Add the Needed Repositories for Kali Linux

In this article I will show you how to add the needed repositories for Kali Linux.

As you may know, Kali is a penetration Linux System based on Debian. It is developed by the Backtrack team.

To add repositories, open the /etc/apt/sources.list file in your favourite text editor as root, and paste the following lines:

$ gksudo /etc/apt/sources.list

Paste this:

deb http://http.kali.org/ /kali main contrib non-free
deb http://http.kali.org/ /wheezy main contrib non-free
deb http://http.kali.org/kali kali-dev main contrib non-free
deb http://http.kali.org/kali kali-dev main/debian-installer
deb-src http://http.kali.org/kali kali-dev main contrib non-free
deb http://http.kali.org/kali kali main contrib non-free
deb http://http.kali.org/kali kali main/debian-installer
deb-src http://http.kali.org/kali kali main contrib non-free
deb http://security.kali.org/kali-security kali/updates main contrib non-free
deb-src http://security.kali.org/kali-security kali/updates main contrib non-free
deb http://repo.kali.org/kali kali-bleeding-edge main

Save and update the system:

$ sudo apt-get update

Now, you are ready to go.

Source: linuxg

[Tool] Few very useful tools for dynamic malware analysis

Some time we need to analysis some executables, and Cuckoo sandbox and other sandboxes can't get information what we want / don't work.

So here a few very useful tools for dynamic malware analysis:

• CFF Explorer - a freeware suite of tools including a PE editor called CFF Explorer and a process viewer

• Process Explorer - shows you information about which handles and DLLs processes have opened or loaded. 

• Process Hacker  - process viewer with powerful process termination and memory searching/editing capabilities.

• LordPE - is able to edit/view many parts of PE (Portable Executable) files, dump them from memory, ...

• PeSturdio - performing the static investigation of any Windows executable binary.

• Process Monitor - is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

• TcpView - is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.

• Wireshark - very powerful network analyzer

• Peframe -  is a tool to perform static analysis on (portable executable) malware

• RegShot - It is a small command line tool for creating and comparing two registry files, export the registry, merge .REG files and much more.

I will update this list, with all useful tools what I see.

Best regards

[Howto] Configure VPN with token support on Mac Os X

For configure VPN with token support in Mac I install openconnect from homebrew with the next command:

brew install openconnect

if you don't know what is homebrew, check this link for more information/instalation guide, after that we need to install tun/tap driver,  we can download it here

And in my case I connect to the server with option --no-cert-check:

openconnect --no-cert-check my_server

This is all, now you have everything what you need :)

best regards

[SLAE] ASM Hello World

Hello. It's a just small example of hello world from SLAE course


; HelloWorld.asm
; Author: Andriy Brukhovetskyy

global _start

section .text

_start:

        ;print hello world on the screen
        mov eax, 0x4
        mov ebx, 0x1
        mov ecx, message
        mov edx, mlen
        int 0x80

        ;exit the program gracefully
        mov eax, 0x1
        mov ebx, 0x5
        int 0x80


section .data

        message: db "Hello World!"
        mlen     equ $-message

;int 0x80 invoke a system call


For creating object from this .asm you need (install if missed nasn, sudo apt-get install nasm in Ubuntu)

sudo nasm -f elf32 -o helloworld.o hw.asm

and then

ld -o HelloWorld helloworld.o

more information about syscalls in Ubuntu you can find in: /usr/include/i386-linux-gnu/asm/unistd_32.h 

Nice article : Sysenter Based System Call Mechanism in Linux 2.6

Best regards

[Cheat sheet] Assembly language x86

Hello, today I searching for a good cheat sheet for Intel Assembly x32, I found one here pdf

Best regards

Jailbreak PS3 12Gb Super Slim OFW 4.50

This weekend I searching information about how to jailbreak PS3 12Gb Super Slim with OFW (firmware official) 4.50, this version is published in October-November 2013.

In many forums/blogs/pages people offer .PUP for downgrade PS3 to version 3.55, this version needed to can install CFW (custom firmware), all what I found it's a scam, what offers to you download .PUP for free from page X with putting your phone number and with a small letter at the end of a page they say what you will pay > 30 euros and you will subscribed to X services.

So at the moment the unique solution is flashing with E3 Flasher or with the Cobra ODE.

Here you can see how to install Cobra ODE on PS3 serie 4000 (SuperSlim).

This information published just for education purpose and protect you from scams, if you do jailbreak the author is not responsible for any damages,  you do it at your own risk. In many countries jailbreak is illegal.

Best regards

[Script] VirusTotal public and private API v2 with all features

Few days ago I finish to improve previous script and add private API  support, so very big thank to VirusTotal team for this :)

I will show a few options with examples, for all options see usage

Important! Some functions as behaviour have many options, if you want active all of them, just use -v/--verbose. For get more details from report use verbose mode.

You can use options --dump for dump json to file, and after analyse it, you can combine this, so you will can see a report and dump him to file, and after pass file as the parameter instead of hash/scan-id/url/etc...

File scan:
Important, if file has been scanned before, you will get a report, file will not be uploaded
Files with size bigger then 32mb will be ignored and you will see warning with file name

You can use name/path wildcard as: /home/user/malware*/*Zeus*

vt.py -f path_to_file

vt.py -f path_to_file -v #with verbose mode you will see the same more detection by AV's

Url scan and report:

Depend of API, if you have public API you can scan up to 4 urls. With private api up to 25 urls.
Example for scanning 2 urls/domains

python vt.py -ur google.com virustotal.com

When you trying to get report and url/domain is not scanned before, and you will upload it to scan you can execute it with option:

python vt.py -ur -u google.com virustotal.com

If you directly want add it to scan/rescan just execute it as:

python vt.py -u google.com virustotal.com

Report search

Here you can use md5/sha1/sha256 hash or scan-id

python vt.py -s 99017f6eebbac24f351415dd410d522d

MD5       : 99017f6eebbac24f351415dd410d522d

SHA1     : 4d1740485713a2ab3a4f5822a01f645fe8387f92

SHA256 : 52d3df0ed60c46f336c131bf2ca454f73bafdc4b04dfa2aea80746f5ba9e6d1c

Scan  Date     : 2013-11-02 05:21:11

Detections:

      39/46 Positives/Total

                                   output is very long, so it's just a part of him

Permanent link : https://www.virustotal.com/file/52d3df0ed60c46f336c131bf2ca454f73bafdc4b04dfa2aea80746f5ba9e6d1c/analysis/1383369671/


Domain search:
Get resolver Ip and date  of the domain

python vt.py -d http://027.ru --dump -v #public api

Get domain info with all info: # the same execution but with private api

You can get all info with verbose mode or just activate options what you want to see, see usage

Get IP info:

python vt.py -i ip/json_dump #public api

Search report

python vt.py -s 99017f6eebbac24f351415dd410d522d #private api example

ExifTool file metadata:

                                                                  <cutted>

Permanent link : https://www.virustotal.com/file/52d3df0ed60c46f336c131bf2ca454f73bafdc4b04dfa2aea80746f5ba9e6d1c/analysis/1382633189/

Cluster info:

python vt.py --cluster 2013-10-01

Distribucion:

python vt.py --distribution-files --report --limit 1

python vt.py --distribution-urls

Permanent link : https://www.virustotal.com/url/6df0f88d03421a4c202bb6151d4b16666be0d8fac3780d387a5b818ca824d6b7/analysis/1383121114/

Get comments:

Behaviour:

it's very cutted output of behaviour, because is very very long

          And much more!

Process Tree

pid:484

name:82a4d0467f93e3ddec3b51a66dbd55cfce3f6c5725d2759850fb4b3b37c28304

children:[]

You need to see usage for all options

python vt.py -h

Enjoy it!