November 6, 2006

BackTrack 2.0 beta on USB stick

I have been playing with backtrack installation on USB since last 3 days. Just thought of sharing my experiences with you. I have a 2 GB USB stick. I wanted to create 2 partitions on it and install backtrack in one of them. Don't ask my why - I just wanted to play with different boot options on a USB stick. Here is what I learned from last 3 days of head breaking:

1. Using a filesystem other than FAT/FAT32 on USB stick is a bad idea. I tried ext2 and ext3. Sometimes they work and sometimes (and on some systems) they fail for no reason.

2. Bootloader 'grub' is a bad choice for USB boot. 'grub' tries to know too much about the system and when things change it just raises the hands and aborts. I could get it run my USB stick, but it was very unreliable.

3. Bootloader 'lilo' also didn't work always. I worked on my laptop, while it got stuck in between on my desktop. I don't know whether it was 'lilo' or filesystem ext2. I didn't test with FAT32. Not to mention that it's 20 times slower than any other bootloader in loading the kernel image.

4. Bootloader 'extlinux' is also unreliable. On the same system, sometimes it works and sometimes not.

5. Bootloader 'syslinux' with FAT32 seems to be the most stable thing till now. I think, I'll stop experimenting with other bootloaders and filesystems on my USB stick until somebody convinces me to do otherwise :)

To install backtrack on USB stick (I've been looking for these instructions for quite some time. No, I didn't want to use MySlax Creator.):
  • Create partitions on your USB stick using fdisk and format them using mkfs.vfat.
    fdisk /dev/sda
    mkfs.vfat /dev/sda1
    mkfs.vfat /dev/sda2

    Make sure that the partition that you want to use for backtrack is marked as active in partition table.

  • Mount 'the' partition on /mnt and copy all the files from one of the following locations:
    • If you are installing from a running live cd distribution, your source is /boot.
    • On any other system, just copy everything from BT iso image/CDROM or USB stick.

  • Install syslinux bootloader to the backtrack partition and copy the mbr.bin that comes with syslinux to MBR of the USB stick:
    syslinux /dev/sda1
    cat mbr.bin > /dev/sda

  • Copy isolinux.cfg inside /mnt to syslinux.cfg and change the paths /boot/vmlinuz and /boot/initrd.gz to vmlinuz and initrd.gz respectively. One way to do it:
    cd /mnt
    sed 's/boot\///g' isolinux.cfg > syslinux.cfg

  • Your USB stick is ready to roll now :)
This procedure can be followed for hard drive installation also. You would probably have another bootloader already installed on the hard drive. In that case you can just add an entry for BT.

Hope this will help backtrackers.
M

November 3, 2006

Some Modules For Backtrack 2.0 Beta

I have compiled some modules during my testing/use of BT 2.0 beta. Here are some modules that you could find useful:

NTFS read/write support using ntfs-3g: http://manugarg.googlepages.com/ntfs-3g-0.20061031-BETA.mo
More information on ntfs-3g can be found in my previous post: "Release of ntfs-3g beta, read write driver for ntfs"

LVM2 support. Device-mapper userspace tools and lvm2 tools are required to make lvm2 work in BT:
http://manugarg.googlepages.com/device-mapper.1.02.12-i386.mo
http://manugarg.googlepages.com/LVM2-2.02.13-i386.mo
Note: muts has already been informed and he has pushed these binaries in the cvs. So next release won't require these modules.

I'll update the modules for this release in this thread only to make it easier to find them.

Happy Backtracking ;)
M

Update: Nov 12, 2006
--------------------
Here comes the new modules: truecrypt. A very useful encryption utility.
http://manugarg.googlepages.com/truecrypt-4.2a.mo

Digg this; Post to del.icio.us

October 31, 2006

Release of Backtrack 2.0 Beta

Some news and some experiences:
mutts and max released Backtrack 2.0 Beta about 2 weeks back. I have not got much time to test it extensively so far. Some inputs from the initial runs:

-It looks even more sexier (very important :)).
-It has latest madwifi drivers. Phew, looks like I am finally relieved of compiling madwifi-ng with every release of backtrack. Very welcome change :)
-Kernel sources with the distribution. Here goes 1 more external module away.
-Replacement of UnionFS by aufs with zlib for modules. This allows for more stuff to be packed in less space. But, it also leaves older modules incompatible (who needs them anyways ;)).

I tried to run it on my thinkpad z60t. My wireless card (Thinkpad a/b/g mini-pci, based on Atheros chipset) came up just fine with madwifi drivers. Monitor mode also seems to work fine. For monitor mode, I had to use wifi0 as source in Kismet configuration, while rest of the networking stuff works fine with ath0.

For graphics, do run 'xorgsetup' while you're in black and white land. It will setup your xorg.conf and doing a 'startx' will take you to the KDE.

So far it looks really cool. Thanks to muts and max. They are doing some neat stuff. Backtrack is already my favorite distribution for any kind of troubleshooting or security stuff. I'll be posting more of my experiences as I get the time to test it more.

Happy Backtracking till then.
-M

October 13, 2006

pyMailer: Sends Mails

This is one tool that I had written about one and half years back. Why am I talking about it now? Well, I have recently realized that it's quite a useful thing. I find myself using it quite a bit. You may also find it of some use.

What does it do? As the title says, it just sends mails. To understand the usability, it will probably help to know why I wrote this? I wanted a tool to backup my files to my gmail account in quick and easy steps. I wanted to use gmail smtp server as I thought gmail would be reliable. Using gmail smtp was not easy, as it required login and tls support from the client. I know I could have used Thunderbird and other clients. But, idea was to have something simple and quick to use. So, requirements were like:

1. Definitely a command line interface
2. Platform independent (should run on linux and windows at least)
3. Attaching files should be easy and smooth.
4. Should have support for TLS
5. And possibly should have support for GUI and an option to save configuration so that I don't have to write email addresses again and again.

I could not find such a thing in the open source software land, so wrote one myself. It's written in python and meets the above requirements. Apart from that,

- It's written in way that it can be extended easily and modules can be used in other programs too.
- The scripts version runs on my Mac OS X without any change

Here are the links:

Homepage:
http://pymailer.sourceforge.net/
Sourceforge page:
http://sourceforge.net/projects/pymailer/
Some screenshots (on Windows):
http://sourceforge.net/project/screenshots.php?group_id=132341

Check it out. You can certainly find some use for it. :)

-M
---
Manu Garg/http://www.manugarg.com/"Journey is the destination of life"

August 21, 2006

Something about ELF auxiliary vectors

...mysterious carriers of information from kernelspace to userspace.

I hit upon them while writing my last paper on sysenter based system call mechanism. In one sentence, these vectors are the mechanism to transfer some OS specific information to the program interpreter (e.g. ld) and the process. Examples of such OS specific information are - page size, system call entry point, real and effective user ids etc. Linux 2.6 specifically uses an ELF auxiliary vector called AT_SYSINFO to pass the address of __kernel_vsyscall.

How these vectors are passed on? This work is done by the elf loader. Elf loader is responsible for loading elf binary files into the system. Elf loader puts these vectors on the process stack alongwith other information like argc, argv, envp. Isn't it new? Many programmers are unaware of these extra creatures on the stack (at least, I was one of them ;)). To make life easier for them (and for me too), I have written this article, nah a small writeup on elf auxiliary vectors.
http://articles.manugarg.com/aboutelfauxiliaryvectors.html

I am sure at least some of you will find it useful. If otherwise, then don't bother to mention that ;-). At least I'll refer to it in future (I have a short memory and new things keep pushing old things out, so these kind of writeups come handy for me).

-M
--
Manu Garg/http://www.manugarg.com/"Journey is the destination of life."

July 16, 2006

Release of ntfs-3g beta, read write driver for ntfs

Szaka announced the release of user land read-write driver for NTFS on linux-ntfs-dev mailing list on July 14th, 2006. This is a user land driver and it makes use of fuse. Fuse is a linux module which provides facility to write filesystems in user space.

It seems that this driver is quite stable and provides better option than captive-ntfs. Good news for BackTrackers, huh? :-). I have complied ntfs-3g beta module for backtrack-v1. Backtrack comes with fuse kernel module, but I had to compile fuse tools and library to compile ntfs-3g. Here are the links to the modules:

http://manugarg.googlepages.com/ntfs-3g-20070714-BETA-i386.mo
http://manugarg.googlepages.com/fuse-2.5.3-i386.mo

I have done some basic testing using these modules and things look fine. Hope you will find these modules helpfull. To start using it:

-Load fuse module using:
modprobe fuse
-Mount windows filesystem using:
mount -t ntfs-3g /dev/hda1 /mnt/windows

More information about ntfs-3g can be found in the announcement here:
http://sourceforge.net/mailarchive/forum.php?thread_id=23836054&forum_id=2697

cheers,
M
=========
Manu Garg
http://www.manugarg.com
"Journey is the destination of the life"


Technorati tags:

Digg this; Post to del.icio.us

July 10, 2006

Sysenter Based System Call Mechanism in Linux 2.6

Reporting from linux kernel land,

Starting with version 2.5, linux kernel introduced a new system call entry mechanism on Pentium II+ processors. Why this new mechanism? Well, somebody reported performances issues with system calls on Pentium IV processors. Apparently, the system call mechanism based on software interrupts was responsible for this performance lag. Linux, or Linus more specifically, responded by implementing an alternative system call mechanism.

This mechanism made use of SYSENTER/SYSEXIT instructions available on Pentium II+ processors to implement system call entry and exit. This articles explores this new mechanism. If I have made any general statement, i.e. not mentioned specific architecture, please make a mental note that I am talking about Pentium processors. Also, all source code listings are based on the kernel i.e. 2.6.15.6 (that's the kernel on backtrack v1.0).

Here is the link:
http://articles.manugarg.com/systemcallinlinux2_6.html

I explored this mechanism for awareness and of course, for fun ;) I wrote this article as a reference for other explorers. You can send me a note (manugarg at gmail dot com) if you find this article of any use.

Happy exploring,
M
http://www.manugarg.com
"Journey is the destination of life"

Technorati tags:

Digg this; Post to del.icio.us

June 7, 2006

madwifi-ng for BackTrack v1.0

BackTrack v.1.0 was released on May 26, 2006. Against all my expectations, it again didn't have latest madwifi drivers on it. So had to compile them again. Few changes that I observed during compiling:

- svn is there (good)
- kernel sources are gone (bad)

Here are the links to compiled packages:

slax community website:
http://slax.linux-live.org/modules.php?id=1151

googlepages.com:
slax-module: http://manugarg.googlepages.com/madwifi-ng.mo
compiled tgz: http://manugarg.googlepages.com/madwifi-bt-v1.tar.gz

Refer to my previous post for instructions to use them.

Happy backtracking!
-M
http://www.manugarg.com
"Journey is the destination of life"

Technorati tags:

March 20, 2006

Running BackTrack on Thinkpad z60t: Wireless

Greetings fellas,

Have been playing with linux on my new Thinkpad z60t recently. Tried running BackTrack (a live-cd distribution of remote-exploit group) from usb drive. BackTrack is based on slax and is probably the best live cd distribution around for pen-testing with lots of security and forensic tools onboard.

Well, it booted up fine from the usb stick, but the default madwifi drivers on the latest (v.3.0) backtrack were not able to recognize the wireless card (ThinkPad 11a/b/g mini-pci) on my laptop which is based on Atheros chipset. After some googling I found out that latest madiwifi drivers should work just fine. Tried looking for some compiled module for slax but could not find any. So, finally decided to build one myself.

I followed the steps here to compile the modules and it went on quite smooth. My wireless card worked just fine with the latest madwifi drivers. To make life a little easier for other BackTrack and Slax users, I have uploaded this module to Slax module repository and my googlepages web space.

Here are the links to the modules:

slax.linux-live.org:
http://slax.linux-live.org/modules.php?id=870

googlepages.com:
http://manugarg.googlepages.com/madwifi-ng-i386-20060319.tgz
http://manugarg.googlepages.com/madwifi-ng-i386-20060319.mo

To use these modules, either use MySlax Creator to modify the iso image or if you are using usb stick, you can directly copy the module to the 'modules' directory on your usb stick.

After booting up backtrack, you will be able to see ath0 device automatically(if not then try running modprobe ath_pci).

To bring up interface:
ifconfig ath0 up
To configure wep key:
iwconfig ath0 key
To get an ip address:
dhcpcd ath0

Hope this helps,
Manu Garg
http://www.manugarg.com
"Journey is the destination of life"

Technorati tags: