Computer Forensic

first of all I dowload the file that will be the material for the exercises that have been uploaded to the mailing list, in this case its a file named practical.floppy.dd
sekarang lakukan perintah dibawah ini

STRUCTURE FILE TAR

STRUCTURE FILE TAR

The Unix TAR program is an archiver program which stores files in a single

archive without compression.

OFFSET Count TYPE Description

@section The Standard Format

A @dfn{tar tape} or file contains a series of records. Each record contains @code{RECORDSIZE} bytes. Although this format may be thought of as being on magnetic tape, other media are often used.

What this it Slack Space, Unallocated Space & Magic Number

SLACK SPACE

Slack space is a form of internal fragmentation, i.e. wasted space, on a hard disk. When a file is written to disk it’s stored at the “beginning” of the cluster. A cluster is defined as a collection of logically contiguous sectors and the smallest amount of disk space that can be allocated to hold a file. Rarely will there be an even match between the space available in a cluster (or collection of clusters for longer files) and the number of bytes in the file. Left over bytes in the cluster are unused, hence the name slack space.

Struktur File System

FAT16 is a file system that uses the allocation unit that has a limit of up to 16-bit, so it can store up to 216 units of allocation (65536 pieces). This file system has a capacity limit of up to 4 Gigabyte sizes only. Allocation unit size used by the FAT16 partition depends on the capacity that was about to be formatted

MBR

Master Boot Record (MBR) will be created when you create the first partition on the hard disk. It is very important data structure on the disk. The Master Boot Record contains the Partition Table for the disk and a small amount of executable code for the boot start. The location is always the first sector on the disk.

The first 446 (0x1BE) bytes are MBR itself, the next 64 bytes are the Partition Table, the last two bytes in the sector are a signature word for the sector and are always 0x55AA.

For our disk layout we have MBR:

Local root exploit

In this tutorial backtrack OS as ubuntu 10.4 As the victim and the attacker
DVWA first open on the address ubuntu http://192.168.56.1/dvwa after that change the security to medium.

This time I used a command execution as the entrance to gain root access to the victim

then enter the following command

the above statements are intended to backtrack as the victim in the listening position so that the linux attacker could log in as root,
after it entered the terminal and enter the following command ubuntu

commands is intended to connect the victim with port 4444, but we just go to the directory dvwa, not to gain root access   
it is time to execute payload

to be continue
  

Attack Vector Metasploit & Beef

 Attack Vector Metasploit & Beef

In the scenario this time I will try to exploit the web browser using the beef combined with metasploit.
First I create a web page that I put java.script that would make victims who access this web page will hook into the beef.

As for its use as below ..
we will exploit windows through warftp application, first of all looking at msfconsole warftp module

after that use the module as shown below warftp
 

Then enter the address of the HOST (IP Address of victims)

Web Browser Exploitasi & Metasploit Using MSF

browser Exploit
First of all open-ng beef

then open the beef on your Mozilla browser and enter the User and Password: beef / beef

msfpayload and msfencode and examples of its use

msfpayload is a command-line instance of Metasploit that is used to generate and output all of the various types of shellcode that are available in Metasploit. The most common use of this tool is for the generation of shellcode for an exploit that is not currently in the Metasploit Framework or for testing different types of shellcode and options before finalizing a module.

msfencode is a tool to obfuscate a "payload that contains backdoor" meterpreter executable shellcode from the Anti-virus

Social Engineering & SET

Social engineering

Social engineering is the acquisition of information, or edicts, secret / sensitive by cheating the owner of such information. Social engineering is typically done via telephone or Internet. Social engineering is one of the methods used by hackers to gain information about the target, by requesting the information directly to the victim or others who have that information.

example of using the metasploit auxeleri

First of all I look for auxiliary modules that I would use

Exploitasi Linux

script program

/ / I am a vulnerable thing.
# include <stdio.h>
# include <string.h>
int main (int argc, char ** argv)
{
char buffer [500];
strcpy (buffer, argv [1]) / / Vulnerable function!
return 0;
}

Eksploitasi File Sharing Wizard

At this time fuzzer, which will try to fuzzing is the File Sharing Wizard
First run the File Shareing Wisard Then, run well and then attach OllyDbg File Sharing Wizard into OllyDbg.
After successfully attach to the File Sharing in OllyDbg, run the following application fuzzer

Buffer OverFlow Big-Ant Server

At this time fuzzer, fuzzing will try to command USV is owned by Big-AntServer.
First of all Big-AntServer then run, run well and then attach antserver.exe into OllyDbgOllyDbg.
After successfully attach a process antserver into OllyDbg, run the following applicationfuzzer

STACK OVERVLOW VUPlayer

First of all open applications VUPlayer, then open the application also Ollydbg for monitoring application that will diexploit
then go to backtrack, open the console and create a fuzzer that will be used to exploit the application VUPlayer, As for the script:

Stack Overvlow RM.MP3 Converter

First of all open applications RM-MP3_Converter, then open the application also Ollydbg for monitoring application that will diexploit
then go to backtrack, open the console and create a fuzzer that will be used to exploit application-MP3_converter RM. As for the script:

Step by step Buffer OverFlow WarFtp

Run windows on virtualbox
open war-ftpd file, after the open click go online
ollydebugger open, click the menu, select the war file attach-ftp is running, click the play button
Log in backtrak console, create a fuzzer as fuzzer.py
Write the script below on the fuzzer

How about OllyDbg

OllyDbg is a debugger application to analyze. For each module (executable or DLL file) it attempts to separate code from data, identify the procedure, look for strings that are embedded and switch tables, determining the loop and the switch, find the function call and decode their arguments, and even predict the value of the register during the execution. To try it you can download here or this one.

How About Fazzer and Fuzzing

Fuzzing is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.
Fuzzing techniques can basically be divided in four different categories: