Category Archives: BackTrack

[Tool] EvilGrade 2.0 (and installation on BackTrack)

1
Posted by Skyler on November 1, 2010 – 10:58 am
Filed under BackTrack, Fu (a.k.a Tips), Tools

This is a fantastic tool that most of you have probably heard of. If not, here is a brief summary. EvilGrade exploits weaknesses in the auto-update services of multiple common software packages. It is able to trick the service into believing there is a signed update available for the product, thus prompting the user to install the upgrade. Unfortunately the upgrade is in actuality an attacker’s payload. The nefarious part about this product is that it is very difficult for the average user to detect! Since it utilizes the software’s own update process, there is no suspicious looking box or popup that would seem out of the ordinary; it would look just like any other legitimate upgrade.

Version 2 has made some even greater improvements. Not only is there more signing bypass, but the available modules (meaning, the pieces of software that you can exploit) has improved greatly. Prior to this I only found the Notepad++ module to be the real exciting one, but now EvilGrade includes the following:

  • Java
  • Mirc
  • VirtualBox
  • VMWare
  • Windows Update
  • IStat
  • Winscp
  • Winamp
  • More

From that list you could target nearly anybody.

You can check out a sweet demo of it (including its bypassing Java’s signing security) here.

Install on BackTrack

Installation on BackTrack is pretty simple. Here are some of the steps:

Step 1: Download EvilGrade here

Step 2: Extract EvilGrade using:

tar -zxvf isr-evilgrade-2.0.0.tar.gz

Step 3: Install Perl Dependencies

Here is the important part. EvilGrade requires the following perl modules:

  • Data::Dump
  • Digest::MD5
  • Time::HiRes

For BackTrack you will need to install the first two. This is how you can locate them:

sudo apt-cache search perl [package, i.e Data::Dump]

It will respond with a package name (like libdata-blahblah, etc). Install it with the following:

sudo apt-get install [package, i.e, libdata-blablah]

Step 4: Run evilgrade

Backtrack’s ‘Dragon’ Utility

0
Posted by Skyler on October 29, 2010 – 9:11 am
Filed under BackTrack, Fu (a.k.a Tips)

I was listening to PaulDotCom’s podcast this morning and I found a neat little tidbit.

The fellows over at Offensive-Security were on talking about the Social-Engineering Framework. Of course, their topic shifted to BackTrack where  Mati mentioned the ‘dragon’ utility that many people are unaware of. Here is what it does:

upgrade – installs all new packages

follow – Nearly equivalent to using aptitude itself

repositories  - toggles the inclusion of the test repository

kernel – prepares kernel sourcecode

firmware – alters firmware used by the distrobution

splash – make any fixes of the bootup splashcreen (like the fixsplash script)

desktop – choose a different desktop manager (kde or fluxbox)

credits – enough said

version – what do you think?

Hope that helps!

Enabling /dev/tcp on Backtrack 4r1(Ubuntu)

2
Posted by Skyler on August 23, 2010 – 5:08 am
Filed under BackTrack, Fu (a.k.a Tips)

After my post on weaponizing /dev/tcp, I had some kickback  from people trying to test it out. Users on a Debian based system will have issues since bash is not compiled with /dev/tcp enabled. All it requires is a quick recompiling of the shell, and a few changes after that:

Step 1: Download the latest BASH source

use a browser to get it here.

or

cd /tmp
sudo wget ftp.gnu.org/gnu/bash/bash-4.1.tar.gz

NOTE: Backtrack uses an older version of bash. I am not sure if they do this for any specific reason. I compiled 4.1 and havn’t had any issues. Let me know if you know otherwise

Step 2: Extract the source code

tar zxvf bash-4.1.tar.gz
cd bash-4.1

Step 3: Configure and install

sudo su
./configure --enable-net-redirections
make && make install

Step 4: Replace old version of bash with the new version

mv /bin/bash /bin/bash-OLD
ln -s /usr/local/bin/bash /bin/bash

Step 5: Test!

check to see if your new installation works. Close your current terminal, and reopn it. Then issue the following command and check the results:

reliks@bt:/tmp$ bash --version


GNU bash, version 4.1.0(1)-release (i686-pc-linux-gnu)


.....
reliks@bt:/tmp$ /bin/bash --version
GNU bash, version 4.1.0(1)-release (i686-pc-linux-gnu)
The versions returned should be that of which you just installed. They should also match.

You can now test to see if your access to /dev/tcp works:

cat < /dev/tcp/time.nist.gov/13

There you go! You should get back the time according to NIST.

Let me know if you have any issues! thanks!

Bad Behavior has blocked 275 access attempts in the last 7 days.