Pro Hack

Okay folks :) Its that time of the year again when you can get high (me on red bull) and celebrate like there is no tomorrow (literally..2012 anyone ? ). Happy New Year everyone..I have taken a lot of resolutions for 2012, and I will make them true .. that's one more resolution for me.

As a roundup of 2011, I got hired at Tulip Telecom and now oversee the good, the bad and the nerdy side of security there along with network operations,ranted about the current security scene,wrote about Top Indian Hackers,  I got my HTC wildfire (rooted and still kicking ass), got myself a new laptop , got interested into networking, hacked routers and did a lot of research on exotic fields if you have been following the Prohack FB page lately. I am sorry for absence of posts though, which can be attributed to  me getting busy on a lot of side projects and on my Job. One of resolutions for 2012 includes giving more time to Prohack and I will see it through .
Nevertheless, stay awesome ! and Have a safe, sane and awesome 2012 .

-Rishabh Dangwal

First of all..Happy Diwali to everyone :) The festival of light , may it brings the best out of you .

Happy Diwali Everyone :)

In the mean time, there have been a lot of commotion going behind the scenes .. lots of emails asking whether I have gone into some kind of digital hibernation .. So, I will be answering the most common questions here ..

Question : What are you doing these days ?

Answer   : Networks..Networks..Networks..and lots of exotic research on some exotic devices..plus some thing related to android,android service codes,gns,cisco,juniper and random stuff about explosives.

Question : Explosives ?

Answer   : No typo :) i am into it actually for quite a long time. Home made stuff rocks if you ask me. (and if you are careful)

Question : Okay..so, why no updates ?

Answer   : Call it , lack of time (dedicated internet included) .. I am sooo busy in company work that I am not able to post some wonderful findings I have dug up.

Question : Why dont you reply to mails ?

Answer   : I reply to each and every mail I get, no matter how "flabbergasting" it may seem to me and only if it gets past my "SPAM" filters.

Question : When you will be back in fulltime writing 

Answer   : Cant say, I write when I am free..and I will stick to it till I get on a vacation.

Stay Amazing..
   Rishabh Dangwal

I came to know about HANS when one of my friends joined it,and eventually I was interested. Hence I thought some research shall suffice before joining one.

PS : bear with me, I am on my android and my thumbs hurt :| Also, in some places, the formatting might not be correct, android blogging issues .

I actually visited their site http://www.indianhans.org had a look at it and found that it had -

1. A non working Facebook login api system which actually logs you out when you do try to log in, tested it on chrome 14.0.835.163 m / Windows 7 (office PC after hours). Also, a flawed login system that allows you to login inside the side without email confirmation, also PHP code is vulnerable.
2. Some outdated references to outdated CVE's and nothing of particular interest.
3. Some 0days which have been patched up long time ago
4. Whitepapers that on google hacking and mobiles which have been published like wildfire in late 2000's, again nothing of particular interest here
5. The "Team" that comprises less of experts and more of management folks. No one with any background of security here.
6. Link to Indian HANS youtube channel.
7. Pretty crap and old flash games about hacking. LAME !
8. Backtrack introduction (mainly) and no technical tutorials in short
9. Zero original research.

Disillusioned,  I wrote a mail to Indian HANS team and  queried Indian HANS team regarding the services they provide and what they do -

Subject : Queries for Indian Hans team from a Security Enthusiastic
Dear Indian HANS Team,

I have some queries which I would like to be answered -

• What is the ultimate motive of HANS ? Are you consultants ? If YES then on what grounds ? If NO, then ,

Can you provide links to your -

• Original research
• ORIGINAL technical advisories/papers
• Tools that you wrote
• Code that you released
• Configurations of exotic software
• Exploits and modules
• 0day/0hour vulnerabilities
• Vulnerabilities what you found
• Cases of complexity that were solved
• CVE
• Documentation of exploits 
• Original findings
• Which fellow infosec researchers are working at HANS? All i found was more of management guys (seriously?) volunteers,executives,technical experts,naive girls,inexperienced folks but no security folks or self confessed hackers with known security experience and expertise.
• What is the symbiotic influence of joining Indian Hans ? Or Why SHALL we join HANS ?

--
Warm Regards,

Rishabh Dangwal
Network Security Analyst
TheProhack.com | Rish.co.in
India

"0x72697368 was here, 2620796f75206172652077617374696e6720796f75722074696d65202e2e2064756d62617373"

 and waited.
 A day passed and the reply came.

Subject : reply to an abuse mail

Warm Greets,

First of all I would like to say thanks, for being so concerned about our organization.

Following are the thoughts I would like to share about our organization.

1)      Our motive is to fill the gap between the cyber victims and the security experts, as many times we felt that in spite of  availability to many security experts in market still victims are not able to get there answers.
2)      Yes, we are consultants/Knowledge Sharers as we guide the common measures to cyber victims and government bodies [maharasthra/Punjab police]such that they can overcome a cyber crime rate.
3)      I have written 2 International Papers :
·        In response to Google Hacking
·        Future Email Security

And 2 national papers:
·        Mobile Security and upcoming challenges
·        Acknowledgement based System for Mobile Security.
4)      I have not written any security tool/configurations yet But, I write other Business applications for Accenture as an Associate Software Engineer.
5)      We have solved numerous cases  which deals with daily cyber problems including ATM cloning case [chandigarh], Source code theft case [Pune], Abuse email, fake profiles, email threatening and other hundreds.  www.youtube.com/theindianhans
6)      Ya, you are right 90% of our Organization members have managerial skills, because we strongly believe that having only technical knowledge is not enough to cease the cyber crime rate, because solving a cyber crime is thinking out of the box process.
7)      Joining a HANS, shows your commitment towards our society, that you have a zeal to help others with your knowledge and skills.


I also wish to bring to your notice without hurting your ego and sentiments that,

We are not competitors of any private owned body who work only for money. Many times we get such mails which prove that really HANS is doing a greats job. These kinds of mails show our Power of being united and our influence on other private organization. It is my humble requests kindly don’t compare our NGO with other private organizations as our motto is different. we don’t believe in writing the viruses, exploits, tools and other stuff because these things wont help a common man who is not IT literate, to overcome a cyber problem. I wont ask you same the questions as I have nothing to do with same.  I hope I have given your answers without hurting you and your team members feelings. I highly apologize if I did so.

Thanks

Happy Hacking

HANS TEAM.

Now that was interesting, my mail has been treated as an abuse email, well..nevermind. A rather to-the-point approach may be confused with that. Well, what they said -

1)      Our motive is to fill the gap between the cyber victims and the security experts, as many times we felt that in spite of  availability to many security experts in market still victims are not able to get there answers.2)      Yes, we are consultants/Knowledge Sharers as we guide the common measures to cyber victims and government bodies [maharasthra/Punjab police]such that they can overcome a cyber crime rate. I actually expected that HANS shall justify itself as a for-profit/not-for-profit organisation and why it requires money to join it when the elite organisations for example Null is a self sustained, free and aimed at the very thing HANS intends to achieve. helping naive people ? Ofcourse..thats why a lot of organisations has been growing like mushrooms (kaizen ?) and making money from it by joining it.  The core thing is that i am 100% sure that volunteers / infosec reserachers wont learn anything new and will waste their time here.

moving on ,

3)      I have written 2 International Papers :·In response to Google Hacking·Future Email Security And 2 national papers:·Mobile Security and upcoming challenges·Acknowledgement based System for Mobile Security.Great..i disregard them as recycled content, already checked it. 4)      I have not written any security tool/configurations yet But, I write other Business applications for Accenture as an Associate Software Engineer. that was fine with me.  5)      We have solved numerous cases  which deals with daily cyber problems including ATM cloning case [chandigarh], Source code theft case [Pune], Abuse email, fake profiles, email threatening and other hundreds.  www.youtube.com/theindianhansAgain, they have solved a lot of cases and hundreds , i would regard it as weasel terms. no journal on how they were solved, the method, instrumental techniques, research employed, tools/techniquies deployed, the collaboration, nothing covered, nothing said, just distorted videos at youtube. Again..no references to it. 6)      Ya, you are right 90% of our Organization members have managerial skills, because we strongly believe that having only technical knowledge is not enough to cease the cyber crime rate, because solving a cyber crime is thinking out of the box process.7)      Joining a HANS, shows your commitment towards our society, that you have a zeal to help others with your knowledge and skills.

How management can help decrease cybercrime rates is beyond me unless they really have the skills to get it in their heads. All aboard the failboat here.

I also wish to bring to your notice without hurting your ego and sentiments that,

We are not competitors of any private owned body who work only for money. Many times we get such mails which prove that really HANS is doing a greats job. These kinds of mails show our Power of being united and our influence on other private organization. It is my humble requests kindly don’t compare our NGO with other private organizations as our motto is different. we don’t believe in writing the viruses, exploits, tools and other stuff because these things wont help a common man who is not IT literate, to overcome a cyber problem. I wont ask you same the questions as I have nothing to do with same.  I hope I have given your answers without hurting you and your team members feelings. I highly apologize if I did so.

thats nice of you,and encouraging, but since you dont write viruses,exploits,0days or anything remotely related with it, then -

• Why they are linked in your website at http://www.indianhans.org/index-4.html  ?
• How do you decipher complex hack jobs them when most of your team is management one with no background of security

Anyways..i fired up my android and wrote a reply.

Subject  - Re: reply to an abuse mail
Dear Indian Hans,

The email was not an intended as an abuse email as indicated by your subject,  I would rather pass your defenses as plain excuses for hiding underlying incompetence since it requires Money to join and still no viable, updated information/code/application (as you said you develop it as associate software engineer for organisations , yet saying that you bridge the gap) , accurate information (I studied the Google hacking and mobile whitepaper, the stuff has been published before a million times, hence I would just regard it something to enhance resume) and would consider your organization nothing but a money making enterprise run by homebrew entrepreneurs without any credible research, what you solved in cases what nothing I shall say of technical callibre or "hacking ", its in more generic sense called as tech support for those who know nothing about cyber security,  while earning fame and money in the process.
I earlier thought to join it, hence inquired about it in a rather direct & to the point manner,but your response, links, references and treatment of it as an abuse email (?) makes me guess its in my best interest to stay away and convey the same to intended audience.
Stay superb

-sent from my android-

call me harsh, but that is the reality. And I am waiting for the reply. Now, I can say that I too Intended to join a Security NGO (period) and I now I am thinking otherwise.

A while back I gave training on UTM devices and Security Issues with Amarjit Singh at Tulip Telecom , here are the slides of the session. It was an enjoyable session with emphasis on security awareness and discussing network security as a whole, and how we can protect them by deploying UTM devices and configuring them for maximum security. You can also read my previous posts on Unified Threat management Systems if you haven't read them already -

1. Unified Threat Management Systems Explained
2. Unified Threat Management Systems - Single User vs Multi User
3. Comparison of Unified Threat Management Products

Corporate Security Issues and countering them using Unified Threat Management Systems and SSL VPN

Hi all,
I was working over 7200 routers for HSRP and VRRP implementation, and thought why not to cover an article over it. I will be covering Static VRRP over Cisco routers in GNS3 and will be showing you how to test it. you can also read my basic GNS3 tutorial over Cisco routers if you wish

GNS 3 Tutorial – Basic Router password Configuration

A bit about VRRP from Cisco Documentation.

The Virtual Router Redundancy Protocol (VRRP) is an election protocol that dynamically assigns responsibility for one or more virtual routers to the VRRP routers on a LAN, allowing several routers on a multiaccess link to utilize the same virtual IP address. A VRRP router is configured to run the VRRP protocol in conjunction with one or more other routers attached to a LAN. In a VRRP configuration, one router is elected as the virtual router master, with the other routers acting as backups in case the virtual router master fails.

In layman's terms, it allows for switching of routers in case a link fails or flaps. I have left some advanced parts from this tutorial, this is completely for those who have a general idea of Cisco CLI and want to learn how to configure fault tolerant VRRP over cisco routers.

Here is the GNS3 topology I will be using for this tutorial


Now, fire up your GNS3 and start by configuring all the routers. Click on the console button over titlebar to start putty terminal.the first step is to configure telnet over routers R3.

(PS: I have kept the passwords simple for the sake of simplicity, don't try this habit in an actual scenario.)

Router R3

Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#line vty 0
Router(config-line)#password r3
Router(config-line)#login
Router(config-line)#exit

Once done, Lets configure the R3 router and assign IP address over it.

Router(config)#int s0/0
Router(config-if)#ip add
Router(config-if)#ip address 1.1.1.1 255.255.255.252
Router(config-if)#no sh
Router(config)#int s0/1
Router(config-if)#ip address 2.1.1.1 255.255.255.252
Router(config-if)#no sh
Router(config-if)#
Router(config-if)#exit
Router(config)#

Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#line vty 0
Router(config-line)#password r4
Router(config-line)#login
Router(config-line)#exit

 and Interface IP's

Router(config)#int s0/0
Router(config-if)#ip add
Router(config-if)#ip address 1.1.1.1 255.255.255.252
Router(config-if)#no sh
Router(config)#int e1/0
Router(config-if)#ip address 192.168.1.1 255.255.255.0
Router(config-if)#no sh
Router(config-if)#
Router(config-if)#exit
Router(config)#

Router R5

1. Observation 1 #  - code can be run over the router , but files must be copied using echo (-ne with append option)  or tftp.  Since busybox is there, we can easily insert a kernel module to be run.
2. Observation 2# -  the webs directory has a lot of html files, maybe manipulated for xss attacks (i didnt covered it as its not my domain, some better guys can do it)
3. Observation 3# - private CVS credentials of Siemindia pserver. insider attack ? :D kidding. pserver is already much insecure, but since i have seen a lot of organisations using stock/easily guessable passwords for their outer router/firewalls/vpn servers, its not a tough nut to crack.
4. Observation 4# (most important) - BSNL SUCKS !

winAUTOPWN and bsdAUTOPWN are minimal Interactive Frameworks which act as a frontend for quick systems vulnerability exploitation. It takes inputs like IP address, Hostname, CMS Path, etc. and does a smart multi- threaded portscan for TCP ports 1 to 65535. Exploits capable of giving Remote Shells, which are released publicly over the Internet by active contributors and exploit writers are constantly added to winAUTOPWN/bsdAUTOPWN. A lot of these exploits are written in scripting languages like python, perl and php. Presence of these language interpreters is essential for successful exploitations using winAUTOPWN/bsdAUTOPWN.


Exploits written in languages like C, Delphi, ASM which can be compiled are pre-compiled and added along-with others. On successful exploitation winAUTOPWN/bsdAUTOPWN gives a remote shell and waits for the attacker to use the shell before trying other exploits. This way the attacker can count and check the number of exploits which actually worked on a Target System.

Download
Read more here