0xdeadbeef dot info | raptor's labs

0xdeadbeef dot info.

"Software is like sex. It's better when it's free." -- Linus Torvalds
"A chain is only as strong as its weakest link." -- Charles A. Lindbergh
"I have seen the fnords." -- Historical graffiti on Anarchy Bridge, UK
"Testing can prove the presence of bugs, but not their absence." -- Edsger Dijkstra
"Hi, my name is Pete and I'm an OSSTMM user." -- Pete Herzog
"Perfection is achieved when there is nothing left to remove." -- Antoine de Saint-Exupery
"The GNU people aren't evil." -- /usr/src/linux/Documentation/CodingStyle
"Never whistle while you're pissing." -- Hagbard Celine
"There are always errors in real data." -- The AWK Programming Language
"When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl." -- Anonymous

Fnord!

[0x01] Who's Raptor?

Welcome to my personal homepage and playground. Even though I'm a busy guy, I try to keep it up to date. Take a look below for (new) stuff. Please send your feedback to: Marco Ivaldi <raptor[at]0xdeadbeef.info> (PGP key).

I'm a seasoned information security researcher and consultant, specializing in networking (from old-style X.25 packet switched networks to modern wireless links), telephony (landline, mobile, VoIP), and control systems (SCADA and critical infrastructures in general).

I'm employed as Principal Security Advisor at @ Mediaservice.net, a leading information security consulting firm based in Italy, where I'm in charge of Red Team coordination, penetration testing, security auditing, vulnerability research, and exploit development. I hold the following professional certifications:

OSSTMM Professional Security Analyst (OPSA)
OSSTMM Professional Security Tester (OPST)
OSSTMM Wireless Security Expert (OWSE)
PCI Qualified Security Assessor (QSA)
PCI Approved Scanning Vendor (ASV)

As member of the ISECOM Core Team, I'm actively involved in the development of the Open Source Security Testing Methodology Manual (OSSTMM), the international standard for performing security testing and metrics. I'm also contributing to the Hacker Highscool (HHS), another ISECOM project providing security awareness for teens.

As a technical writer, I've published articles about hacking, security, and privacy on many computing magazines and web sites. I'm co-founder and editorial board member of Linux&C (the first Italian magazine about Linux and open source), Linux Pratico, and H&C.

I'm an OpenBSD and FreeBSD aficionado. When I have to use Linux, I choose my first love Slackware.

[0x02] Projects.

Here's the list of my current research projects related to ethical hacking and information security.

OSSTMM. I'm a primary contributor of ISECOM's Open Source Security Testing Methodology Manual.
HHS. I'm contributing to the Hacker Highscool, another ISECOM project providing security awareness for teens.
Antifork Research. I'm one of the founders of the project (formerly known as disLESSici team).
Blackhats.it. This is the old site of the ITBH security research community (discontinued project).
TSTF. I'm member of the Telecom Security Task Force, involved in telco-related research.
Lab @ Media. This is the on-line repository of research projects sponsored by my employer.

[0x04] Papers.

This is a collection research papers, presentations, and advisories I've written or reviewed.

Articles and Books.

L'anonimato su Internet. About anonymity and privacy on the Internet, appeared on Apogeonline on 19/01/2000.
Qualcuno ci ascolta. About the ECHELON network (written in January 2000, not published elsewhere).
Introduzione al Quantum Computing. Introduction to QC, also released as an Apogeonline ebook in July 2002.
L'arte dell'hacking. I did the technical review of the translation of Hacking: the art of exploitation, by J. Erickson.
Vulnerabilita' su Linux. I wrote the foreword for this practical exploitation guide by Enrico Feresin.
Stealing Minutes. Newsweek International reporter Benjamin Sutherland interviewed me for this article on VoIP.
Hacking Exposed Linux. I wrote the VoIP chapter for the third edition of the HEL book, released by ISECOM.
Materatown. I have been interviewed by the fine folks at Materatown.net on the topic of satire and anonymity.
How Secure is Secure Enough?. Control's Editor-in-Chief Walt Boyes interviewed me for this article on SCADA.
La metrica di sicurezza di OSSTMM (new). About the attack surface security metrics defined by OSSTMM (rav).

Papers and Presentations.

Intrusioni di rete. Slides compiled for an Information Security Master in Milan University (14/12/2001).
Sicurezza su reti X.25. White paper written for Blackhats.it and released to the public in September 2002.
Buffer Overflow in passwd(1). This white paper has been written by Shaun McAdams for his GIAC GCIH practical.
Whoppix-raptor. A flash demo showing raptor_chown.c in action done for whoppix.net by ports@portsonline.net.

Advisories.

CVE-2003-0190. I discovered and published this OpenSSH/PAM Delay Information Disclosure Vulnerability.
CVE-2006-1242. I discovered and published this Linux Kernel IP ID Information Disclosure Weakness.
CVE-2006-5229. I discovered and published yet another OpenSSH information disclosure via timing leak.

Magazines.

Linux&C. The first Italian magazine dedicated to GNU/Linux and the open source movement, since 1999.
H&C. Hard core Italian computer security and hacking magazine (discontinued project).
ICT Security. The first Italian magazine entirely dedicated to computer security and business continuity.
PC Magazine. Italian magazine dedicated to personal computing and professional information technology.

Mailing Lists.

Bugtraq. The first public mailing list dedicated to issues about computer security, and how to fix them.
Full-Disclosure. An unmoderated high-traffic discussion list for disclosure of security information.
Vuln-Dev. Low-traffic vulnerability research and exploit development mailing list, hosted by SecurityFocus.
Pen-Test. Another mailing list from SecurityFocus, dedicated to security testing and network auditing.
DailyDave. The premier list for discussion of security issues, 0days, and reverse engineering.
Scadasec. Discussion group about critical infrastructure protection and SCADA/control systems security.
Sikurezza.org. A virtual community of people interested in computer (in)security issues, based in Italy.

[0x08] Exploits.

Here are some exploits I've developed during my vulnerability research activities. For educational purposes only.

Linux.

raptor_chown.c. Linux 2.6.x < 2.6.7-rc3 (CVE-2004-0497). Missing DAC controls in sys_chown() on Linux.
raptor_prctl.c. Linux 2.6.x from 2.6.13 up to versions before 2.6.17.4 (CVE-2006-2451). Suid_dumpable bug.
raptor_prctl2.c. Linux 2.6.x from 2.6.13 up to versions before 2.6.17.4 (CVE-2006-2451). Via logrotate(8).
raptor_truecrypt.tgz. TrueCrypt <= 4.3 (CVE-2007-1738). Local privilege escalation via setuid volume mount.
raptor_ldaudit. Local privilege escalation through glibc dynamic linker (CVE-2010-3856). Via crond(8).
raptor_ldaudit2. Local privilege escalation through glibc dynamic linker (CVE-2010-3856). Via logrotate(8).

Solaris/x86.

raptor_ucbps. Solaris 8, 9 (CVE-1999-1587). Information leak with /usr/ucb/ps on both SPARC and x86.
raptor_sysinfo.c. Solaris 10 (CVE-2006-3824). Kernel memory disclosure with the sysinfo(2) system call.
raptor_libnspr. Solaris 10 (CVE-2006-4842). NSPR library arbitrary file creation oldschool local root.
raptor_libnspr2. Solaris 10 (CVE-2006-4842). NSPR library arbitrary file creation local root via LD_PRELOAD.
raptor_libnspr3. Solaris 10 (CVE-2006-4842). NSPR library arbitrary file creation local root via constructor.
raptor_peek.c. Solaris 8, 9, 10 (CVE-2007-5225). Kernel memory disclosure with fifofs I_PEEK ioctl(2).

Solaris/SPARC.

raptor_ucbps. Solaris 8, 9 (CVE-1999-1587). Information leak with /usr/ucb/ps on both SPARC and x86.
raptor_rlogin.c. Solaris 2.5.1, 2.6, 7, 8 (CVE-2001-0797). Buffer overflow in System V login via rlogin vector.
raptor_ldpreload.c. Solaris 2.6, 7, 8, 9 (CVE-2003-0609). Stack-based buffer overflow in the runtime linker ld.so.1.
raptor_libdthelp.c. Solaris 7, 8, 9 (CVE-2003-0834). Buffer overflow in CDE libDtHelp via dtprintinfo help feature.
raptor_libdthelp2.c. Solaris 7, 8, 9 (CVE-2003-0834). Buffer overflow in CDE libDtHelp, non-exec stack version.
raptor_passwd.c. Solaris 8, 9 (CVE-2004-0360). Stack-based buffer overflow in the circ() function of passwd(1).
raptor_sysinfo.c. Solaris 10 (CVE-2006-3824). Kernel memory disclosure with the sysinfo(2) system call.
raptor_xkb.c. Solaris 8, 9, 10 (CVE-2006-4655). Buffer overflow in the Strcmp() function of X11 XKEYBOARD.
raptor_libnspr. Solaris 10 (CVE-2006-4842). NSPR library arbitrary file creation oldschool local root.
raptor_libnspr2. Solaris 10 (CVE-2006-4842). NSPR library arbitrary file creation local root via LD_PRELOAD.
raptor_libnspr3. Solaris 10 (CVE-2006-4842). NSPR library arbitrary file creation local root via constructor.
raptor_peek.c. Solaris 8, 9, 10 (CVE-2007-5225). Kernel memory disclosure with fifofs I_PEEK ioctl(2).

AIX.

raptor_libC. AIX 5.3, 6.1 (CVE-2009-2669). Arbitrary file creation or overwrite via libC debugging functions.

Oracle.

raptor_oraextproc.sql. Oracle 9i, 10g (CVE-2004-1364). Directory traversal vulnerability in extproc.
raptor_oraexec.sql. Exploitation suite for Oracle written in Java, to read/write files and execute OS commands.
raptor_orafile.sql. File system access suite for Oracle based on the utl_file package, to read/write files.

MySQL.

raptor_udf.c. Helper dynamic library for local privilege escalation through MySQL run with root privileges.
raptor_udf2.c. Slight modification of raptor_udf.c, it works with recent versions of the open source database.
raptor_winudf.tgz. MySQL reverse shell and command execution UDFs backdoor kit for M$ Windows.

Misc.

raptor_sshtime. OpenSSH (CVE-2003-0190, CVE-2006-5229). Remote timing attack information leak exploit.
raptor_dominohash. Lotus Domino R5, R6 (CVE-2005-2428). Webmail names.nsf password hash dumper.

[0x10] Code.

This section is dedicated to some of the programs I've coded in the past. Most of this stuff is experimental, standard disclaimer applies.

New School.

mssql-hax0r. Multi-purpose SQL injection attack tool for advanced Microsoft SQL Server exploitation.
samba-hax0r. Multi-purpose attack tool for SMB/CIFS network protocols exploitation.
havoc-0.1d.tgz. Random ARP traffic generator, BOFH style. It can temporarily hose an ethernet segment.
ikenum. Script for remote enumeration of supported ISAKMP authentication methods (RFC 2409).
oracrack. Oracle database password cracking helper, to be used with the checkpwd cracker.
orabackdoor.sql. Proof-of-concept code to demonstrate how to write a simple backdoor for Oracle.
scan-tools.tgz. A collection of easily customizable bash scripts for network scanning purposes.
sequel.tgz. A growing collection of simple scripts for performing multiple tasks via SQL injection attacks.

Old School.

brutus.pl. Remote login/password bruteforce cracker for TELNET, FTP, POP3, SMTP, and HTTP protocols.
ward.c. Fast wardialer for UNIX systems, it scans a list of phone numbers hunting for active modems.
rasbrute.bat. Very basic and easily customizable DOS batch script for remote bruteforcing of M$ PPTP.
x25-tools.tgz. A collection of multi-purpose X.25 scanners based on vudu, including nuascan and cudscan.
psibrute.com. This DCL script abuses the old PSI_MAIL trick on VMS/OpenVMS to remotely find valid users.
backdoor.bas. Simple VMS/OpenVMS lib$spawn() setuid-like backdoor (easily portable to other languages).
autoscan.pl. Autonet NUA scanner for the old autonet x25pad gateway, based on the brutus.pl engine.

Exploitation.

abo-exploits.tgz. Advanced buffer overflows study. See gera's vulnerable code exploited in different ways.
fs-exploits.tgz. Format strings exploitation study. Commented solutions to gera's fs vulnerable code series.
vulndev-exploits.tgz. Exploit code for vuln-dev challenges. Currently, there are 2 accomplished challenges.
linux-x86-exploits.tgz. Linux/x86 vulnerable code study. Currently, there are 86 example exploits included.
solaris-sparc-exploits.tgz. Solaris/SPARC vulnerable code study. Currently, there are 19 example exploits.

Shellcode.

setuid-linux.c. Short (30 bytes) shellcode for Linux/x86, executing a setuid(0) and an execve() of /bin/sh.
gets-linux.c. Linux/x86 shellcode for stdin re-open and /bin/sh exec. Useful to exploit some gets() overflows.
reusage-linux.c. Linux/x86 shellcode for /bin/sh string re-usage from vulnerable program (16 bytes only).
portbind-linux.c. Simple Linux/x86 portbind shellcode, spawning a setuid(0) shell on port 31337/tcp (96 bytes).
setuid-bsd.c. Short (31 bytes) shellcode for BSD/x86, executing an execve() of /bin/sh after a setuid(0).
portbind-bsd.c. Simple BSD/x86 portbind shellcode, spawning a setuid(0) shell on port 31337/tcp (94 bytes).
raptorcode.c. Another shellcode for Linux/x86 that prints "Raptor owns your safe\n" on your current tty.
leetcode.c. Another setuid(0)/execve() shellcode for BSD/x86, with a nice ascii message buried into it.

Esoteric.

poly.txt. A polyglot, a program that may be compiled in more than one language (in this case C and Perl).
poly2.txt. Another simple polyglot. This particular one is interpreted both as a C program or BASH script.
poly3.txt. A third polyglot. This program works under cc, sh, and csh (polyglot^3).
poly4.txt. Another small polyglot for cc, perl, sh, and csh (the almost done awk porting is welcome).

Misc.

pfilter.pl. OpenBSD PF log file filter (parser and colorizer). It supports both /var/log/pflog and pflog0.
snortctl.tgz. Management script and log parser/colorizer for Snort NIDS, from the early stages of @Aenigma.
libc-search.c. Quick and easily-adaptable libc symbol/pattern search helper. Tested on Linux.
cidr.c. Quick parser for Classless Inter Domain Routing (CIDR). It generates an IP address list from ip/cidr.
bounce.c. Simple netcat-like bouncer client that pipes on localhost an active TCP session.
p2s.c. Prism2stumbler is a wireless network stumbler for PRISM2 cards. Tested on Linux with wlan-ng.
ftw.pl. FTP-to-WEB Gateway. HTTP interface to an FTP tree, formerly used on Antifork Research archive.

[0x20] Configuration.

Here are some configuration templates for common information security solutions. YMMV.

Packet Filters.

MacOSXFirewall.tgz. Startup script and basic ruleset for the ipfw firewall bundled with Mac OS X.
pf.conf.39. Sample PF/NAT ruleset for the configuration of a basic OpenBSD 3.9 stateful firewall.
pf.conf.39.adsl. Another sample PF/NAT ruleset for an OpenBSD 3.9 stateful firewall optimized for ADSL.
pf.conf.39.dmz. Sample PF/NAT ruleset for an OpenBSD 3.9 stateful firewall with bridged DMZ on 3rd NIC.
rc.iptables v1. Sample basic ruleset for the configuration of a Linux 2.4 stateful firewall (host fw + vpn).
rc.iptables v2. Sample basic ruleset for the configuration of a Linux 2.4 stateful firewall (masq fw + vpn).
ipf.rules v1. Sample rules for the IPFilter stateful firewall, with detailed comments. Tested on OpenBSD 2.9.
ipnat.rules v1. Sample rules for the configuration of IPFilter NAT and Proxies. Tested on OpenBSD 2.9.
ipf.rules v2. Another sample ruleset for IPFilter (DMZ with a 3-NIC firewall). Tested on OpenBSD 2.9.
ipnat.rules v2. Sample ruleset for IPNat, needed to deploy ipf.rules v2 above. Tested on OpenBSD 2.9.

Application Firewalls.

modsecurity-2.5.12.conf. Sample configuration file for the ModSecurity application firewall v2.5.12.
modsecurity-2.6.8.conf (new). Sample configuration file for the ModSecurity application firewall v2.6.8.

Virtual Private Networks.

isakmpd.policy v1. Sample IKE policy file for a basic IPsec VPN. Tested on OpenBSD 2.9.
isakmpd.conf.1 v1. Sample IKE configuration file for a basic IPsec VPN (#1). Tested on OpenBSD 2.9.
isakmpd.conf.2 v1. Sample IKE configuration file for a basic IPsec VPN (#2). Tested on OpenBSD 2.9.
isakmpd.policy v2. IKE policy file for a basic IPsec VPN using X.509 certs. Tested on OpenBSD 3.2.
isakmpd.conf.1 v2. IKE config file for a basic IPsec VPN using X.509 certs (#1). Tested on OpenBSD 3.2.
isakmpd.conf.2 v2. IKE config file for a basic IPsec VPN using X.509 certs (#2). Tested on OpenBSD 3.2.
isakmpd.policy v3. Another IKE policy file for a road warrior IPsec VPN. Tested on OpenBSD 3.2.
isakmpd.conf.1 v3. Another IKE config file for a road warrior IPsec VPN (server). Tested on OpenBSD 3.2.
isakmpd.conf.2 v3. Another IKE config file for a road warrior IPsec VPN (client). Tested on OpenBSD 3.2.

[0x40] Other cool stuff.

First of all, read the BOFH stories by Simon Travaglia, also in their new home! As a bonus I've written a small CGI script that generates a random "excuse of the day". Other cool stuff follows here...

Linux Penguin. A cool HTML artwork representing Tux, the Linux Penguin (257 x 303 @ 250 colors).
OpenBSD Devil. Another extremely cool HTML artwork, portrait of the OpenBSD Devil mascotte.
RTFM. Hey, you! Yeah, you! Don't ask stupid questions, always Read The Fucking Manual before.
Utah Bengaled Raptor. An impressive 8 foot tall, 1 ton wooden prehistoric monster, created by artist Matt Kron.
0xdefaced. This is the archived 0xdeadbeef dot info defacement hoax made for April Fools' Day 2004.
Voodoo. A picture of my old and glorious Acer TravelMate 345T notebook, running OpenBSD.
HP JetDirect Crash. Cool stack dump printed on paper by my HP JetDirect printer after a Denial of Service.
Insert Coin. My kinda original HP JetDirect printer's new display (yeah, I was bored that day).
Control Room. ITAPAC (DNIC 2222) is the most known Italian X.25 network, still alive as of 2006.
Vi Assistant. Fear the infamous clippy-like assistant for vim. Resistance is futile, you'll be assimilated.
Sidecar Wardriving. Funny picture of a l33t wardriving session on an original Ural sidecar.
Pen-test Moderation. Cheap viagra spam and SecurityFocus "penetration" test mailing list moderation fun.
This Site is Blocked. A screenshot of UAE's Internet Access Management Policy in action.

$Id: index.html,v 1.605 2013/04/19 11:15:11 raptor Exp $