Create a BackTrack 4 persistent USB drive

BackTrack is widely considered the complete hacker boot disc. Born out of WHAX this security sharp linux distro has been years in the making, and finally version 4 final is out.

One of the best ways to experience BackTrack 4 (BT4) is by creating a USB boot drive. Simply download the ISO and “burn” it to a USB drive with a tool like unetbootin.

BackTrack even offers a VMDK if you’re interested in playing around in VMware or VirtualBox.

In this episode Darren guides you through partitioning, formatting and installing BackTrack 4 to a USB drive and configuring persistence.

A ZipIt Userland image for the average user

How to Connect your Zipit Z2 to an encrypted WPA network.
With Aliosa’s OS:

Turn on the wireless radio by opening the termina and issuing “ifconfig eth1 up”
Create a WPA supplicant configuration file for your router and password by issuing “Wpa_passphrase youraccesspoint yourpassphrase > nameoffile.wpa”
Connect to the WPA network using the configuration file you just created with “Wpa_supplicant –Dwext –i eth1 –c nameoffile.wpa –B”
Get an IP address from your router’s DHCP by typing “Dhclient eth1″.
Installing RootNexus’s ‘Average User’ userland image.

Plug in your miniSD
Open PhysDiscWrite GUI
Right-click miniSD, choose Oofnen, choose Image Laden
Choose the average user image file
Click yes, and wait 10 minutes.
Eject your miniSD safely and restart your Zipit Z2 with the miniSD card in it
Zipit Z2 “Average User” userland image: http://zipit.rootnexus.org/
Getting WPA to work: http://www.christopherkois.com/?p=53

Put Mubix in a room with a whiteboard and prepare to take notes. Go grab yourself a copy of Metasploit, or build a BackTrack Virtual Machine and start playing. Mubix’s complete show notes can be found at Room362.com. Mubix also recommends the free Offensive Security course Metasploit Unleashed – Mastering the Framework.

This time on the show Darren’s having a little man-in-the-middle fun with a demonstration os SSLStrip, an epic tool for removing that pesky encryption from your victims browsing session.

Moxie Marlinspike’s SSLStrip, released at Blackhat/DEFCON this year, is a tool that transparently hijacks HTTP traffic and redirects HTTPS links to look-alike HTTP links. While this description barely scratches the surface, Darren’s segment takes a closer look including a pracitcal demonstration of a man-in-the-middle attack using arpspoof and a little luck with remote-exploit’s BackTrack 4 penetration testing distribution.

Merge folders with Winmerge

This open source Windows tool allows you to easily identify inconsistencies between two would-be identical directories and quickly make corrections, complete with keyboard shortcuts. Check out Winmerge

inSSIDer, an open source Windows WiFi Scanner

So in my never ending search for better and better utilities to make my life easier, I came across inSSIDer by metageek.

Which is basically a stripped down version of their Chanalyzer software.

Stripped down maybe, but extremely useful none the less? YES!

After performing a scan of my boss’s house who was plagued with signal drops and slow speeds, I came across the reason.

Interfering access points. His router was on channel 6, surrounded by half a dozen other access points.

So using the easy to read inSSIDer software I decided to put him on channel 11, where there were no other AP’s in range.

As soon as I made the switch, I had vastly improved signal strength, and no longer had drops walking through the house.

We’ll be running a review of the Wi-Spy products and metageek’s Chanalyzer in an upcoming episode.

LAN Party

This month’s LAN Party is Team Fortress 2 on Saturday, October 3rd, at game.hak5.org. Find all the LAN Party details at hak5lan.squarespace.com

Windows VPN connection as Service

One of the nice things about Windows Server is the built in VPN service — RRAS or Routing and Remote

Access. In this segment I demonstrate a way to connect one Windows Server to another utilizing a PPTP VPN

connection as a service. The built in VPN connection manager isn’t half bad.

A nifty feature is >the rasdial.exe program

which allows you to connect/disconnect a VPN profile from the command line. Pairing that with the AutoExNT service from the Windows Server

Resource Kit and you’ve got a VPN connection on boot, even before login.

Contest

This month’s contest is for the scatter brained and design concious desktop users. Share your desktop’s

over at Hak5.org/screenshot and be entered to

win leet Hak5 swag and Ashley Schwartau’s Hackers Are People Too DVD.

There is plenty to do on the Kindle that isn’t in the user manual. Read on for details!

At the Home screen use ALT-SHIFT-M for Minesweeper. It’s a little slow in response time, but still fun.

Free Books and PDF’s on your Kindle can be accessed through sites like Mnybks.Net and Feedbooks.
Mobipocket creator converts pdf’s to kindle files for all of your needs. If you don’t want to use Mobipocket, check this out- for free conversions, email a document to “name”@free.kindle.com and have it emailed back to you in kindle format.

Bypassing Paying for Blogs
Check out sites like Kindle Feeder to read your favorite blogs and news sites for free, instead of paying for the subscription version. From your browser, go to kindlefeeder.com and sign up or just search for your favorite feed.

Try accessing a site that isn’t compatible with mobile through proxy sites like mowser.com.

Google Maps
Under browser mode, click Alt-1 to access google maps quickly. Alt-2 shows gas stations and Alt-3 shows restaurants.

For email and useful messengers, use the following:
Gmail: m.gmail.com
Yahoo Messenger: us.m.yahoo.com/p/messenger/
Google Reader: google.com/reader/m
Google Calendar: google.com/calendar/m

SMS messages to your friends cell phone can be accessed by simply emailing the 10-digit cell phone number at the appropriate gateway. e.g. for AT&T cell customers would be 1234567890@txt.att.net.
This is a (unverified) list of gateways for various cell services.
AT&T: @txt.att.net
Alltel: @message.alltel.com
Nextel: @messaging.nextel.com
Powertel: @ptel.net
Sprint: @messaging.sprintpcs.com
SunCom: @tms.suncom.com
T-Mobile: @tmomail.net
US Cellular: @email.uscc.net
Verizon: @vtext.com
Virgin Mobile: @vmobl.com

To view personal pictures on your Kindle, plug your Kindle into it’s mini USB to a computer. Add a folder called ‘pictures’ in the root of the Kindle or SD card. Create another folder inside the Kindle folder ‘pictures’ called whatever you like. In the Home screen, hit Alt-Z to refresh and your new ‘book’ should appear with the name of the folder you chose. Open it and page back or forward to view your pictures. Press Alt-Shift-0 to set the current picture as a screensaver.

And here are a couple of tips for the Kindle 2:
Tether your Kindle 2 via a USB port so you don’t have to use WhisperNet or create a custom screensaver with your own pictures.

Matt Lestock reviews BlueBear’s Adobe Air-based application for managing mixed virtualization environments. Kodiak currently supports VMware ESX servers with Citrix XenServer and Microsoft Hyper-V compatibility coming soon. This cross platform management application is pretty slick!

Darren Kitchen discusses the evolution of his favorite boot loader, Grub, and points out USB installation options and Grub2’s loopback option. He also discusses persistent changes, nested menus, and notes.

Darren also checks out LiveUSB, a tool that promises to automate the process of building a USB Multi Boot tool. Note: The site and application are all in French.

Engineering a mid size office network from the ground up. Matt shares with us tips on switch stacking and more. Palm centro security? Shannon shows us how to bypass SIM lockout. And Darren’s getting his grub2 on without borking his ubuntu box. All that and more on this episode of Hak5.

The Palm Centro has the ability to do a system lockout with access to the SIM only by using a PIN code. If you set this lockout, when you power cycle your phone, you can only have access to the lockout menu. You can either enter your PIN, choose cancel, or choose make emergency call. If you choose make emergency call and go through a few buttons, you can enter the hardware of the Centro. From the main menu of one of these phones, you can access the users contacts, SMS messages, photos, apps, games, notes, and more. Here is a walkthrough of how to bypass the lockout:
How to Bypass Your Palm Centro Security

To help protect your phone from this kind of issue, you can use a program like Warden Security. Sadly, it costs a whopping $14.95, and no one wants to spend that much on an app!
Warden Security

Know of a nifty phone hack you want to share with us? Email feedback with details!

Shot with the Canon T1i and edited with Premiere CS4. Song is 1979 by Smashing Pumpkins. Just toying around with the 720p video functions of the camera.

by Darren Kitchen

What’s your best defense against a boot CD that breaks Windows passwords in two keystrokes? Encrypting your entire hard disk. Shannon’s got the details on truecrypt drive encryption while Darren brings up plausible deniability with hidden volumes.

Encrypting your entire hard drive

Truecrypt is an open-source, free program for everyone.
Download the latest version of Truecrypt.

Open Truecrypt and choose ‘Create Volume’. Choose ‘Encrypt entire hard drive’. Then, you will choose whether you single-boot or multi-boot your machine.

On the encryption options, I just choose AES because it is the default setting, and it’s a very strong encryption.

Next you will choose a password. This option is neat because it actually gives you a small notice saying that a password with less than 20 characters is easier to break than one with more than 20.

On the next page, you must randomize your data. You must move your mouse around in the box of algorithms to create a very randomized clump of data. The more randomized, the better encrypted.

Truecrypt will make your create a rescue disk. This is easy if you have a cd burner already installed in your tower. If not (if you have a netbook), you must create the rescuedisk.iso and burn it onto a flashdrive or something of the like. You are basically making Truecrypt think you have a cd burner and are burning the cd, when instead, you are just sticking the iso on a USB flashdrive.

For my netbook, I used WinCD Emu. WinCD Emu emulates the burning of a cd, so Truecrypt thinks you’ve finished this task.

Truecrypt will ask you to wipe your drive, and I just choose none since I don’t really need to. Next you must go through a pretest. Your computer will restart and a Truecrype login screen will appear before the windows login (this is why Konboot wouldn’t work!). If everything goes well and the pretest completes with no problems, you can begin encrypting. Encryption takes a LONG time, so be patient! Once it’s done, it’ll prompt you, and you’re finished!

For a more in depth step by step, go here.

And as always, you can email me at snubs@hak5.org!

Plausible Deniability with Hidden Truecrypt Volumes

Plausible Deniability basically means being able to deny awareness of something. For a more rich explination check out Wikipedia’s article on the subject, it’s quite interesting.

In regards to Truecrypt, our subject of the week, Plausible Deniability referrs to the ability to hide encrypted volumes within encrypted volumes. Since it cannot be proven that a hidden volume exists within a truecrypt volume.

Hidden volumes can contain just about any data, including entire operating systems. It is important to note that the sectors of a hidden volume do not change over time. If an adversary had access to the outer volume contents over a period of time the existance of a hidden volume could be proven if files were never read or written to or from these sectors.

Questions? Comments? Write me directly, Darren@Hak5.org or send feedback to the entire Hak5 crew.

Building the ultimate white box ESXi server for under $2000! Can it be done? Darren and Matt grab the company credit card and answer that question.

<strong>Building the Ultimate White Box Server for under $2000</strong></p>

<p>When it comes to building a white box server for ESXi your best resources are <a href="http://vm-help.com/" target="_blank">vm-help.com</a>, <a href="http://ultimatewhitebox.com/" target="_blank">UltimateWhiteBox.com</a>, the <a href="http://www.vmware.com/resources/compatibility/search.php" target="_blank">VMware Compatibility Guide</a>, and the <a href="http://communities.vmware.com/home.jspa" target="_blank">VMware community</a>.</p>
<p>We carefully selected ESXi supported components based on reliability and value. If this were the ultimate $3000 white box server we might have picked a server board with dual Xeon’s and ECC memory, but to keep it under that magic $2000 price point we went with beefy “desktop” components such as the <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16819115202" target="_blank">Intel Core i7 920</a>, the <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16813131365" target="_blank">ASUS P6T Deluxe</a>, and <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16820145233" target="_blank">12 GB of Corsair XMS3</a> memory.</p>

<p>Drive wise you can’t go wrong with the <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16816116042" target="_blank">3ware 9650SE-4LPML</a>. It supports four SATA II drives in RAID 0, 1, 5, 10 or JBOD. It’s bigger brother the <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16816116045" target="_blank">9650SE-16ML</a> sixteen channel SATA II controller is hot too — just at three times the price. The 9650SE isn’t supported out of the box by ESXi, however 3ware provides a <a href="http://www.3ware.com/KB/article.aspx?id=15548" target="_blank">knowledge base article and drivers</a> necessary to add support for the card after your ESXi box is built.</p>
<p>Drive wise we picked up four <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16822136284" target="_blank">Western Digital Caviar Black</a> 1TB drives since they’re cheap and reliable.</p>
<p>To make things easy when installing all these components in our <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16811147101" target="_blank">Rosewill RSV-Z4000</a> 4U rackmount case we picked up a <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16817707117" target="_blank">4 Drive trayless how swap sata backplane</a> from StarTech. IcyDock makes one too. This was the only $100 spent for convenience over performance/value, but anyone who has dealt with 5.25″ to 3.5″ mounting brackets will agree it’s worth every penny.</p>

<p>Rather than installing ESXi on the RAID, we used a 4GB USB drive from Patriot. The <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16820220251">Xporter XT</a>. It boasts really fast read/write times. I’m sure any old 1gb or larget USB drive would have done but they’re so cheap, why not?</p>
<p>We’re doing a little white box server contest. Winners will get all sorts of swag from the <a href="http://www.hak5.org/hakshop/" target="_blank">Hak5 Store</a>. Check out all the details in the <a href="http://hak5.org/forums/index.php?showtopic=13481" target="_blank">episode release thread</a> at Hak5.org</p>