What is Ncrack?

Taken from the author’s site…

Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed using a modular approach, a command-line syntax similar to Nmap and a dynamic engine that can adapt its behavior based on network feedback. It allows for rapid, yet reliable large-scale auditing of multiple hosts.

Ncrack’s features include a very flexible interface granting the user full control of network operations, allowing for very sophisticated brute-forcing attacks, timing templates for ease of use, run-time interaction similar to Nmap’s and many more.

Ncrack was started as a “Google Summer of Code” Project in 2009. While it is already useful for some purposes, it is still unfinished, alpha quality software. It is released as a standalone tool and can be downloaded from the section below. Be sure to read the Ncrack man page to fully understand Ncrack usage.

Modules

Ncrack’s architecture is modular with each module corresponding to one particular service or protocol. Currently, Ncrack supports the protocols FTP, TELNET, SSH and HTTP(S) (basic authentication). Below we describe some key points for each of them.

FTP Module

FTP authentication is quite fast, since there is very little protocol negotiation overhead. Most FTP daemons allow 3 to 6 authentication attempts but usually impose a certain delay before replying with the results of a failed attempt. Filezilla is one of the most characteristic examples of this case, where the time delay is so great, that it is usually faster to open more connections against it, with each of them doing only 1 authentication per connection.

TELNET Module

Telnet daemons have been largely substituted by their safer ‘counterpart’ of SSH. However, there are many boxes, mainly routers or printers, that still rely on Telnet for remote access. Usually these are also easier to crack, since default passwords for them are publicly known. The drawback is that telnet is a rather slow protocol, so you shouldn’t be expecting really high rates against it.

SSH Module

SSH is one of the most prevalent protocols in today’s networks. For this reason, a special library, named opensshlib and based on code from OpenSSH, was specifically build and tailored for Ncrack’s needs. Opensshlib ships in with Ncrack, so SSH support comes out of the box. OpenSSL will have to be installed in Unix systems though. Windows OpenSSL dlls are included in Ncrack, so Windows users shouldn’t be worrying about it at all.

SSH brute-forcing holds many pitfalls and challenges, and you are well advised to read a paper that was written to explain them. The latest version of the “Hacking the OpenSSH library for Ncrack” document can be found under docs/openssh_library.txt or at http://sock-raw.org/papers/openssh_library

HTTP(S) Module

The HTTP Module currently supports basic authentication only, however additional methods will be added soon. Ncrack tries to use the “Keepalive” HTTP option, whenever possible, which leads to really high speeds, since that allows dozens of attempts to be carried out per connection. The HTTP module can also be called over SSL.

SMB Module

The SMB module currently works over raw TCP. NetBIOS isn’t supported yet. This protocol allows for high parallelization, so users could potentially increase the number of concurrent probes against it. SMB is frequently used for file-sharing among other things and is one of the most ubiquitous protocols, being present in both Unix and Windows environments.

RDP Module

RDP (Remote Desktop Protocol) is a proprietary protocol developed by Microsoft for the purpose of providing remote terminal services by transferring graphics display information from the remote computer to the user and transporting input commands from the user to the remote computer. Fortunately, Microsoft recently decided to open the protocol’s internal workings to the public and has provided official documentation, which can be found at http://msdn.microsoft.com/en-us/library/cc240445%28v=PROT.10%29.aspx

RDP is one of the most complex protocols, requiring the exchange of many packets, even for just the authentication phase. For this reason, cracking it takes a lot of time and this is probably the slowest module. The connection phase is briefly described at http://msdn.microsoft.com/en-us/library/cc240452%28v=PROT.10%29.aspx where you can also see a diagram of the various packets involved. Care must be taken against RDP servers in Windows XP versions, since they can’t handle multiple connections at the same time. It is advised to use a very slow timing template or even better limit the maximum parallel connections using timing options such as CL (Connection Limit) or cd (connection delay) against Windows XP (and relevant) RDP servers. Windows Vista and above don’t suffer from the same limitation.

POP3(S) Module

POP3 support is still experimental and hasn’t been thoroughly tested. You can expect it to work against common mail servers, nevertheless.

Installation and Basic usage:

Once you have download the latest version from the Ncrack website, the installation process is as follows:

tar -xzf ncrack-0.3ALPHA.tar.gz
cd ncrack-0.3ALPHA
./configure
make
su root
make install

Or download the development svn:

svn co –username guest –password “” svn://svn.insecure.org/ncrack

Before you attempt to start  using this tool its recommended that you first read the Manual, either online or issue “man ncrack”, from your console.

Quick Examples:

I first fired up nmap and ran it against a Lexmark network printer.

infolookup@TestSrvr:~# nmap -A 172.29.19.85

Starting Nmap 5.35DC1 ( http://nmap.org ) at 2010-09-22 22:26 EDT
Nmap scan report for rnp92a8d6.localhost (172.29.19.85)
Host is up (0.00020s latency).
Not shown: 992 closed ports
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        Lanier LP125cx/LP126cn ftpd 4.15.1
|_ftp-bounce: bounce working!
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
23/tcp   open  tcpwrapped
80/tcp   open  http       Ricoh Aficio printer web image monitor (Web-Server httpd 3.0)
|_html-title: Web Image Monitor
|_http-methods: No Allow or Public header in OPTIONS response (status code 501)
139/tcp  open  tcpwrapped
514/tcp  open  login      Aficio/NRG/Ricoh printer logind
515/tcp  open  printer    lpd (error: Illegal service request)
631/tcp  open  ipp        NRG copier or Ricoh Aficio printer (Embedded Web-Server 3.0)
9100/tcp open  jetdirect?
MAC Address: 00:00:23:92:G8:F1 (Ricoh Company)
Device type: printer
Running: Ricoh embedded, Savin embedded
OS details: Ricoh Aficio 3045/3245C multifunction printer, Savin 8025e multifunction printer
Network Distance: 1 hop
Service Info: Device: printer

Now that we have our open ports  we can now  feed them to ncrack to test if we have any weak passwords. As you can see from the below command I am using NCrack to look for weak authentication via Telnet, FTP, HTTP. You can either specify the port number, the service name or both.

infolookup@TestSrvr:~# ncrack -v –log-errors /tmp/ncrack.txt  172.29.19.85 -p telnet,ftp:21,http

Starting Ncrack 0.3ALPHA ( http://ncrack.org ) at 2010-09-22 22:41 EDT

Failed to resolve given hostname/IP: . Note that you can’t use ‘/mask’ AND ’1-4,7,100-’ style IP ranges
http://172.29.19.85:80 finished.
Discovered credentials on ftp://172.29.19.85:21 ‘root’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘administrator’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘guest’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘info’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘security’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘support’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘abuse’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘admin’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘postmaster’ ’123456′
Discovered credentials on ftp://172.29.19.85:21 ‘lists’ ’123456′
caught SIGINT signal, cleaning up
Saved current session state at: /root/.ncrack/restore.2010-09-22_22-42

We can conclude from the above test that our FTP service was mis-configured because we left “Anonymous FTP login ” turned on. Our Nmap scan shown us this and we were able to confirm it, since every possible login via FTP was granted access.

Now this was just a basic test, however you can do much more like stop and restart your session, specify your own username and password list, and much more. If you don’t have a good password list visit –>  SkullSecurity , and I must end by saying ” for an Alpha release I am very impressed”, and I cant wait to see what the future has to offer for this program.

Reference links:

http://nmap.org/ncrack/man.html

Today’s post will serve as a sort of show notes for the Linux Basix podcast that I will be a guest on tonight.

Discussion Links:

1. SET v0.7 aka “Swagger Wagon” new release, I did a blog posting on the 14th highlighting SET, and I am mentioning it here again because I think it worth taking a look at this program. For anyone not familiar with the Social-Engineer Toolkit (SET), it’s specifically designed to perform advanced attacks against the human element. SET was designed to be released with the http://www.social-engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. The group also had a Social Engineering Capture the Flag competition at”Defcon 18″ and the have finally release the full report http://www.social-engineer.org/resources/sectf/Social-Engineer_CTF_Report.pdf
   
2. A report was published detailing the exploits of a former Google engineer who allegedly used his internal clearances to access private Gmail and GTalk accounts so that he could spy on and harass people, including four minors, read more over at http://techcrunch.com/2010/09/14/google-engineer-spying-fired/. Now this brings me back to a similar point I made a while back, we have to stop putting all our truth in the cloud-base services because we never know if or how much the are violating our privacy.
3. Second time’s a charm “Linux Kernel 0-day bug”, on the 16th I did a quick new bulletin post highlighting a serious Linux vulnerability. The vulnerability was found in a component of the operating system that translates values from 64 bits to 32 bits (and vice versa) was fixed once before – in 2007 with the release of  kernel version 2.6.22.7. But several months later, developers inadvertently rolled back the change, once again leaving the OS open to attacks that allow unprivileged users to gain full root access, Read the complete article over at The Register..
   
4. Is Stuxnet the ‘best’ malware ever? Even though this is not Linux related issue, I know a lot of us fix our friends and family computers and its always good to keep-up on new malware threads. The Stuxnet worm is a “groundbreaking” piece of malware so devious in its use of unpatched vulnerabilities, so sophisticated in its multipronged approach, that the security researchers who tore it apart believe it may be the work of state-backed professionals. They work for the two security companies that discovered that Stuxnet exploited not just one zero-day Windows bug but four — an unprecedented number for a single piece of malware, read full article over at computerworld.com.
   
5. Tunneling SSH over HTTP(S), Not much to talk about this one but I think it’s pretty cool and you should give it a try, I know I will. –> http://dag.wieers.com/howto/ssh-http-tunneling/

Tech Segment: Building your test lab

During this segment I i will be discussing what I have been up too for the last  few days and thats rebuilding my home network so I can  have more that just a laptop to perform my various testing.

Equipment used in lab:

• HP DL 380 G4 server with 6 drives (2X75, 4X150) with ESXi installed.
• Cisco 3500 switch
• Cisco 2621 router
• Verizon FIOS Wifi router.
• PFsense FW

OS currently installed:

• FreeBSD
• Ubuntu server
• Snorby IDS

Router config:

RT01#sh run
Building configuration…

Current configuration : 1202 bytes
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname RT01
!
enable secret 5 10g1n\//\/
enable password 7 10g1n\//\/
!
ip subnet-zero
!
interface FastEthernet0/0
no ip address
speed 100
full-duplex
!
interface FastEthernet0/0.30
encapsulation dot1Q 30
ip address 10.29.19.1 255.255.255.0
!
interface FastEthernet0/0.40
encapsulation dot1Q 40
ip address 10.29.20.1 255.255.255.0
!
interface FastEthernet0/0.50
encapsulation dot1Q 50
ip address 10.29.21.1 255.255.255.0
!
interface Serial0/0
no ip address
shutdown
!
interface FastEthernet0/1
description Transit-to-FW
ip address 172.1.1.2 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1.10
encapsulation dot1Q 10
!
router rip
version 2
network 172.0.0.0
network 10.29.0.0
no auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.1.1.1
no ip http server
!
line con 0
password 7 10g1n\//\/
login
line aux 0
line vty 0 2
password 7 10g1n\//\/
login
line vty 3 4
password 7 10g1n\//\/
login
!
end

Switch Config:

SW01#sh run
Building configuration…

Current configuration:
!
! No configuration change since last restart
!
version 12.0
no service pad
service timestamps debug uptime
service timestamps log datetime msec
service password-encryption
!
hostname SW01
!
enable password 7 10g1n\//\/
!
username infolookup password 7 10g1n\//\/
!
ip subnet-zero
no ip domain-lookup
!
interface FastEthernet0/1
description Uplink-to-Verizon
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/2
description Firewall-OUT-interface
switchport access vlan 10
spanning-tree portfast
!
interface FastEthernet0/3
description Firewall Inside-Transit
switchport access vlan 11
!
interface FastEthernet0/4
description Link to Router  – Fa0/1
duplex full
switchport access vlan 11
!
interface FastEthernet0/5
!
interface FastEthernet0/18
!
interface FastEthernet0/19
switchport access vlan 30
spanning-tree portfast
!
interface FastEthernet0/20
description Inside-workstation
switchport access vlan 40
spanning-tree portfast
!
interface FastEthernet0/33
description ESX Host
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 30
switchport trunk allowed vlan 1,30,40,50,1002-1005
switchport mode trunk
!
interface FastEthernet0/34
!
interface FastEthernet0/35
description ESXi Host-Mgmnt
duplex full
speed 100
switchport access vlan 40
spanning-tree portfast
!
interface FastEthernet0/36
!
interface FastEthernet0/48
duplex full
speed 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 30
switchport trunk allowed vlan 1,30,40,50,1002-1005
switchport mode trunk
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface VLAN1
no ip address
no ip directed-broadcast
no ip route-cache
shutdown
!
interface VLAN30
ip address 10.29.19.10 255.255.255.0
no ip directed-broadcast
no ip route-cache
!
interface VLAN100
no ip directed-broadcast
no ip route-cache
shutdown
!
ip default-gateway 10.29.19.1
!
line con 0
exec-timeout 0 0
password 7 10g1n\//\/
login local
transport input none
stopbits 1
line vty 0 4
password 7 10g1n\//\/
login local
line vty 5 15
no login
!
ntp clock-period 11259018
ntp server 153.16.4.130
end

PFsense Config:

• Configured port forwarding, you can do this via the interface or be editing /config/config.xml
  • Forward to my FreeBSD box
  • Configured my dynamic DNS  host (free of course)
  • Forward my VMware ESX connection over SSH
  • Configured Snort to send logs to Snorby

Links:

• http://www.pfsense.org/
• http://snorby.org/
• http://www.securityjokes.com/2010/04/pfsense-remote-logging-and-snorby.html
• http://www.freebsd.org/
• http://www.cisco.com/en/US/tech/tk389/tk689/technologies_configuration_example09186a008009478e.shtml

I am sure by noon today you will see lots more technology blogs talking about this old but yet new bug. “The Linux kernel has been purged of a bug that gave root access to untrusted users – again.”

Background:

The vulnerability in a component of the operating system that translates values from 64 bits to 32 bits (and vice versa) was fixed once before – in 2007 with the release of version 2.6.22.7. But several months later, developers inadvertently rolled back the change, once again leaving the OS open to attacks that allow unprivileged users to gain full root access.

//

The bug was originally discovered by the late hacker Wojciech “cliph” Purczynski. But Ben Hawkes, the researcher who discovered the kernel regression bug, said here that he grew suspicious when he recently began tinkering under the hood of the open-source OS and saw signs the flaw was still active. Read the complete article over at The Register..

Sample exploit is already in the wild as show via http://seclists.org/fulldisclosure/2010/Sep/268 . Since I am not a expert in exploit development or analysis I will sit back and wait for the guys over at Metasploit or SET to whip up so I can test.

Unless you don’t follow the Infosec/Social engineering scene you should know what the Social-Engineering toolkit is, and that a new version was  release today, version 0.7 aka “Swagger Wagon”. However since I am really happy that I have a new version to play with I will try to assist anyone that’s new to SET by pointing you in the right direction to get you started and by sharing a bit of information on how the project got started.

I did a post a few weeks back on using version 0.6.1 to exploit the Microsoft windows OS DLL flaw which you can view here. However today’s posting is all about the new features that you are getting with version 0.7, what has been fixed and a mini interview with the creator of SET none other than Mr David Kennedy aka ReL1k.

For a quick recap..

What is SET?

The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the http://www.social-engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.

New features and bug fixes :

* Fixed the NAT/Port FWD descriptions to be a little bit more descriptive
* Bug fixes on payload gen with x64 bit payloads in Metasploit
* Added new Multi-Attack Payload option to utilize multiple attack vectors
* Incorporated Multi-Attack into each web attack vector
* Added a PID management system in SET for stray processes
* Cleaned up payloadgen code and SET code to reflect new multiattack changes
* Added the web jacking attack vector by white_sheep, emgent, and the Back|Track team
* Fixed an issue with ARP Cache defaulting, it should now poison everyone
* Added better error handling within the SET menus, still needs a bit more work
* Cleaned up color schema and removed old code
* Added the Adobe CoolType SING Table ‘uniqueName’ Overflow zero day from Metasploit in spear  phishing
* Added two more Teensy based payloads, thanks Garland!
* Added HTML support for Spear-Phishing Attack Vector
* Added HTML support when WEBATTACK_EMAIL=ON for web attack vector
* Added the Adobe Cooltype SING Table Overflow zero day for browser exploit
* Added the new SET User Manual to readme/. This is a big update and has updated content for 0.7
* Fixed a simple yes or no answer when requirements for SET were not met

If you are new to SET you should start here:

1. http://www.secmaniac.com/
2. http://www.social-engineer.org
3. IRC.freenode.net #social-engineer
4. http://www.vimeo.com/14837669
5. http://www.offensive-security.com/metasploit-unleashed/SET

Mini interview with SET’s creator David Kennedy aka “ReL1k”:

Question: Do you think social engineering is a growing threat or would you say its something of the pass?

Answer: Social-Engineering has always been problematic however it is ever increasing because of the controls put in place on the external perimeter. Your typically not seeing the same types of attacks externally facing as you once were. This is a good thing and a testament that security is starting to work in the industry however, with social-engineering you face a whole new slew of problems.

Q: Where did the name SET came from?

A: Me and Chris from social-engineer.org were sitting on skype talking about making a tool, kind of just came to mind and stuck with it.. We never had any idea it would get this big.

Q: What made you start this project?

A: When Chris Hadnagy (loganWHD) was starting up social-engineer.org, we were sitting there talking and came to the conclusion that there really was no penetration testing tools out there dedicated to social-engineering. We knew the effects of social-engineering and how easy it was, but there was nothing out there to help aid in testing social-engineering.

Q:Who was your intended audiences for this framework?

A: I try to keep SET as easy as possible, you have the basic setup, but then you can customize and do more advanced setup based of your needs. It’s really intended for super technical folks as well as hobbyists.

Q: What other framework like this can SET be compared too?

A: I’m not sure there are other frameworks out there that can be compared to SET, it’s specially designed to Social-Engineering, not something that’s really out there. SET can’t be compared to something like a exploitation framework like Metasploit who has full time commitment and years of maturity with some of the most brilliant minds in the industry. But someday hope SET will reach that level on the social-engineer side.

Q: Do you plan on commercialising this project at any point in time and start charging for its use?

A: Never, SET will always remain free and open source. That has always and will always be my goal. *Awesome answer *

Q: What was the total number of downloads for version 0.6.1?

A: SET v0.6.1 has over 1.3 million downloads last time I checked. These are unique IP addresses, not downloads over and over again. I think that’s awesome in some fashions, but scary in another…

Q: What are a few of your favorite features in this new version?

A: The multi-attack is awesome, the ability to load multiple attack vectors in one, then have multiple attacks targeted at a victim. The webjacking is really awesome too, it’s a really convincing attack.

Q: What inspired your new code name for the this version?

A: Well 0.6 was inspired on my favorite drink, Arnold Palmers. This drink for some reason gets me to spit out thousands of lines of code effortlessly. Now in 0.7 (swagger wagon), me and my wife recently added two twins to our household and bought a mini-van, so the family was the influence for this version code name . *I think the should give you a free case for saying that *

Q: What’s the best way someone can contribute to this project if the have ideas and suggestions?

A: Email is the best route, I really try to take every one’s recommendations and if it fits, incorporate it into SET. You can always find me on IRC as well on #social-engineer.org. Or like Kos did, he sent me his python code and I worked it into the 0.6 version of SET. I’m always looking at improving SET and making it better, it wouldn’t be anywhere near where it is now without the help of everyone contributing with bug fixes, ideas, and additions.

So there you have it, a new version is out if you haven’t had a chance to play with older versions now is your change at the new and improve version. I am sure in  few months I will be doing another blog posting if ReL1k keeps drinking those “Arnold Palmers” . Go get your copy, send in your sample codes, report your bugs, and lets make this version hit over 2M downloads.

I  appeared on the Linux Basix podcast once more, I am becoming a regular . Below are some of the things I spoke of during my segment.

Discussion Links:

1. Symantec Snoop Dogg rap contest site rickrolled: Symantec’s attempts to link up with Snoop Dogg to launch a cybercrime rap contest, to bring about awareness on the issue. However it turned out that the site had several vulnerabilities and had to be taken down for maintenance, read more over at  http://www.theregister.co.uk/2010/09/03/symantec_rap_contest_farce/.
2. Facebook adds new remote log-out security feature: Facebook on Thursday announced a new security feature that will allow users to see if they are logged into their accounts on a different computer and to remotely log out if so. This can also be used to see if someone has your password and has been logging in when you are not around. The new security feature follows a Login Notification feature the company announced in May that lets users tell Facebook to notify them via e-mail or SMS when a new computer or device is used to log into their account, read more over at  http://news.cnet.com/8301-27080_3-20015482-245.html .
3. Rosetta Stone for Unix: The goal of this site is to give you a command syntax comparison between Linux, Unix, MAC OSX, and a few others, visit http://bhami.com/rosetta.html and have some fun. Another good site with a collection of Unix/Linux/BSD commands is –> http://cb.vu/unixtoolbox.xhtml which gives you the option to save the page as a new PDF ebook.
4. Malware hosted on Google Code project site: Malicious individuals are using the Google Code repository to host Trojans horses, backdoors and password stealing keyloggers, according to researchers at Zscaler. The researchers found a malicious project hosted on the free Google Code site with about 50+ malware executables stored in the download section of the project. “The first malicious file was uploaded on June 24, 2010 and was still active at the end of August this year, proving that Google is slow to find and remove malicious projects”, read more over at http://www.zdnet.com/blog/security/malware-hosted-on-google-code-project-site/7247

Tech Segment: Installing and using Xplico

What is Xplico?

The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT).

Features

• Protocols supported: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, …;
• Port Independent Protocol Identification (PIPI) for each application protocol;
• Multithreading;
• Output data and information in SQLite database or Mysql database and/or files;
• At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;
• Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer -RAM, CPU, HD access time, …-);
• TCP reassembly with ACK verification for any packet or soft ACK verification;
• Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
• No size limit on data entry or the number of files entrance (the only limit is HD size);
• IPv4 and IPv6 support
• Modularity. Each Xplico component is modular. The input interface, the protocol decoder (Dissector) and the output interface (dispatcer) are all modules
• The ability to easily create any kind of dispatcer with which to organize the data extracted in the most appropriate and useful to you

Installing and Configuring:

First begin with a little sudo fu and install the following packages:

apt-get install tcpdump tshark apache2 php5 php5-sqlite build-essential perl zlib1g-dev libpcap-dev libsqlite3-dev php5-cli libapache2-mod-php5 libx11-dev libxt-dev libxaw7-dev python-all sqlite3 recode sox lame libnet1 libnet1-dev libmysqlclient15-dev

Create a temp directory to wget your files too with mkdir Xbuild and cd Xbuild

Download Xplico source code from SorceForge or BerliOS

tar zxvf xplico-0.5.x.tgz

wget http://geolite.maxmind.com/download/geoip/api/c/GeoIP-1.4.6.tar.gz
tar zxvf GeoIP-1.4.6.tar.gz

cd GeoIP-1.4.6
./configure
make

cd ..
rm -f *.tar.gz

cd xplico
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
gzip -d GeoLiteCity.dat.gz
rm -f *dat.gz
make

cd ..
wget http://mirror.cs.wisc.edu/pub/mirrors/ghost/GPL/ghostpdl/ghostpdl-8.70.tar.bz2
tar jxvf ghostpdl-8.70.tar.bz2

The ghostpcl contains the pcl6 application that it is necessary to “network printer job”

rm -f *.bz2
cd ghostpdl-8.70
make

Wait for some time

cd ..
cp ghostpdl-8.70/main/obj/pcl6 xplico-0.5.x
rm -rf ghostpdl-8.70

Download videosnarf from http://ucsniff.sourceforge.net/videosnarf.html. Note for 64 bits architectures: Some codec libraries are proprietary and are only for 32bits architecture. The only solution in this case is this: http://forum.xplico.org/viewtopic.php?p=453#p453

wget http://downloads.sourceforge.net/project/ucsniff/videosnarf/videosnarf-0.63.tar.gz
tar xvzf videosnarf-0.63.tar.gz
cd videosnarf-0.63
./configure
make
cd ..
cp videosnarf-0.63/src/videosnarf xplico-0.5.x

Install Xplico

cd xplico-0.5.x
make install

Copy Apache configuration file

cp /opt/xplico/cfg/apache_xi /etc/apache2/sites-enabled/xplico

After this we have to change Apache ports file to add port of XI. Then, in /etc/apache2/ports.conf add:

# xplico Host port
NameVirtualHost *:9876
Listen 9876

We must also modify the php.ini file to allow uploads (pcap) files. Edit /etc/php5/apache2/php.ini.

The lines to modify are:\\
**post_max_size = 100M** \\
**upload_max_filesize = 100M**\\

Enable mode rewrite in Apache:

a2enmod rewrite

And finally restart Apache:

/etc/init.d/apache2 restart

You can find much more information and documentation on the wiki –> http://wiki.xplico.org.

Uploading your first PCAP file:

1. Log into the user inter by going to http://xplicoip:9876
2. Username:xplico and password:xplico please change after
3. Click on Case to create a new case.
4. Click on session to create a new session
5. Click on newly created session within the newly created case and click upload–> browse to your capturefile.pcap.
6. You can also create a live stream and just have the host sit there passively listening.

Sit back wait for xplico to works it’s magic and then browse your results. View this page to see screen-shots of all the various options of xplico –> http://wiki.xplico.org/doku.php?id=web_interface. Now all your have to do is go sniffing, read the manual and have fun viewing your results.

the below Post came through Full Disclosure mailing this today and I figured for something this interesting it merited a re-post.

Month of Abysssec Undisclosed Bugs – Day 1 From: muts
Date: Wed, 01 Sep 2010 15:21:34 +0200

Hi Lists,

The Abysssec Security Team has started its Month of Abysssec undisclosed
bugs (MOAUB).

During this month, Abysssec will release a collection of 0days, web application vulnerabilities, and detailed binary analysis (and pocs) for recently released advisories by vendors such as Microsoft, Mozilla, Sun, Apple, Adobe, HP, Novel, etc.

The exploits, papers and PoCs will be featured on the Exploit-Database (http://www.exploit-db.com), averaging one 0day and one binary analysis a day.

Get your hard-hats on, your VM¹s and debugging tools organized ­ it’s going to be a an intensive ride.

Posted today – MOAUB Day 1:

1– http://www.exploit-db.com/adobe-acrobat-newclass-invalid-pointer-vulnerability/

2 – http://www.exploit-db.com/moaub-1-cpanel-php-restriction-bypass-vulnerability/

Enjoy,
Abysssec and the Exploit Database Team

Since these are going to be mostly 0-days or currently unpatched vulnerabilities, it might be time to update to the latest versions of your various applications. Lastly if you have not been looking at your various logs, and consoles this week might be a good time to start.