Vulnimages

Now that I do not not have the lovely lab at offsec, I find myself constantly searching for good vulnerable or "boot to root" images to test my skills against. I have found all kinds but I seem to enjoy the ones that are more like a pen test. Meaning I need to scan the machines, ID services, exploit a weakness, get a shell, elevate privs, get root. So far I have found a couple that I like (in no particular order)...

Err... well, I don't actually know the name for this Vulnimage. A co-worker put this up in our VM lab and said go for it, but it was an enjoyable experience. I liked it mainly because it has a bunch of elements to it. There are multiple vectors for an initial attack so you get to practice both website based attacks as well as service based buffer overflow attacks. Once you gain root there is another little nugget that I really enjoyed, a vulnerable custom program running as root and listening. This I have to say was the most fun and educational part of this image. The opportunity to take someone else's program and fuzz and exploit it from scratch. I needed to learn the basics of a linux command line debugger (gdb) to get the information I was used to seeing on the screen for Immunity. It took some time, a chat with a colleague, and a fist full of Google but I finally was able to get the information I needed out of gdb and and write a custom exploit. Definitely a good practice machine for my skill level. Had things I knew and things I needed to learn

The next one I came a crossed was Hackademic.RTB1. Another good machine here and looks to be a promising series, hats off to mr.p0rn for putting this stuff together. Again web based entry, takes some research and the use of tools to get shell and root. Fairly straight forward but fun to explore. No custom apps here but still worth the time to pop.

On the Hackademic note, The RTB1 machine is wonderful and realistic (hell I know several people/companies running vulnerable version of the webapp used), but.... When I tried RTB2 I felt it was more.... I don't know... lacking? non-realistic? classroom-ish?, I don't know if those words are accurate but I ended up not being a fan. I did like the introduction to PK but I cant help but think this one wasn't really a hacking challenge as much as a thinking challenge. I would have like to see a real DB powering the login and a little more hunting/digging/cracking for the sequence needed to get a shell. ... ... ... Actually looking over my notes, I now know what this feels like... it felt like a simple forensic investigation. Something where you were trying to find/decode hidden info. I guess in that aspect it just bumped up a notch in my list. :-)

I tired to keep spoilers to a minimum and make one recommendation to you if you are going to do any vulnimage, Try to do it yourself before researching anything. With these when you even Google a small question you are going to end up with results to posts where you are given a walkthrough for the whole task. I think this sort of takes the fun out. On the flip side if you are looking for walkthroughs go check out g0tmi1k's blog There is a ton of useful stuff here above and beyond just walkthroughs.

My OSCP Experience

Last summer I was tossing around starting to study for a security certification. I got my Security+ at the end of 2010 and felt it was time to look into something a little more advanced. I looked at the CISSP but felt that maybe I wait on that one as i was going to really have to stretch to pull off the professional requirements. Next I came a crossed the Cisco security certs but not even having a CCNA means a very long process and I wanted something a little quicker. Eventually I ended up looking at the CEH and I though this looks pretty promising but in doing some additional research I heard a few people talking about the OSCP from Offensive Security. Now I thought the theory behind the both of them seemed to overlap in a lot of places but from what I could tell (and now believe to be true) the OSCP is a lot more hands on. Since I find I learn better with hands on learning I opted to go after my OSCP.

So, come mid-September I signed up for the 30 day course. Well... I was in for a world of hurt. Once the course begins they give you a bunch of videos to watch and a decent sized lab manual (I recommend printing a hard copy to take notes on) to go through. Also, how could I forget to mention, what I consider the biggest perk of the course, VPN access to the lovely offsec lab. Now since I work full time and have a handful of kids needless to say I did not spent 24 hours a day going through this material. Some days I was able to get in a couple hours at work but most of my progress was made on weekends. So 25 days later I was just finishing up going though the lab manual and videos. Not even really preforming the exercises, just absorbing the all of this new and wondrous information being dumped on me. Looking up some supplemental topics on Google as  I went just either to clarify or because I can't believe I hear about a topic before. Needless to say I had to signup for another 30 days.

My second 30 days were spent... well mostly off topic. Feeling a little overwhelmed and no shortage of other life things happening I spent as much time as I could in the lab. I remember the first day I actually started to attack the machines, I went after, what I considered, the low hanging fruit and in about four hours I had two machines. Thinking that was good for the day I turned to other exercises in an attempt to refine my skills. The next day I got two more machines. I started to think "Hey I'm actually getting the hang of this... Its easier than I thought!" ... ... .. .. A week later I was still in the same spot. Confidence going down the tubes at this point after everything I was trying and nothing was working out. Eventually I was able to get a few more techniques under my belt and my machine count started to slowly add up. Before I knew it my second round of 30 days was nearly up and I needed to grab another 30 days.

On my last 30 days I feel I may have "grown" the most as a student. I was researching topics a bit more, starting to see things in a new light. Hell at this point the course already helped me land a new job just by telling them I was taking it! I had more than a decent chunk of machines popped and I felt now was a good time to organize everything and go back over the lab manual making sure I crossed my "I"s and dotted my "T"s! By the end of this last 30 days I still felt like I had so much to learn but I didn't really want to invest any more money at this point and with the holiday break coming up it was the perfect time to take the exam. So the last two weeks I spent time writing my report and making sure I got all (most) of my extra miles exercises done. I then scheduled my exam to start 5pm on Dec 29th. I figured its 24 hours let me get the night out of the way in the beginning. Not saying this ended up being a good idea or a bad one, with the time crunch I eventually felt wiped out. Now I would love to go into details and specifics but I can't and won't. I don't want to be that guy who shouts out the ending of the moving in the middle of a crowed theater.

What I can say is that after the exam ended I was miserable. I felt like I should have done better but looking back now I think I was a little hard on myself. Either way I shot my full report off to Offsec went to bed!

Much to my surprise come Saturday morning I got the email that I passed. I was ecstatic!! I felt like I had actually proved something to myself. Not only that I few days later I was going through some books that I had read last year while moving them into my new office and found that "Grey Hat Hacking" actually made a lot more sense.

Did I have fun? Yes. Was it hard? Hell yes. Did it build be up and shoot me down? Without a doubt! ..... Was it worth it? Absolutely! and I would do it again. Hell I have spent the past two weeks looking for decent vulnimages that are similar to the lab enshrinement. If you are looking into the course, just do it! You will learn most of what you need to know during the course. Don't be afraid to chat in the IRC, they are there to help you along. Remember, Google is your friend! You may not find specifics (in fact you flat out won't) but you will find enough to point you in the right direction or to make you look at a problem in a new light.

And last but not least, when you have tried everything you can think of, your sleep deprived, on the verge of giving up, and you feel in over your head.... Try Harder!!! (its worth it!)

First Things First....

I have thought about blogging for a while and never could think of things to talk about or even organize my thoughts enough to start. However recently I received a huge jolt of confidence from passing my OSCP and then it hit me... I should use a blog to keep track of all the tools and ideas that I have trouble remembering! I figure at the very least I will have my own reference for the common tools I use and maybe someone else can get a straight forward answer on how to use one or two of them. I may pepper in some thoughts and experiences over time but at least I finally found a place to start!