Kali Linux Issue Starting Metasploit/Postgres

March 13, 2014 Leave a comment

When trying to start Metasploit from the Application menu or starting postgresql from the command line I got the following error:

“Starting PostgreSQL 9.1 database server: main[….] The PostgreSQL server failed to start. Please check the log output”

I was also running low on available space in my VM too, so clearing out the /tmp directory and running ‘apt-get clean’ seemed to help.  I updated the /usr/sbin/update-rc.d file and commented out postgres in the black list and wrote it in enabled in the white list section.  Then, after rebooting, I just had to start postgres manually:

su postgres -c "/usr/lib/postgresql/9.1/bin/postgres -D /etc/postgresql/9.1/main/" &

PwnPad Installation Tutorial thru Kali VM

October 9, 2013 Leave a comment

I attended the Pwnie Express PwnPad Installation class at DerbyCon 3.0 and found out how to install the PwnPad image on my Nexus7 (16GB, 1st generation, WiFi only) thru a Kali VM image.  I won’t write out the entire process, just the differences from their installation document.

Unfortunately you can’t just “apt-get install adb fastboot” you have to add some french repositories and install a few other packages to get it going.  The following commands should get you through that (many thanks to the Kali developer that attended the DerbyCon class for this!) –

  1. mkdir /opt/android && cd /opt/android
  2. echo “deb-src http://debian.ens-cachan.fr/ftp/debian/ sid main contrib non-free” >> /etc/apt/sources.list
  3. apt-get update
  4. apt-get -y build-dep android-tools
  5. apt-get -y source –build android-tools
  6. dpkg -i android-tools-*.deb
  7. cd ~
  8. rm -rf /opt/android
  9. sed -i ‘s/.*cachan\.fr.*//’ /etc/apt/sources.list

At command #6 I kept getting a “no space left on device” error, but running “apt-get clean” fixed that issue for me.  Once that’s done, you should be good to go.  Prep the USB drive like it says and follow the remaining instructions.

Once installed, open a root shell and hit enter a couple times, then type ‘yes’ when prompted to setup your ssh keys with a blank password (needed to run some of the scripts on the device).  Be sure to install the latest updates from pwnieexpress.com (it’s easiest to just browse there on your tablet and then copy/paste the wget command into a shell on the device.

Categories: Mobile, OS, Security Tools, Tutorial Tags: ,

Using RatProxy in Windows (Updated)

August 27, 2013 Leave a comment

These instructions are largely copied from a post by SecureIdeas, but there were enough issues that I had to work through that I thought I’d post what was successful for me.   Using these instructions I was able to successfully install ratproxy on Windows XP SP3 and Windows 7 SP1, both 32-bit systems running in VMware Workstation.

Install Cygwin

  1. Download the Cygwin installer from http://www.cygwin.com.
  2. Run the Setup.exe installer.
  3. Follow the on screen prompts, using the default is fine, until the Utilities screen appears.  Select the following packages:
    1. Select make from the devel package.
    2. Select gcc-core from the devel package.
    3. Search for “openssl” and select the following from the net package.
      • openssl-devel
      • libopenssl
      • openssl
  4. Complete the installation.  This may take some time as it downloads all of the packages needed.

Install ratproxy

  1. Download the package from http://code.google.com/p/ratproxy/.
  2. Unzip the downloaded ratproxy distribution file into the Cygwin directory.  If cygwin was installed to C:\cygwin then ratproxy should be unzipped to C:\cygwin\ratproxy. 
  3. Update Flare (used to decompile flash objects):
    1. For the latest instructions open the readme file in the \ratproxy\flare-dist directory.
    2. Open the URL for the Windows distribution and save the file.
    3. Unzip the file into the \ratproxy\flare-dist directory.
  4. Open a Cygwin bash by double-clicking the C:\cygwin\Cygwin.bat file.
  5. Navigate to the ratproxy directory.  If installed at C:\cygwin\ratproxy, type cd ../../ratproxy and press enter.
  6. Type make and press enter.
    1. If you receive an error that looks like this: “ratproxy.c:1635: error: incompatible type for argument 2 of ‘waitpid'” the ratproxy.c file needs to be modified.
    2. Open ratproxy.c and modify line 1635 “while (waitpid(-1,&x,WNOHANG) > 0);” to be “while (waitpid(-1,(int*)&x,WNOHANG) > 0);“.
    3. run the make command again. This should run successfully.
  7. Add cygwin to your path.
    1. Right-click “My Computer” and select “Properties”.
    2. Select “Advanced system settings” and then select “Environmental Variables”.
    3. Find the “Path” variable under “System Variables” and edit it.
    4. Add “;C:\Cygwin” (without the quotes) to the end of the “Variable Value”.

Before actually running ratproxy (after following the instructions on installing it), make sure that the following .dll files are in the ratproxy directory:

  • cygcrypto-1.0.0.dll (if that’s the version of OpenSSL you installed)
  • cyggcc_s-1.dll
  • cygssl-1.0.0.dll
  • cygwin1.dll
  • cygz.dll

Simplify Running ratproxy

Also, I highly recommend using a batch file to simplify running the proxy, so you don’t have to remember which flags you like to use (just know that the batch file has to be located in the ratproxy directory, if you want it elsewhere, just create a shortcut).

Sample .bat file running RatProxy through Burp listening on 8080 (browser proxy points to RatProxy on 8081):

@echo off

rem default values
set logfilename=""
set domain=""

rem set base log file name and target domain
 set /p logfilename=Enter base log file name: 
 if %logfilename%=="" goto setfilename
 set /p domain=Enter target domain (www.domain.com): 
 if %domain%=="" goto setDomain

rem Run ratproxy
start "" "C:\cygwin\ratproxy\ratproxy.exe" ^
-w /cygdrive/c/temp/rp-logs/%logfilename%.log ^
-v /cygdrive/c/temp/rp-traces -d %domain% -p 8081 ^
-P -lextifscgjm

USB Wireless Adapter on a Kali Virtual Machine

July 3, 2013 Leave a comment

To get started, Debian has incredibly helpful instructions on installing wireless adapters – I have a TP-LINK WN722N and used these instructions: http://wiki.debian.org/ath9k_htc.

After drivers are installed:

  1. Connect your USB wireless adapter
  2. Pass it through to your VM
  3. Run ‘ifconfig wlan0 up’
  4. To get started monitoring run ‘airmon-ng start wlan0’
  5. Run ‘airodump-ng mon0’ to start listing all the wireless AP’s and probes being sent out
Categories: Tutorial, Wireless Tags: , , ,

Logging Attack Traffic

June 11, 2013 2 comments

When performing a test, it is important that you log all your activity so that you have proof of what you were doing, in case anything goes awry (and it is not your fault!). Here are a couple methods of logging activity:

  • Wireshark: before you start capturing data, in the Capture Options window select “Use multiple files” and in the “Next file every” field specify the upper limit of the file size that you desire (a new file will be created once the current file reaches that limit) – see image below.
  • Tshark (found in the c:\program files\wireshark directory): c:\program files\Wireshark\tshark.exe -i [interface] -w [base file name] -b filesize:[file size in KB]  -p [this flag restricts monitoring to current VM, otherwise all VM traffic will be captured]
    • This option doesn’t put as much strain on your machine as using Wireshark does
  • tcpdump: tcpdump -i [interface, use ‘tcpdump -D’ to get list] -w [base file name] -C [file size in MB]
    • Another low resource option


Extracting Certs and Keys from .pfx and using with sqlmap

June 5, 2013 Leave a comment

I only had a .pfx file to work with and needed to extract the key and certificate in order to use sqlmap against a particular site. This site provided all the steps I needed to do that.

  1. Extract private key:
    • openssl.exe pkcs12 -in file.pfx -nocerts -out privKey.pem
  2. Extract certificate:
    • openssl.exe pkcs12 -in file.pfx -clcerts -nokeys -out cert.pem
  3. Remove password from private key:
    • openssl.exe rsa -in privKey.pem -out private.pem

Once that is done run sqlmap with the following flags:

  • sqlmap -u https://www.targeturl.com --auth-cert privatekey.pem,cert.pem

To save time typing in the key and cert locations, if in windows you can just drag the file into the command prompt (not sure about linux/mac).

Option 2:

If you have your client cert loaded into Burp, you could just use the sqlmap option ‘–proxy=”http://localhost:8080″‘ and have sqlmap go through Burp and then not worry about extracting certs/keys.  This would have been easier, but I found out about it later.  Good to know for the future.

Setup VNC Server in BT5 r3 KDE

October 30, 2012 Leave a comment
  1. Install vncserver – ‘apt-get install vnc4server’
  2. Run – ‘vncserver’
  3. Setup 8-character password
  4. Edit xstartup – ‘vi ~/.vnc/xstartup’
  5. Comment out entire file
  6. Append the following three lines to the file:
    • export XKL_XMODMAP_DISABLE=1
    • exec ck-launch-session startkde
    • exec pcmanfm –desktop
  7. Run – ‘vncserver -kill :1’
  8. Run – ‘vncserver’

You then just need to install the free VNC Viewer on the client machine and make sure to add ‘:5901’ to the end of the IP address of your new vncserver.