spoonfork

stopping blogging for a while. nothing much to write, plus i have better things to do. my next update is probably after i get some ink done. maybe.

nbss.rb is a NetBIOS shares scanner, well not really, but more of a wrapper for smbclient and nmblookup to search for shares on Windows machines. the scan result is somewhat-nicely formatted in html (sample). it was written in a haste during a recent pen-test assignment a few enhancements would make it better:

• using threads for faster scans. currently, the IPs are scanned sequentially, scanning a large network (especially when there are non-Windows machines around) take some time. however, i haven't really tested Ruby threads, so...


• the HTML output needs face lift


• results of scans are concatenated and printed after all scans are done - reducing memory usage by writing results of each scanned IP will solve this.


• some of the error messages in the output file need to be supressed.


• a -u username and -p password arguments for scanning. right now the scans are done as anonymous user.


• testing whether the shares are readable and writeable using supplied credentials (or anonymous user) - very good for penetration testing

like i say, it was written in a haste, but it works for me. the preferred usage is by feeding nbss.rb with a file containing a list of IPs to scan (IPs of windows machine already scanned using nmap), and then piping the output to a file (nbss.rb ip.txt > result.html). also, you need to have samba and ipadmin installed.

listening to: everything but the girl - each and everyone

geek00l and i will be conducting a two-day training titled structured network threat analysis and forensics at the next hitbsecconf2006 conference. this is a hands-on, highly-technical two day training that will teach you on how to detect, analyze, and perform incident response and handling. we will throw at you tons of packet capture files, and we will show you how to analyze them using Open Source tools. when we say analyze, we mean: looking for signs of attacks, determining the source and attack destination, and detecting targetted vulnerabilities. we will also show you how to build, deploy and manage NSM (Network Security Monitoring) architecture.

heh, this is gonna be a totally ghetto, old skool packet analysis training.

details of the training can be found here. the full training syllabus will be made available by next week. i will also create a wiki page a couple of months before the training, that if we have enough people registering for it.

4500 0028 b5cb 4000 fe01 b229 0102 0304 c0a8 0505

what is the length of the ip header in the capture above? how many bytes are in the ip header? if you want to know the answer by just looking at the dump, our training class will show you the way of the packet

listening to: queens of the stone age - in the fade

some tools:

• catdoc reads m$ word file and output its contents in ASSKEY to standard out.


• antiword works similarly as catdoc, except that the output is not formatted as nicely as the one created by catdoc.

what's the tool for? forensics analysis and penetration testing. in the latter, during a recent penetration testing exercise, i've managed to retrieve "My Documents" which contained up to 500 m$ word files. from the hacker's perspective, this was a gem of a find. however, sorting and viewing all the files manually aren't productive. so, enter catdoc/antiword and a few lines of shell scripts, one can do:

# generate lists of keywords euclid $ cat > search_key.txt password katalaluan email tender report kewangan ^D # run catdoc and search euclid $ IFS="$(echo -ne '\000')" # use space as field separator euclid $ for i in `find . -name "*.doc" -print`; do catdoc $i > tmpdir/$i.txt; done euclid $ for i in `ls tmpdir'; do cat tmpdir/$i | egrep --color -i -f search_key.txt >> results.txt ; done
and you might find files that contain lists of usernames and passwords (as in the case of the pen-test that i was doing).

NOTE: the IFS internal variable will work for files with spaces... there's a shell script to handle files with (, &, and all sorts of characters but wait till i clean it up and make it more useful

for forensic, the purpose is the same as above, i.e. looking for files by searching their contents.

listening to: everything but the girl - meet me in the morning

left this post blank intentionally

listening to: busta rhymes - dangerous