Ho ho ho, Merry Christmas!

With Christmas just around the corner, I should be relaxing with a nice, warm mince pie, but instead, i've booked my OSCP exam for the 20th of December - yes, 6 days! Add that to the fact that i'm working over Christmas and you'll be asking yourself: Is he mad?!

But enough about that, what can we expect in 2015? I'm eager to begin posting regularly again, as i've been so busy over the past 3 months that there hasn't been much in the way of content. I expect some big changes in 2015 and more courses on the horizon, so it looks like it's set to be an interesting year.

I'll be sure to let you know how I fare with the exam. But for those celebrating Christmas, have a good one! And for those who aren't celebrating Christmas, happy holidays! Expect an update in seven days time.

An update on the OSCP

Hello readers,

I have to give you an update on the OSCP course - yes - I am still hanging in there by a thread doing it. This course is by far the hardest course i've ever done, but that's because I was expecting the course contents to cover absolutely everything I needed to know to successfully attack machines. That...hasn't quite been the case and i've found myself doing alot of research.

So now, picture me, coming home after a 12 hour shift, where i've sat in front of the computer for 11 hours and I need to research X/Y/Z before I carry out X/Y/Z attacks in the lab. Yeah - it's rough. Well, as it stands, i've got this far:

59 days in, 21 machines popped, one of which includes the notoriously hard "pain" and i've *almost* got root on "sufference" which is much, much harder than "pain".

I've got 21 days left in the labs, so if I can manage to pop 1 every 2 days, that'd give me 10 more machines, which would give me a grand total of 31 machines popped which is much more respectable than just 21.

90 Days of OSCP

Day 1: 21st September

As does everyone who signs up for the OSCP, I managed to somehow get the starting time wrong. The OffSec website said 00:00 but actually arrived at 01:00 - thanks British Summer Time!

I received a rather lengthy email which consisted of videos to follow, the main pdf which serves as your source of information and your username and password for the VPN you'll use to connect to the lab. I managed to read 47 pages which were fairly straight forward - but I have learned 2/3 new things already. I'm going to get through as much as I can today and see how I find it.

Day 2: 22nd September

It's 00:15 at the time of writing. I've got dark circles around my eyes and this is only the second day. I spent 14 hours 45 minutes reading the pdf and completing exercises yesterday. I went to work and from 9:00am til 5:30pm I was in front of a computer screen.

Once I got home I ate a piece of bread and a single slice of chicken before going onto my laptop and working from 7:30 til 00:00. That's 4 hours 30. I'm sticking to my personal plan quite well but whether I can keep this up I dont know.

Day 3: 23rd September

No progress. Was too busy with other things to study...

Day 4: 24th September

It's proving to be very difficult. Batch scripting and FTP exploits are on my to-do list. I've found the 'reverts' system to be a tad annoying because you only get 6 reverts a day, you tend to use them very scarcely and if an exploit in the lab isn't working, then you've essentially got to use up a revert. If someone is working on the same machine as you (which is possible, albeit unlikely) you might need to revert. It's very early days but i'm not feeling overly confident with this one. On the plus side I've spoken to some really cool people in the IRC. I've even been told to "try harder!" By the offsec staff - not that I wasn't trying hard! And if I wasn't trying hard enough, I fully intend to use every spare moment of this weekend working on this.

Day 5: 25th September

Bob is still causing issues. For those who don't know, Bob is a bit of a legend at OSCP labs. Bob is a machine which requires alot of hard work and determination; if you ask for help be prepared to be told: 'Bob is laughing at you!'. Navigate to the IP in the browser and indeed, Bob really is laughing at you. I'm going to focus on other machines and will return later.

Day 6: 26th September

Bob has now been owned! I was trying the right things but missing a parameter. I've wasted alot of time on Bob. I'm going to do the exercises later and see if I can get through more of the pdf. Enjoying the course so far but i'm hearing ALOT of "try harder" on the IRC.

Day 7: 27th September

I  managed to pop 'ORACLE' today and make some further progress in the book. So far i'm finding the course quite interesting. The difficulty level is medium. I don't know whether i'll be able to pop all of the machines in the lab in 90 days - i'll certainly try but it has taken 7 days to pop 4. It's impossible to guess how long it'll take to pop others because the difficulty varies per machine.

Day 8: 28th September

Managed to pop another machine. I'm getting the hang of it now. Need to make progress on the exercises. Time isn't on my side at the moment. Lucky for me i've got a break on Wednesday where I can devote a full day to catching up on the exercises and might even pop another machine by then if i'm lucky.

Day 9: 29th September

Managed to pop a Linux machine which was nice. Enumeration really is key. The more information you gain the more avenues you can explore.

Day 10: 30th September

80 days to go. I've popped 6 machines of 54 - I feel like it'll be a race against time to pop them all and complete everything...

Day 11: 1st October

Friend came over so I only made a small bit of progress on a very difficult machine in the labs. Can only get a basic shell.

Day 12: 2nd October

Finally rooted a machine I've been after for two days. Updated my report and off for a day out for the gf's birthday. Will be spending 10-15 hours on the exercises tomorrow to make up for the time I've missed.

l will update each day for 90 days.

Unshadowing + Password Cracking

In prep for the OSCP, i'm going over some relatively basic skills so that they're not only fresh in my mind, but so I understand them well enough to take it to the next level with the OSCP. I was researching privilege escalation and came up with a scenario. Let's say that a system administrator has made a boo-boo on the system and any user can see the /etc/shadow file along with the /etc/passwd file. Of course, this would be a, very, very rare occurrence (one would hope!) but it gives us somewhere to start.

So once you've got a hold of the passwd and shadow file, we can see that the passwd file isn't showing the passwords at all, not even hashed! (Great!). However, the shadow file is showing simon's password hash (Fig 1).

 Fig 1

Now, I run hash-identifier (Fig 2) to find out what hash we're dealing with here. This isn't too necessary in this case, but it's a fantastic tool which has helped me plenty of times. Windows users can download the python script from Github. Simply type in (or paste in) the hash and the script will attempt to identify what method of encryption is being used.

 Fig 2

Now I can see that we're dealing with a DES (Unix) password (Fig 3). Makes sense right, after-all, we're looking at a hashed password on a unix-like system.

Fig 3

 So now, it's time to get this hash cracked. We need to use the 'unshadow' feature/function to unshadow the 'passwd' and 'shadow' files. Essentially, by unshadowing, you're combining the files which will let us brute force them shortly with JTR.

In Fig 4 below, you'll see the way this is done - we call the unshadow script from sbin, select our passwd file followed by our shadow file and direct it to a database (file ext not necessary, but it just helps to convey the information).

 Fig 4

 You may notice that i've already cracked the file before taking this screenshot, so i've had to use the '--show' switch to let you see the password in plain text. All that's needed to crack the password is for you to run 'john <nameOfDatabase>', in my case 'john crack'.

In Fig 5, you can see the plain text password:

simon:password:1003:1003:simon:home/simon:/bin/bash

Of course, the more complex the password, the harder or more time consuming it'd be to crack.

 

Fig 5

Thanks for reading!

OSCP - Finally Signed Up

I've done it. I've signed up for the OSCP. It has taken quite some time to decide whether or not I should go for it. In fact - it has taken a few years. The course was previously known as 'Pen testing with backtrack', whereas now, it has been updated to 'Pen testing with Kali', as Kali Linux has taken off where Backtrack left off.

In case you're wondering why it has taken me so long to sign up, the answer is simple: cost vs fear of failure. Prior to starting the OSCP, my pen testing knowledge is heavily rooted in wireless security. I've had experience with Bluetooth hacks, WEP, WPA etc but not so much with pen testing desktop computers/laptops/servers.

I've passed the OSWP (Offensive Security Wireless Professional) course and found that it was written very well; one can only hope that the OSCP will follow suit. I've read reviews online which suggest it's very possible to pass providing you put many hours each day into it. I'm prepared to do that in order to pass. Which brings me onto my next point. I've been afraid to take on this course incase I fail, yet I know that its going to be a learning curve - just of bigger proportions.

I've had to remind myself that over the past few years, i've learned first hand that the key to success is trial and error. Do you remember when you first tried to ride a bicycle as a child? You fell off it, right? You got hurt and thought: "I'm not doing that again!" - but you persisted and ultimately, you could ride the bike. The same applies to swimming, relationships, driving etc. You fail more often than you win, but it takes determination to continue until you win.

I'll give you a story. There was a kid born in 1847. Couldn't concentrate in school. His teacher referred to him as "addled". It was looking as if this kid wasn't going to make it; dropping out of school and then being home schooled, this kid didn't look like he was going anywhere. When he was older, he created an automatic voting system, which, as an entrepreneur, should have gained him fame and prosperity. It didn't. It wasn't wanted: it was a failure.

All this guy knew was failure, up until age of 30 when he created the telephone. This guy was Thomas Edison. Failure didn't deter him - and look what he created. You get out what you put in. I know that whatever happens with the OSCP, i'm going to learn alot throughout the course. I don't know if i'll pass the exam first time, but if I don't, i'll try again, and again, and again until I do; afterall the moto is "try harder".

MSN Messenger - The Eulogy

15 years after MSN Messenger was introduced to the world, it has now sadly gone (completely). The service was turned off in 2013 and Skype took its place for those of us not living in China; the Chinese were lucky enough to have the service until it's due to be turned off permanently in October, 2014. I thought i'd write a quick eulogy to give MSN Messenger a good send off.

In 1999, I was 10 years old. I was there when MSN Messenger first arrived. It felt like something sent from God. It was a serious rival to the likes of AOL's AIM (AOL Instant Messenger) and ICQ. At the time - AOL was king; disks advertising 'x days free trial' for AOL were all the rage. But over at Microsoft, they'd designed a great tool, with a memorable logo. The logo was simple - eye catching and became an instantly recognisable symbolization which appeared all over the web. Here is how it looked:

If I asked people today what a .NET Passport is, they might look at you with a confused look in their eyes. A .NET Passport was your passport (your registration) that allowed you to use MSN Messenger.




The screenshot to your left is how the early MSN Messenger looked. Simple - uncomplicated - fast - reliable(ish). The whole point of MSN Messenger was to contact your friends. You'd simply add them via email address and you'd be able to see whether or not they were online - think of it like WhatsApp....but in 1999.

Not only could you have instant conversations with your friends - but you could see whether you had any new emails. Eventually, MSN Messenger began to evolve. Updates added functionality and the MSN Messenger service grew. Up until 2009, there were 330 million users. At the time - everyone had MSN.

MSN was often used by people to chat up the hottest girls in the year. Rejection via instant messenger was less painful than rejection in real life. "BRB m8", "LOL", "TTYL" - acronyms that we still use daily formed by avid users of MSN. As soon as you got home from school, you'd jump onto MSN, say "wuu2?" to your friends and wait eagerly for their reply which would be something like "nm, u?". It was better than it sounds - honest.

The screenshot to the right shows what MSN Messenger was becoming. It was now a place where you could add a fancy tagline, such as: ☆đση'т ¢σρу, вε σяιgιคℓ☆. There were literally hundreds, if not thousands of websites dedicated to people sharing quotes, taglines, custom profile pictures - the works.

With later versions of MSN Messenger - there were all the signs of adverts coming into the picture. As you can see, there was space for ads on the bottom and ads on the left hand side of the software; MSN Homepage links at the top too. It was so great - yet starting to get annoying to use, especially if you were used to the first few releases.

Microsoft changed the branding of MSN Messenger to Windows Live Messenger for v8 in 2005 - this caused some anger in the community, as we'd gotten used to calling Windows Live Messenger "MSN". Ads and general bloated software lead to more annoyance, but we continued to use it anyway, because quite frankly, it was a fantastic tool.

2012 signaled the end for Windows Live Messenger when Microsoft acquired Skype for £5.1 billion ($8.5bn). As Skype already had an instant messenger built in, most of us knew deep down that the days of MSN would become just a memory. In 2013, Microsoft shut down the service as users made the transition to Skype.



It's a real shame to have to say goodbye to MSN Messenger - it really did pave the way for services like Whatsapp, Viber, iMessage and other copycat services that still exist today. For all the reasons listed above and many more, it really does prove that technology never stands still. Things move on and we must enjoy them whilst they last. So whilst you're snapchatting, Whatsapping and tapping on your technology today, know that it might not be there in years to come. Good bye MSN Messenger.

Why I'm Getting Rid Of My Nokia Lumia 920...

I should have had an update out about TOR - and I apologize to my readers about that. I've been super busy. Between full time work and catching up with friends, it makes things pretty difficult to keep up with. That post will come out, but first, I thought i'd get in a post about the state of the mobile market today.

I'm no stranger to mobile phones/smartphones. The very first mobile phone I owned was a Ericsson t28, passed down to me by my Uncle, who had 'upgraded' to a Ericsson t66!! (Wow!). Those phones were fantastic. Ultimately, I ended up getting the best phone to ever exist (at the time): the Nokia 3310. I found out that these phones could be 'unlocked' for free online by typing in your IMEI number and getting an unlock code - I was charging kids in the school playground like £3 a pop. I was a little entrepreneur .... well, almost. You see, there weren't as many kids with phones - in fact, most adults didn't have a mobile phone back in the year 2000.

These days, it's hard to find someone who doesn't have a mobile phone. Kids grow up amongst phones/tablets and the world as we know it is becoming much more reliant on technology as a tool to communicate, live and work with. Having loved the Nokia 3310 and all of the other models i've owned (trust me, it's hard to name a Nokia that I haven't owned), I went back to the Nokia world that I had fond memories of and purchased a Lumia 920. The biggest change is that Microsoft now own Nokia...

The home screen on the Windows Phone 8 device is actually quite nice. It's a 'live tile' which updates when you get emails, or texts, or calls. Missed a call? No problem, you get a '1' on the live tile. Weather? The weather will update live on the tile. News? Yeah - that's covered too. The problem with Microsoft's Nokia range is the user-interface that sits behind the home screen. It's absolutely WOEFUL.

My Nokia Lumia 920 shipped with Windows Phone 8 as the OS and soon enough, there was a sneaky way to upgrade to the developers preview of Windows Phone 8.1. Of course, I did this, and there were some good changes. What I was extremely unhappy to find - was that the user interface was exactly the same, but with more options. This makes for a horrible mess of an interface which Microsoft/Nokia haven't addressed. Now this might not sound like a big deal, but when Apple's flagship iPhone series have virtually perfected their interface - it's a BIG problem.

To top it off, Microsoft have said that Windows Phone 8.1 is going to be released in the UK in "late 2014", Source: http://www.pcadvisor.co.uk/news/mobile-phone/3510108/windows-phone-81-cortana-release-date-new-features-uk/

Personally, i've waited 7 months since owning the phone for Windows Phone 8.1 - and when I purchased the phone, it was already an aging phone. To make me wait longer AND not improve the user interface - I'm out. Although I wanted an iPhone, i'm actually opting for an Android (and believe me, I hated Android in the past).....but I am going to try it and see how things go.

I may end up going back to the iPhone if the Android phone doesn't work out - and i'm not the only one who thinks this way! There are millions of avid consumers out there wanting the latest and greatest phones which do everything they want - and then some. It really highlights that the mobile phone market is more competitive than ever and there's a-lot at stake. It wouldn't surprise me if companies end up going bust trying to compete in the current climate as consumers want the best deal for their hard earned cash.

Until next time - thanks for reading.