- Prison Code Breaker Diary -

I write this bash script to automate the process of creating Linux libraries in C/C++

#!/bin/bash

clear

echo -e "##########################################"
echo -e "#     LIBRARY AUTO-CREATOR by [JaPh]     #"
echo -e "#========================================#"
echo -e "Usage: `basename $0` lib_name type path   "
echo -e "Example: "
echo -e " + creating libraries from hello.c in current directory"
echo -e " `basename $0` hello C . "
echo -e " + creating libraries from bye.cpp to '/opt/lib' directory"
echo -e "   `basename $0` bye C++ /opt/lib"
echo -e "Feel free to contact, pete.houston.17187@gmail.com\n"

ARG=3

if [ "$#" -ne "$ARG" ]
then
 echo -e "[?] wrong input arguments!"
 exit
fi

libname=lib"$1"

if [ "$2" == "C" ]
then
 filename="$1.c"
 compiler="gcc"
elif [ "$2" == "C++" ]
then
 filename="$1.cpp"
 compiler="g++"
else
 echo -e "[?] unknown filetype"
 exit
fi

echo -e "< Static Library: $libname.a >"
command="$compiler -Wall -c $filename"
echo -e "\$ $command"
if [ !`$command` ]
then
 echo -e ".created: $1.o"
else
 echo -e ".[?] cannot create object $1.o"
 exit
fi

echo -e "\$ ar -cvq $libname.a $1.o"
ar -cvq $libname.a $1.o
echo -e ".created: $libname.a"
echo -e "< Static Library '$libname.a' created ! >"

rm -f $1.o
echo -e "< Shared Object Library: $libname.so.1.0 >"
command="$compiler -Wall -fPIC -c $1.c"
echo -e "\$ $command"
if [ !`$command` ]
then
 echo -e ".created: $1.o"
else
 echo -e ".[?] cannot create object $1.o"
 exit
fi

command="$compiler -shared -Wl,-soname,$libname.so.1 -o $libname.so.1.0 $1.o"
echo -e "\$ $command"
if [ !`$command` ]
then
 echo -e ".created: $libname.so.1.0"
else
 echo -e ".[?] cannot create shared object $libname.so.1.0"
 exit
fi

ln -sf $libname.so.1.0 $libname.so
ln -sf $libname.so.1.0 $libname.so.1

echo -e "< Shared Object Library '$libname.so.1.0' created ! >"

if [ "$3" != "." ]
then
 mv $libname.* "$3"
 echo -e "[!] All files moved to $3"
fi

NateOn is the instant messenger created by SK Telecom, for Koreans.
However, it does supports Windows only as main platform.
I've just found some projects that provides a way to communicate with NateOn under Linux.

1. For Mac / Linux (Gnome users):
- JateOn, written in Java (Swing, SWT required): http://jateon.kfmes.com/viewforum.php?f=4
It's still being developed.
- NateOn plugin for Pidgin: http://nateon.haz3.com
I don't think it is under development anymore....

2. For Linux (KDE users): this is the best choice
- NateOn Linux (current version 1.0 beta): http://nateonweb.nate.com/download/messenger/linux/
It's best if you are using Fedora, Gentoo or Ubuntu because the installation package is done, just one click and run. Other distros might need to download source and compile.

3. Using WineHQ to emulate:
- Some notes on experiment can give you a hint. You might want to give it a try: http://appdb.winehq.org/objectManager.php?sClass=version&iId=7524&iTestingId=11299

If you know any other, please notice me!

This is an amazing download manager, which is an add-on of Firefox. Not saying it's the best, however, if you are using Linux and looking for a good download manager, DownThemAll owns !!!

Homepage: http://downthemall.net/
Download: https://addons.mozilla.org/en-US/firefox/addon/201

I gave it a try and now it becomes my favorite one.
It supports downloads from almost all common network protocols, can resume downloads (also depending on the servers' allowance), just one click and download, especially, it can be used to download from various hosting sites like: rapidshare.com, megaupload.com, ....

Compare to others, I think I love DTA the most !

You need to install these tools and utilities to work with:

1. Sysinternals Suite: available from: http://sysinternals.com/
2. OllyDbg: available from: http://ollydbg.de/
3. IDA Pro (freeware): available from: http://www.hex-rays.com/idapro/
4. PEiD: available from: http://www.peid.info/
5. Several packer and unpacker around if require.

You will find more utilities around Internet that can be useful for your work. Just hang around with Google!
Get ready for the next step!

Have fun!

The very first step to think about testing or analyzing application or malware is to prepare yourself an appropriate environment that is under control. It's simple:

• You don't want the application or malware to take the real effects or damage your lovely environment.
• You can control and do whatever you want inside the box.
  
• It's very effective and easy to work.

However, it does have some drawbacks:

• Consume more resources, can cause harm to your computer, such as heating, slow like hell, unexpected NOT RESPONDING of Windows OS overtime ....
  
• Cost may be high depending on your personal references like using 2 or more computers to test, pay high for commercial software (VMWare Workstation...), ..

But that's not the problem if you are well-financial or well-supported or even illegalism, pirated software. Make your own choice!

For this series, I will use VMWare Workstation for this series.
What about VMWare Workstation?

1. It's a virtual machine manager, which provides you the functionality to create and test any operating system inside your main OS and doesn't affect your main one.
2. Get it here: http://www.vmware.com/products/workstation/ . You have 30 days trial for now. It's a good try! My suggestion: buy if you have money because it is so GOOOOD...
   
3. It concerns your hardware requirements. Well, at least 2 GB Ram and share 1/3 or 1/4 to virtual OS is better. It's up to you!

What OS to test, then?
I think it is better to try to common operating system, Windows XP SP2 or SP3.
Here is my virtual OS specifications and settings:


We're gonna take advantages of snapshots while testing the malware.
So for now, setup your environment and get ready for the next shot!

Have fun!

My friends wonder how to copy & paste from/to Putty under Linux.

Here the trick:

+ in putty screen, highlight the text you want to copy, move to text application, press middle-button of the mouse to paste it.
+ vice versa, highlight and copy the text you want to paste into Putty, then press the middle-button to paste into Putty.

Have fun!@

-:== Crackme Info ==:-
Difficulty: 1 - Very easy, for newbies
Platform: Unix/linux etc.
Language: Assembler
Link: Click to refer

Solution:

This is a pretty simple crackme under Linux. The tools you need is GNU Debugger (GDB) and OBJDUMP, supported w/ every Linux distribution.

Download then extract file.

If you run the executables blah, it shows nothing.
Let's have a quick view of this binary in assembly

$ objdump -D blah

This is result

blah:     file format elf32-i386


Disassembly of section .text:

08048094 <.text>:
8048094:    31 c0                    xor    %eax,%eax
8048096:    b8 2f 00 00 00           mov    $0x2f,%eax
804809b:    cd 80                    int    $0x80
804809d:    3d ad de 00 00           cmp    $0xdead,%eax
80480a2:    75 16                    jne    0x80480ba
80480a4:    b8 04 00 00 00           mov    $0x4,%eax
80480a9:    bb 01 00 00 00           mov    $0x1,%ebx
80480ae:    b9 c4 90 04 08           mov    $0x80490c4,%ecx
80480b3:    ba 06 00 00 00           mov    $0x6,%edx
80480b8:    cd 80                    int    $0x80
80480ba:    31 c0                    xor    %eax,%eax
80480bc:    40                       inc    %eax
80480bd:    31 db                    xor    %ebx,%ebx
80480bf:    cd 80                    int    $0x80

Disassembly of section .data:

080490c4 <.data>:
80490c4:    4f                       dec    %edi
80490c5:    6b 65 6a 21              imul   $0x21,0x6a(%ebp),%esp
80490c9:    0a                       .byte 0xa

Quick view, as you know about Linux programming, you surely know the the system call (interrupt) 80h.

The first syscall:

8048094:    31 c0                    xor    %eax,%eax
8048096:    b8 2f 00 00 00           mov    $0x2f,%eax
804809b:    cd 80                    int    $0x80

This syscall is to retrieve the group id (0x2f), getgid().
Reference Linux system call table

And then, program will try to compare the result from getgid() and 0xDEAD.
If not equal, it will jump below

80480ba:    31 c0                    xor    %eax,%eax
80480bc:    40                       inc    %eax
80480bd:    31 db                    xor    %ebx,%ebx
80480bf:    cd 80                    int    $0x80

This is the exit() syscall (0x01).

If it equals, then the program will try to print the message by syscall write().
The message is stored in data section (0x080490C4).

OK!
So, here we can find our solutions.
+ Either, create a new group and set id is 0xDEAD (57005)
+ Or, patch the conditional jump.

The first solution is to set group id to 57005 ( using setgid() ), then add user to the group by groupadd().

I'm going to talk about patching the jump next.

Load gdb

$ gdb blah

We set breakpoint at 0x804809d

(gdb) break *0x804809d

(gdb) run
Breakpoint 1, 0x0804809d in ?? ()

(gdb) info registers
eax            0x1f4    500
ecx            0x0    0
edx            0x0    0
ebx            0x0    0
esp            0xbf9c04d0    0xbf9c04d0
ebp            0x0    0x0
esi            0x0    0
edi            0x0    0
eip            0x804809d    0x804809d
eflags         0x200246    [ PF ZF IF ID ]
cs             0x73    115
ss             0x7b    123
ds             0x7b    123
es             0x7b    123
fs             0x0    0
gs             0x0    0

As you see, my group id is 500 (stored in EAX); hence, program will exit immediately.
Let's do the patch 2-NOP bytes at 0x80480a2

(gdb) x/x 0x80480a2
0x80480a2:    0x04b81675

We need to patch 2 bytes: 75 16
therefore,

(gdb) set {int} 0x80480a2 = 0x04b89090
(gdb) quit

Now re-run the patched crackme.

$ ./blah
Okej!

well done! you patched the crackme.
Hope this tutorial be a little guide for whom to start cracking in Linux like me.

Have fun!@

One of the utility required for tracking network via packet is a Packet Sniffer or Packet Editor.
WPE is one of those famous ones; but it's hard to find where to download.

However, you can download it here => WPE Pro 9.0a - Upload by [JaPh]

Have fun!@