Hak4Kidz 2014 Presentation

August 25, 2014 Leave a comment

I was honored to be able to present and set up a demo on performing a packet capure for the kidz at Hak4Kidz this year. I am now making my slides availabel for anyone!

https://docs.google.com/presentation/d/1d7jmBwmFhLzT6FoML43nypKobuZkbaOoNeYAU0_8jZI/pub?start=false&loop=false&delayms=3000

Categories: Random

BSJTF Lork CTF

July 10, 2014 Leave a comment

I have posted my write up for this CTF event to github. I am planning on going through the rooms that I didn’t get to now that Lork is publicly accessible again. I will admit that I will be using other peoples write ups to help guide me and it will be made obvious which rooms were solved with “help”.

 

https://github.com/irishjack/bsjtflork0.1

Categories: CTF, InfoSec Tags: , , ,

Woot! I’m on github

June 30, 2014 Leave a comment

Woot! I’m on github

So I started uploading my scripts to github!

Categories: Random Tags: ,

Circle City Con 2014

June 23, 2014 Leave a comment

Circle City Con 2014 was full of firsts, it was the inaugural year for Circle City Con which is Indianapolis’ first, and also my first con. I was nervous going into the weekend since I didn’t know anyone, I was volunteering, and it was a completely new experience.

There was free training from topics ranging from an introduction to pentesting to working with executives and managers. I sat in on Hacking SCADA, ICS, and Embedded Devices for the Lulz pu on by esSOBi. This class went through analysing a packet capture in order to reverse engineer a protocol and using that knowledge to inject your own data into the stream. Then we looked at what it would take to build a metasploit module in order to automate the attack. Finally we went through a utility called binwalk which allows you to disassemble firmware.

Working the AV desk for a few of the talks taught me that all the effort that Adrian Crenshaw (irongeek) puts into recording and posting of the videos deserves more thanks than I can give. It also gave me the opportunity to sit in on talks that I would not have otherwise gone to. They were great talks and I think I got more out of those talks than I did the ones that I had scheduled myself to sit in on.

I spent some time over in the lock picking village and the folks from Bloomington Fools (Fraternal Order Of LockSport http://www.bloomingtonfools.org/) were fantastic. Being completely green to lock picking they explained what it is that is going on when picking a lock and provided some tools and locks for folks to try their hand at it. It was a great experience not once did they make me feel like I was being rushed to turn the lock back in so that someone else could take a shot at it. They made sure that anyone and everyone who wanted to try could, they were very prepared and I did not once witness someone having to wait to use the tools.

On a final note the greatest thing from the weekend was getting to meet so many new people. Everyone was friendly and inviting and I felt at home the entire time. It really is a great community to be a part of, everyone is there to learn from one another even those doing the training and giving presentations.

Categories: Random Tags:

Hackers are people too!

February 3, 2014 Leave a comment

Hackers are people too!

This is a great post! Well worth the read.

Categories: Random Tags: ,

Cisco LWAPP not joining controller

January 27, 2014 Leave a comment

I recently had to reboot some Cisco wireless LAN controllers, after which all of the previously joined APs were failing to re-join the controllers. After much banging of my head against the keyboard (sleep deprived related I swear) I decided to begin checking the debugging options on the controllers.

Since the issue was related to the APs connecting to the controller I ran the following

>Debug capwap events enable

I took a stab in the dark and did a search against this error.

*spamReceiveTask: Jan 23 03:25:22.024: SOME:AP:MAC Multiple Join Request: 
Join request received from AP which is already present. Deleting previous connection

*spamReceiveTask: Jan 23 03:25:22.025: SOME:AP:MAC State machine handler: 
Failed to process  msg type = 3 state = 0 from Some.AP.IP:62217

A quick google sent me to a post on Cisco’s forum that directed me to check what types of certificates the controllers were accepting.

>show auth-list

That showed me that the controllers were not accepting the certificates on the AP from the manufacturer

 Authorize MIC APs against AAA ................... disabled 
 Authorize LSC APs against Auth-List ............. disabled
 APs Allowed to Join
 AP with Manufacturing Installed Certificate.... no
 AP with Self-Signed Certificate................ yes
 AP with Locally Significant Certificate........ no

Fortunately it is one command to fix which, after running I made sure to save the running configuration to startup.

>config auth-list ap-policy mic enable

Create md5sum of tar files in a directory

August 7, 2013 Leave a comment

When copying a number of large files from one location to another I have always tried to follow the practice of hashing the files to check integrity. This was something that I have always done fairly easily in Windows using third party utilities such as TeraCopy. When copying a large number files from one directory to another on a headless linux server I had to do some digging.

This is what I came up with:

The files i needed checked were all tar files and I can get a list of those by issuing the following find command from the source location.

>find . -type f -name '*.tar'

This will get all the files ending in .tar in the current directory.

We then pass the output of find to md5sum using the exec option. The exec option passes the output from find to the specified program wherever {} is. Then we need to save the output from md5sum to a text file in order to compare the other set of files against.

>find . -type f -name '*.tar' -exec md5sum '{}' \; > /path/to/filetostorehash

The output should give you a file with contents that look similar to this:

88110a1ba660a96bf884cb99be8adb68  ./file01.tar
3b1c5faddb7265a5c2fa2bf833195d70  ./file02.tar

That is the md5 hash of the file and the file name.

We can use this file to compare the md5 hash against the other set of files in the new location.

>cd /path/to/newlocation
>md5sum -c /path/to/filetostorehash

The output of this command will look like this if everything is ok.

./file01.tar: OK
./file02.tar: OK
Categories: linux Tags: ,