dsl for pen testers

Forum: DSL Embedded
Topic: dsl for pen testers
started by: Elc0chin0

Posted by Elc0chin0 on Nov. 29 2006,22:12

I just registered here. I downloaded the usb dsl and think it's terrific. I do have a few suggestions if possible.

1) is there a way to make the screen bigger and set it to default.

2) I can't seem to get to the hard drive on the laptop /computer when I try to the 'unmount' button on the bottom right corner I get a dialog box that says something about the file system type. I tried going into the /KNOPPIX directory and changing to the /mnt to mount the hard drive but I can't seem to locate it. I didn't see it in the /auto directory. Sorry this must be a no brainer I just can't see it.

3) I'd like to be able to use a few tools like a) nmap, b) tcpdump, c) airsnort, d) sleuthkit, e) metasploit if possible. I think if I can get to the harddrive I can download the tools and use them from there but I just can't get to the hd.

If this is already available I'd really appreciate a url where I can just download it.

Thanks

Posted by ^thehatsrule^ on Nov. 30 2006,02:25

1. do you mean resolution? run xsetup.sh

2. scroll around in the mount tool to select the device (if supported) before clicking mount

3. I think there are some extensions for them - check mydsl. Or else you could always get them elsewhere.

Posted by Elc0chin0 on Nov. 30 2006,16:22

I got the xsetup.sh to work but it didn't seem make a difference. Maybe I have to restart DSL Linux.

I have no idea what the mount tool is, so I can't test anything. If the little box that's in a pinkish red on the bottom right of my DSL screen is the mount box then I can't do anything with it.

If I right click it give me an "Error: mount: you must specify the filesystem type" HOW?

If I left click I get the same error message.

Again HOW do you specify the filesystem type?

When I open a root shell and go to /KNOPPIX/mnt

there is an 'hd' now but when I try to 'mount -a hd' I get something about it not being in fstab.

and I checked the mydsl and opened up most of the tabs/buttons and got nothing but a blank dialogbox.

Thanks but this idiot was looking for something a little more straight forward.

I can get it to open somethings and i do find it very useful. I just would like to use it a little differently than a virtual desktop.

Posted by ^thehatsrule^ on Nov. 30 2006,17:25

run ` ls -l /mnt/hd* ` and paste your output.

hd itself is unused I believe, just an empty dir.

yes, that would be the mount tool. Try another device. To manually specify the fs, you can use mount -t <type> but it's most likely a filesystem that DSL doesn't recognize - or is the device even formatted?

Output of `fdisk -l` could be helpful as well.
Also `cat /etc/fstab`.

Posted by roberts on Nov. 30 2006,17:32

I wonder if he is running Qemu? But with the Wiki calling the Qemu version the USB version which is wrong! And with his statements of:
Not full screen and no access to local drives? We can only guess. Still posted in wrong place and not clear what version of DSL?
What happened to that post "How to ask a Question"

Posted by Elc0chin0 on Nov. 30 2006,19:29

Interesting note;

when rebooting the system I noticed that it sees the bios

which also sees the hds and cd as;
ata0 and ata1 and it notes the size of each.

also I do need to restart dsl linux for the xsetup to take effect. Nice.

The first time I rebooted the system hung at 'Booting from Hard Disk...'

The second time it also hung at the same place. This isn't a real big deal in XP or most windows environments I guess.

It trieds to mnt the ndiswrapper from mnt/hda1/windows etc etc. but can't find them or mount to...

Ok found the mount tool, but it's basically the same little thing at the bottom right corner and does basically the same thing. Again, where do you specify the file type?

Still looking for some of the tools I mentioned and haven't found anything yet.

Posted by Elc0chin0 on Nov. 30 2006,19:43

Thanks for the info and all the help Roberts.

BTW it's posts like you're that turn a good question into something other than what it started out.

Also, FYI I liked this tool so much I made a donation yesterday evening. Nothing like what Bill Gates did but non the less a donation, and I get a Super Admin comment like this.

Thanks but I think I'll keep working with ^thehatsrule^ as he appears to at least be of assistance.

I dl'ed the latest version of dsl 3.1 I think. Not the beta version.

I did find the 'windows manager'. If you right click on the screen you'll get a host of menu options. The 'window option allows you to change to 'jvm' or something like that. It works a lot faster but I still get nothing when I click on the 'Apps' of MyDSL.

Here's what I get with 'ls -l /mnt/hd*'

/mnt/hd:
/mnt/hda:
/mnt/hab:

When I 'cd' to any one of them and then 'ls' to say 'hda' it's empty. I've tried to 'mount -a hda' from the /mnt directory and them 'cd' to the hd* directory. Still no results.

Sorry about the long questions but I'm trying to work with someone else on using this.

And thanks for whoever it is that's providing the assistance, maybe you should be a super admin.

Posted by ^thehatsrule^ on Nov. 30 2006,19:54

roberts, I suppose moving this thread isn't possible?

Quote

also I do need to restart dsl linux for the xsetup to take effect. Nice.

You just need to restart X actually.

Quote

Ok found the mount tool, but it's basically the same little thing at the bottom right corner and does basically the same thing. Again, where do you specify the file type?[quote]See my last post about this...

[quote]/mnt/hd:
/mnt/hda:
/mnt/hab:

are you sure its hab?
Anyways, it looks like it's not partitioned correctly... the output from the commands in my previous post's last paragraph might help us figure out what's on those devices.

Posted by roberts on Nov. 30 2006,22:16

Moved.

I hadn't moved it cause I couldn't tell if it is Qemu/Embedded or native USB booting.,

If it is trying to use ndiswrapper upon boot, sounds like it was run on abother system and has a backup that likely is incorrect for the current target machine.

Try booting it with
dsl base norestore

Posted by Elc0chin0 on Dec. 01 2006,21:55

Quote

If it is trying to use ndiswrapper upon boot, sounds like it was run on abother system and has a backup that likely is incorrect for the current target machine.

Try booting it with
dsl base norestore

I'm booting from a usb drive in windows xp on a sony laptop. I'm not exactly sure what 'booting with dsl base norestore' is but I've gone into the .bat file to examine what's there and get the following;

REM Start qemu on windows
@ECHO OFF

START qemu\qemu.exe -L qemu/ -no-kqemu -m 128 -soundhw sb16 -localtime -kernel linux24 -initrd minirt24.gz -hda KNOPPIX/knoppix -hdb qemu/harddisk -append 'qemu sb=0x220,5,1,5 frugal quiet modules=hdb noscsi nosub nofirewire atapicd noideraid noacpi acpi=off noapm noagp ide1=noprobe ide2=nnoprobe nomce"

CLS
EXIT

Now I'm no linux guru but it appears from the hda KNOPPIX that this is the virtual disk it creates up on start up. The hdb gemu/harddisk should be the hard drive on the laptop.

Would I run "START qemu\qemu.exe -L qemu/ dsl base norestore" without the quotes of course?

Posted by ^thehatsrule^ on Dec. 01 2006,22:34

Oh, using qemu. Different story altogether - should've guessed that when you wanted a "bigger" window.

Yes, hda is mounted with the DSL image. hdb (not hab) is the virtual 60mb (default) image located in .../qemu/harddisk - it is NOT your physical drive. There have been a couple other threads on this for some workarounds with qemu. Note that by default this image is empty, therefore resulting in your mounting errors.

About networking, you may as well run network security tools on windows, because that will have native access to your network.

Posted by roberts on Dec. 01 2006,22:44

As I suspected from the first post.
DSL as I implemented it in Qemu is a sandbox.
You are in a virtual machine with no access to the physical drives.
You will have a passthru network connection to use the browser using your pre-existing Windows network setup.

You can use advanced Qemu settings to play outside the sandbox.
Most of your questions are Qemu specific.

Try this link
< http://www.h7.dion.ne.jp/~qemu-win >

Posted by Elc0chin0 on Dec. 04 2006,20:07

Thanks for the link. Too bad i don't understand Japanese.

So I understand now what you meant by DSL is a sandbox. But that's why I thought it could be used as a pen-testers tool. That's probably why I initially put this in the other area.

I've checked around the files looking for some of these tools and have haven't been able to find them.

Some of the things I can see this being used for is like forensic investigators looking at a suspects computer for evidence. If you have a search warrant and get the suspects permission you can do a limited amount of searching before you confiscate evidence.

The other is for a pen-tester who would be doing a quick down and dirty assessment. For instance, if a client asks what would it take for you to do an assessment of my company, I don't have a topology I don't have any schemeatics I don't have a clue where anything is, but I need to have some sort of vulnerability analysis or pen-test.

With a tool like this having a few nice tools loaded like, nc, nmap, metasploit, nessus, tcpdump, johntheripper, firewalk, Sleuthkit etc. you could set up a few quick scripts or run through a quick nmap scan, maybe a johntheripper or something to be able to assess what this might cost the client.

So, if the only way to get to the hd physically is to go through the network, that may not be the idea way to do any of this since we'd like to keep everything read only.

I just thought there may be another way to do this.

Thanks for the Japanese links though it kept me busy for a few hours.

Posted by ^thehatsrule^ on Dec. 04 2006,20:52

It's in english...? At least, as long as you don't click on the japanese link.

Well, you may just be limited by qemu's networking capabilities, not to mention to be restricted by the host environment. You can directly boot natively into a linux livecd/liveusb/etc. for your needs, if you do not wish to use windows' tools.

Posted by roberts on Dec. 04 2006,21:02

Gosh, when I click on the link I provided I see english.

You may want to check out the distro called INSERT.
INSERT was orginally based on DSL and I believe has many tools that you have mentioned. But again, INSERT is not embedded in Qemu and boots as a live CD. It is not a general desktop.

Posted by Elc0chin0 on Dec. 04 2006,22:13

Hey Gosh, click on one of the screen shots.

I never saw any engrish that lookie like that.

Sorry i did go to one of the links to look at TAP since that would have allowed me network access. The rinks there with the sclean shots have no engrish.