http://www.mcgrewsecurity.com Thu, 05 Jan 2012 11:44:23 +0000 hourly 1 http://wordpress.org/?v=3.3.1 http://www.mcgrewsecurity.com/2008/08/04/man-in-the-middle-fake-dns-for-metasploit/#comment-393 SiriServer – polished and done | Going on my way… Thu, 05 Jan 2012 11:44:23 +0000 http://www.mcgrewsecurity.com/?p=157#comment-393 [...] It uses this stuff: -metasploit fakeDNS server – enhanced version by Wesley McGrew, modified to work with the latest Metasploit, http://www.mcgrewsecurity.com/2008/08/04/man-in-the-middle-fake-dns-for-metasploit/ [...] [...] It uses this stuff: -metasploit fakeDNS server – enhanced version by Wesley McGrew, modified to work with the latest Metasploit, http://www.mcgrewsecurity.com/2008/08/04/man-in-the-middle-fake-dns-for-metasploit/ [...]

]]> http://www.mcgrewsecurity.com/2011/08/09/defconblackhat-slides-whitepaper-tools/#comment-1051 koreaUNI_forensic_center Wed, 16 Nov 2011 05:36:38 +0000 http://www.mcgrewsecurity.com/?p=889#comment-1051 executing “run modules/post/windows/gather/enum_drives.rb(imager, listdevices)” on meterpreter does not show any output why?..syntax error..... executing “run modules/post/windows/gather/enum_drives.rb(imager, listdevices)” on meterpreter does not show any output why?..syntax error…..

]]> http://www.mcgrewsecurity.com/pub/hackingu3/#comment-104 iiiears Wed, 26 Oct 2011 15:40:31 +0000 http://www.mcgrewsecurity.com/?page_id=394#comment-104 usbsniff /that is all usbsniff /that is all

]]> http://www.mcgrewsecurity.com/2011/03/23/geohot-antagonizing-sonys-forensic-examiners/#comment-1008 Skippy Fri, 21 Oct 2011 14:16:17 +0000 http://www.mcgrewsecurity.com/?p=853#comment-1008 The statement that the hard drives were encrypted is interesting. Likely the hard drives were locked through the BIOS, requiring a hard drive password to access the drives. Sony is known for using this technology. The password is stored within a process that hard codes the password to the system. You remove the hdd from the computer and you cannot image it. ( I've tried.) Removing the controller card and replacing with an identical one could bypass this protection allowing access to the data which is technically not encrypted just protected. Changing the boards could have been an attempt to bypass this protection, or changing them with the wrong board could prevent the examiner from replacing the controller card with the correct one, thus preventing the examiner from imaging the drive, since the examiner would then not be able to match the controller board. The other option either some kind of container encryption or something like bit locker could not be bypassed through controller card replacement. The statement that the hard drives were encrypted is interesting. Likely the hard drives were locked through the BIOS, requiring a hard drive password to access the drives. Sony is known for using this technology. The password is stored within a process that hard codes the password to the system. You remove the hdd from the computer and you cannot image it. ( I’ve tried.) Removing the controller card and replacing with an identical one could bypass this protection allowing access to the data which is technically not encrypted just protected. Changing the boards could have been an attempt to bypass this protection, or changing them with the wrong board could prevent the examiner from replacing the controller card with the correct one, thus preventing the examiner from imaging the drive, since the examiner would then not be able to match the controller board. The other option either some kind of container encryption or something like bit locker could not be bypassed through controller card replacement.

]]> http://www.mcgrewsecurity.com/2011/08/09/defconblackhat-slides-whitepaper-tools/#comment-1048 Anon Thu, 08 Sep 2011 23:48:58 +0000 http://www.mcgrewsecurity.com/?p=889#comment-1048 the path for the enum_drives module is post/windows/gather/forensics/enum_drives the path for the enum_drives module is post/windows/gather/forensics/enum_drives

]]> http://www.mcgrewsecurity.com/pub/hackingu3/#comment-101 andy Wed, 07 Sep 2011 18:05:39 +0000 http://www.mcgrewsecurity.com/?page_id=394#comment-101 Is there a way to get U3 on a normal flash. i have been looking in to it and the CDFS partition contains the U3 code which emulates the CD drive, or is it hard ware as in another chip emulating the CD drive. i think it could be done from a normal flash chip it would just have to be reprogrammed. (would copying the drive by sector to another drive emulate the CD drive or would the flash chip have to be re imaged to put in another sector with emulation code?) thanks any help would be greatly appreciate (need to recreate CD emulation on flash drives) if it is hardware is it possible to get a MSP430 to do it? Is there a way to get U3 on a normal flash. i have been looking in to it and the CDFS partition contains the U3 code which emulates the CD drive, or is it hard ware as in another chip emulating the CD drive. i think it could be done from a normal flash chip it would just have to be reprogrammed. (would copying the drive by sector to another drive emulate the CD drive or would the flash chip have to be re imaged to put in another sector with emulation code?)
thanks any help would be greatly appreciate (need to recreate CD emulation on flash drives) if it is hardware is it possible to get a MSP430 to do it?

]]> http://www.mcgrewsecurity.com/2009/10/16/amending-my-f0rb1dd3n-network-review/#comment-819 Plagiarism and the State of Infosec Publishing | InfoSec Reviews Blog Mon, 22 Aug 2011 13:14:21 +0000 http://www.mcgrewsecurity.com/?p=628#comment-819 [...] ‘This was an honest mistake and I sincerely apologize for any miscommunication. I hope that the correct and proper citations can be added soon and that all questions regarding copyright and plagiarism issues can be resolved. I hope the book can still be enjoyed as a valuable contribution to the information security community and I hope it will go on to fulfill its objective in reaching anyone who desires to learn more about hacking and security. I want to specifically apologize to Jayson, Kent, Syngress, Rachel, Angelina, all the readers, reviewers, and others who have taken offense. I want to fix this and I sincerely appreciate everyone’s positive support!’  (http://www.mcgrewsecurity.com/2009/10/16/amending-my-f0rb1dd3n-network-review/).  [...] [...] ‘This was an honest mistake and I sincerely apologize for any miscommunication. I hope that the correct and proper citations can be added soon and that all questions regarding copyright and plagiarism issues can be resolved. I hope the book can still be enjoyed as a valuable contribution to the information security community and I hope it will go on to fulfill its objective in reaching anyone who desires to learn more about hacking and security. I want to specifically apologize to Jayson, Kent, Syngress, Rachel, Angelina, all the readers, reviewers, and others who have taken offense. I want to fix this and I sincerely appreciate everyone’s positive support!’  (http://www.mcgrewsecurity.com/2009/10/16/amending-my-f0rb1dd3n-network-review/).  [...]

]]> http://www.mcgrewsecurity.com/2011/08/09/defconblackhat-slides-whitepaper-tools/#comment-1047 Wesley McGrew Mon, 22 Aug 2011 12:51:49 +0000 http://www.mcgrewsecurity.com/?p=889#comment-1047 I'll give this a shot on my test VMs when I get back home today, or earlier if I get the time to set it up here today. I’ll give this a shot on my test VMs when I get back home today, or earlier if I get the time to set it up here today.

]]> http://www.mcgrewsecurity.com/2011/08/09/defconblackhat-slides-whitepaper-tools/#comment-1046 ebros Mon, 22 Aug 2011 10:20:14 +0000 http://www.mcgrewsecurity.com/?p=889#comment-1046 After svn update in bt5, executing "run modules/post/windows/gather/enum_drives.rb" on meterpreter does not show any output. Anybody successfully tested this? After svn update in bt5, executing “run modules/post/windows/gather/enum_drives.rb” on meterpreter does not show any output. Anybody successfully tested this?

]]> http://www.mcgrewsecurity.com/2007/04/19/using-the-burp-suite-to-bypass-weird-access-controls/#comment-146 Grant Stone Mon, 15 Aug 2011 18:27:41 +0000 http://www.mcgrewsecurity.com/blog/?p=26#comment-146 Kiki's probably trying to access sites before loading the targets in the "target >> scope" tab. You can't just visit any site in your browser while the proxy is set, only what Burp allows - and it only allows what you've previously established as your target. Sorry to post on such an old topic, but I'm willing to bet that was the problem. Kiki’s probably trying to access sites before loading the targets in the “target >> scope” tab. You can’t just visit any site in your browser while the proxy is set, only what Burp allows – and it only allows what you’ve previously established as your target. Sorry to post on such an old topic, but I’m willing to bet that was the problem.

]]>