-
Shows
- AppJudgment
- Bytejacker
- Dan 3.0
- Digg Dialogg
- The Digg Reel
- Diggnation
- Film Riot
- Food Mob
- The Game Show
- GeekBeat.TV
- Hak5
- HD Nation
- iFanboy
- INST MSGS
- Joe Genius
- Penn Point
- ROFL
- Scam School
- Tekzilla
- Tom's Top 5
- The Totally Rad Show
- Unboxing Porn
- Web Zeroes
- XLR8R TV
- Best Of Revision3
- Archived Shows
- Revision3 Beta
- Watch Revision3 Now
- Schedule
- Deals
- Community
- Inside Revision3
- Shop
Exit Theater Mode
Login or register to enable this feature.
Or, compose an email to send yourself.
Download this episode
Embed or link to this episode
Hacking WPA, ESXi and iSCSI, Bypass Windows Passwords
Tuesday, June 16th, 2009 running time 40:40
Darren's Hacking WPA-PSK keys using the recently updated Cowpatty and some damn fine lookup tables. Connecting ESXi to iSCSI targets -- Matt breaks it down with FreeNAS. And Shannon completely bypasses local Windows logins with a Kernel modifyin' boot cd? w00t!
This week's episode covers the following topics. Click to jump:
- Cracking WPA Keys with Cowpatty
- ESXi & iSCSI
- Bypass Windows Local Logins
Cracking WPA Keys with Cowpatty
Excerpt Darren Kitchen's blogA lot has changed since I last talked about WPA Cracking on Hak5. Specifically Joshua Wright, author of CowPatty has released a new version that dramatically changes the way one thinks about cracking WPA and WPA2 TKIP keys.
The most notable new feature in Cowpatty 4.5 is the "-2" option, which only requires the first two frames of the 4-way handshake to start attacking.
By removing the need for the third and fourth frames of the handshake, an attacker is now more likely to successfully crack WPA keys when channel hopping. Furthermore, the lack of the third and fourth frame opens up a world of possibilities when it comes to trapping targets with rogue access points, or "honey pots".
An example scenario illustrated on Wright's blog details how an attacker may pose as a victim's corporate wireless access point. Since it doesn't matter if the target associates with the honey pot, anything from hostap to a spare WPA supporting access point with a bogus key will due.
Of course this has our friend Robin Wood pondering a Jasager plugin.
Pineapples anyone?
As for carrying out the attack it's pretty straight forward. I BackTrack as my hacking OS of choice coupled with an eee PC or Acer Aspire One. When it comes to Wireless I'm a big fan of the ALFA AWUS036H 500mW USB Wireless Adapter.
Other tools needed to carry out the attack include WPA tables like these SSID specific Cowpatty WPA Tables from Offensive Security and the Aircrack-ng suite.
The commands are pretty straight forward and well highlighted in the episode. There are a number of ways to go about this so if you've got another method you'd like to share with me, questions about this, or suggestions for future topics drop me a line. darren[at]hak5=dot=org.
ESXi & iSCSI
Excerpt Matt Lestock's blogSo the series I’ve been doing on ESXi has been getting nothing but great feedback, and I’m glad that I can share what I’ve learned over the course of the last couple years with everyone.
On episode 518 of Hak5, we show how truly easy it is to add iSCSI storage to a free deployment of ESXi.
So what is iSCSI?
In computing, iSCSI (pronounced /??s'k?zi/), is an abbreviation of Internet Small Computer System Interface, an Internet Protocol (IP)-based storage networking standard for linking data storage facilities. By carrying SCSI commands over IP networks, iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. iSCSI can be used to transmit data over local area networks (LANs), wide area networks (WANs), or the Internet and can enable location-independent data storage and retrieval. The protocol allows clients (called initiators) to send SCSI commands (CDBs) to SCSI storage devices (targets) on remote servers. It is a popular storage area network (SAN) protocol, allowing organizations to consolidate storage into data center storage arrays while providing hosts (such as database and web servers) with the illusion of locally-attached disks. Unlike traditional Fibre Channel, which requires special-purpose cabling, iSCSI can be run over long distances using existing network infrastructure.
In simpler terms, using some free software, it’s stupid easy to create a large amount of storage which is not tied to the physical adapter of the host server (in this case, the server ESXi is running on).
So what do we need?
- Functioning ESXi Installation
- Server capable of running FreeNAS
- Gigabit connectivity between ESXi server and FreeNAS
Now let’s get started. While it’s recommended to separate your iSCSI traffic from your other internet networking, for the purpose of this instruction, we’re just going to use the same IP subnet for all of our LAN and iSCSI traffic.
Our ESXi server sits at 10.10.1.55 and our newly installed FreeNAS server is located at 10.10.1.66.
1) Connect to your FreeNAS server through the WebGUI using your favorite browser. In the top menu select Disks, then click Management.
2) Click on the plus sign in the lower right corner to add drives.
3) Next to Disk, choose the drive you want to add from the drop down, and if you want enter a description for it next to Description.
4) When you go back to the Disk Management screen you will be asked to confirm the addition by clicking on Apply changes, go ahead and do that now.
5) From the top menu choose Services, then iSCSI Target.
6) Click on the plus sign in the Extent area.
7) The Bolded fields are required, so place a name in the Extent name field, leave the Type as Device, and then choose the Device you want in the dropdown.
8) When you get back to the iSCSI Target page click on Apply changes.
9) Click on the plus sign in the Target area.
10) As before the Bolded fields are required. Here is a breakdown of the fields:
Target name: Add your own or leave the default
Flags: RW for Read/Write or RO for Read Only
Storage: Will have the extents listed that were setup, choose the one you want to use
Authorized Network: Enter the IP network that can access this drive. For us we’re going to enter 10.10.1.0 and we’ll leave the /24 as our subnet is 255.255.255.0
11) Once you fill in all the info click on Add.
12) Back at the iSCSI target page you need to click on Apply changes once again.
13) Now place a check in the box next to Enable in the top right corner and then click Save and Restart in the bottom left.
The iSCSI Target drive is now setup and ready for use.
14) Now we need to setup ESXi to connect to our newly created iSCSI target.
- Start by logging into your your host by using the Vitrual Infrastructure Client.
- Click on your host, and then click the configuration tab.
- Click Storage adapters, and then select your VMHBA32 iSCSI storage adapter.
- Click properties and configure, then check the enabled box.
Goto the dynamic discovery tab, and add your FreeNAS IP address (in this case, 10.10.1.66)
- Click ok, then close, and then rescan the HBA.
15) At this point you should see your storage, now we need to format the new storage.
- So click back to the storage option on the left.
- Then click Add Storage.
- Select Disk / Lun, and click next.
- Select your new disk on the FreeNAS iSCSI target, and next, next, finish.
DONE!
Questions? Post em in the comments!
Bypass Windows Local Logins
Excerpt Shannon Morse's blogKon-Boot is an prototype piece of software which allows to change contents of a linux kernel (and now Windows kernel also!!!) on the fly (while booting). In the current compilation state it allows to log into a linux system as ‘root’ user without typing the correct password or to elevate privileges from current user to root. For Windows systems it allows to enter any password protected profile without any knowledge of the password. It was acctually started as silly project of mine, which was born from my never-ending memory problems
Secondly it was mainly created for Ubuntu, later i have made few add-ons to cover some other linux distributions. Finally, please consider this is my first linux project so far
Entire Kon-Boot was written in pure x86 assembly, using old grandpa-geezer TASM 4.0.
So basically, Kon-Boot enables you to log into any Windows or Linux password protected computer without knowing the password or anything about it.
The tech behind it? Kon-Boot basically latches onto parts of the memory and starts patching parts of the kernel (the Brain!), mainly the parts that have to do with the log-on auth and security. These patches let you logon without a password. Then, the bootkit does it so quickly that it leaves no footprints behind after you leave.
DUDE!
To do this:
Go to the website above and download Kon-Boot, open the zip file, and burn the .iso to a disc. I use ImgBurner because it is fast, easy, and FREE.
Shut down the computer you intend to get on to. When booting up, if it isn’t already set to boot from CD (or flashdrive, or whatever Kon-Boot is on), go into the BIOS and set it. You should see the Kon-Boot splash screen for a few seconds, then the username/password screen will appear with the main username already set if they have it saved. If not you need to know the username ahead of time. Press enter or type in some random characters (it doesn’t really matter) and press enter. You’re in!
Now party, snoop around, and get that file you wanted. Get your flashdrive or CD out, then shut the computer back off like usual.
Protecting yourself:
Password protect your BIOS!
True Crypt your entire harddrive!
Highlights
squarespace
(
15:20, 15:26, 15:28, 15:35, 15:43, 15:50, 15:56, 15:59, 15:20, 15:26, 15:28, 15:35, 15:43, 15:50, 15:56, 15:59
)
hard drives
(
14:11, 16:25, 14:11, 16:25
)
open source
(
0:45, 0:45
)
joomla
(
31:43, 31:43
)
squarespace
(
15:20, 15:26, 15:28, 15:35, 15:43, 15:50, 15:56, 15:59, 15:20, 15:26, 15:28, 15:35, 15:43, 15:50, 15:56, 15:59
)
hard drives
(
14:11, 16:25, 14:11, 16:25
)
open source
(
0:45, 0:45
)
joomla
(
31:43, 31:43
)
Automatically Generated Transcript(may not be 100% accurate) ( more )
" Wow. Coming up on the show cracking a WP keys with cow patty -- look at tables. Building and I discussing that's for VMware and bypassing local audience what Condit. All that and more on this episode of Hak5. I just brought to you by godaddy square space and the Adobe flash platform. Adobe flash provides everything you need to develop cross platform apps content and video. It isn't three -- was at Adobe flash camp and has the latest on flash the other four. Flash catalyst -- open source flex for a framework stay tuned for the video at the end of the show to learn more about Adobe's new announcements."
" And Hak5 my name is Darren Kitchen iMac -- and Janet Weiss. An excellent chip you guys tonight and we are playing with all sorts -- one -- the ESX man. Com on booting windows -- it's what. Yeah yeah then it cited its its pretty much you know we've been talking about the last couple weeks but it I think we've kind of found a niche. You know people want to do more. And -- it's. What -- want us to do more they want us to show them. The different options that are actually out there and you know my series and you you're -- hacking and stuff like that in -- with her destroyer passwords. Bills it's you know."
" Lake your segment particularly you're series on virtualization. Just sprawls. Like my a motorcycle journeys and the backwoods and suddenly the little backwards like. Those look O Richard tracks it. Have you know it's like. But -- other -- gonna let it but I love it because I thought I'd get and that's I T right that is like exactly what happens is you -- It's beautiful thing about our industry to come to work when they everybody recognizes that even programmers this means engineer comes with a knock the office whatever and it. Different (%expletive) different day."
" I mean that's the that you get to do something in and you know the need is presented to the point where it's. -- this now you know and and unite and by the end of the learning process you start to realize. That's why I think that in at least in our industry experiences worth more than education yet I'm not talking and it didn't wear your degree -- Do that yet. But you know it really speaks volumes when you're just because your -- on the job on forever and ever never ever I'll have warriors college. Notepad now it's just. Will we say this but yeah is there yet. We're here. -- And -- imports coming up soon we need to finalize the date for ads are and of season five is coming out and report like our four year anniversaries again scrutiny by the next episode that these -- Which Busch Gardens trip. Okay which -- you know I'm just put that out there I doubt that will sit down finalizing -- on but August that. Will be our five year are there four year anniversary of -- out so you know if you can come out Busch Gardens Williamsburg Virginia. We can have a grand -- time. Keep that in mind. Yes -- infinitely easier in roller coasters do halfway house you -- to determine area were to get big and useless in Atlanta in. The -- in -- You remember if there's not a lot of other -- if I -- remember I don't remember that they that the us and or else. I know it it was there spots. Anyway I think we should just go ahead and get in the -- meat of it and let's go ahead and continue on with. It appears that we had over and Hoboken and -- practical stuff so. Last week I was talking about the advancements in -- Actually -- that the developer. Game decal ID not because he was trying to make a mockery of the EPA. But that he really it's yet."
" Yeah it's actually really good code I think you know so new version will ever having compared here. Anyway so four point five is out."
" Excellent he's cut this like which we talked about last week -- two very big news features first of all you can. You can verify that information you gathered with your you know packet captures of what you need to start attack. Because if you don't have everything why bother going through an attacked assisting him -- found. And second of all you can view you can. Crack it WPA. Connection just using two parts of four way handshake. And more details on on the previous episode and also -- links in. The show notes so you know not to negate humans -- there but what's important what we're gonna talk about practically hear. Is this is the proverbial sitting next year and I'm -- here. It's not you it's just that there's a lot of crap routers and we just use in this city now here's what could've been a Linksys negative in dealing visible in the closet. So this little guy is what your grandmother is on the Internet -- right there I mean. This is Gramm. -- doing them justice by pocono up with the WPA. The the view Wi-Fi protected access as opposed to that the BP crap. -- Wired equivalent to wired equivalency protocol. And it's post privacy rights and it's only weapons only if this is good is wired and while we argue that it -- so anyway. We're gonna go ahead and show you how to audit your own home network. Your neighbors how to make sure that your system is all good using. You can talk subtitle demo set up I actually would going to use my Acer aspire one with the virtual machines and -- for on stuff. Problems of virtualization and talk to you later about that I actually said Mac. You know what I'm just gonna break out a real machine. So I broke out. EPC two which you said. It looks like virtual machine system and the right so you can see and them by. And theatre little it didn't pick up an -- get this this is the -- AWU. Easier 368. -- beautiful little 500 know a lot US be. Wi-Fi card that does once you get him on. -- went on -- so on with the fun stuff so I'm here backtrack three. And let's go ahead and get started first thing we need to do is scout around for access point right down if you keep things so for some going to go ahead and set your -- And G. To start. W and zero that is. My I -- there -- alpha and you can see him wander about and I'm gonna run Kidman. With taxi and it's an art he 81 even. The view and zero. Alpha. Okay and -- did that wrong some. Oh."
" He wanted."
" You know this EPC keyboard. Sometimes don't lose your -- registered DK we'll know the offset that they're supposed to be the till the next one so the pushed over anyway. So I can see here. That here is mine -- here. And what's important here it I'm on going to need. Is obviously. The name of the network which is all caps and here I'm going to need to know the -- idea of the network and I'm gonna need to know what channel it's on so going to. Right all those things down. And once we have this written down let's go ahead and start sniffing we don't need to associate with the access point anyway. But we can tell art card to listen to channel eleven. Particularly listening for traffic connected to this net gear so I think I already have that. Right here so we're gonna run aero dump NG and we taxied to set channel eleven the we're gonna write the file out to net gear underscore be. And that's on the -- and zero. -- you can already see we have. Our connection going on and this is where we talked about earlier. Last week that if you you know you -- it connotes. For the -- way handshake. We're now at least in some cases just you parts it you get you have to get and shaken and normally to get that what you'll do is you'll. Is. Couple of ways we talked about creating a honey pot or there's wanted to staking out the access point and while waiting for connection and that's what I'm doing right now on this laptop. Or if there's already a connection and you'll see on backtrack here I now have a connection can see. That is from you know this address I can see how many packets are going and what not and if I wanted to I can go ahead and issue a so go -- see that real quick -- easy so using another part of aircrack airplay. -- With -- easier to specify ADR we gonna send I don't know thirty deauth packets. And we're gonna say it's -- the BS this idea there's. The client that we want to -- off. Use this guy here's the movement we -- around. Of course to be aliens here as our interface. Rhonda. And actually what I'm doing so the idea off and there yeah I just went ahead do that -- if you look over the other window where you'll notice is you see that the -- handshake because I used. You know this and promiscuous. -- going to hadn't sent all these -- packets we've actually. Kick the machine off of the network and it has rejoined and when it it was all right over here. It says hey there we -- we got the the VP handshake took actually stopped capturing these packets here and have good and stop that and now we have. Single packet capture file that we when they couldn't send account. Now. Kathy. Does a couple of different things right so we can use count -- to take two parts of the -- antics sometimes. Or four parts -- more information on why that is. And we can either dictionary. With like a word list. War we can do a rainbow table attacks actually it's not really it's it's a pre computer time memory trade off and not have that they ran the table to look up table. Point being. We've there are available from a sense of security the people that together. That do stuff with it it part of remote exploit people that you backtrack so awesome -- there right. They have these huge list of all of these different primitive league for different access points to remember we talked about that forty gig. All encompassing right. That was are separated separated out for Linksys -- here we're dealing. Exactly so instead that forty gig I just downloaded one point eight gig specifically for -- here so I have that going on here and actually let me. I see this will actually be be. Okay so we're gonna run -- I -- are TUR that you're capture that we just did -- to the -- here dot WPA those are the render tables downloaded army it's. And then we have to specify the F societies and ethnic here there now go ahead and run this and you can see already. It is 800000. Attempts now this is heat this this some -- the table. Contains eight on a different keys right but it's able to go -- so much circuitry in comparison. I'm only doing on the on this machine technology 33. Attempts -- second on dictionary attacks and you can see here I'm doing tens of thousands the second. So you know that's about 10000. Yep so let's go ahead and take a look speed this up and even get the password. So they -- got. Password is password. And that's hook. Well we starts 32 million passwords. At twenty nearly 26000."
" A second and this is done in a sees you PC. Right I was like 900 megahertz Celeron under clock to 600 nagger I would recommend not trying to crack one of these passwords on. Easy easy as a -- when you're trying to do a podcast and I get it done before midnight because it doesn't work now. So. But let you have it so that really did take like nearly half hour on this thing but I imagine on a real machine which would be like ten times -- whatever but -- There's a couple things ornaments and right so. Like I said you can do dictionary attacks which this you can do this frame the people -- you with that 32 million. I'm trick and it could've kept going there's a ton of passwords in here up -- just read it and you're like really weird ones that possible. We -- company it's it's it's the other thing is it's not just care it it's not just Yeltsin in there if there's there's also got Iraq it's in all this crazy other there was a -- in the that was said. It is of no on it is of no consequence. That's a past president spaces and everything anyway so so before until I'd -- is. Is to be hit passwords I think it's eight to 63 rate to sixty -- 63. Is at all. Absurd. Special care yes. Kidnapper is gonna bother making six -- well okay. You right now right now in 2009 nobody's gonna bother doing 63 characters -- for -- the F this idea neck as we said. The hash is based on election really wanted to the thing is somebody off have the -- fault. -- wireless ID and just make a 63. Nothing gets paid aren't I don't know there's enough gigabytes or terabytes or paid about the hard drives -- pointing the other thing to note though is that a cow patty can be used for standard in standard now right. So I you can couple it with something like John the ripper to do brute force attack so you can even hate you or regular dictionary file run it through John the ripper that passes it over to -- To take things like password to change it. Happy stuff. So a couple of things to take a look at if you want audit the security of your own home wireless network for your corporate wireless network with permission. Keep in mind anyway what we get back we are going to be talking about it's Aziz I SCSI I SCSI."
" Yes XY and sand and it's through many acronyms for me. But it does when I'm gonna go ahead and figures Shannon and see what's going on this week in the Lan party. This plus Lan party is counterstrike source we're gonna be playing over at CSS dot Hak5 dot org on Saturday. June 27. Makes a sign up and vote for your favorite game for the next Lan party program Hak five's land that Squarespace dot com and makes better read up on all the details forget it strikes -- And I'd like to thank our sponsor Squarespace. "
" As you know Squarespace is the quick and easy way to build a beautiful blogger website without ever messing -- And over the last six months Squarespace is grown over a 100%. May attribute much of that -- to fans like you. As a special thanks revision history and Squarespace will be giving away an iPhone -- for the next thirty days to lucky fans. Play it to do is include how Squarespace into a -- He entered into the drawing a winner will be chosen at the end of each day and announce on Squarespace dot com and twitter.com slash Squarespace. "
" We'll be back with some -- right after this."
" Virtualization. Sands. A -- what is I SCSI. It's the implementation. SCSI hard drives which you all know all too well over -- IP protocol. -- The easiest way to do it for free on the cheap is using something like open -- free -- not today. I got questioner previous there questions on how to create virtual machines and it set up the -- doesn't -- like that's really kill two birds with ones that know. Two birds one stone. And we're gonna destroy the numbers. Area first we're gonna go ahead relaunch her VI -- which is virtual infrastructure client. 1010055. Is our server that is actually running in the corner over there. -- is the username and Hak5 is still password to connect up here we're gonna do is we're create a virtual machine virtual machine is going to be. Free -- now you kind of wondering why am creating virtual machine inside of free Nass. Just because it's easy and I don't have a separate box to install free dance on configure yes sex so. Follow along we're going to create free -- as a virtual machine that we're gonna connect the host which is hosting the free Nast virtual machine. To be asked as -- target which is inside virtual machine atop the had it but it is -- real right click on our. Server here recreate new virtual machine. And what we're gonna do is we're gonna do a typical. Next and it's going to be. Free -- and we're just gonna stick it on. The second data store okay this is going to be a other. 32 bit you can download 64 bit free -- but don't really need to 32 bits that -- now moving on. Is free. DSD. And one virtual processors find 256 megs of ram. Sure that's fine as well now when you start yes sex. It automatically creates -- via network on your primary bound ethernet interface. You could set up multiple mix you have multiple networks like Indians the year in or red networks on and so forth. This is already pre configured as we only have one network card in this system this is the only network interface that we actually have to choose from. Ringo and select next and we're going to create I like to run my yeah my free nest boxes with two drives. Primary for the free NASA west and secondary for the data stores or data or whatever so we're gonna make -- one -- primary. And we're gonna click finish. And that we're going to expand. -- the listing of virtual machines once it's actually completed. We're going to edit the settings. We're gonna add another hard disk cache and a hard disk with the size. 250 case and restore with a virtual machine we don't need this or elsewhere but finished. And okay it's gonna go ahead and create the virtual machine. Hard drive filed of the MDK. And once that's -- we can actually start the machine we're gonna need to do is we're gonna need to transfer the free nest I I so up to. The yes -- server you could do that simply by clicking on. The data store. Create a folder. And upload your image right from your desktop to the the data store to a party got the free -- so in there. And we are going to right click on this edit settings. Are going to edit the CD drive. With the data store myself. It's in data store two nice images and free Nast and connective power on click okay. And let's start some virtual machine love it. Open console here so we can actually see what's going on. And here it is beginning the installation. Of free dance now. While it's loading screen aspirin have to. Think about okay what's our network and stuff like that blah blah -- easiest ways just he's DH CPAs -- off with its gonna assign itself and address. And that we're gonna do is we're going to then apply. The free now us. Installer. Files. Image itself on to the one gigabyte. Hard this that we created initially. A case of free -- a live CD has completed its installation. And now we need to do we need to configure the system. It's already got -- C zero which is our only interface bound to this virtual machine. In there will we need to do we not need to set the Lan addressed to -- hit option to. And really use DH CP for this. No I don't care about IPV six so it's an initial as the interface. And their recounts are DH CP server as a sign this and address of ten that and that oh. Now 152 and we can now manage the free net server on port eighty but first we need to deploy this lied image to the disk. So we're gonna do is we're and hit enter. Well that's that's when none of those were hit option nine to install or upgrade to -- or last flash device. Reinstall the full OS and hard drive and data and swap partition. It's like okay. That is the source of the CD live image and then there are is are one gigabyte. VMware virtual disk on channel DEA zero through it okay. 128 for the OS partition. Minimum is 2128 souls -- six okay we want as swap partition. Doesn't really matter if you do or not you've got enough memory. Saying now. Okay so here we go free -- now installed on DAS. One you can now remove the CD and reboot the PC so we're gonna do is right come up here. Ctrl+Alt. -- Edit settings. We're going to. This connect. That's okay and click okay. And we can now. So just for good measure we're gonna make sure that the virtual machine actually starts with that image. That we've just install it's select yes repeat the system and now we're gonna go ahead and recruit. A case or rebooting and unfortunately it didn't get a DH CP address -- go ahead. And set the Lan interface again. Mostly yes for DH CP now in this lies here is once again. And then from here once he knew it the devices -- we can go to our web browser and we can actually start to set up. The -- the device. So that we connect. Yes acts to -- yes that's -- drive. Now obviously you're not going to use this in production environments in the because there's absolutely no reason to why would you create nice because it target. On top of your data store nobody would but for this for the sake of showing you how to do it refresh -- here. So we're gonna Ctrl+Alt out of this this is pretty much don't we don't need to use this consul anymore. 1010 -- don't want to do too so let's go here. And I believe it's admin and password. -- Our rights are -- ago the nice pretty interface of freelance. It's a lot better than has looked in the last couple versions so let's go ahead and -- we need to do is we need to go ahead and add a disk. The disk itself is going to be. The 250. Gig. Caller our -- SCSI. This. Quick and apply changes. Come over here to services on the -- SCSI target we need to add an extent. The extent itself is what VMware is gonna see -- going to be a device because we're gonna buy it right to the device which is DA one. I SCSI. Disk. -- changes. Now we need to add the actual -- doesn't target of this I SCSI target. Is going to be what accepts the request from VMware yes -- to say hey. I'm over here I have extends. That stuff so we're gonna make it read write able. It's gonna be extent zero -- network and that tend oh oh slash 24. Comment. -- SCSI disk -- Oregon. Click add. Click apply. Go over here to enable. Come down here save and restore case and now that's done now if we did everything correctly we can go back over yes exide. And select. Our host. Come over here to configuration. And two storage adapters. We need to use we need to select the -- SCSI software adaptor as we don't have hardware HCA. Click properties. Configure. Enable it. Select okay there is no -- authentication on our eyes as he targets it would have to worry about authentication or anything like that some because we're not running. We call this a separate network. Dynamic discovers what we're gonna do. Add ten at ten that -- that 152. Default port is thirty to sixty we're good with that slicked okay. Clothes and yes we want to read scanned. So here Rego. We -- scanned the -- SCSI HBA correctly. And we can hear now see a VM HBA 33. With a capacity of 250 gigs now we come over here. To know that yet when you click storage and we actually need create of the -- FS system on this this new. Data -- that we that we found. Or click add storage disk one because I SCSI appears to this system as just another physically connected device. This one click next. And bull there is our 250 gig capacity. Is there's your San identifier. There's the actual device that VMware -- click next. Click next as the hard disk is blank were called this three -- A scuzzy one. The next now this is important. A lot of people have been bitten by this in the past and you need to capacity planned before you actually. Continue on this step the maximum file size that you going to be able to have a specific data store. Two terabyte. File sizes. Are obviously for people -- very large databases in single file. We had so a client with you know one and half terabyte. Database dump that they gave us a single file. And we had to shuffle everything around so that we can. -- format. Our line. To accept a file that it don't get it in the ass and accidentally undersized or block sizes so we're in a select. 256 gigs in the because that's how big are one is when -- maximize capacity click next and click finish. Now what it's gonna do down here is create in Vienna has -- store the right now it's actually form adding that I'd SCSI line. And what it's gonna do is allow us to then create. A virtual machine just as if we had another connected. You know direct attached. Storage media even though it's actually. On the other side of the data center traveling -- RT CP network so while this is in progress. What we can actually do is make sure. And there it is so it just showed up in our storage list and we can come over here right click new virtual machine. Typical I'm just gonna fly through this -- quick and here we now see that the free and SI SCSI target with the capacity to under 56 gigs is now in -- available data store list. Click next click next yes next next next finish. And let's see if it actually creates the virtual machine because -- format and it it should be okay. And there we go so now if we come over here in go to summary. We now see in the data store we've got eight gigs taken up by our newly created virtual machine. So once again let's go into an overview obviously you're not gonna have -- when I ask as a target under the host Richard and of connecting to. Why is this good well. Free NASA is really easy to set up obviously you install on a machine that you have from six years ago. As long as you have a big enough case for a number of drives and the you know you can do software raid working -- you know hardware device that's free -- compatibility list you can do hardware raid. It really is the cheapest of the cheap way to deploy your eyes -- target in an enterprise one and -- it. Now when -- enterprise obviously you know multi million dollar companies probably are gonna be using yes it signed free -- For the sake of learning it's a great tool that'll allow you to you know know the stats that you need to create extends. Targets how to configure them. Deployed them would. This is all you know. Research that you can do on your own. Learning from anywhere here or reading online. So -- that I will leave you two noodle on how you were going to take your yet six implementation so the next step. I really like your your comments if you guys have fiddled with yes exide. Or -- scuzzy or any of the other things that we've been talking about here. If you have concerns but what I'd really like to know is what you've done since we've started this series what you actually want us to do. To help you guys out of Yemeni questions Kenya matter act five dot org and respond all the emails but I promise I won't get to eventually. Right now. We're gonna -- to break."
" And -- is gonna show us how ridiculously. Easy it is -- which is password without them ever known. Last week we had a photo caption contests this was the Fed up. And the winner of that caption contest what -- with the caption good taste I had it. It's got Sparta we really enjoy that line and we you're going to be sending you your choice of Hak five's -- from the -- jobs. This week's trivia it is. What to German researchers discovered is to fascinate a flaw and WPA TK IP that can -- short package such as our messages. If you feel like Tran after this trivia overnight Hak5 dot org slash -- and you're -- your chance to win some Swedish flags this week. And last but not least I would like to thank our sponsors godaddy. Starting at less than five dollars a month web hosting from godaddy.com. Includes 99 point 9% up time 24 sevenths support and free access to. Godaddy hosting connection. Which is the place to quickly install over fifty free applications like word press Joomla Drupal cost commerce and more. Also be sure to check out revision3.com. Slash godaddy for all of Hak five's coupons and deals. Next up we're gonna take a break and after that I'm gonna show you how to bypass windows security by using Condit."
" You said that about wraps up -- just a fact that. It. I have a nifty little worried at. A case adjacent you know he brought it flat object -- down -- written Christmas. I decided that I was going to use second laptop. Entertainment culture yes yes so I I don't know it's password right now you know like it usual air. I'm just gonna -- serious displayed equal. I did. So it DJ a lot that's right now and it actually showed us what was going on on the television screen for you guys. I'd be able to show you that this thing called Condit is booting up right now right off for the CD it's just a little ice so filed right off the -- Elect them and burn this it's -- it's crypt that's what it does not take yes it's by. -- Tora back and yet. Dot com I'm not really sure I use that but those does that and I -- it it's called Condit. It's really really simple all it does is it grabs windows kernel changes about the little bit so you don't even have to know -- persons windows password. You basically just get to the windows password screen whereas for the username and PW and you presenters and you get it and then you can mess around as long line. And then you just log out they got it CD and nobody -- the news. So basically what you're saying this -- and off packages that while yes. Yes and drop it actually you had to use rainbow table and if it wasn't a very easy pass where it. You probably wouldn't get or it would take a really really long time if you had a huge rainbow table and hopefully you did. With this you don't even need that use presenter couple attacks you don't even need."
" But the nice thing about this is I mean without going through that one the other utilities where it changes the past right I I won numerous occasions legitimately happy office you know. Senate user leaves the company I re purpose laptop they don't give us you know -- being a bit whatever it. Use the empty all applying that password and registry editor I think -- it's called -- a bunch of them that will mean you don't have to do that one but there's a bunch of them just boot and it. Resets the password but it -- the pastor good. Right so it's just temporary fix confuses me -- proceeding exactly so we've we've rebooting now."
" We rebate it we're back to the username and password screen XP professional. This. Just press center. Jason what password it doesn't pass apparently it doesn't matter if I can obviously not yeah it hardcore."
" And you know it again you. When you first mentioned this has like that template and -- her boot nothing yet I asked -- X about it and like him he's like trying to through machines psychic network."
" I tried it on two different machines and it worked on two different machines. And I hear that there are in the media works in the next yes there is also another version just for clinics and that one does pretty much the exact same thing's changed is up at all. We're gonna have -- I guess there are ways to protect yourself there are ways to protect yourself you can obviously got a bios password. Okay there we gossip -- policy that certain ways around that and you capacity use something as symbols TrueCrypt and just. TrueCrypt your entire hard drive. Andy what would not be able to see your stuff you and that we think so I can definitely come back next week can tell you about that. On another thing I want to mention is if you are are deciding to do this. You can go in and change somebody's password say he can't change that. So no matter what it once you log off if they want it says basically no more life."
" You know for people who. There companies who you know -- machines -- here time before you know keeps up for government purposes. Forgot password -- machines just sit there -- you know retention is this what yeah yeah and right and while there's -- setting in act gold mine not worry about you know crash inspired drive it is. Is the house well that he once again his computer it has. Its eighty days. Fees and -- I cannot. Mark at the top show as always all of this stuff records used only here I don't know don't we get that wrong hmmm yes. Iran use it for all. Purposes only and that's that thing. The polls you know windows oh meters in mind is that don't let yourself and F five felony on your ass because he decided to have a lot upon Cain and Abel and university's network and the milk in there and saying hey I'm with the class felony but it's something stupid and you can change my hurts my Mac address will want -- Point being. -- And again and network it's in his stuff to your systems. And then get paid a lot of money to other people's one. Alright well with all of that said I think this is an excellent long windy Austin purposes technical and if."
" it. Jim going to be elect -- take off fifteen minute epithets have you ever done it fifteen don't. Think it's."
" Anyway if you enjoyed what you saw say definitely gonna supplement of red -- back -- Hak5 dollars."
" Okay and also -- member -- that stuff coming out store I don't know jackpot dot org slash. -- The tech talk yeah."
" And as -- we -- reminding you to. Test your tech."
" And I get -- it. I didn't read it. No if you're going to between Dreamweaver and you stopped and the -- that I would describe. Is contingent."
" What we're working on and what's happened with classes the truly evolve the technology. From being your original animation. Player on the web -- really really into the bull. We have remained."
" at this release."
" Basically most people start an application either thinking about the design thinking about the -- we've really tried to enable that in -- the report the power lived in the wrong hands when it came to designing a really rich and an application to -- would hand -- static. -- for developers and then you lose all control over the actual final build an application."
" Plus another four I think really enables a much better work between designers and developers."
" But this release does is it really puts that power back to the designers and owned the visual appearance all the way into building an actual place."
" They can build out -- to -- in addition they can import it into flash -- You can add all your data connectivity and really keep your design the web designer intended it."
" On the developers so far fielder is his home for me for features that are more support me are on the silly. And things like this package you navigator they think -- help -- be more."
" So all of the types of lingering need to get through the -- designer or new project -- they're blasting out when it's gonna look like what it's. I was gonna work happens -- them for support and facility -- communication it's pretty off."
" but they -- seek time like time. And after it that's close much EPA to upbeat used to come back up. And then you -- your business -- and in flash filter and plays great application that. Just sort of gonna revolutionize the kinds of expressive that you can go."
" Wow. Coming up on the show cracking a WP keys with cow patty -- look at tables. Building and I discussing that's for VMware and bypassing local audience what Condit. All that and more on this episode of Hak5. I just brought to you by godaddy square space and the Adobe flash platform. Adobe flash provides everything you need to develop cross platform apps content and video. It isn't three -- was at Adobe flash camp and has the latest on flash the other four. Flash catalyst -- open source flex for a framework stay tuned for the video at the end of the show to learn more about Adobe's new announcements."
" And Hak5 my name is Darren Kitchen iMac -- and Janet Weiss. An excellent chip you guys tonight and we are playing with all sorts -- one -- the ESX man. Com on booting windows -- it's what. Yeah yeah then it cited its its pretty much you know we've been talking about the last couple weeks but it I think we've kind of found a niche. You know people want to do more. And -- it's. What -- want us to do more they want us to show them. The different options that are actually out there and you know my series and you you're -- hacking and stuff like that in -- with her destroyer passwords. Bills it's you know."
" Lake your segment particularly you're series on virtualization. Just sprawls. Like my a motorcycle journeys and the backwoods and suddenly the little backwards like. Those look O Richard tracks it. Have you know it's like. But -- other -- gonna let it but I love it because I thought I'd get and that's I T right that is like exactly what happens is you -- It's beautiful thing about our industry to come to work when they everybody recognizes that even programmers this means engineer comes with a knock the office whatever and it. Different (%expletive) different day."
" I mean that's the that you get to do something in and you know the need is presented to the point where it's. -- this now you know and and unite and by the end of the learning process you start to realize. That's why I think that in at least in our industry experiences worth more than education yet I'm not talking and it didn't wear your degree -- Do that yet. But you know it really speaks volumes when you're just because your -- on the job on forever and ever never ever I'll have warriors college. Notepad now it's just. Will we say this but yeah is there yet. We're here. -- And -- imports coming up soon we need to finalize the date for ads are and of season five is coming out and report like our four year anniversaries again scrutiny by the next episode that these -- Which Busch Gardens trip. Okay which -- you know I'm just put that out there I doubt that will sit down finalizing -- on but August that. Will be our five year are there four year anniversary of -- out so you know if you can come out Busch Gardens Williamsburg Virginia. We can have a grand -- time. Keep that in mind. Yes -- infinitely easier in roller coasters do halfway house you -- to determine area were to get big and useless in Atlanta in. The -- in -- You remember if there's not a lot of other -- if I -- remember I don't remember that they that the us and or else. I know it it was there spots. Anyway I think we should just go ahead and get in the -- meat of it and let's go ahead and continue on with. It appears that we had over and Hoboken and -- practical stuff so. Last week I was talking about the advancements in -- Actually -- that the developer. Game decal ID not because he was trying to make a mockery of the EPA. But that he really it's yet."
" Yeah it's actually really good code I think you know so new version will ever having compared here. Anyway so four point five is out."
" Excellent he's cut this like which we talked about last week -- two very big news features first of all you can. You can verify that information you gathered with your you know packet captures of what you need to start attack. Because if you don't have everything why bother going through an attacked assisting him -- found. And second of all you can view you can. Crack it WPA. Connection just using two parts of four way handshake. And more details on on the previous episode and also -- links in. The show notes so you know not to negate humans -- there but what's important what we're gonna talk about practically hear. Is this is the proverbial sitting next year and I'm -- here. It's not you it's just that there's a lot of crap routers and we just use in this city now here's what could've been a Linksys negative in dealing visible in the closet. So this little guy is what your grandmother is on the Internet -- right there I mean. This is Gramm. -- doing them justice by pocono up with the WPA. The the view Wi-Fi protected access as opposed to that the BP crap. -- Wired equivalent to wired equivalency protocol. And it's post privacy rights and it's only weapons only if this is good is wired and while we argue that it -- so anyway. We're gonna go ahead and show you how to audit your own home network. Your neighbors how to make sure that your system is all good using. You can talk subtitle demo set up I actually would going to use my Acer aspire one with the virtual machines and -- for on stuff. Problems of virtualization and talk to you later about that I actually said Mac. You know what I'm just gonna break out a real machine. So I broke out. EPC two which you said. It looks like virtual machine system and the right so you can see and them by. And theatre little it didn't pick up an -- get this this is the -- AWU. Easier 368. -- beautiful little 500 know a lot US be. Wi-Fi card that does once you get him on. -- went on -- so on with the fun stuff so I'm here backtrack three. And let's go ahead and get started first thing we need to do is scout around for access point right down if you keep things so for some going to go ahead and set your -- And G. To start. W and zero that is. My I -- there -- alpha and you can see him wander about and I'm gonna run Kidman. With taxi and it's an art he 81 even. The view and zero. Alpha. Okay and -- did that wrong some. Oh."
" He wanted."
" You know this EPC keyboard. Sometimes don't lose your -- registered DK we'll know the offset that they're supposed to be the till the next one so the pushed over anyway. So I can see here. That here is mine -- here. And what's important here it I'm on going to need. Is obviously. The name of the network which is all caps and here I'm going to need to know the -- idea of the network and I'm gonna need to know what channel it's on so going to. Right all those things down. And once we have this written down let's go ahead and start sniffing we don't need to associate with the access point anyway. But we can tell art card to listen to channel eleven. Particularly listening for traffic connected to this net gear so I think I already have that. Right here so we're gonna run aero dump NG and we taxied to set channel eleven the we're gonna write the file out to net gear underscore be. And that's on the -- and zero. -- you can already see we have. Our connection going on and this is where we talked about earlier. Last week that if you you know you -- it connotes. For the -- way handshake. We're now at least in some cases just you parts it you get you have to get and shaken and normally to get that what you'll do is you'll. Is. Couple of ways we talked about creating a honey pot or there's wanted to staking out the access point and while waiting for connection and that's what I'm doing right now on this laptop. Or if there's already a connection and you'll see on backtrack here I now have a connection can see. That is from you know this address I can see how many packets are going and what not and if I wanted to I can go ahead and issue a so go -- see that real quick -- easy so using another part of aircrack airplay. -- With -- easier to specify ADR we gonna send I don't know thirty deauth packets. And we're gonna say it's -- the BS this idea there's. The client that we want to -- off. Use this guy here's the movement we -- around. Of course to be aliens here as our interface. Rhonda. And actually what I'm doing so the idea off and there yeah I just went ahead do that -- if you look over the other window where you'll notice is you see that the -- handshake because I used. You know this and promiscuous. -- going to hadn't sent all these -- packets we've actually. Kick the machine off of the network and it has rejoined and when it it was all right over here. It says hey there we -- we got the the VP handshake took actually stopped capturing these packets here and have good and stop that and now we have. Single packet capture file that we when they couldn't send account. Now. Kathy. Does a couple of different things right so we can use count -- to take two parts of the -- antics sometimes. Or four parts -- more information on why that is. And we can either dictionary. With like a word list. War we can do a rainbow table attacks actually it's not really it's it's a pre computer time memory trade off and not have that they ran the table to look up table. Point being. We've there are available from a sense of security the people that together. That do stuff with it it part of remote exploit people that you backtrack so awesome -- there right. They have these huge list of all of these different primitive league for different access points to remember we talked about that forty gig. All encompassing right. That was are separated separated out for Linksys -- here we're dealing. Exactly so instead that forty gig I just downloaded one point eight gig specifically for -- here so I have that going on here and actually let me. I see this will actually be be. Okay so we're gonna run -- I -- are TUR that you're capture that we just did -- to the -- here dot WPA those are the render tables downloaded army it's. And then we have to specify the F societies and ethnic here there now go ahead and run this and you can see already. It is 800000. Attempts now this is heat this this some -- the table. Contains eight on a different keys right but it's able to go -- so much circuitry in comparison. I'm only doing on the on this machine technology 33. Attempts -- second on dictionary attacks and you can see here I'm doing tens of thousands the second. So you know that's about 10000. Yep so let's go ahead and take a look speed this up and even get the password. So they -- got. Password is password. And that's hook. Well we starts 32 million passwords. At twenty nearly 26000."
" A second and this is done in a sees you PC. Right I was like 900 megahertz Celeron under clock to 600 nagger I would recommend not trying to crack one of these passwords on. Easy easy as a -- when you're trying to do a podcast and I get it done before midnight because it doesn't work now. So. But let you have it so that really did take like nearly half hour on this thing but I imagine on a real machine which would be like ten times -- whatever but -- There's a couple things ornaments and right so. Like I said you can do dictionary attacks which this you can do this frame the people -- you with that 32 million. I'm trick and it could've kept going there's a ton of passwords in here up -- just read it and you're like really weird ones that possible. We -- company it's it's it's the other thing is it's not just care it it's not just Yeltsin in there if there's there's also got Iraq it's in all this crazy other there was a -- in the that was said. It is of no on it is of no consequence. That's a past president spaces and everything anyway so so before until I'd -- is. Is to be hit passwords I think it's eight to 63 rate to sixty -- 63. Is at all. Absurd. Special care yes. Kidnapper is gonna bother making six -- well okay. You right now right now in 2009 nobody's gonna bother doing 63 characters -- for -- the F this idea neck as we said. The hash is based on election really wanted to the thing is somebody off have the -- fault. -- wireless ID and just make a 63. Nothing gets paid aren't I don't know there's enough gigabytes or terabytes or paid about the hard drives -- pointing the other thing to note though is that a cow patty can be used for standard in standard now right. So I you can couple it with something like John the ripper to do brute force attack so you can even hate you or regular dictionary file run it through John the ripper that passes it over to -- To take things like password to change it. Happy stuff. So a couple of things to take a look at if you want audit the security of your own home wireless network for your corporate wireless network with permission. Keep in mind anyway what we get back we are going to be talking about it's Aziz I SCSI I SCSI."
" Yes XY and sand and it's through many acronyms for me. But it does when I'm gonna go ahead and figures Shannon and see what's going on this week in the Lan party. This plus Lan party is counterstrike source we're gonna be playing over at CSS dot Hak5 dot org on Saturday. June 27. Makes a sign up and vote for your favorite game for the next Lan party program Hak five's land that Squarespace dot com and makes better read up on all the details forget it strikes -- And I'd like to thank our sponsor Squarespace. "
" As you know Squarespace is the quick and easy way to build a beautiful blogger website without ever messing -- And over the last six months Squarespace is grown over a 100%. May attribute much of that -- to fans like you. As a special thanks revision history and Squarespace will be giving away an iPhone -- for the next thirty days to lucky fans. Play it to do is include how Squarespace into a -- He entered into the drawing a winner will be chosen at the end of each day and announce on Squarespace dot com and twitter.com slash Squarespace. "
" We'll be back with some -- right after this."
" Virtualization. Sands. A -- what is I SCSI. It's the implementation. SCSI hard drives which you all know all too well over -- IP protocol. -- The easiest way to do it for free on the cheap is using something like open -- free -- not today. I got questioner previous there questions on how to create virtual machines and it set up the -- doesn't -- like that's really kill two birds with ones that know. Two birds one stone. And we're gonna destroy the numbers. Area first we're gonna go ahead relaunch her VI -- which is virtual infrastructure client. 1010055. Is our server that is actually running in the corner over there. -- is the username and Hak5 is still password to connect up here we're gonna do is we're create a virtual machine virtual machine is going to be. Free -- now you kind of wondering why am creating virtual machine inside of free Nass. Just because it's easy and I don't have a separate box to install free dance on configure yes sex so. Follow along we're going to create free -- as a virtual machine that we're gonna connect the host which is hosting the free Nast virtual machine. To be asked as -- target which is inside virtual machine atop the had it but it is -- real right click on our. Server here recreate new virtual machine. And what we're gonna do is we're gonna do a typical. Next and it's going to be. Free -- and we're just gonna stick it on. The second data store okay this is going to be a other. 32 bit you can download 64 bit free -- but don't really need to 32 bits that -- now moving on. Is free. DSD. And one virtual processors find 256 megs of ram. Sure that's fine as well now when you start yes sex. It automatically creates -- via network on your primary bound ethernet interface. You could set up multiple mix you have multiple networks like Indians the year in or red networks on and so forth. This is already pre configured as we only have one network card in this system this is the only network interface that we actually have to choose from. Ringo and select next and we're going to create I like to run my yeah my free nest boxes with two drives. Primary for the free NASA west and secondary for the data stores or data or whatever so we're gonna make -- one -- primary. And we're gonna click finish. And that we're going to expand. -- the listing of virtual machines once it's actually completed. We're going to edit the settings. We're gonna add another hard disk cache and a hard disk with the size. 250 case and restore with a virtual machine we don't need this or elsewhere but finished. And okay it's gonna go ahead and create the virtual machine. Hard drive filed of the MDK. And once that's -- we can actually start the machine we're gonna need to do is we're gonna need to transfer the free nest I I so up to. The yes -- server you could do that simply by clicking on. The data store. Create a folder. And upload your image right from your desktop to the the data store to a party got the free -- so in there. And we are going to right click on this edit settings. Are going to edit the CD drive. With the data store myself. It's in data store two nice images and free Nast and connective power on click okay. And let's start some virtual machine love it. Open console here so we can actually see what's going on. And here it is beginning the installation. Of free dance now. While it's loading screen aspirin have to. Think about okay what's our network and stuff like that blah blah -- easiest ways just he's DH CPAs -- off with its gonna assign itself and address. And that we're gonna do is we're going to then apply. The free now us. Installer. Files. Image itself on to the one gigabyte. Hard this that we created initially. A case of free -- a live CD has completed its installation. And now we need to do we need to configure the system. It's already got -- C zero which is our only interface bound to this virtual machine. In there will we need to do we not need to set the Lan addressed to -- hit option to. And really use DH CP for this. No I don't care about IPV six so it's an initial as the interface. And their recounts are DH CP server as a sign this and address of ten that and that oh. Now 152 and we can now manage the free net server on port eighty but first we need to deploy this lied image to the disk. So we're gonna do is we're and hit enter. Well that's that's when none of those were hit option nine to install or upgrade to -- or last flash device. Reinstall the full OS and hard drive and data and swap partition. It's like okay. That is the source of the CD live image and then there are is are one gigabyte. VMware virtual disk on channel DEA zero through it okay. 128 for the OS partition. Minimum is 2128 souls -- six okay we want as swap partition. Doesn't really matter if you do or not you've got enough memory. Saying now. Okay so here we go free -- now installed on DAS. One you can now remove the CD and reboot the PC so we're gonna do is right come up here. Ctrl+Alt. -- Edit settings. We're going to. This connect. That's okay and click okay. And we can now. So just for good measure we're gonna make sure that the virtual machine actually starts with that image. That we've just install it's select yes repeat the system and now we're gonna go ahead and recruit. A case or rebooting and unfortunately it didn't get a DH CP address -- go ahead. And set the Lan interface again. Mostly yes for DH CP now in this lies here is once again. And then from here once he knew it the devices -- we can go to our web browser and we can actually start to set up. The -- the device. So that we connect. Yes acts to -- yes that's -- drive. Now obviously you're not going to use this in production environments in the because there's absolutely no reason to why would you create nice because it target. On top of your data store nobody would but for this for the sake of showing you how to do it refresh -- here. So we're gonna Ctrl+Alt out of this this is pretty much don't we don't need to use this consul anymore. 1010 -- don't want to do too so let's go here. And I believe it's admin and password. -- Our rights are -- ago the nice pretty interface of freelance. It's a lot better than has looked in the last couple versions so let's go ahead and -- we need to do is we need to go ahead and add a disk. The disk itself is going to be. The 250. Gig. Caller our -- SCSI. This. Quick and apply changes. Come over here to services on the -- SCSI target we need to add an extent. The extent itself is what VMware is gonna see -- going to be a device because we're gonna buy it right to the device which is DA one. I SCSI. Disk. -- changes. Now we need to add the actual -- doesn't target of this I SCSI target. Is going to be what accepts the request from VMware yes -- to say hey. I'm over here I have extends. That stuff so we're gonna make it read write able. It's gonna be extent zero -- network and that tend oh oh slash 24. Comment. -- SCSI disk -- Oregon. Click add. Click apply. Go over here to enable. Come down here save and restore case and now that's done now if we did everything correctly we can go back over yes exide. And select. Our host. Come over here to configuration. And two storage adapters. We need to use we need to select the -- SCSI software adaptor as we don't have hardware HCA. Click properties. Configure. Enable it. Select okay there is no -- authentication on our eyes as he targets it would have to worry about authentication or anything like that some because we're not running. We call this a separate network. Dynamic discovers what we're gonna do. Add ten at ten that -- that 152. Default port is thirty to sixty we're good with that slicked okay. Clothes and yes we want to read scanned. So here Rego. We -- scanned the -- SCSI HBA correctly. And we can hear now see a VM HBA 33. With a capacity of 250 gigs now we come over here. To know that yet when you click storage and we actually need create of the -- FS system on this this new. Data -- that we that we found. Or click add storage disk one because I SCSI appears to this system as just another physically connected device. This one click next. And bull there is our 250 gig capacity. Is there's your San identifier. There's the actual device that VMware -- click next. Click next as the hard disk is blank were called this three -- A scuzzy one. The next now this is important. A lot of people have been bitten by this in the past and you need to capacity planned before you actually. Continue on this step the maximum file size that you going to be able to have a specific data store. Two terabyte. File sizes. Are obviously for people -- very large databases in single file. We had so a client with you know one and half terabyte. Database dump that they gave us a single file. And we had to shuffle everything around so that we can. -- format. Our line. To accept a file that it don't get it in the ass and accidentally undersized or block sizes so we're in a select. 256 gigs in the because that's how big are one is when -- maximize capacity click next and click finish. Now what it's gonna do down here is create in Vienna has -- store the right now it's actually form adding that I'd SCSI line. And what it's gonna do is allow us to then create. A virtual machine just as if we had another connected. You know direct attached. Storage media even though it's actually. On the other side of the data center traveling -- RT CP network so while this is in progress. What we can actually do is make sure. And there it is so it just showed up in our storage list and we can come over here right click new virtual machine. Typical I'm just gonna fly through this -- quick and here we now see that the free and SI SCSI target with the capacity to under 56 gigs is now in -- available data store list. Click next click next yes next next next finish. And let's see if it actually creates the virtual machine because -- format and it it should be okay. And there we go so now if we come over here in go to summary. We now see in the data store we've got eight gigs taken up by our newly created virtual machine. So once again let's go into an overview obviously you're not gonna have -- when I ask as a target under the host Richard and of connecting to. Why is this good well. Free NASA is really easy to set up obviously you install on a machine that you have from six years ago. As long as you have a big enough case for a number of drives and the you know you can do software raid working -- you know hardware device that's free -- compatibility list you can do hardware raid. It really is the cheapest of the cheap way to deploy your eyes -- target in an enterprise one and -- it. Now when -- enterprise obviously you know multi million dollar companies probably are gonna be using yes it signed free -- For the sake of learning it's a great tool that'll allow you to you know know the stats that you need to create extends. Targets how to configure them. Deployed them would. This is all you know. Research that you can do on your own. Learning from anywhere here or reading online. So -- that I will leave you two noodle on how you were going to take your yet six implementation so the next step. I really like your your comments if you guys have fiddled with yes exide. Or -- scuzzy or any of the other things that we've been talking about here. If you have concerns but what I'd really like to know is what you've done since we've started this series what you actually want us to do. To help you guys out of Yemeni questions Kenya matter act five dot org and respond all the emails but I promise I won't get to eventually. Right now. We're gonna -- to break."
" And -- is gonna show us how ridiculously. Easy it is -- which is password without them ever known. Last week we had a photo caption contests this was the Fed up. And the winner of that caption contest what -- with the caption good taste I had it. It's got Sparta we really enjoy that line and we you're going to be sending you your choice of Hak five's -- from the -- jobs. This week's trivia it is. What to German researchers discovered is to fascinate a flaw and WPA TK IP that can -- short package such as our messages. If you feel like Tran after this trivia overnight Hak5 dot org slash -- and you're -- your chance to win some Swedish flags this week. And last but not least I would like to thank our sponsors godaddy. Starting at less than five dollars a month web hosting from godaddy.com. Includes 99 point 9% up time 24 sevenths support and free access to. Godaddy hosting connection. Which is the place to quickly install over fifty free applications like word press Joomla Drupal cost commerce and more. Also be sure to check out revision3.com. Slash godaddy for all of Hak five's coupons and deals. Next up we're gonna take a break and after that I'm gonna show you how to bypass windows security by using Condit."
" You said that about wraps up -- just a fact that. It. I have a nifty little worried at. A case adjacent you know he brought it flat object -- down -- written Christmas. I decided that I was going to use second laptop. Entertainment culture yes yes so I I don't know it's password right now you know like it usual air. I'm just gonna -- serious displayed equal. I did. So it DJ a lot that's right now and it actually showed us what was going on on the television screen for you guys. I'd be able to show you that this thing called Condit is booting up right now right off for the CD it's just a little ice so filed right off the -- Elect them and burn this it's -- it's crypt that's what it does not take yes it's by. -- Tora back and yet. Dot com I'm not really sure I use that but those does that and I -- it it's called Condit. It's really really simple all it does is it grabs windows kernel changes about the little bit so you don't even have to know -- persons windows password. You basically just get to the windows password screen whereas for the username and PW and you presenters and you get it and then you can mess around as long line. And then you just log out they got it CD and nobody -- the news. So basically what you're saying this -- and off packages that while yes. Yes and drop it actually you had to use rainbow table and if it wasn't a very easy pass where it. You probably wouldn't get or it would take a really really long time if you had a huge rainbow table and hopefully you did. With this you don't even need that use presenter couple attacks you don't even need."
" But the nice thing about this is I mean without going through that one the other utilities where it changes the past right I I won numerous occasions legitimately happy office you know. Senate user leaves the company I re purpose laptop they don't give us you know -- being a bit whatever it. Use the empty all applying that password and registry editor I think -- it's called -- a bunch of them that will mean you don't have to do that one but there's a bunch of them just boot and it. Resets the password but it -- the pastor good. Right so it's just temporary fix confuses me -- proceeding exactly so we've we've rebooting now."
" We rebate it we're back to the username and password screen XP professional. This. Just press center. Jason what password it doesn't pass apparently it doesn't matter if I can obviously not yeah it hardcore."
" And you know it again you. When you first mentioned this has like that template and -- her boot nothing yet I asked -- X about it and like him he's like trying to through machines psychic network."
" I tried it on two different machines and it worked on two different machines. And I hear that there are in the media works in the next yes there is also another version just for clinics and that one does pretty much the exact same thing's changed is up at all. We're gonna have -- I guess there are ways to protect yourself there are ways to protect yourself you can obviously got a bios password. Okay there we gossip -- policy that certain ways around that and you capacity use something as symbols TrueCrypt and just. TrueCrypt your entire hard drive. Andy what would not be able to see your stuff you and that we think so I can definitely come back next week can tell you about that. On another thing I want to mention is if you are are deciding to do this. You can go in and change somebody's password say he can't change that. So no matter what it once you log off if they want it says basically no more life."
" You know for people who. There companies who you know -- machines -- here time before you know keeps up for government purposes. Forgot password -- machines just sit there -- you know retention is this what yeah yeah and right and while there's -- setting in act gold mine not worry about you know crash inspired drive it is. Is the house well that he once again his computer it has. Its eighty days. Fees and -- I cannot. Mark at the top show as always all of this stuff records used only here I don't know don't we get that wrong hmmm yes. Iran use it for all. Purposes only and that's that thing. The polls you know windows oh meters in mind is that don't let yourself and F five felony on your ass because he decided to have a lot upon Cain and Abel and university's network and the milk in there and saying hey I'm with the class felony but it's something stupid and you can change my hurts my Mac address will want -- Point being. -- And again and network it's in his stuff to your systems. And then get paid a lot of money to other people's one. Alright well with all of that said I think this is an excellent long windy Austin purposes technical and if."
" it. Jim going to be elect -- take off fifteen minute epithets have you ever done it fifteen don't. Think it's."
" Anyway if you enjoyed what you saw say definitely gonna supplement of red -- back -- Hak5 dollars."
" Okay and also -- member -- that stuff coming out store I don't know jackpot dot org slash. -- The tech talk yeah."
" And as -- we -- reminding you to. Test your tech."
" And I get -- it. I didn't read it. No if you're going to between Dreamweaver and you stopped and the -- that I would describe. Is contingent."
" What we're working on and what's happened with classes the truly evolve the technology. From being your original animation. Player on the web -- really really into the bull. We have remained."
" at this release."
" Basically most people start an application either thinking about the design thinking about the -- we've really tried to enable that in -- the report the power lived in the wrong hands when it came to designing a really rich and an application to -- would hand -- static. -- for developers and then you lose all control over the actual final build an application."
" Plus another four I think really enables a much better work between designers and developers."
" But this release does is it really puts that power back to the designers and owned the visual appearance all the way into building an actual place."
" They can build out -- to -- in addition they can import it into flash -- You can add all your data connectivity and really keep your design the web designer intended it."
" On the developers so far fielder is his home for me for features that are more support me are on the silly. And things like this package you navigator they think -- help -- be more."
" So all of the types of lingering need to get through the -- designer or new project -- they're blasting out when it's gonna look like what it's. I was gonna work happens -- them for support and facility -- communication it's pretty off."
" but they -- seek time like time. And after it that's close much EPA to upbeat used to come back up. And then you -- your business -- and in flash filter and plays great application that. Just sort of gonna revolutionize the kinds of expressive that you can go."
Please visit the sponsors of this episode. Interested in more Revision3 special offers?

Adobe
Adobe Flash Platform provides everything you need to develop applications, content, and video across operating systems and devices. Adobe has announced further advancements in the Adobe Flash Platform with the beta availability of Adobe Flash builder 4, Adobe Flash Catalyst, and the open source Flex 4 framework.

Go Daddy
Transfer your domain to Go Daddy for as little as $6.99 and get a free 1-year extension plus guaranteed renewal pricing! GoDaddy.com makes transferring easy and offers loads of extras including: hosting, a 5-page site builder, complete email, total DNS control and more! What are you waiting for?

Gamefly
Gamefly is the largest online video game rental service and offers you a choice from over 6,000 new and classic titles across all consoles and handhelds. With plans starting at $15.95/month, Gamefly members can rent 1 to 4 games at a time and keep them for as long as they'd like. There are no late fees, no due dates, and shipping is always free. Once you're done playing a game, send it back, and Gamefly will send you the next available game on your list. If you really like the game you're playing simply click 'Keep It' on the Gamefly website and the game is yours at a discounted price. Gamefly will even mail you the case and manuals free of charge.
marilee
Started discussion: June 17, 2009 @ 9:56am GMT
Episode 518: Hacking WPA, ESXi and iSCSI, Bypass Windows Passwords [Discussion]
Darren's Hacking WPA-PSK keys using the recently updated Cowpatty and some damn fine lookup tables. Connecting ESXi to iSCSI targets -- Matt breaks it down with FreeNAS. And Shannon completely bypasses local Windows logins with a Kernel modifyin' boot cd? w00t!
Watch or download this episode now!
italiano40
last year
can darren tell us what rainbow table he was using for cowpatty???
shieldsa
last year
Rainbow Table
Darren used the 1.8gig netgear rainbow table from http://offensive-security.com/wpa-tables but it looks like they pulled that content for now.paradoxdream
last year
question
using BT4 i managed to crack MY wep with aircrack-ng and now am attempting to do MY wpa2 with the cowpatty methed used in the show.My question is some one told me that the Rainbow tables from offensive SEC are only if the routers name is set to default is this true?
example: if you use a WRT54G and have changed the name in the set up page (192.168.1.1) to boomshockalocka then if you use the
linksys.wpa, linksys-g.wpa, linksys_g.wpa, linksys1.wpa, linksys2.wpa
Rainbow tables it wont find any thing








