Category Archives: BASH

Crack the Windows SAM file from a backup filesystem

November 9, 2017 by admin · Leave a comment

The SAM file is locate in C:\Windows\System32\config and stores all Windows account password encrypted.

The problem is that you cannot copy or tamper the file while the file system is mounted.

This leaves us with at least 2 options: copy the SAM and SYTEM files from a Linux live CD or by having a copy of those files in a backup.

I have the backup and I copy the 2 files to my Kali Linux machine.

I recover the NTLM hashes by issuing the following command:

root@kali:~# /usr/bin/samdump2 /root/Desktop/SYSTEM /root/Desktop/SAM
user1:1000:aad3b435b51404eeaad3b435b51404ee:f9a14effe4a24ceb1cf0b2e8e9e7e9f9:::
root@kali:~#

The backup is from a Windows 7 version and that means that we are seeing NTLM v.2 hashes, which translates to the fact that only the last part of the hashes are useful.

So we need to convert to uppercase the bold part by using 2 BASH commands:

cristi@ubserver-nv:~/hashcat$ STRING=’f9a14effe4a24ceb1cf0b2e8e9e7e9f9‘
cristi@ubserver-nv:~/hashcat$ echo $STRING | awk ‘{print toupper($0)}’
F9A14EFFE4A24CEB1CF0B2E8E9E7E9F9
cristi@ubserver-nv:~/hashcat$

Copy the uppercase version to a text file and start hashcat:

crs@ubsv:~$ ./hashcat -m 1000 -a 3 ./ntlm.txt -w 3 –status

Good luck!

Posted in BASH, hacks, tutorial. Tagged with hashcat, NTLM, SAM file, SYSTEM file, windows password cracking, Windows password recovery.

How to increase the Kali Linux root partition

April 1, 2017 by admin · 6 Comments

If you need to increase the Kali Linux root partition size, this might become difficult if you have another extended partition (like SWAP) right after your root partition ends.
First things first.

WARNING: backup your important data first! This might end up losing your data if you don’t know what you’re doing.

If you are using VMware, edit the settings of the Kali virtual machine and expand the hard disk.
Power on the Kali virtual machine.

My problem:
/dev/sda1 30GB mounted on /
/dev/sda2 5GB extended partition mounted as SWAP

What I want to do is delete the SWAP partition, mark the space as unused and increase the / partition size and leave a couple of GB free to create another SWAP partition.

Using qparted will not work, because it will tell you that the (swap) partition is in use.
Commenting the swap partition in /etc/fstab will also not work. Also tried swapoff –all with the same result.

The fix:
root@kali:~# fdisk /dev/sda5 //the SWAP partition
use p to print the current partitions on that device.
use d to delete the partition
with w write the changes and reboot.

Use df -h to see if the SWAP is still there, or qparted if you want a GUI.

Resize the root partition by deleting it:

root@kali:~# fdisk /dev/sda

Command (m for help): p
Disk /dev/sda: 300 GiB, 322122547200 bytes, 629145600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xaaea4a6f

Device Boot Start End Sectors Size Id Type
/dev/sda1 * 2048 60262399 60260352 28.8G 83 Linux

Command (m for help): d //deletes the partition
Selected partition 1
Partition 1 has been deleted.

// recreate the partition starting from the first allocated cylinder (2048), this increases the size of the partition
Command (m for help): n
Partition type
p primary (0 primary, 0 extended, 4 free)
e extended (container for logical partitions)
Select (default p): p
Partition number (1-4, default 1): 1
First sector (2048-629145599, default 2048): 2048
Last sector, +sectors or +size{K,M,G,T,P} (2048-629145599, default 629145599): +290G //extend the / partition to 290G

Created a new partition 1 of type ‘Linux’ and of size 290 GiB.

Command (m for help): a //mark the partition as bootable
Selected partition 1
The bootable flag on partition 1 is enabled now.

Device Boot Start End Sectors Size Id Type
/dev/sda1 * 2048 608176127 608174080 290G 83 Linux

Command (m for help): w //write the changes
The partition table has been altered.
Calling ioctl() to re-read partition table.
Re-reading the partition table failed.: Device or resource busy

The kernel still uses the old table. The new table will be used at the next reboot or after you run partprobe(8) or kpartx(8).

root@kali:~# reboot

After the reboot, issue the following command:

root@kali:~# resize2fs /dev/sda1
resize2fs 1.42.13 (17-May-2015)
Filesystem at /dev/sda1 is mounted on /; on-line resizing required
old_desc_blocks = 2, new_desc_blocks = 19
The filesystem on /dev/sda1 is now 76021760 (4k) blocks long.

Check with df -h if the partition scheme is ok.

root@kali:~# df -h
Filesystem Size Used Avail Use% Mounted on
udev 10M 0 10M 0% /dev
tmpfs 529M 7.9M 521M 2% /run
/dev/sda1 286G 9.5G 264G 4% /
tmpfs 1.3G 320K 1.3G 1% /dev/shm
tmpfs 5.0M 0 5.0M 0% /run/lock
tmpfs 1.3G 0 1.3G 0% /sys/fs/cgroup
tmpfs 265M 8.0K 265M 1% /run/user/133
tmpfs 265M 16K 265M 1% /run/user/0
tmpfs 1.3G 4.0K 1.3G 1% /var/lib/polkit-1/localauthority/90-mandatory.d
root@kali:~# resize2fs /dev/sda1

To create another SWAP partition, just use qparted and create the partition with the desired size.

Cheeers!

Posted in BASH, Kali Linux. Tagged with fdisk, increase root partition size, kali linux, qparted, resize root partition.

Delete files older than

January 26, 2016 by admin · Leave a comment

find ./your_directory/ -mtime +30 -type f -delete

Posted in BASH, How to. Tagged with delete files.

Install Logwatch in Linux CentOS

May 19, 2015 by admin · Leave a comment

Logwatch is a Linux application that parses log files, analyses them and sends periodical reports, based on specific criteria, to one or more email addresses.
In order to install logwatch in linux CentOS you have to issues the following command:

yum install logwatch

Edit the configuration file:

nano /usr/share/logwatch/default.conf/logwatch.conf

Check and edit the following directives in order to suit your needs:

LogDir = /var/log
MailFrom = Logwatch@mydomain.com
Range = yesterday //(or today)
Detail=Medium // (other: Low, Medium, High)
Service=all //(other examples would be httpd, sshd2, ftp)

Run logwatch manually:

logwatch --detail High --mailto myemail@domain.com --service http --range today

The output should be like this:

 ################### Logwatch 7.3.6 (05/19/07) ####################
        Processing Initiated: Tue May 19 14:21:59 2015
        Date Range Processed: today
                              ( 2015-May-19 )
                              Period is day.
      Detail Level of Output: 5
              Type of Output: unformatted
           Logfiles for Host: nix
  ##################################################################

 --------------------- courier mail services Begin ------------------------

 **Unmatched Entries**
   courier-pop3d - 2 Times
      Connection, ip=[::ffff:182.118.53.150] - 1 Time
      Disconnected, ip=[::ffff:182.118.53.150] - 1 Time



 ---------------------- courier mail services End -------------------------


 --------------------- Cron Begin ------------------------

sshd:
    Authentication Failures:
       root (43.255.188.163): 4930 Time(s)
       root (43.255.188.155): 3524 Time(s)
       root (61-218-247-185.hinet-ip.hinet.net): 925 Time(s)
       unknown (61-218-247-185.hinet-ip.hinet.net): 391 Time(s)
       root (61.133.63.14): 137 Time(s)
       root (58.218.205.72): 114 Time(s)
       root (222.186.160.48): 98 Time(s)
       root (218.65.30.61): 90 Time(s)
       root (221.229.166.81): 80 Time(s)
       root (58.218.205.66): 69 Time(s)
       root (58.218.199.195): 68 Time(s)

Posted in BASH, scripts. Tagged with linux, log, logwatch.

Block failure notice emails in qmail

April 6, 2015 by admin · Leave a comment

I have Plesk on my Linux server and I receive lots of spam emails from the root account on my server.
Here’s what happened. My forum used to send emails to non-existent email accounts around the web and I used to receive the failure notices for them.
To block failure notice emails in qmail that were forwarded to my main email I had to modify the aliases from

/var/qmail/alias

Here’s a sample email I received:

MAILER-DAEMON@nixware.net
Mar 30 (7 days ago)

to postmaster 
Hi. This is the qmail-send program at nixware.net.
I tried to deliver a bounce message to this address, but the bounce bounced!

:
2a00:1450:4013:0c01:0000:0000:0000:001a does not like recipient.
Remote host said: 550-5.1.1 The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 q5si14669450wjx.9 - gsmtp
Giving up on 2a00:1450:4013:0c01:0000:0000:0000:001a.

--- Below this line is the original bounce.

Return-Path: &lt;&gt;
Received: (qmail 8634 invoked for bounce); 29 Mar 2015 23:50:02 +0200
Date: 29 Mar 2015 23:50:02 +0200
From: MAILER-DAEMON@nixware.net
To: root@nixware.net
Subject: failure notice

As you can see, the postmaster account was receiving the spam from MAILER-DAEMON and MAILER-DAEMON was forwarding them to my gmail.com account. Pretty nasty…

The fix:
Go to

/var/qmail/alias

do a

ls -alh

and you will see a couple of hidden config files.

Inside each of those file I had my @gmail account. With the next script I overwrote the gmail account with a non-existent email:

for FILE in ./.qmail-*;do echo "nonexistent@nodomain.tld" > $FILE;done

Restart/reload qmail:

service qmail reload

That’s it! You should not receive any spam from any of the root, mailman or postmaster accounts.

Posted in BASH, Plesk, scripts. Tagged with block qmail spam, failure notice, mailer-daemon, plesk, postmaster, root.

Batch download files from a website

December 17, 2014 by admin · Leave a comment

I needed a quick bash script that will batch download files from a website and I came up with the following.

The files had the names like 1.gif, 2.gif, etc and were accessible via a CDN subdomain like http://images.mydomain.com.

So here it is:

for i in {1..18000}; do wget images.mydomain.com/$i.gif; sleep 5;done

Replace mydomain.com with your site and that’s it.
Alternatively you can get rid of “sleep 5” and put the whole script in a file and execute it with:

[root@nix]# nohup ./script.sh &amp;

This will keep your script running even if you disconnect from the shell console.

Posted in BASH, scripts.

Restore mysql database from sql file

November 7, 2014 by admin · Leave a comment

If you want to restore a mysql database from a sql file you have to issue this command:

[root@enix ~]#mysql -uroot -pxxx my-database < my-database-backup.sql

– where: my-database is your databse where you want to restore data;
– my-database-backup.sql is your sql backup file
– change root to your mysql user
– change xxx with your mysql password

And that’s it.

When dumping the database with mysqldump, use the option –no-create-db.
This will suspress the CREATE DATABASE statement in your dump file.
Then restore the database with

mysql -h <host> -u <user> -p <databasename> < dump.sql

In this way you can restore your data in whatever database you like (But that database has to exist!).

Posted in BASH, mysql.

Substitution operators

October 2, 2014 by admin · Leave a comment

Substitution operators are used for expanding parameters and variable values.

Examples:

${variablename:-some word}

-If varname exists and isn’t null, return its value; otherwise return word.

Purpose: Returning a default value if the variable is undefined.

[root@euve59329 ~]# echo ${PWDx:-non existent variable}
non existent variable

${varname:=word}
– If varname exists and isn’t null, return its value; otherwise set it to
word and then return its value. Positional and special parameters

[root@euve59329 ~]# echo ${ID:=0}
0

– ID variable does not exist. In this case, the value is set to 0.

Purpose:Setting a variable to a default value if it is undefined.

${varname:?message}

If varname exists and isn’t null, return its value; otherwise print
varname: followed by message, and abort the current command or
script (non-interactive shells only). Omitting message produces the
default message parameter null or not set.

[root@euve59329 ~]# echo ${thevariable:?does not exist}
bash: thevariable: does not exist
[root@euve59329 ~]#

– Purpose: Catching errors that result from variables being undefined.

${varname:+word}

[root@euve59329 ~]# echo ${count:+1}
1
[root@euve59329 ~]# echo ${countX:+1}

Purpose: Testing for the existence of a variable.
Example: ${count:+1} returns 1 (which could mean “true”) if count is
defined.

${varname:offset:length}

Performs substring expansion.[5] It returns the substring of $varname
starting at offset and up to length characters. The first character in
$varname is position 0. If length is omitted, the substring starts at
offset and continues to the end of $varname. If offset is less than 0 then
the position is taken from the end of $varname. If varname is @, the
length is the number of positional parameters starting at parameter
offset.
Purpose: Returning parts of a string (substrings or slices).
Example:

[root@euve59329 ~]# count=MyCoolText
[root@euve59329 ~]# echo ${count:4}
olText
[root@euve59329 ~]# echo ${count:4:4}
olTe
[root@euve59329 ~]#

Inspired from Learning the bash Shell: Unix Shell Programming (In a Nutshell (O’Reilly))

Posted in BASH. Tagged with bash, substitution operators, variable.

String Manipulation and Expanding Variables

October 1, 2014 by admin · Leave a comment

String Manipulation and Expanding Variables

For your ready references here are all your handy bash parameter substitution operators. Try them all; enhance your scripting skills like a pro:

${parameter:-defaultValue} Get default shell variables value
${parameter:=defaultValue} Set default shell variables value
${parameter:?”Error Message”} Display an error message if parameter is not set
${#var} Find the length of the string
${var%pattern} Remove from shortest rear (end) pattern
${var%%pattern} Remove from longest rear (end) pattern
${var:num1:num2} Substring
${var#pattern} Remove from shortest front pattern
${var##pattern} Remove from longest front pattern
${var/pattern/string} Find and replace (only replace first occurrence)
${var//pattern/string} Find and replace all occurrences
REFERENCES:

via http://www.cyberciti.biz/tips/bash-shell-parameter-substitution-2.html

Posted in BASH. Tagged with bash, string manipulation.

How to empty large log files

September 30, 2014 by admin · Leave a comment

If you want to empty large log files (aka lots of GB) without deleting the file, here’s how you can do that:

nix# > mylargelog.log

nix# echo " " > mylargelog.log

Tadaa!!

Posted in BASH, How to. Tagged with bash, empty, files, large log.