Emergency Web server with netcat

• Create single-page-serving emergency Web server with netcat:

- - - - - - - - - - - - - - - - - - -

• Example with index.html on port 8080. You'll nicely see their requests sent by their browser in the terminal:
  


shell# while true; do nc -l -p 8080 <index.html; done
GET / HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Firefox; BSD)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive

(You will see HTTP headers from clients connecting)

Detect virtualized environment: Solaris Zones

• How to determine you're in virtualized environment?

• Here comes tips against honeypots based on Solaris Containers (Zones)

- - - - - - - - - - - - - - - - - - -

• 1) Root directory (/) inode numbers for '.' and '..' do not match:
  

root# ls -lai /
total 594
4 drwxr-xr-x 19 root root 21 Oct 10 16:16 .
3 drwxr-xr-x 19 root root 21 Oct 10 16:16 ..
...

- - - - - - - - - - - - - - - - - - -

• 2) System diagnostic tools will not work, or will not be available:
  

root# prtdiag
prtdiag can only be run in the global zone

root# prtconf
System Configuration: Sun Microsystems i86pc
Memory size: 8064 Megabytes
System Peripherals (Software Nodes):

prtconf: devinfo facility not available
root#
- - - - - - - - - - - - - - - - - - -

• Solaris Zones will not be used probably for any honeypot activities..
  

Password Recovery Tool for ZIP-files (fcrackzip)

• GPL Open Source application for cracking zip passwords called fcrackzip:

bash# fcrackzip -h

fcrackzip version 1.0, a fast/free zip password cracker
written by Marc Lehmann  You can find more info on
http://www.goof.com/pcg/marc/

USAGE: fcrackzip
       [-b|--brute-force]            use brute force algorithm
       [-D|--dictionary]             use a dictionary
       [-B|--benchmark]              execute a small benchmark
       [-c|--charset characterset]   use characters from charset
       [-h|--help]                   show this message
       [--version]                   show the version of this program
       [-V|--validate]               sanity-check the algortihm
       [-v|--verbose]                be more verbose
       [-p|--init-password string]   use string as initial password/file
       [-l|--length min-max]         check password with length min to max
       [-u|--use-unzip]              use unzip to weed out wrong passwords
       [-m|--method num]             use method number "num" (see below)
       [-2|--modulo r/m]             only calculcate 1/m of the password
       file...                    the zipfiles to crack

methods compiled in (* = default):

0: cpmask
1: zip1
*2: zip2, USE_MULT_TAB

- - - - - - - - - - - - - - - - - - -

• Example 1) Dictionary attack:

bash# fcrackzip -v -D -p /usr/share/dict/words confidental.zip
found file 'list.xml', (size cp/uc     12/     0, flags 9, chk 61f7)
possible pw found: zoologists ()                    
^D
bash#

- - - - - - - - - - - - - - - - - - -

• Example 2) Bruteforce with alphanumeric characters (a-z 0-9) with lenght of 7 characters:

bash# fcrackzip -v -b -c a1 -p aaaaaaa secret.zip
found file 'secret.doc', (size cp/uc     12/     0, flags 9, chk 61f7)
possible pw found: 1337pwd ()                    
checking pw 15igvpt
^D
bash#

Blocking websites in Windows (local DoS)

• Tip how to block any website in Windows system (9x,XP,2k,2k3..) from command line - enhanced version against skilled powerusers:

- - - - - - - - - - - - - - - - - - -

• 1) Open this file with any editor:
  C:\WINDOWS\System32\drivers\etc\HOSTS

• This file contains configuration for name resolver subsystem - translated addresses. Now think of some random IP address, and check that it's down or unreachable or that it has at least closed ports like 80, 443.
  

• 2) Add it all to the hosts file:
  

35.234.31.215     www.i_dont_want.com  i_dont_want.com

• Now the site "i_dont_want.com" will be automatically name-resolved incorrectly - will point to the host, which doesn't work - user will get no suspicion about modified hosts file (no 127.x.x.x shit..)

- - - - - - - - - - - - - - - - - - -

• Command line friendly usage - block youtube.com :

C:\> echo "35.234.31.215 www.youtube.com youtube.com" >> C:\WINDOWS\System32\drivers\etc\HOSTS