I love the site www.big-boys.com but in linux it would not play so I wanted to install a browser plugin that would play wmv files.
Here’s how I went about it. First I installed mplayer using yum (I use FC4 with kernel 2.6.13.2).
yum install mplayer
Make sure the internet connection is present when you run this command.

Then I went to Linux Plugins site to get the mplayerplugin. It redirected me to Mplayer Sourceforge site.

Then I downloaded the source of mplayerplug-in from Sourceforge download page for Mplayerplug-in.
Once I did that then came the main struggle of compiling and getting this to run.

I first untarred the file with command:

tar zxvf mplayerplug-in-3.11.tar.gz
cd mplayerplug-in
./configure –with-gecko-sdk=/usr/include/mozilla-1.7.8/
make

But this resulted in a bunch of errors.
I realized that an extra slash was put in there so I opened the Makefile with vim and removed the extra slash at the end of the string /usr/include/mozilla-1.7.8/ in the Makefile.
Tried to make again but again errors this time around some include files called prtypes.h was missing.

I noticed that in the CFLAGS section of the Makefile there was a space between -I and /usr/include. Deleted those.

So opened the Makefile in vim again and added the string -I/usr/include/mozilla-1.7.8/nspr/ to the CFLAGS section of the Makefile.

Also added -L/usr/lib/firefox-1.0.4/ to the LFLAGS section coz I was getting some linker errors after that. The struggle was not over.

I got a linker error :

/usr/bin/ld: cannot find -lxpcomglue
collect2: ld returned 1 exit status

Changed the -lxpcomglue in Makefile to -lxpcom.
Finally, the compilation and the build were successful. Then the final command
cp mplayerplug-in*.so /usr/lib/firefox-1.0.4/plugins/
And now I have mplayerplug-in live and kicking!

-Rajat.

I had to wipe my existing OS and had to reinstall Nessus on the new BT5R3 image. However, I still wanted all my previous scan data and users to be unaffected in the new OS. So how did I do that? Here’s how:

Take a backup and restore the following folders on the new install:

1. Users Folder (/opt/nessus/var/nessus/users)
2. Master.key (/opt/nessus/var/nessus/master.key)
3. Policies.db (/opt/nessus/var/nessus/policies.db)

If you do get an error after this follow these steps to get rid of errors and just reactivate the nessus feed as follows:

1. service nessusd stop
2. /opt/nessus/sbin/nessus-fix –reset
3. /opt/nessus/bin/nessus-fetch –register [activation code]
4. /opt/nessus/sbin/nessusd -R
5. service nessusd start

Dell had this program called Dell Vista Express Upgrade as a part of which once you pay for your XP Pro you become eligible for a Vista upgrade. The interesting thing was it was an introductory offer and they would ship the DVDs upon Vista’s release if we activated the upgrade. I did activate the upgrade but I did not receive my DVDs until a few days but when I eventually did it was a “Dell Vista Upgrade Assistant DVD”. What was even more interesting was that this DVD was not even an installation DVD (with no warnings on it that it was not the OS installation itself which I assumed all along). It was just a DVD because Dell likes sending DVDs to users! So I contacted Dell about the OS when I couldn’t boot up the OS and they said that no wonder…this is not the OS. So I asked them where’s the OS and the customer care went “you should have it”! Now if they didn’t ship it and I didn’t receive it (although I paid Dell for it), who should have it! They tell me Microsoft has it. It just seems illogical that the person who I pay for the software would not be the one to ship it out to me. The Dell Resolution specialist called today and said there’s nothing he could do. They have my money, they didn’t ship out the DVD…and so be it! Do what you can! That’s just the worst ever case of customer care I’ve ever seen!

I have a Dell Inspiron 700m. I have Kubuntu Breezy Badger 5.10 on this box.
This is how I got the WiFi going on this beauty.
1. Boot up into windows and get the Intel Driver from Intels 1st site OR Intels 2nd site

2. Save the files into a location on the drive which is accessible through linux.

root@trance:/home/trance# ls -al /media/hda1/intel/wireless_9.0.4_generic_109116/Drivers/
total 8680
dr-x—— 1 root root 4096 2006-05-14 05:42 .
dr-x—— 1 root root 4096 2006-05-14 05:42 ..
-r——– 1 root root 188416 2005-12-27 23:53 SetupWLD.EXE
-r——– 1 root root 4849 2005-01-25 15:17 SetupWLD.ini
-r——– 1 root root 13 2006-02-02 12:38 verfile.tic
-r——– 1 root root 1671168 2006-01-27 08:50 W29MLRES.DLL
-r——– 1 root root 2956544 2006-01-17 21:34 w29n50.sys
-r——– 1 root root 14821 2006-02-02 00:47 w29n51.cat
-r——– 1 root root 119785 2006-01-18 15:47 w29n51.INF
-r——– 1 root root 3325312 2006-01-17 21:32 w29n51.sys
-r——– 1 root root 466944 2006-01-27 08:49 W29NCPA.DLL
-r——– 1 root root 122880 2005-12-27 23:53 WLDMLRES.DLL
root@trance:/home/trance#

3. Go back into Kubuntu and get the ndiwrapper-utils, ndisgtk, ndiswrapper-source using

root@trance:/home/trance# sudo apt-get install ndiswrapper ndisgtk ndiswrapper-source

4. As root ndiswrapper -i will use the windows inf file to install the wireless driver. ndiswrapper -l lists the driver installed.
example:

root@trance:/home/trance# ndiswrapper -i /media/hda1/intel/wireless_9.0.4_generic_109116/Drivers/w29n51.INF
root@trance:/home/trance# ndiswrapper -l
Installed ndis drivers:
w29n51 driver present, hardware present
root@trance:/home/trance#

5. modprobe ndiswrapper checks if the ndiswrapper kernel module is installed. An installed module will result in no error. Then write the config file such that you do not need to go through the earlier steps every time you restart the system.

root@trance:/home/trance# modprobe ndiswrapper
root@trance:/home/trance# ndiswrapper -m
Adding “alias wlan0 ndiswrapper” to /etc/modprobe.d/ndiswrapper

6. If some error occurs check the output of lsmod

root@trance:/home/trance# lsmod | grep ndiswrapper

7. Now that your ndiswrapper is installed and configured. We now need to start up the wireless interface. On my box the wireless interface used to show up as eth0, however, it was not configured to use the ndiswrapper so I would get ‘segmentation fault’ on doing ifup eth0.
However, with the drivers set, I checked if all was well.

root@trance:/home/trance# iwconfig
lo no wireless extensions.

eth1 no wireless extensions.

eth0 IEEE 802.11g ESSID:”MySSID”
Mode:Managed Frequency:2.437 GHz Access Point: 00:13:46:46:78:28
Bit Rate=54 Mb/s Tx-Power=20 dBm
Retry limit:7 RTS thr:off Fragment thr:off
Encryption key:XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XX Security mode:open
Power Management:off
Link Quality=97/100 Signal level=-27 dBm Noise level=-89 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

sit0 no wireless extensions.
root@trance:/home/trance# ifconfig
eth0 Link encap:Ethernet HWaddr 00:13:CE:D9:0D:74
inet6 addr: fe80::213:ceff:fed9:d74/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:48 errors:0 dropped:0 overruns:0 frame:0
TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:236683 (231.1 KiB) TX bytes:1104 (1.0 KiB)
Interrupt:10 Base address:0x8000 Memory:e0206000-e0206fff

eth1 Link encap:Ethernet HWaddr 00:12:3F:6B:36:2F
inet addr:192.168.0.109 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::212:3fff:fe6b:362f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3050 errors:0 dropped:0 overruns:0 frame:0
TX packets:1534 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3117901 (2.9 MiB) TX bytes:159050 (155.3 KiB)
Interrupt:10

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:33 errors:0 dropped:0 overruns:0 frame:0
TX packets:33 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2058 (2.0 KiB) TX bytes:2058 (2.0 KiB)

root@trance:/home/trance# ifup eth0
There is already a pid file /var/run/dhclient.eth0.pid with pid 0
Internet Systems Consortium DHCP Client V3.0.2
Copyright 2004 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/products/DHCP

sit0: unknown hardware address type 776
sit0: unknown hardware address type 776
Listening on LPF/eth0/00:13:ce:d9:0d:74
Sending on LPF/eth0/00:13:ce:d9:0d:74
Sending on Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3
ip length 328 disagrees with bytes received 332.
accepting packet with data after udp payload.
DHCPOFFER from 192.168.0.1
DHCPREQUEST on eth0 to 255.255.255.255 port 67
ip length 328 disagrees with bytes received 332.
accepting packet with data after udp payload.
DHCPACK from 192.168.0.1
bound to 192.168.0.101 — renewal in 241302 seconds.
root@trance:/home/trance# ifdown eth1
There is already a pid file /var/run/dhclient.eth1.pid with pid 6390
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.2
Copyright 2004 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/products/DHCP

sit0: unknown hardware address type 776
sit0: unknown hardware address type 776
Listening on LPF/eth1/00:12:3f:6b:36:2f
Sending on LPF/eth1/00:12:3f:6b:36:2f
Sending on Socket/fallback
DHCPRELEASE on eth1 to 192.168.0.1 port 67
root@trance:/home/trance# ping www.google.com
PING www.l.google.com (64.233.161.99) 56(84) bytes of data.
64 bytes from 64.233.161.99: icmp_seq=1 ttl=233 time=73.5 ms
64 bytes from 64.233.161.99: icmp_seq=2 ttl=233 time=51.6 ms

— www.l.google.com ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 51.688/62.634/73.580/10.946 ms

8. To make sure that you don’t have to type iwconfig essid key every time you log on. Change you /etc/network/interfaces file to have these few lines at the end of the file. wireless essid is your wireless network name (SSID) and the key is the WEP key.

iface eth0 inet dhcp
wireless-essid XXXXXXX
wireless-key XXXXXXXXXXXXXXXXX

My /etc/network/interfaces of Ubuntu (in FC/RHL this is the counterpart of the /etc/sysconfig/network-scripts/ifcfg-ethX)
looks like:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# This is a list of hotpluggable network interfaces.
# They will be activated automatically by the hotplug subsystem.
mapping hotplug
script grep
map eth1

# The primary network interface
auto eth1
iface eth1 inet dhcp

auto eth0
allow-hotplug eth0
iface eth0 inet dhcp
wireless-essid USC-Trojans
wireless-key # This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# This is a list of hotpluggable network interfaces.
# They will be activated automatically by the hotplug subsystem.
mapping hotplug
script grep
map eth1

# The primary network interface
auto eth1
iface eth1 inet dhcp

auto eth0
allow-hotplug eth0
iface eth0 inet dhcp
wireless-essid USC-Trojans
wireless-key 11111111111111111111111111

Using watermarks in word documents looks really cool. But the problem occurs when the documents become too big. In such cases, the document becomes exceedingly slow to react to scrolling. Adobe PDF conversion is an even bigger problem.
To remove the watermark it is simple enough : Format -> Background -> Printed Watermark. Then click on “No watermark” and you are golden (or you should be golden).
I’ve observed that the watermark does not get removed many times when you have too many sections in the document.
In such cases: Goto View -> Header and Footer. Click on “Show/Hide Document Text”.
You should see that all your text has disappeared except the watermark. Click on the watermark and you should be able to select it like a floating image. Press the “delete” key and lo! behold! the watermark is gone.
This took me a while to figure out and it was quite frustrating. I hope this post helps someone!

I was looking at some Oracle databases recently and I saw that the Oracle Auditing Tool (OAT) is an awesome toolset but you just need to download the classes12.zip which are the Oracle JDBC drivers for Java into that same directory. I downloaded the classes12.zip from the Oracle site and placed it into the same folder as OAT. On linux, the .sh files will then need some editing. Just replace classes111.zip to classes12.zip and off you go.
Patrik Karlsson has done an awesome job of providing these tools. You can do the whole gamut of operations using this tool from first guessing the Oracle SID to checking for default passwords using opwg.sh.
sudo ./opwg.sh -s 192.168.1.101
The above command will give you the Oracle SID for the remote database.
Once you have the sid and the credentials you can run queries using oquery.sh
sudo ./oquery.sh -s 192.168.1.101 -u DBSNMP -p DBSMP -d db_sid_found -q "select 1 from dual"
The source of the OAT is also provided here: http://www.cqure.net/tools/oat-source-1.3.1.zip. I found an interesting decompiler for Java too (when I overlooked that the sources existed on cqure.net website) and it’s called jd-gui. It works wonderfully on linux.

Server-Side Request Forgery is a security issue in applications where an attacker is able to get a server to send some type of a request (these days mostly HTTP/s requests) that the server should not be able to send. This issue is the classic abuse of trust vulnerability – the server tends to sit in a “trusted” environment (e.g., DMZ, your cloud VPC, etc.) and the users of the application sit outside the trust boundary (e.g., mobile devices, cafe, home, corporate environments, API clients within and outside cloud).

A brief history
In this blog post though, I won’t be talking about all the fancy new things that have had SSRF issues – you can likely find a few hundreds of those anyway! I am going to be talking about a brief history of this issue and what happened before we gave this issue a “name” – SSRF. The earliest references to the name “SSRF” appear to come from a talk done in BlackHat US 2012, and wayback machine tells me that the CWE-918 page was authored sometime around 2013. If you look closely at the CWE-918 page though, you will find that there were old CVEs dating back to 2002, and 2004. There was a Shmoocon talk about it in 2008 too but the term SSRF was not established until 2012.

The Issue
I was working on a penetration test for a financial services firm in 2010 of a popular load balancer that offered a GTM (Global traffic manager) solution and that allowed folks to login and obtain restricted execution environments wherefrom certain applications could be exposed and that would allow remote workers or untrusted entities who you only want to expose certain applications could use. The issue was in a POST request post login and IIRC even pre-login (though my details on this are fuzzy). This might be circa 2010 timeframe and to my knowledge the issue was not issued a CVE and wasn’t associated with Knowledge base article – I may not know 100%. The guidance from the vendor was simple – update the software and move on. The issue was this – an authenticated or an unauthenticated user would send an HTTP POST request to a page with a base64 encoded parameter that included a hostname which would trigger a DNS request on the back end of the GTM site. The time it took for the response to get back would indicate whether the domain was legitimate or not. So I used the a popular dictionary and enumerate all the hostnames from that directory that were legitimate and the ones that were not sitting outside on the Internet and mapping the hosts on the internal network.

The backstory
What the vendor of the GTM software did not know was how critical this application was to the business of the customer. They seemed to be dragging their feet without updates and meanwhile the customer – a financial institution with lots at stake could not go live. The pressure mounted on the IT staff to fix the issue and the vendor while being responsive was unable to give a firm date quickly – remember this was 13-14 years ago prior to bug bounties and responsible disclosures still were quite clunky! And the customer was also advising me to push the software vendor so we could discuss. Thankfully, on the vendor side, there was a solid security person who understood the issue immediately and its impact and advised the software teams to do what was right. They made the process post authentication and they also added tokens, limits and constant time responses to fix the issue.

Fast forward
Today, obviously things are a lot better. And I wrote this blog post so the old me can look back and point to this in a meaningful way without forgetting the old experiences among the new.