and the CA certificates all installed. I then imported the SSL certificate into the “Configuration -> Device Management -> Manage Certificates -> Identity Certificates” but it did not seem to work. I kept getting an error “Failed to parse or verify imported certificate”. The certificate was in the .p7b form. Changing the format of the certificate to X.509 Base64 Encoded format resulted in acceptance of the certificate.
I sincerely hope that Cisco alters its error messages to accurately reflect that .p7b is not a format supported by them.

Update: This link has the information on how to install SSL certificates on ASA:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00809fcf91.shtml

0

Something new that I learnt in Excel

-

While my roommate was doing an excel sheet I came to know of an interesting thing:
If you wanted to transpose rows and columns in an excel file (i.e. interchange rows and columns) just select all the rows and columns that you want to be interchanged and copy them. Then select another cell outside the selected range and right-click. Then click on “Paste Special” and then click on the check box on “Transpose”. That’s it!

0

Grand Canyon Trip

-


Another trip to the national parks of US. This time in Arizona State! The Grand Canyon in AZ, USA lying on the Colorado Plateau in Northwestern Arizona is a blistering (not because of heat, though) example of soil erosion caused over more than 4000 years by Colorado river.
We organized a trip of 8 people in a Toyota Sienna. It turned out to be a fantastic van and it could easily carry the load of all the eight people and still not run out of steam like we did on the trail.
We reached the Canyon at around 7:50 am on the Saturday morning after an 8 hr drive. But getting apermit at such a short notice in summer is really difficult. So we ended up with no campgrounds in the Mather campground as well as the Backcountry CBG campground (Bright angel creek, just 0.5 miles from the Colorado river). So we first went to 10-X Campground just near the Grand Canyon Airport. This campground is on first come first served basis and takes only 10 bucks for a day. Anyway, we did not have too many choices with the campground so we had to take whatever spot we got.
Then at around 11:30 am we started on the Bright Angel Trail. According to the canyon officials the worst times to take the trails is between 10:00 am to 4:00 pm. But the brave souls that we were, our enthusiasm and inexperience with Canyon led us to believe our valor more than we had! So we began the trail with a backpack carrying water and food for each person. Every man for himself!
But we met a volunteer on the way who advised us that unless we were Marathon runners (which we are not by any stretch of imagination) going to the Plateau Point and coming back on the same day is not advisable. The thoughts that he put into our minds germinated into a tree of doubt which we could not climb.
We could reach only the 3-mile point and climbed back up. But as it turns out we had made almost 70% of the elevation and most of the inclining hike. Had we continued the further trail was not at all steep. But this is hindsight or may be a case of sour grapes or maybe a case of inflated self-esteem !?!!
Then after coming back exhausted from the trail we set up our tent and after some food went off for a well-deserved siesta. The next day after lot of deliberation from Gandhe and Sardar we made it again to the Canyon to look at the points on the South Rim itself. After going afound in the bus we saw most of the points and then headed back to LA with the same reverse route (64 S – 40 W – 15 S – 10 W)!
-Rajat.
My homepage.

0

John Jay College of Criminal Justice

-

I will be speaking in Prof. Sengupta’s class at John Jay College of Criminal Justice at the City University of New York on Oct 28, 2010.  The topic of discussion will where does Digital Forensics fit in the big picture of organizations.  The talk will introduce the students to a variety of topics including choosing a career as a digital forensics investigator, their duties as an investigator, being successful as an investigator, case studies and real-life problems faced by the computer forensic investigators.